hitch-rails 0.2.0

data/app/models/hitch/application_record.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Hitch
+  class ApplicationRecord < ActiveRecord::Base
+    self.abstract_class = true
+  end
+end

data/app/models/hitch/authorization_request.rb

@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+module Hitch
+  # The HTTP-free core of one authorize request: parameter and PKCE
+  # validation, client and redirect_uri resolution against whichever
+  # registration scheme the client_id belongs to, scope clamping, and
+  # response-redirect construction. The controller renders what this
+  # object decides.
+  class AuthorizationRequest
+    include Hitch::IssuerUrl
+    include Hitch::UriValidation
+
+    Error = Data.define(:code, :description, :status)
+
+    # Response parameters are stripped from the registered query before the
+    # response is appended. Defense in depth plus one real gap: a client that
+    # legitimately registered a query containing a response parameter would
+    # otherwise receive it twice, and first-wins query parsers (URLSearchParams,
+    # Go's Query().Get, Python's parse_qs) would read the registered value —
+    # the issuer mix-up RFC 9207 exists to prevent. The error parameters don't
+    # even need that gap: registration is unauthenticated, so an attacker can
+    # point their own client's redirect_uri at a legitimate client's callback
+    # carrying `?error=…`, and §4.1.2 makes clients branch on `error` first —
+    # attacker-written UI copy inside the real client's trusted error surface.
+    RESPONSE_PARAMS = %w[code state iss error error_description error_uri].freeze
+
+    attr_reader :params, :principal
+
+    def initialize(params, principal:)
+      @params = params
+      @principal = principal
+    end
+
+    def valid?
+      @error = validate unless defined?(@error)
+      @error.nil?
+    end
+
+    def error
+      valid?
+      @error
+    end
+
+    # :decision is accepted on the consent POST but never echoed by the
+    # consent screen — a crafted authorize link must not pre-press Deny.
+    def deny?
+      params[:decision] == "deny"
+    end
+
+    def client_id = params[:client_id]
+    def redirect_uri = params[:redirect_uri]
+    def state = params[:state]
+    def code_challenge = params[:code_challenge]
+    def code_challenge_method = params[:code_challenge_method]
+
+    # The canonical resource (RFC 8707 audience), available once valid.
+    attr_reader :resource
+
+    # The resolved client, from whichever registration scheme the client_id
+    # belongs to: an https client_id is a Client ID Metadata Document
+    # reference (MCP 2026-07-28); anything else is an opaque DCR client_id.
+    # The two cannot collide. Resolved once — each question the flow asks
+    # (redirect validation, consent warning, audit name) would otherwise
+    # repeat the DB lookup or, for CIMD without a shared cache, the outbound
+    # fetch. nil (no such client) memoizes too.
+    def client
+      return @client if defined?(@client)
+
+      @client =
+        if ClientIdMetadata.reference?(client_id)
+          ClientIdMetadata.resolve(client_id, actor: rate_limit_actor)
+        else
+          Client.find_by(client_id: client_id)
+        end
+    end
+
+    # Intersect the requested scope with the server's supported_scopes
+    # allowlist. A client can only ever receive scopes the server actually
+    # supports (RFC 6749 §3.3 — the AS MAY narrow). An empty intersection
+    # falls back to the default scope so the token is never scopeless.
+    def granted_scopes
+      supported = Array.wrap(Hitch.configuration.supported_scopes).map(&:to_s)
+      asked = params[:scope].to_s.split(/\s+/).reject(&:blank?)
+      (asked & supported).presence&.join(" ") || supported.first
+    end
+
+    # The redirect back to the validated redirect_uri, carrying `iss`
+    # unconditionally (RFC 9207 — byte-identical to the discovery issuer,
+    # which is why both come from the shared IssuerUrl derivation).
+    def redirect_uri_for(**response)
+      uri = URI.parse(redirect_uri)
+      query_params = URI.decode_www_form(uri.query || "")
+                        .reject { |key, _| RESPONSE_PARAMS.include?(key) }
+      response.merge(iss: issuer_url).each do |key, value|
+        query_params << [ key.to_s, value ] if value.present?
+      end
+      uri.query = URI.encode_www_form(query_params)
+      uri.to_s
+    end
+
+    def redirect_host
+      URI.parse(redirect_uri.to_s).host
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # The consent screen's display name. Never the client's declared name —
+    # that is attacker-controllable in both registration schemes — but a
+    # label derived from the verified redirect_uri host.
+    def display_client_name
+      friendly_client_name || redirect_host || "An application"
+    end
+
+    # The name the client claims for itself. Attacker-controllable in both
+    # schemes; persisted on the token for audit fidelity only.
+    def audit_client_name
+      client&.client_name || friendly_client_name || "Unknown"
+    end
+
+    # MCP 2026-07-28 security considerations: a metadata document "cannot
+    # prevent localhost URL impersonation by itself" — anyone can host a
+    # document claiming any name and point it at a loopback port, and nothing
+    # proves which program is listening there. The consent screen warns.
+    def localhost_only_client?
+      return false unless ClientIdMetadata.reference?(client_id)
+
+      declared = registered_redirect_uris
+      return false if declared.blank?
+
+      declared.all? { |candidate| loopback_redirect_uri?(candidate) }
+    end
+
+    private
+
+    def validate
+      return invalid_request("response_type is required") if params[:response_type].blank?
+      unless params[:response_type] == "code"
+        return failure("unsupported_response_type", "response_type must be code")
+      end
+      return invalid_request("client_id is required") if client_id.blank?
+      return invalid_request("redirect_uri is required") if redirect_uri.blank?
+      return invalid_request("Invalid redirect_uri") unless valid_redirect_uri?(redirect_uri)
+      return invalid_request("code_challenge is required") if code_challenge.blank?
+      unless Hitch::Pkce.valid_s256_challenge?(code_challenge)
+        return invalid_request("code_challenge must be a 43-character S256 value")
+      end
+      unless code_challenge_method == "S256"
+        return invalid_request("code_challenge_method must be S256")
+      end
+
+      resource_error = validate_resource
+      return resource_error if resource_error
+
+      @params = params.merge(resource: @resource).freeze
+      validate_client_redirect
+    end
+
+    # RFC 8707 audience binding: the request's `resource` must canonicalize
+    # to exactly the resource this server protects.
+    def validate_resource
+      return failure("invalid_target", "resource is required") if params[:resource].blank?
+
+      allow_loopback = Rails.env.local?
+      requested = Hitch::ResourceUri.canonicalize!(params[:resource], allow_loopback_http: allow_loopback)
+      configured = Hitch::ResourceUri.canonicalize!(
+        Hitch.configuration.resource_uri,
+        allow_loopback_http: allow_loopback
+      )
+      unless requested == configured
+        return failure("invalid_target", "resource does not identify this MCP server")
+      end
+
+      @resource = requested
+      nil
+    rescue Hitch::ResourceUri::Invalid => error
+      failure("invalid_target", error.message)
+    end
+
+    # redirect_uri MUST be validated against a registered client on EVERY
+    # authorize request (OAuth 2.1 §4.1.1, RFC 9700 §4.1.3). There is no
+    # unregistered path: clients without prior registration obtain a
+    # client_id via DCR or host a metadata document first.
+    def validate_client_redirect
+      registered = registered_redirect_uris
+      return failure("invalid_client", unknown_client_message) if registered.nil?
+      return invalid_request("client has no usable redirect_uris") if registered.blank?
+
+      # RFC 8252 port-agnostic match for loopback; exact otherwise.
+      return nil if registered.any? { |candidate| redirect_uri_matches?(candidate, redirect_uri) }
+
+      invalid_request("redirect_uri not registered for this client")
+    end
+
+    # The client's declared redirect_uris. nil means "no such client"; an
+    # empty array means "a client, but nothing usable to redirect to". The
+    # gem's https-or-loopback policy (RFC 8252) applies to CIMD documents
+    # here — DCR enforces it at registration time, and a metadata document
+    # never passes through registration, so without this filter CIMD would
+    # bypass a check DCR clients face.
+    def registered_redirect_uris
+      return client&.redirect_uris unless ClientIdMetadata.reference?(client_id)
+
+      client&.redirect_uris&.select { |candidate| valid_redirect_uri?(candidate) }
+    end
+
+    def unknown_client_message
+      if ClientIdMetadata.reference?(client_id)
+        "Could not resolve a client metadata document at that client_id"
+      else
+        "Unknown client_id — register via /oauth/register first"
+      end
+    end
+
+    def loopback_redirect_uri?(candidate)
+      parsed = URI.parse(candidate)
+      parsed.scheme == "http" && loopback_host?(parsed.host)
+    rescue URI::InvalidURIError
+      false
+    end
+
+    # Identifies the principal driving a metadata fetch, for per-actor rate
+    # limiting — the bound on amplification no DNS or URL trick changes.
+    # Class name included so two principal models cannot collide on an
+    # integer id; nil when the principal has no id, which keeps the limiter
+    # honest rather than silently unlimited.
+    def rate_limit_actor
+      return nil unless principal.respond_to?(:id)
+
+      "#{principal.class.name}:#{principal.id}"
+    end
+
+    # First matching entry in the configured table, with case/when
+    # semantics: String keys compare exactly, Regexp keys match.
+    def friendly_client_name
+      host = redirect_host
+      return nil if host.blank?
+
+      Hitch.configuration.client_names.each do |matcher, label|
+        return label if matcher === host
+      end
+      nil
+    end
+
+    def invalid_request(description)
+      failure("invalid_request", description)
+    end
+
+    def failure(code, description)
+      Error.new(code: code, description: description, status: :bad_request)
+    end
+  end
+end

data/app/models/hitch/client/credentials.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Hitch
+  class Client
+    class Credentials
+      class SerializationForbidden < TypeError; end
+
+      attr_reader :client, :client_secret
+
+      def initialize(client:, client_secret:)
+        @client = client
+        @client_secret = client_secret.to_s.dup.freeze
+        freeze
+      end
+
+      def inspect
+        %(#<#{self.class.name} client_id=#{client.client_id.inspect} client_secret="[FILTERED]">)
+      end
+
+      alias_method :to_s, :inspect
+
+      def to_h(*)
+        raise SerializationForbidden, "one-time client credentials cannot be serialized"
+      end
+
+      def as_json(*) = to_h
+      def to_json(*) = to_h
+    end
+  end
+end

data/app/models/hitch/client.rb

@@ -0,0 +1,237 @@
+# frozen_string_literal: true
+
+module Hitch
+  # OAuth Dynamic Client Registration (RFC 7591) record. Captures the
+  # human-readable client_name an MCP client sends during DCR so the
+  # authorize flow can attribute records back to the originating
+  # application (Claude Code, ChatGPT, Cursor, etc.).
+  #
+  # The client_name is attacker-controllable (anyone can POST to
+  # /oauth/register with any client_name); consent UIs should NOT
+  # trust it for display. Storage keeps it for audit fidelity.
+  class Client < ApplicationRecord
+    self.table_name = "hitch_clients"
+
+    TOKEN_ENDPOINT_AUTH_METHODS = %w[none client_secret_basic].freeze
+    CLIENT_SECRET_BYTES = 48
+    MAX_CLIENT_ID_BYTES = 255
+    MAX_CLIENT_NAME_BYTES = 255
+    MAX_REDIRECT_URIS = 32
+    MAX_REDIRECT_URI_BYTES = 255
+
+    class InvalidRegistrationMetadata < ArgumentError; end
+
+    # OpenID Connect Dynamic Client Registration 1.0 §2 defines exactly
+    # these two. (Not RFC 7591 — that spec has no application_type; the
+    # field is IANA-registered, which is how it rides along in an
+    # otherwise RFC 7591 registration request.) A client sending anything
+    # else is recorded as having declared nothing, rather than having its
+    # registration rejected — see #normalize_application_type.
+    APPLICATION_TYPES = %w[native web].freeze
+
+    has_many :redirect_uri_records,
+      class_name: "Hitch::ClientRedirectUri",
+      foreign_key: :hitch_client_id,
+      inverse_of: :client,
+      dependent: :delete_all
+
+    validates :client_id, presence: true, uniqueness: true
+    validate :bounded_client_identifiers
+    validates :application_type, inclusion: { in: APPLICATION_TYPES }, allow_nil: true
+    validates :token_endpoint_auth_method, inclusion: { in: TOKEN_ENDPOINT_AUTH_METHODS }
+
+    validate :secret_matches_auth_method
+
+    def self.register!(client_id:, client_name:, redirect_uris:, application_type: nil)
+      metadata = normalize_registration_metadata!(
+        client_id: client_id,
+        client_name: client_name,
+        redirect_uris: redirect_uris
+      )
+      validate_application_type_shape!(application_type)
+
+      transaction do
+        client = create!(
+          client_id: metadata.fetch(:client_id),
+          client_name: metadata.fetch(:client_name),
+          application_type: normalize_application_type(application_type),
+          token_endpoint_auth_method: "none"
+        )
+        client.replace_redirect_uris!(metadata.fetch(:redirect_uris))
+        client
+      end
+    end
+
+    def self.register_confidential!(client_id:, client_name:, redirect_uris:, application_type: nil)
+      metadata = normalize_registration_metadata!(
+        client_id: client_id,
+        client_name: client_name,
+        redirect_uris: redirect_uris
+      )
+      validate_application_type_shape!(application_type)
+      raw_secret = generate_client_secret
+
+      client = transaction do
+        record = create!(
+          client_id: metadata.fetch(:client_id),
+          client_name: metadata.fetch(:client_name),
+          application_type: normalize_application_type(application_type),
+          token_endpoint_auth_method: "client_secret_basic",
+          client_secret_digest: digest_secret(raw_secret),
+          client_secret_issued_at: Time.current
+        )
+        record.replace_redirect_uris!(metadata.fetch(:redirect_uris))
+        record
+      end
+
+      Credentials.new(client: client, client_secret: raw_secret)
+    end
+
+    # Unrecognized values become nil rather than a registration error.
+    # `application_type` is recorded, never enforced (see the migration),
+    # so a junk value costs nothing to drop — whereas rejecting the
+    # registration would break a client over a field the server does not
+    # yet act on. Absent and unrecognized are both "did not declare",
+    # which is the honest reading of each.
+    def self.normalize_application_type(value)
+      value = value.to_s
+      APPLICATION_TYPES.include?(value) ? value : nil
+    end
+
+    # Shared size and shape boundary for HTTP registration, operator tasks,
+    # and direct framework callers. URI scheme policy remains protocol-level;
+    # this method guarantees every persistence path is finite and lossless.
+    # client_id is optional: HTTP registration mints one only after the
+    # rest of the metadata is admitted, so it has nothing to validate here.
+    def self.normalize_registration_metadata!(client_name:, redirect_uris:, client_id: nil)
+      {
+        client_id: client_id.nil? ? nil : bounded_string!(client_id, :client_id, max_bytes: MAX_CLIENT_ID_BYTES),
+        client_name: client_name.nil? ? "MCP Client" :
+          bounded_string!(client_name, :client_name, max_bytes: MAX_CLIENT_NAME_BYTES),
+        redirect_uris: normalize_redirect_uris!(redirect_uris, allow_empty: false)
+      }
+    end
+
+    def self.normalize_redirect_uris!(values, allow_empty: true)
+      unless values.is_a?(Array) && (allow_empty || values.any?) && values.length <= MAX_REDIRECT_URIS
+        raise InvalidRegistrationMetadata,
+          "redirect_uris must be an array of #{allow_empty ? '0' : '1'}..#{MAX_REDIRECT_URIS} strings"
+      end
+
+      normalized = values.map do |value|
+        bounded_string!(value, :redirect_uri, max_bytes: MAX_REDIRECT_URI_BYTES)
+      end
+      if normalized.uniq.length != normalized.length
+        raise InvalidRegistrationMetadata, "redirect_uris must not contain duplicates"
+      end
+
+      normalized
+    end
+
+    def self.bounded_string!(value, field, max_bytes:)
+      unless value.is_a?(String) && value.valid_encoding? && value.present? && value.bytesize <= max_bytes
+        raise InvalidRegistrationMetadata, "#{field} must be a non-empty string of at most #{max_bytes} bytes"
+      end
+
+      value.dup
+    end
+    private_class_method :bounded_string!
+
+    def self.validate_application_type_shape!(value)
+      return if value.nil? || value.is_a?(String)
+
+      raise InvalidRegistrationMetadata, "application_type must be a string"
+    end
+    private_class_method :validate_application_type_shape!
+
+    def self.digest_secret(secret)
+      Digest::SHA256.hexdigest(secret.to_s)
+    end
+
+    def self.generate_client_secret
+      SecureRandom.urlsafe_base64(CLIENT_SECRET_BYTES)
+    end
+
+    def public_client?
+      token_endpoint_auth_method == "none"
+    end
+
+    def confidential_client?
+      token_endpoint_auth_method == "client_secret_basic"
+    end
+
+    def authenticates_secret?(candidate)
+      return false unless confidential_client? && client_secret_digest.present? && candidate.present?
+
+      candidate_digest = self.class.digest_secret(candidate)
+      ActiveSupport::SecurityUtils.secure_compare(client_secret_digest, candidate_digest)
+    end
+
+    def rotate_secret!
+      raise ArgumentError, "public clients do not have a client secret" unless confidential_client?
+
+      raw_secret = nil
+      with_lock do
+        raw_secret = self.class.generate_client_secret
+        now = Time.current
+        update!(
+          client_secret_digest: self.class.digest_secret(raw_secret),
+          client_secret_issued_at: now,
+          client_secret_rotated_at: now
+        )
+      end
+      Credentials.new(client: self, client_secret: raw_secret)
+    end
+
+    def redirect_uris
+      redirect_uri_records.order(:uri).pluck(:uri)
+    end
+
+    # Works on new and persisted records alike: unpersisted clients build
+    # association records that save with the parent; persisted clients
+    # replace their rows atomically.
+    def redirect_uris=(values)
+      desired = self.class.normalize_redirect_uris!(values)
+      if persisted?
+        replace_redirect_uris!(desired)
+      else
+        self.redirect_uri_records = desired.map { |uri| Hitch::ClientRedirectUri.new(uri: uri) }
+      end
+    end
+
+    def replace_redirect_uris!(values)
+      desired = self.class.normalize_redirect_uris!(values)
+      transaction do
+        if desired.empty?
+          redirect_uri_records.delete_all
+        else
+          redirect_uri_records.where.not(uri: desired).delete_all
+        end
+        existing = redirect_uri_records.where(uri: desired).pluck(:uri)
+        (desired - existing).each { |uri| redirect_uri_records.create!(uri: uri) }
+      end
+      redirect_uris
+    end
+
+    private
+
+    def secret_matches_auth_method
+      if public_client?
+        errors.add(:client_secret_digest, "must be absent for a public client") if client_secret_digest.present?
+        errors.add(:client_secret_issued_at, "must be absent for a public client") if client_secret_issued_at.present?
+        errors.add(:client_secret_rotated_at, "must be absent for a public client") if client_secret_rotated_at.present?
+      elsif client_secret_digest.blank? || client_secret_issued_at.blank?
+        errors.add(:client_secret_digest, "and issued_at are required for a confidential client")
+      end
+    end
+
+    def bounded_client_identifiers
+      if client_id.is_a?(String) && client_id.bytesize > MAX_CLIENT_ID_BYTES
+        errors.add(:client_id, "is too long (maximum is #{MAX_CLIENT_ID_BYTES} bytes)")
+      end
+      if client_name.is_a?(String) && client_name.bytesize > MAX_CLIENT_NAME_BYTES
+        errors.add(:client_name, "is too long (maximum is #{MAX_CLIENT_NAME_BYTES} bytes)")
+      end
+    end
+  end
+end

data/app/models/hitch/client_authentication.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module Hitch
+  class ClientAuthentication
+    MAX_AUTHORIZATION_BYTES = 4_096
+    MAX_SECRET_BYTES = 512
+    CONTROL_CHARACTERS = /[\u0000-\u001F\u007F-\u009F]/
+
+    class Invalid < StandardError
+      attr_reader :oauth_code, :http_status
+
+      def initialize(oauth_code, message, http_status: :bad_request)
+        @oauth_code = oauth_code
+        @http_status = http_status
+        super(message)
+      end
+    end
+
+    def self.resolve(request:, body_client_id:, body_secret_present:)
+      authorization = request.headers["Authorization"].to_s
+      return public_client_id(body_client_id, body_secret_present:) if authorization.blank?
+
+      raise Invalid.new("invalid_request", "client_secret is not accepted in the request body") if body_secret_present
+
+      client_id, secret = decode_basic(authorization)
+      invalid_client! if body_client_id.present? && body_client_id != client_id
+
+      client = Hitch::Client.find_by(client_id: client_id)
+      invalid_client! unless client&.authenticates_secret?(secret)
+
+      client_id
+    end
+
+    def self.public_client_id(client_id, body_secret_present:)
+      raise Invalid.new("invalid_request", "client_secret is not accepted in the request body") if body_secret_present
+      raise Invalid.new("invalid_request", "client_id is required") if client_id.blank?
+      invalid_client! unless valid_component?(client_id, max_bytes: Hitch::Client::MAX_CLIENT_ID_BYTES)
+
+      client = Hitch::Client.find_by(client_id: client_id)
+      invalid_client! if client&.confidential_client?
+
+      client_id
+    end
+    private_class_method :public_client_id
+
+    def self.decode_basic(authorization)
+      invalid_client! if authorization.bytesize > MAX_AUTHORIZATION_BYTES
+
+      scheme, encoded = authorization.split(" ", 2)
+      invalid_client! unless scheme&.casecmp?("Basic") && encoded.present? && !encoded.match?(/\s/)
+
+      decoded = Base64.strict_decode64(encoded)
+      encoded_client_id, encoded_secret = decoded.split(":", 2)
+      invalid_client! if encoded_client_id.blank? || encoded_secret.nil?
+
+      client_id = URI.decode_www_form_component(encoded_client_id).encode(Encoding::UTF_8)
+      secret = URI.decode_www_form_component(encoded_secret).encode(Encoding::UTF_8)
+      invalid_client! unless valid_component?(client_id, max_bytes: Hitch::Client::MAX_CLIENT_ID_BYTES) &&
+        valid_component?(secret, max_bytes: MAX_SECRET_BYTES)
+
+      [ client_id, secret ]
+    # Base64, URI decoding, and encoding conversion raise these for malformed
+    # credentials; they collapse to the same uniform refusal.
+    rescue ArgumentError, EncodingError
+      invalid_client!
+    end
+    private_class_method :decode_basic
+
+    def self.invalid_client!
+      raise Invalid.new("invalid_client", "Client authentication failed", http_status: :unauthorized)
+    end
+    private_class_method :invalid_client!
+
+    def self.valid_component?(value, max_bytes:)
+      value.is_a?(String) && value.valid_encoding? && value.present? &&
+        value.bytesize <= max_bytes && !value.match?(CONTROL_CHARACTERS)
+    end
+    private_class_method :valid_component?
+  end
+end

data/app/models/hitch/client_id_metadata/cache.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "digest"
+
+module Hitch
+  class ClientIdMetadata
+    # Rails.cache storage for resolved documents and failure negatives.
+    # A cache outage must not take the authorize endpoint with it: every
+    # operation degrades to a miss.
+    module Cache
+      # Cached negatives are deliberately short-lived relative to positives:
+      # long enough that a hostile URL cannot drive one fetch per request,
+      # short enough that a client fixing a genuinely broken document isn't
+      # locked out for an hour.
+      FAILURE_TTL = 60
+
+      module_function
+
+      # Versioned so a change to Document's shape invalidates old entries
+      # instead of colliding with them.
+      def key(client_id)
+        "hitch/cimd/v1/#{Digest::SHA256.hexdigest(client_id.to_s)}"
+      end
+
+      def failure_key(host)
+        "hitch/cimd/v1/failed-host/#{Digest::SHA256.hexdigest(normalized_host(host))}"
+      end
+
+      # "evil.example" and "evil.example." are the same DNS name and the
+      # same destination; without stripping the root label they would be
+      # two cache keys, which is one more outbound fetch than intended.
+      def normalized_host(host)
+        host.to_s.downcase.chomp(".")
+      end
+
+      # Validates the rebuilt struct rather than relying on Document.new
+      # to object. A keyword_init Struct accepts string keys without
+      # raising and yields a half-built Document with nil members — so
+      # the stringifying-coder case this guard exists for would sail
+      # straight through an ArgumentError rescue.
+      def rehydrate(cached)
+        document = Document.new(**cached)
+        return nil unless document.client_id.is_a?(String) && document.redirect_uris.is_a?(Array)
+
+        document
+      rescue ArgumentError, TypeError
+        nil
+      end
+
+      def read(key)
+        Rails.cache.read(key)
+      rescue StandardError
+        nil
+      end
+
+      def write(key, value, ttl)
+        Rails.cache.write(key, value, expires_in: ttl)
+      rescue StandardError
+        nil
+      end
+
+      def delete(key)
+        Rails.cache.delete(key)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end