iron-cms 0.18.2 → 0.19.0

data/app/models/iron/content.rb

@@ -1,4 +1,4 @@
-require "open-uri"
+require "net/http"
 
 module Iron
   class Content
@@ -13,51 +13,74 @@ module Iron
       end
     end
 
+    MAX_DOWNLOAD_REDIRECTS = 5
+    MAX_DOWNLOAD_BYTES = 50.megabytes
+    DOWNLOAD_OPEN_TIMEOUT = 5
+    DOWNLOAD_READ_TIMEOUT = 30
+
     class << self
       def list(handle, locale: nil)
-        as_system(locale) do
+        acting_as(nil, locale) do
           content_type(handle).entries.order(:id).map { |entry| render_entry(entry) }
         end
       end
 
       def get(handle, id: nil, route: nil, locale: nil)
-        as_system(locale) do
+        acting_as(nil, locale) do
           render_entry(locate_entry(content_type(handle), id:, route:))
         end
       end
 
-      def create(handle, content, route: nil, locale: nil)
+      def create(handle, content, route: nil, locale: nil, actor: nil, allow_local_files: true)
         type = content_type(handle)
         raise Error, "#{handle} is a single — use update" if type.single?
 
-        as_system(locale) do
+        acting_as(actor, locale) do
           entry = type.entries.build
           entry.route = route if route
-          write_entry(entry, content)
+          write_entry(entry, content, allow_local_files:)
         end
       end
 
-      def update(handle, content, id: nil, route: nil, locale: nil)
+      def update(handle, content, id: nil, route: nil, locale: nil, actor: nil, allow_local_files: true)
         type = content_type(handle)
 
-        as_system(locale) do
-          write_entry(entry_for_update(type, id:, route:), content)
+        acting_as(actor, locale) do
+          write_entry(entry_for_update(type, id:, route:), content, allow_local_files:)
         end
       end
 
-      def delete(handle, id: nil, route: nil)
-        as_system(nil) do
+      def delete(handle, id: nil, route: nil, actor: nil)
+        acting_as(actor, nil) do
           entry = locate_entry(content_type(handle), id:, route:)
-          purge_file_attachments(entry)
           entry.destroy!
           { "deleted" => true, "id" => entry.id }
         end
       end
 
+      def serialize(entry)
+        render_entry(entry)
+      end
+
+      def download(url, filename: nil, content_type: nil, budget: DownloadBudget.new)
+        io = fetch_guarded(url, budget)
+
+        ActiveStorage::Blob.create_and_upload!(
+          io:,
+          filename: filename.presence || File.basename(URI.parse(url).path).presence || "upload",
+          content_type:
+        )
+      rescue URI::InvalidURIError
+        raise Error, "could not download #{url}: invalid URL"
+      rescue SocketError, SystemCallError, OpenSSL::SSL::SSLError,
+             Net::OpenTimeout, Net::ReadTimeout, Timeout::Error, Net::HTTPBadResponse => error
+        raise Error, "could not download #{url}: #{error.message}"
+      end
+
       private
 
-        def as_system(locale_code, &block)
-          Current.set(user: User.system, locale: resolve_locale(locale_code)) do
+        def acting_as(actor, locale_code, &block)
+          Current.set(user: actor || User.system, locale: resolve_locale(locale_code)) do
             ActiveStorage::Current.set(url_options: storage_url_options, &block)
           end
         end
@@ -67,7 +90,9 @@ module Iron
         end
 
         def storage_url_options
-          Rails.application.routes.default_url_options.presence || { host: "localhost", port: 3000 }
+          ActiveStorage::Current.url_options.presence ||
+            Rails.application.routes.default_url_options.presence ||
+            { host: "localhost", port: 3000 }
         end
 
         def content_type(handle)
@@ -100,19 +125,87 @@ module Iron
           end
         end
 
-        def write_entry(entry, content)
+        def write_entry(entry, content, allow_local_files: true)
           content ||= {}
           raise Error, "payload must be a JSON object of field handles" unless content.is_a?(Hash)
 
-          entry.assign_content(ingest_files(content))
+          content = declared_content(entry, content)
+          entry.assign_content(ingest_files(content, allow_local_files:, budget: DownloadBudget.new))
           raise InvalidContent, entry.content_errors unless entry.save
 
           render_entry(entry)
         end
 
-        def purge_file_attachments(entry)
-          entry.fields.each do |field|
-            field.file.purge if field.is_a?(Fields::File) && field.file.attached?
+        # Assignment ignores unknown handles at every nesting level, so they
+        # are dropped before file ingestion: a _file directive under one would
+        # otherwise be downloaded and stored without ever attaching to a field.
+        def declared_content(entry, content)
+          prune_to_schema(content, entry.content_type.field_definitions)
+        end
+
+        # Reserved handles are excluded even if a legacy host schema still has a
+        # field defined with one: leaving a field named "_file" in place would
+        # let ingest_files read the whole object as a file directive. New
+        # schemas can't declare them (FieldDefinition validation), so this only
+        # neutralizes pre-existing collisions on upgrade.
+        def prune_to_schema(content, definitions)
+          declared = definitions.index_by(&:handle).except(*FieldDefinition::RESERVED_HANDLES)
+          content.each_with_object({}) do |(handle, value), pruned|
+            definition = declared[handle.to_s]
+            pruned[handle] = prune_field_value(definition, value) if definition
+          end
+        end
+
+        def prune_field_value(definition, value)
+          case definition
+          when FieldDefinitions::Block
+            prune_block_content(definition.supported_block_definition, value)
+          when FieldDefinitions::BlockList
+            value.is_a?(Array) ? value.map { |item| prune_block_item(definition, item) } : strip_ingestibles(value)
+          when FieldDefinitions::File
+            prune_file_value(value)
+          when FieldDefinitions::ReferenceList
+            value.is_a?(Array) ? value.map { |id| strip_ingestibles(id) } : strip_ingestibles(value)
+          else
+            strip_ingestibles(value)
+          end
+        end
+
+        def prune_block_item(definition, item)
+          return strip_ingestibles(item) unless item.is_a?(Hash)
+
+          type_handle = (item["_type"] || item[:_type]).to_s
+          block_definition = definition.supported_block_definitions.detect { |candidate| candidate.handle == type_handle }
+          prune_block_content(block_definition, item)
+        end
+
+        # An unresolvable block keeps only its _type marker: assignment still
+        # reports it, and nothing nested inside can reach the downloader.
+        def prune_block_content(block_definition, value)
+          return strip_ingestibles(value) unless value.is_a?(Hash)
+
+          pruned = block_definition ? prune_to_schema(value, block_definition.field_definitions) : {}
+          [ "_type", :_type ].each { |key| pruned[key] = strip_ingestibles(value[key]) if value.key?(key) }
+          pruned
+        end
+
+        def prune_file_value(value)
+          if value.is_a?(Hash)
+            file_key = [ "_file", :_file ].find { |key| value.key?(key) }
+            file_key ? value.slice(file_key) : {}
+          else
+            strip_ingestibles(value)
+          end
+        end
+
+        # A container where the schema expects a scalar can only be malformed
+        # content: emptying it preserves the validation error while ensuring
+        # nothing inside can be traversed for ingestion.
+        def strip_ingestibles(value)
+          case value
+          when Hash then {}
+          when Array then []
+          else value
           end
         end
 
@@ -120,16 +213,17 @@ module Iron
           JSON.parse(Api::BaseController.render(partial: "iron/api/entry", formats: [ :json ], locals: { entry: }))
         end
 
-        def ingest_files(content)
+        def ingest_files(content, budget:, allow_local_files: true)
           case content
           when Hash
             if file_directive?(content)
-              uploaded_blob(file_source(content)).signed_id
+              budget.charge_file!
+              uploaded_blob(file_source(content), allow_local_files:, budget:).signed_id
             else
-              content.transform_values { |value| ingest_files(value) }
+              content.transform_values { |value| ingest_files(value, allow_local_files:, budget:) }
             end
           when Array
-            content.map { |value| ingest_files(value) }
+            content.map { |value| ingest_files(value, allow_local_files:, budget:) }
           else
             content
           end
@@ -143,20 +237,95 @@ module Iron
           hash["_file"] || hash[:_file]
         end
 
-        def uploaded_blob(source)
+        def uploaded_blob(source, budget:, allow_local_files: true)
           unless source.is_a?(String) && source.present?
-            raise Error, '"_file" must be a file path or URL string'
+            raise Error, '"_file" must be a file path, URL, or upload signed_id'
           end
 
-          source.match?(%r{\Ahttps?://}i) ? downloaded_blob(source) : local_blob(source)
+          if source.match?(%r{\Ahttps?://}i)
+            download(source, budget:)
+          elsif (blob = signed_blob(source))
+            blob
+          elsif allow_local_files
+            local_blob(source)
+          else
+            raise Error, '"_file" must be an http(s) URL or an upload signed_id (local file paths are not allowed here)'
+          end
+        end
+
+        def signed_blob(source)
+          ActiveStorage::Blob.find_signed(source)
+        end
+
+        # Fetches a URL while defending against SSRF: each hop is resolved once,
+        # every resolved address must clear the allow-list, and the connection
+        # is pinned to a vetted IP (preserving the hostname for Host, SNI, and
+        # certificate verification) so DNS can't rebind to a private address
+        # between validation and connect. Redirects are followed manually so
+        # their targets face the same check.
+        def fetch_guarded(url, budget)
+          uri = URI.parse(url)
+          redirects = 0
+
+          loop do
+            budget.verify_deadline!(url)
+            response, body = request_pinned(uri, budget)
+            return StringIO.new(body) if body
+
+            unless response.is_a?(Net::HTTPRedirection)
+              raise Error, "could not download #{url}: #{response.code} #{response.message}"
+            end
+
+            raise Error, "could not download #{url}: too many redirects" if (redirects += 1) > MAX_DOWNLOAD_REDIRECTS
+
+            location = response["location"]
+            raise Error, "could not download #{url}: redirect without a location" if location.blank?
+
+            uri = URI.join(uri.to_s, location)
+          end
+        end
+
+        def request_pinned(uri, budget)
+          http_response(uri, vetted_address(uri), budget)
+        end
+
+        def http_response(uri, address, budget)
+          build_http(uri, address).start do |connection|
+            connection.request(Net::HTTP::Get.new(uri)) do |response|
+              return [ response, response.is_a?(Net::HTTPSuccess) ? read_capped(response, uri, budget) : nil ]
+            end
+          end
+        end
+
+        # Passing nil for the proxy disables Net::HTTP's default :ENV proxy
+        # discovery: an http_proxy would connect to the proxy and let it
+        # re-resolve the hostname, sidestepping the pinned address.
+        def build_http(uri, address)
+          http = Net::HTTP.new(uri.hostname, uri.port, nil)
+          http.ipaddr = address
+          http.use_ssl = uri.scheme == "https"
+          http.open_timeout = DOWNLOAD_OPEN_TIMEOUT
+          http.read_timeout = DOWNLOAD_READ_TIMEOUT
+          http
+        end
+
+        def vetted_address(uri)
+          raise Error, "could not download #{uri}: unsupported scheme" unless %w[ http https ].include?(uri.scheme)
+
+          addresses = SsrfProtection.public_addresses(uri.hostname)
+          raise Error, "could not download #{uri}: host is not allowed" if addresses.empty?
+
+          addresses.first
         end
 
-        def downloaded_blob(url)
-          URI.open(url) do |io|
-            ActiveStorage::Blob.create_and_upload!(io:, filename: File.basename(URI.parse(url).path))
+        def read_capped(response, uri, budget)
+          body = +""
+          response.read_body do |chunk|
+            body << chunk
+            budget.verify_deadline!(uri)
+            raise Error, "could not download #{uri}: exceeds #{MAX_DOWNLOAD_BYTES} bytes" if body.bytesize > MAX_DOWNLOAD_BYTES
           end
-        rescue OpenURI::HTTPError, SocketError, URI::InvalidURIError, Timeout::Error, Errno::ECONNREFUSED => error
-          raise Error, "could not download #{url}: #{error.message}"
+          body
         end
 
         def local_blob(path)

data/app/models/iron/field_definition.rb

@@ -11,7 +11,7 @@ module Iron
     has_one :titlable_content_type, class_name: "Iron::ContentType", inverse_of: :title_field_definition, dependent: :nullify
     has_one :web_publishable_content_type, class_name: "Iron::ContentType", foreign_key: :web_page_title_field_definition_id, inverse_of: :web_page_title_field_definition, dependent: :nullify
 
-    RESERVED_HANDLES = %w[id base _metadata _type].freeze
+    RESERVED_HANDLES = %w[id base _metadata _type _file].freeze
 
     validates :name, presence: true
     validates :handle, presence: true, exclusion: { in: RESERVED_HANDLES }
@@ -22,6 +22,12 @@ module Iron
       end
     end
 
+    # Bumps updated_at so caches keyed on it — the OpenAPI/MCP schema — refresh
+    # when a habtm edit changes the generated schema without touching a column.
+    def bump_schema_revision(_record)
+      touch if persisted?
+    end
+
     def humanized_type
       type.demodulize.humanize
     end

data/app/models/iron/field_definitions/block.rb

@@ -3,7 +3,9 @@ module Iron
     has_and_belongs_to_many :supported_block_definitions,
       class_name: "::Iron::BlockDefinition",
       foreign_key: "field_definition_id",
-      association_foreign_key: "block_definition_id"
+      association_foreign_key: "block_definition_id",
+      after_add: :bump_schema_revision,
+      after_remove: :bump_schema_revision
 
     validate :validate_exactly_one_supported_block_definition
 

data/app/models/iron/field_definitions/block_list.rb

@@ -3,6 +3,8 @@ module Iron
     has_and_belongs_to_many :supported_block_definitions,
       class_name: "::Iron::BlockDefinition",
       foreign_key: "field_definition_id",
-      association_foreign_key: "block_definition_id"
+      association_foreign_key: "block_definition_id",
+      after_add: :bump_schema_revision,
+      after_remove: :bump_schema_revision
   end
 end

data/app/models/iron/integration.rb

@@ -8,6 +8,17 @@ module Iron
 
     validates :name, presence: true
 
+    def self.authenticate(token)
+      return if token.blank?
+
+      integration = find_by(token:)
+      return if integration.nil? || integration.expired?
+      return unless integration.user&.active?
+
+      integration.touch(:last_used_at)
+      integration.user
+    end
+
     def expired?
       expires_at? && expires_at.past?
     end

data/app/models/iron/oauth/client.rb

@@ -0,0 +1,63 @@
+module Iron
+  module Oauth
+    class Client < ApplicationRecord
+      self.table_name = "iron_oauth_clients"
+
+      MAX_REDIRECT_URIS = 5
+      MAX_REDIRECT_URI_LENGTH = 2000
+
+      has_many :grants, dependent: :destroy
+      has_many :tokens, dependent: :destroy
+
+      before_create :assign_uid
+
+      validates :name, presence: true, length: { maximum: 255 }
+      validate :redirect_uris_are_present_and_allowed
+
+      def redirect_uri_list
+        redirect_uris.to_s.split("\n").map(&:strip).reject(&:blank?)
+      end
+
+      def redirect_uri_allowed?(uri)
+        redirect_uri_list.include?(uri)
+      end
+
+      private
+
+        def assign_uid
+          self.uid ||= Secret.generate
+        end
+
+        def redirect_uris_are_present_and_allowed
+          uris = redirect_uri_list
+
+          if uris.empty?
+            errors.add(:redirect_uris, :blank)
+            return
+          end
+
+          if uris.size > MAX_REDIRECT_URIS || uris.any? { |uri| uri.length > MAX_REDIRECT_URI_LENGTH }
+            errors.add(:redirect_uris, :invalid)
+            return
+          end
+
+          errors.add(:redirect_uris, :invalid) unless uris.all? { |uri| secure_redirect_uri?(uri) }
+        end
+
+        def secure_redirect_uri?(uri)
+          parsed = URI.parse(uri)
+          return false unless parsed.is_a?(URI::HTTP)
+          return false if parsed.host.blank?
+          return false if parsed.fragment.present?
+
+          parsed.scheme == "https" || loopback?(parsed)
+        rescue URI::InvalidURIError
+          false
+        end
+
+        def loopback?(uri)
+          uri.scheme == "http" && %w[ localhost 127.0.0.1 ::1 ].include?(uri.hostname)
+        end
+    end
+  end
+end

data/app/models/iron/oauth/grant.rb

@@ -0,0 +1,67 @@
+module Iron
+  module Oauth
+    class Grant < ApplicationRecord
+      self.table_name = "iron_oauth_grants"
+
+      belongs_to :client
+      belongs_to :user, class_name: "Iron::User"
+
+      def self.issue!(client:, user:, redirect_uri:, scopes:, code_challenge:, resource:, code_challenge_method: "S256", ttl: 10.minutes)
+        code = Secret.generate
+        grant = create!(
+          client: client,
+          user: user,
+          redirect_uri: redirect_uri,
+          scopes: scopes,
+          code_challenge: code_challenge,
+          code_challenge_method: code_challenge_method,
+          resource: resource,
+          code_digest: Secret.digest(code),
+          expires_at: ttl.from_now
+        )
+        [ grant, code ]
+      end
+
+      # Consumes the code only once the exchange is fully bound to the client,
+      # redirect URI, and PKCE verifier — all inside the lock. Validating before
+      # marking it redeemed stops an interceptor without the verifier from
+      # burning a legitimate client's code. When a block is given, the token is
+      # issued in the same transaction, so a failure there rolls the redemption
+      # back and leaves the code usable for a retry.
+      def self.redeem(code, client:, redirect_uri:, verifier:, resource:)
+        grant = find_by(code_digest: Secret.digest(code))
+        return unless grant
+
+        result = nil
+        grant.with_lock do
+          if grant.redeemable_by?(client:, redirect_uri:, verifier:, resource:)
+            grant.update!(redeemed_at: Time.current)
+            result = block_given? ? yield(grant) : grant
+          end
+        end
+        result
+      end
+
+      def redeemable_by?(client:, redirect_uri:, verifier:, resource:)
+        active? &&
+          client_id == client.id &&
+          self.redirect_uri == redirect_uri &&
+          self.resource == resource &&
+          pkce_verified?(verifier)
+      end
+
+      def pkce_verified?(verifier)
+        expected = Base64.urlsafe_encode64(OpenSSL::Digest::SHA256.digest(verifier.to_s), padding: false)
+        ActiveSupport::SecurityUtils.secure_compare(expected, code_challenge)
+      end
+
+      def expired?
+        expires_at.past?
+      end
+
+      def active?
+        redeemed_at.nil? && !expired?
+      end
+    end
+  end
+end

data/app/models/iron/oauth/resource.rb

@@ -0,0 +1,27 @@
+module Iron
+  module Oauth
+    # The MCP endpoint is the only resource this authorization server protects.
+    # RFC 8707 resource indicators bind every grant and token to it, so a token
+    # a client obtained while talking to a malicious MCP server that advertised
+    # this authorization server can never be replayed against this one.
+    module Resource
+      def self.url(base_url)
+        normalize("#{base_url}#{Iron::Engine.routes.url_helpers.api_mcp_path}")
+      end
+
+      def self.permitted?(resource, base_url:)
+        resource.is_a?(String) && normalize(resource) == url(base_url)
+      end
+
+      # Scheme and host compare case-insensitively; the path stays byte-exact.
+      def self.normalize(resource)
+        uri = URI.parse(resource.to_s)
+        uri.scheme = uri.scheme.downcase if uri.scheme
+        uri.host = uri.host.downcase if uri.host
+        uri.to_s
+      rescue URI::Error
+        resource
+      end
+    end
+  end
+end

data/app/models/iron/oauth/scope.rb

@@ -0,0 +1,13 @@
+module Iron
+  module Oauth
+    module Scope
+      MCP_ACCESS = "mcp:access"
+
+      SUPPORTED = [ MCP_ACCESS ].freeze
+
+      def self.default
+        SUPPORTED.join(" ")
+      end
+    end
+  end
+end

data/app/models/iron/oauth/secret.rb

@@ -0,0 +1,13 @@
+module Iron
+  module Oauth
+    module Secret
+      def self.generate
+        SecureRandom.urlsafe_base64(32)
+      end
+
+      def self.digest(plaintext)
+        OpenSSL::Digest::SHA256.hexdigest(plaintext)
+      end
+    end
+  end
+end