iron-cms 0.18.2 → 0.19.0

data/app/models/iron/oauth/token.rb

@@ -0,0 +1,123 @@
+module Iron
+  module Oauth
+    class Token < ApplicationRecord
+      self.table_name = "iron_oauth_tokens"
+
+      Issued = Data.define(:access_token, :refresh_token, :expires_in, :scope)
+
+      REFRESH_RETRY_GRACE = 30.seconds
+
+      belongs_to :client
+      belongs_to :user, class_name: "Iron::User"
+
+      def self.issue!(client:, user:, scopes:, audience:, family_id: Secret.generate, access_ttl: 2.hours, refresh_ttl: 30.days)
+        access_token = Secret.generate
+        refresh_token = Secret.generate
+        create!(
+          client: client,
+          user: user,
+          scopes: scopes,
+          audience: audience,
+          family_id: family_id,
+          access_token_digest: Secret.digest(access_token),
+          refresh_token_digest: Secret.digest(refresh_token),
+          expires_at: access_ttl.from_now,
+          refresh_expires_at: refresh_ttl.from_now
+        )
+        Issued.new(
+          access_token: access_token,
+          refresh_token: refresh_token,
+          expires_in: access_ttl.to_i,
+          scope: scopes
+        )
+      end
+
+      def self.authenticate(access_token)
+        token = find_by(access_token_digest: Secret.digest(access_token))
+        return unless token&.active?
+
+        token.record_use
+        token
+      end
+
+      # Rotates a refresh token to a fresh one, keeping at most a single active
+      # token per family. Only a lost-response retry may redo an exchange: the
+      # token's revocation must be the family's newest, still inside the grace
+      # window, and the minted successor never used — the one shape a client
+      # retrying a dropped response can produce. Every other reuse is a replay
+      # and burns the whole lineage (RFC 9700 §4.14.2), so a stolen refresh
+      # token cannot quietly take over the session.
+      #
+      # Every exchange in a family serializes on the same anchor row, so a
+      # retry and a rotation can't interleave into two live tokens; a partial
+      # unique index is the database backstop.
+      def self.exchange_refresh(refresh_token, client:)
+        current = find_by(refresh_token_digest: Secret.digest(refresh_token), client: client)
+        return unless current
+
+        issued = nil
+        family_anchor(current.family_id).with_lock do
+          current.reload
+          if !current.refresh_active_window?
+            issued = nil
+          elsif current.revoked_at.nil? || current.lost_response_retry?
+            current.revoke_family!
+            issued = issue!(client: client, user: current.user, scopes: current.scopes, audience: current.audience, family_id: current.family_id)
+          else
+            current.revoke_family!
+          end
+        end
+        issued
+      end
+
+      def self.family_anchor(family_id)
+        where(family_id: family_id).order(:id).first
+      end
+
+      def revoke_family!
+        self.class.where(family_id: family_id, revoked_at: nil).update_all(revoked_at: Time.current)
+      end
+
+      def revoke!
+        update!(revoked_at: Time.current)
+      end
+
+      def record_use
+        update_column(:used_at, Time.current) if used_at.nil?
+      end
+
+      def active?
+        revoked_at.nil? && expires_at.future?
+      end
+
+      def refresh_active_window?
+        refresh_expires_at&.future? || false
+      end
+
+      def lost_response_retry?
+        revoked_within_grace? && newest_family_revocation? && successor_untouched?
+      end
+
+      def revoked_within_grace?
+        revoked_at? && revoked_at > REFRESH_RETRY_GRACE.ago
+      end
+
+      def newest_family_revocation?
+        family_tokens.where("revoked_at > ?", revoked_at).none?
+      end
+
+      def successor_untouched?
+        successor = family_tokens.find_by(revoked_at: nil)
+        successor.present? && successor.used_at.nil?
+      end
+
+      def family_tokens
+        self.class.where(family_id: family_id)
+      end
+
+      def scopes_include?(scope)
+        scopes.to_s.split.include?(scope)
+      end
+    end
+  end
+end

data/app/models/iron/ssrf_protection.rb

@@ -0,0 +1,82 @@
+require "resolv"
+require "ipaddr"
+
+module Iron
+  module SsrfProtection
+    extend self
+
+    DNS_RESOLUTION_TIMEOUT = 2
+
+    # 2000::/3 is the only IPv6 block IANA has delegated as global unicast, so
+    # anything outside it (unspecified, loopback, link-local, ULA, multicast,
+    # translation, discard) is non-global by construction. Within it, a few
+    # sub-ranges are still reserved and must be denied explicitly.
+    GLOBAL_UNICAST_V6 = IPAddr.new("2000::/3")
+
+    DISALLOWED_RANGES = [
+      IPAddr.new("0.0.0.0/8"),       # "This" network / unspecified (RFC1122)
+      IPAddr.new("100.64.0.0/10"),   # Carrier-grade NAT (RFC6598)
+      IPAddr.new("192.0.0.0/24"),    # IETF protocol assignments (RFC6890)
+      IPAddr.new("192.0.2.0/24"),    # Documentation TEST-NET-1 (RFC5737)
+      IPAddr.new("198.18.0.0/15"),   # Benchmark testing (RFC2544)
+      IPAddr.new("198.51.100.0/24"), # Documentation TEST-NET-2 (RFC5737)
+      IPAddr.new("203.0.113.0/24"),  # Documentation TEST-NET-3 (RFC5737)
+      IPAddr.new("192.88.99.0/24"),  # 6to4 relay anycast (RFC7526)
+      IPAddr.new("224.0.0.0/4"),     # IPv4 multicast (RFC5771)
+      IPAddr.new("240.0.0.0/4"),     # Reserved (RFC1112)
+      IPAddr.new("2001::/23"),       # IETF protocol assignments — non-global (Teredo, ORCHID, benchmarking)
+      IPAddr.new("2001:db8::/32"),   # Documentation (RFC3849)
+      IPAddr.new("2002::/16"),       # 6to4 (RFC3056) — non-global
+      IPAddr.new("3fff::/20")        # Documentation (RFC9637)
+    ].freeze
+
+    def public_host?(hostname)
+      public_addresses(hostname).any?
+    end
+
+    # Resolves a hostname and returns its addresses only when every one of them
+    # is public, so a caller can connect to a vetted IP without re-resolving.
+    def public_addresses(hostname)
+      addresses = resolve(hostname)
+      return [] if addresses.empty? || addresses.any? { |ip| blocked?(ip) }
+
+      addresses.map(&:to_s)
+    end
+
+    def blocked?(ip)
+      ip = IPAddr.new(ip.to_s) unless ip.is_a?(IPAddr)
+
+      return true if ip.ipv6? && !GLOBAL_UNICAST_V6.include?(ip)
+
+      ip.private? ||
+        ip.loopback? ||
+        ip.link_local? ||
+        ip.ipv4_mapped? ||
+        ip.ipv4_compat? ||
+        DISALLOWED_RANGES.any? { |range| range.include?(ip) }
+    rescue IPAddr::Error
+      true
+    end
+
+    private
+
+      def resolve(hostname)
+        return [] if hostname.blank?
+
+        literal = ip_literal(hostname)
+        return [ literal ] if literal
+
+        Resolv::DNS.open(timeouts: DNS_RESOLUTION_TIMEOUT) do |dns|
+          dns.getaddresses(hostname).map { |address| IPAddr.new(address.to_s) }
+        end
+      rescue Resolv::ResolvError, IPAddr::Error
+        []
+      end
+
+      def ip_literal(hostname)
+        IPAddr.new(hostname)
+      rescue IPAddr::Error
+        nil
+      end
+  end
+end

data/app/views/iron/authentication/_brandmark.html.erb

@@ -0,0 +1,5 @@
+<div class="monogram flex size-12 items-center justify-center rounded-xl">
+  <span class="text-lg/none font-bold text-white/70 select-none"><%= Iron::Current.account&.name&.first&.upcase || "I" %></span>
+</div>
+<div class="h-px w-12 bg-gradient-to-r from-transparent via-stone-300 to-transparent dark:via-stone-700/50"></div>
+<span class="text-[11px]/6 font-semibold uppercase tracking-widest text-stone-500"><%= Iron::Current.account&.name&.upcase || "IRON" %></span>

data/app/views/iron/oauth/authorizations/new.html.erb

@@ -0,0 +1,31 @@
+<% content_for :title, t(".title") %>
+
+<div class="w-full max-w-sm">
+  <div class="flex flex-col items-center gap-4 mb-8">
+    <%= render "iron/authentication/brandmark" %>
+    <h1 class="text-base font-semibold text-stone-950 dark:text-white"><%= t(".heading") %></h1>
+    <p class="text-center text-sm text-stone-500"><%= t(".description", client: @client.name) %></p>
+  </div>
+
+  <div class="rounded-lg bg-white p-4 ring-1 ring-stone-200 dark:bg-white/5 dark:ring-white/10">
+    <p class="text-xs font-semibold uppercase tracking-wide text-stone-400"><%= t(".permissions") %></p>
+    <p class="mt-1 text-sm text-stone-700 dark:text-stone-200"><%= t(".scope_content") %></p>
+
+    <p class="mt-4 text-xs font-semibold uppercase tracking-wide text-stone-400"><%= t(".destination") %></p>
+    <p class="mt-1 text-sm break-all text-stone-700 dark:text-stone-200"><%= @redirect_uri %></p>
+  </div>
+
+  <%= form_with url: "/oauth/authorize", method: :post, class: "mt-6 grid grid-cols-2 gap-3" do |form| %>
+    <%= form.hidden_field :client_id, value: params[:client_id] %>
+    <%= form.hidden_field :redirect_uri, value: @redirect_uri %>
+    <%= form.hidden_field :response_type, value: params[:response_type] %>
+    <%= form.hidden_field :scope, value: @scopes %>
+    <%= form.hidden_field :state, value: params[:state] %>
+    <%= form.hidden_field :code_challenge, value: @code_challenge %>
+    <%= form.hidden_field :code_challenge_method, value: @code_challenge_method %>
+    <%= form.hidden_field :resource, value: @resource %>
+
+    <%= form.button t(".deny"), name: "decision", value: "deny", class: "button-secondary w-full" %>
+    <%= form.button t(".approve"), name: "decision", value: "approve", class: "button-primary w-full" %>
+  <% end %>
+</div>

data/app/views/iron/sessions/new.html.erb

@@ -1,10 +1,6 @@
 <div class="w-full max-w-sm">
   <div class="flex flex-col items-center gap-4 mb-8">
-    <div class="monogram flex size-12 items-center justify-center rounded-xl">
-      <span class="text-lg/none font-bold text-white/70 select-none"><%= Iron::Current.account&.name&.first&.upcase || "I" %></span>
-    </div>
-    <div class="h-px w-12 bg-gradient-to-r from-transparent via-stone-300 to-transparent dark:via-stone-700/50"></div>
-    <span class="text-[11px]/6 font-semibold uppercase tracking-widest text-stone-500"><%= Iron::Current.account&.name&.upcase || "IRON" %></span>
+    <%= render "iron/authentication/brandmark" %>
     <p class="text-sm text-stone-500"><%= t(".title") %></p>
   </div>
 

data/app/views/layouts/iron/application.html.erb

@@ -42,5 +42,8 @@
     <dialog class="drawer" data-controller="drawer" closedby="any">
       <%= turbo_frame_tag :drawer, data: { drawer_target: "frame" } %>
     </dialog>
+
+    <%# Host-app opt-in dev tooling: the dummy app defines this partial in development. %>
+    <%= render "layouts/dev_tools" if Rails.env.development? && lookup_context.exists?("layouts/dev_tools", [], true) %>
   </body>
 </html>

data/app/views/layouts/iron/authentication.html.erb

@@ -20,5 +20,8 @@
     </div>
 
     <%= render "layouts/iron/toast" %>
+
+    <%# Host-app opt-in dev tooling: the dummy app defines this partial in development. %>
+    <%= render "layouts/dev_tools" if Rails.env.development? && lookup_context.exists?("layouts/dev_tools", [], true) %>
   </body>
 </html>

data/config/locales/en.yml

@@ -348,6 +348,18 @@ en:
         api_error: "is managed in code and cannot be edited on this environment"
         badge: "Managed in code"
         details: "Content types, blocks, fields, and locales are defined in db/cms/schema.json and applied on deploy. Editing is disabled on this environment — change the schema in development, commit it, and run bin/rails iron:schema:apply."
+    oauth:
+      authorizations:
+        invalid_request: "We couldn't verify this authorization request."
+        new:
+          title: "Authorize access"
+          heading: "Authorize access"
+          description: "%{client} wants to connect to your account."
+          permissions: "This will allow it to"
+          scope_content: "Read and edit content"
+          destination: "Authorization codes will be sent to"
+          approve: "Approve"
+          deny: "Deny"
     sessions:
       new:
         email_address: "Email address"

data/config/locales/it.yml

@@ -387,6 +387,18 @@ it:
         api_error: "è gestito nel codice e non può essere modificato in questo ambiente"
         badge: "Gestito nel codice"
         details: "Tipi di contenuto, blocchi, campi e lingue sono definiti in db/cms/schema.json e applicati al deploy. La modifica è disabilitata in questo ambiente — modifica lo schema in sviluppo, esegui il commit e lancia bin/rails iron:schema:apply."
+    oauth:
+      authorizations:
+        invalid_request: "Non siamo riusciti a verificare questa richiesta di autorizzazione."
+        new:
+          title: "Autorizza l'accesso"
+          heading: "Autorizza l'accesso"
+          description: "%{client} vuole connettersi al tuo account."
+          permissions: "Questo gli permetterà di"
+          scope_content: "Leggere e modificare i contenuti"
+          destination: "I codici di autorizzazione verranno inviati a"
+          approve: "Autorizza"
+          deny: "Rifiuta"
     sessions:
       new:
         email_address: "Indirizzo email"

data/config/routes.rb

@@ -28,6 +28,7 @@ Iron::Engine.routes.draw do
 
   namespace :api, defaults: { format: :json } do
     get "openapi.json", to: "openapi#show", as: :openapi
+    match "mcp", to: "mcp#handle", via: %i[ get post ], as: :mcp
     post "uploads", to: "uploads#create"
     get "content/:handle", to: "content#index", as: :content_index
     post "content/:handle", to: "content#create", as: :content_create

data/db/migrate/20260626090000_create_iron_oauth_tables.rb

@@ -0,0 +1,50 @@
+class CreateIronOauthTables < ActiveRecord::Migration[8.1]
+  def change
+    create_table :iron_oauth_clients do |t|
+      t.string :uid, null: false
+      t.string :name, null: false
+      t.text :redirect_uris, null: false
+      t.string :scopes, null: false, default: "mcp:access"
+      t.timestamps
+    end
+
+    add_index :iron_oauth_clients, :uid, unique: true
+
+    create_table :iron_oauth_grants do |t|
+      t.references :client, null: false, foreign_key: { to_table: :iron_oauth_clients }
+      t.references :user, null: false, foreign_key: { to_table: :iron_users }
+      t.string :code_digest, null: false
+      t.text :redirect_uri, null: false
+      t.string :scopes, null: false, default: "mcp:access"
+      t.string :code_challenge, null: false
+      t.string :code_challenge_method, null: false, default: "S256"
+      t.string :resource, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :redeemed_at
+      t.timestamps
+    end
+
+    add_index :iron_oauth_grants, :code_digest, unique: true
+
+    create_table :iron_oauth_tokens do |t|
+      t.references :client, null: false, foreign_key: { to_table: :iron_oauth_clients }
+      t.references :user, null: false, foreign_key: { to_table: :iron_users }
+      t.string :family_id, null: false
+      t.string :access_token_digest, null: false
+      t.string :refresh_token_digest
+      t.string :scopes, null: false, default: "mcp:access"
+      t.string :audience, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :refresh_expires_at, null: false
+      t.datetime :used_at
+      t.datetime :revoked_at
+      t.timestamps
+    end
+
+    add_index :iron_oauth_tokens, :access_token_digest, unique: true
+    add_index :iron_oauth_tokens, :refresh_token_digest, unique: true
+    add_index :iron_oauth_tokens, :family_id
+    add_index :iron_oauth_tokens, :family_id, unique: true, where: "revoked_at IS NULL",
+      name: "index_iron_oauth_tokens_active_per_family"
+  end
+end

data/lib/generators/iron/install/install_generator.rb

@@ -8,6 +8,7 @@ module Iron
       MOUNT_PATH = "/admin".freeze
       MOUNT_LINE = %(mount Iron::Engine => "#{MOUNT_PATH}").freeze
       SEEDS_MARKER = "# == Iron CMS admin ==".freeze
+      OAUTH_ROUTES_MARKER = "iron/oauth/metadata#protected_resource".freeze
 
       class_option :skip_db, type: :boolean, default: false,
         desc: "Skip the database steps (migrate, seed, schema apply)"
@@ -16,6 +17,12 @@ module Iron
         route MOUNT_LINE unless routes_include?(MOUNT_LINE)
       end
 
+      def wire_oauth_routes
+        return if routes_include?(OAUTH_ROUTES_MARKER)
+
+        inject_into_file routes_path, "\n#{oauth_routes_block}", after: /#{Regexp.escape(MOUNT_LINE)}\n/
+      end
+
       def install_active_storage
         return if skip_db_steps?
         return if migration_present?("create_active_storage_tables.active_storage.rb")
@@ -76,6 +83,7 @@ module Iron
         say "  - db/cms/schema.json (minimal CMS schema skeleton — edit, then bin/rails iron:schema:apply)"
         say "  - db/seeds.rb provisions the first administrator (run by db:seed)"
         say "  - lib/tasks/iron_release.rake applies the CMS schema during db:prepare"
+        say "  - config/routes.rb OAuth endpoints power the MCP endpoint at #{MOUNT_PATH}/api/mcp"
         say "  - .claude/skills/iron-cms/SKILL.md (the Iron CMS workflow for coding agents)"
         say "  - app/controllers/pages_controller.rb renders published content"
         say "\nSet IRON_SEED_EMAIL and IRON_SEED_PASSWORD outside local environments, or seeding fails fast."
@@ -86,6 +94,17 @@ module Iron
 
       private
 
+        def oauth_routes_block
+          <<~ROUTES.gsub(/^(?=.)/, "  ")
+            get "/.well-known/oauth-protected-resource", to: "iron/oauth/metadata#protected_resource"
+            get "/.well-known/oauth-authorization-server", to: "iron/oauth/metadata#authorization_server"
+            get "/oauth/authorize", to: "iron/oauth/authorizations#new"
+            post "/oauth/authorize", to: "iron/oauth/authorizations#create"
+            post "/oauth/token", to: "iron/oauth/tokens#create"
+            post "/oauth/register", to: "iron/oauth/registrations#create"
+          ROUTES
+        end
+
         def skip_db_steps?
           options[:skip_db] || options[:pretend]
         end

data/lib/iron/engine.rb

@@ -8,11 +8,13 @@ require "lexxy"
 require "bcrypt"
 require "ostruct"
 require "rqrcode"
+require "mcp"
 require "iron/lexorank"
 require "iron/sdk"
 require "pagy"
 require "iron/routing"
 require "iron/image_analyzer"
+require "iron/oauth_body_limit"
 
 module Iron
   class Engine < ::Rails::Engine
@@ -32,6 +34,10 @@ module Iron
       ActionDispatch::Routing::Mapper.include Iron::Routing
     end
 
+    initializer "iron.oauth_body_limit" do |app|
+      app.middleware.insert 0, Iron::OauthBodyLimit
+    end
+
     initializer "iron.active_storage_analyzers" do |app|
       app.config.active_storage.analyzers.prepend Iron::ImageAnalyzer
     end

data/lib/iron/oauth_body_limit.rb

@@ -0,0 +1,52 @@
+require "stringio"
+
+module Iron
+  # Rack::MethodOverride parses form-encoded POST bodies before the request
+  # reaches any controller, so the public OAuth endpoints installed at the
+  # host root get their size ceiling from the very front of the middleware
+  # stack, ahead of anything that might read the body.
+  class OauthBodyLimit
+    PATHS = %w[ /oauth/authorize /oauth/token /oauth/register ].freeze
+    MAX_BYTES = 64 * 1024
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      if guarded?(env) && oversized?(env)
+        [ 413, { "content-length" => "0" }, [] ]
+      else
+        @app.call(env)
+      end
+    end
+
+    private
+      def guarded?(env)
+        env["REQUEST_METHOD"] == "POST" && PATHS.include?(normalized_path(env["PATH_INFO"]))
+      end
+
+      # Rails resolves /oauth/token.json and /oauth/token/// to the same route,
+      # so the ceiling has to match those variants too — not just the literal
+      # paths — or an oversized body slips past on a format suffix or trailing
+      # slashes.
+      def normalized_path(path)
+        path = path.sub(%r{/+\z}, "")
+        path.sub(%r{\.[^./]+\z}, "")
+      end
+
+      def oversized?(env)
+        declared = env["CONTENT_LENGTH"]
+        return declared.to_i > MAX_BYTES if declared
+
+        buffer_capped(env)
+      end
+
+      def buffer_capped(env)
+        body = env["rack.input"].read(MAX_BYTES + 1).to_s
+        env["rack.input"] = StringIO.new(body)
+        env["CONTENT_LENGTH"] = body.bytesize.to_s
+        body.bytesize > MAX_BYTES
+      end
+  end
+end

data/lib/iron/version.rb

@@ -1,3 +1,3 @@
 module Iron
-  VERSION = "0.18.2"
+  VERSION = "0.19.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: iron-cms
 version: !ruby/object:Gem::Version
-  version: 0.18.2
+  version: 0.19.0
 platform: ruby
 authors:
 - Massimo De Marchi
@@ -279,6 +279,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.13'
+- !ruby/object:Gem::Dependency
+  name: mcp
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.20'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.20'
 description: A Rails engine for managing and publishing content with a flexible schema.
 email:
 - massimo@inkofpixel.com
@@ -326,6 +340,7 @@ files:
 - app/controllers/concerns/iron/api/token_authentication.rb
 - app/controllers/concerns/iron/authentication.rb
 - app/controllers/concerns/iron/authorization.rb
+- app/controllers/concerns/iron/bounded_request_body.rb
 - app/controllers/concerns/iron/locale_aware.rb
 - app/controllers/concerns/iron/schema_editing.rb
 - app/controllers/concerns/iron/web_page.rb
@@ -333,6 +348,7 @@ files:
 - app/controllers/iron/account/imports_controller.rb
 - app/controllers/iron/api/base_controller.rb
 - app/controllers/iron/api/content_controller.rb
+- app/controllers/iron/api/mcp_controller.rb
 - app/controllers/iron/api/openapi_controller.rb
 - app/controllers/iron/api/schema/base_controller.rb
 - app/controllers/iron/api/schema/block_definitions_controller.rb
@@ -353,6 +369,10 @@ files:
 - app/controllers/iron/home_controller.rb
 - app/controllers/iron/icons_controller.rb
 - app/controllers/iron/locales_controller.rb
+- app/controllers/iron/oauth/authorizations_controller.rb
+- app/controllers/iron/oauth/metadata_controller.rb
+- app/controllers/iron/oauth/registrations_controller.rb
+- app/controllers/iron/oauth/tokens_controller.rb
 - app/controllers/iron/passwords_controller.rb
 - app/controllers/iron/qr_codes_controller.rb
 - app/controllers/iron/references_controller.rb
@@ -402,6 +422,22 @@ files:
 - app/jobs/iron/reindex_search_job.rb
 - app/mailers/iron/application_mailer.rb
 - app/mailers/iron/passwords_mailer.rb
+- app/mcp/iron/mcp/error.rb
+- app/mcp/iron/mcp/forbidden.rb
+- app/mcp/iron/mcp/invalid_request.rb
+- app/mcp/iron/mcp/paginator.rb
+- app/mcp/iron/mcp/server.rb
+- app/mcp/iron/mcp/tool_context.rb
+- app/mcp/iron/mcp/tools/base.rb
+- app/mcp/iron/mcp/tools/create_entry.rb
+- app/mcp/iron/mcp/tools/delete_entry.rb
+- app/mcp/iron/mcp/tools/describe_schema.rb
+- app/mcp/iron/mcp/tools/get_entry.rb
+- app/mcp/iron/mcp/tools/list_content_types.rb
+- app/mcp/iron/mcp/tools/list_entries.rb
+- app/mcp/iron/mcp/tools/search.rb
+- app/mcp/iron/mcp/tools/update_entry.rb
+- app/mcp/iron/mcp/tools/upload_asset.rb
 - app/models/concerns/iron/broadcastable.rb
 - app/models/concerns/iron/instance_scoped.rb
 - app/models/concerns/iron/processable.rb
@@ -415,6 +451,7 @@ files:
 - app/models/iron/block_definition/exportable.rb
 - app/models/iron/block_definition/importable.rb
 - app/models/iron/content.rb
+- app/models/iron/content/download_budget.rb
 - app/models/iron/content_type.rb
 - app/models/iron/content_type/exportable.rb
 - app/models/iron/content_type/field_queryable.rb
@@ -474,6 +511,12 @@ files:
 - app/models/iron/importer.rb
 - app/models/iron/integration.rb
 - app/models/iron/locale.rb
+- app/models/iron/oauth/client.rb
+- app/models/iron/oauth/grant.rb
+- app/models/iron/oauth/resource.rb
+- app/models/iron/oauth/scope.rb
+- app/models/iron/oauth/secret.rb
+- app/models/iron/oauth/token.rb
 - app/models/iron/person.rb
 - app/models/iron/person/transferable.rb
 - app/models/iron/qr_code_link.rb
@@ -487,6 +530,7 @@ files:
 - app/models/iron/search_record/fts.rb
 - app/models/iron/seed.rb
 - app/models/iron/session.rb
+- app/models/iron/ssrf_protection.rb
 - app/models/iron/system.rb
 - app/models/iron/user.rb
 - app/models/iron/user/deactivatable.rb
@@ -525,6 +569,7 @@ files:
 - app/views/iron/api/schema/locales/index.json.jbuilder
 - app/views/iron/api/schema/locales/show.json.jbuilder
 - app/views/iron/api/search/show.json.jbuilder
+- app/views/iron/authentication/_brandmark.html.erb
 - app/views/iron/block_definitions/_block_definition.html.erb
 - app/views/iron/block_definitions/_empty_state.html.erb
 - app/views/iron/block_definitions/_form.html.erb
@@ -595,6 +640,7 @@ files:
 - app/views/iron/locales/edit.html.erb
 - app/views/iron/locales/index.html.erb
 - app/views/iron/locales/new.html.erb
+- app/views/iron/oauth/authorizations/new.html.erb
 - app/views/iron/passwords/edit.html.erb
 - app/views/iron/passwords/new.html.erb
 - app/views/iron/passwords_mailer/reset.html.erb
@@ -661,6 +707,7 @@ files:
 - db/migrate/20260215222735_remove_legacy_auth_from_iron_users.rb
 - db/migrate/20260221231832_create_iron_integrations.rb
 - db/migrate/20260612131538_create_iron_systems.rb
+- db/migrate/20260626090000_create_iron_oauth_tables.rb
 - exe/iron
 - lib/generators/iron/agents/agents_generator.rb
 - lib/generators/iron/agents/templates/AGENTS.md
@@ -686,6 +733,7 @@ files:
 - lib/iron/lexorank/rankable.rb
 - lib/iron/lexorank/rebalance_rank_job.rb
 - lib/iron/lexorank/utils.rb
+- lib/iron/oauth_body_limit.rb
 - lib/iron/published_page_constraint.rb
 - lib/iron/routing.rb
 - lib/iron/sdk.rb
@@ -716,7 +764,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Iron is a Ruby on Rails engine for managing and publishing content.
 test_files: []