mcp-auth 0.5.0 → 0.6.0

data/lib/mcp/auth.rb

@@ -2,6 +2,7 @@
 
 require 'mcp/auth/version'
 require 'mcp/auth/engine'
+require 'mcp/auth/secret_hashing'
 require 'mcp/auth/services/token_service'
 require 'mcp/auth/services/authorization_service'
 
@@ -40,7 +41,14 @@ module Mcp
                     :token_signing_private_key,
                     :token_signing_public_key,
                     :token_signing_additional_public_keys,
-                    :token_signing_kid
+                    :token_signing_kid,
+                    :secret_dual_read,
+                    :refresh_token_reuse_grace_period,
+                    :mcp_server_url,
+                    :allowed_redirect_uri_patterns,
+                    :allow_loopback_redirects,
+                    :verified_redirect_hosts,
+                    :strict_scope_validation
 
       # token_signing_algorithm has a validating writer defined below, so only
       # the reader is generated here.
@@ -58,8 +66,22 @@ module Mcp
         @consent_view_path = 'mcp/auth/consent'
         @use_custom_consent_view = false
         @mcp_server_path = '/mcp'
+        # Public origin of the MCP resource server (e.g. 'https://api.example.com').
+        # The token audience, protected-resource metadata and 401 challenge are
+        # built from it. Optional: defaults to the request origin. Set it to pin
+        # these against a forged Host header, and whenever authorization_server_url
+        # points at a different host.
+        @mcp_server_url = nil
         @mcp_docs_url = nil
         @validate_scope_for_user = nil
+        # Refresh-token rotation grace period (seconds). A rotated (revoked)
+        # refresh token replayed WITHIN this window of its rotation is treated as
+        # a benign client race/retry — rejected softly, WITHOUT revoking the
+        # family — because real MCP clients often fire several refreshes at once
+        # when the access token expires. A replay after the window is treated as
+        # genuine reuse/theft and revokes the whole family. Set to 0 to disable
+        # the grace and revoke on any replay.
+        @refresh_token_reuse_grace_period = 10
         # CP-9255 batch 2: JWT signing.
         # Default HS256 keeps existing setups working (shared oauth_secret).
         # Set algorithm to 'RS256' or 'ES256' and provide PEM-encoded keys
@@ -71,6 +93,30 @@ module Mcp
         # for verification and published in the JWKS during key rotation.
         @token_signing_additional_public_keys = []
         @token_signing_kid = nil
+        # Transitional dual-read for the "hash secrets at rest" migration. While
+        # true (the default), a presented secret/token/code is matched against
+        # BOTH its digest and any legacy plaintext row not yet backfilled — this
+        # is what makes the upgrade safe under rolling deploys and safe to roll
+        # back. Set to false once every row is hashed (the backfill migration has
+        # run and no old code remains) to reject plaintext-form matches.
+        @secret_dual_read = true
+        # Dynamic Client Registration redirect-URI policy. Registration is open
+        # (RFC 7591), so a rogue client could register an attacker-controlled
+        # redirect_uri and phish a user into approving it on the genuine consent
+        # page. Plain http is ALWAYS rejected except for loopback hosts. Set
+        # allowed_redirect_uri_patterns (Strings, matched exactly, or Regexps)
+        # to additionally restrict registration to known clients; nil keeps any
+        # https / native-scheme URI. Loopback (localhost, 127.0.0.1, [::1], any
+        # port; RFC 8252 §7.3) is allowed unless allow_loopback_redirects is false.
+        @allowed_redirect_uri_patterns = nil
+        @allow_loopback_redirects = true
+        # Redirect hosts shown as "verified" on the consent screen (exact host or
+        # '*.example.com'); any other host is flagged as unverified.
+        @verified_redirect_hosts = []
+        # true: unknown scopes are rejected (invalid_client_metadata at
+        # registration, invalid_scope at /oauth/authorize). false: silently
+        # dropped, the pre-0.6.0 behavior.
+        @strict_scope_validation = true
       end
 
       def token_signing_algorithm=(value)
@@ -139,8 +185,9 @@ module Mcp
   end
 end
 
-# Loaded after the module body so they can reference Mcp::Auth::Configuration
-# and Mcp::Auth::ControllerHelpers defined above. The services are already
-# required at the top of this file.
+# Loaded after the module body so they can reference Mcp::Auth::Configuration,
+# Mcp::Auth::ControllerHelpers, and Mcp::Auth::Error defined above. The services
+# are already required at the top of this file.
 require 'mcp/auth/scope_registry'
 require 'mcp/auth/protected_resource'
+require 'mcp/auth/schema_guard'

data/lib/tasks/mcp_auth_tasks.rake

@@ -17,6 +17,32 @@ namespace :mcp_auth do
     puts "Cleanup complete!"
   end
 
+  desc "Check that the database schema matches the installed mcp-auth version"
+  task doctor: :environment do
+    missing = Mcp::Auth::SchemaGuard.missing_columns
+    secret_problem = Mcp::Auth::Services::TokenService.oauth_secret_problem
+    healthy = true
+
+    if missing.empty?
+      puts "mcp-auth #{Mcp::Auth::VERSION}: database schema is up to date."
+    else
+      healthy = false
+      warn "mcp-auth #{Mcp::Auth::VERSION}: PENDING MIGRATION"
+      warn "  Missing: #{missing.join(', ')}"
+      warn '  Run: rails g mcp:auth:upgrade && rails db:migrate'
+    end
+
+    if secret_problem
+      # A hard error at token-signing time outside development/test.
+      healthy = false unless Rails.env.development? || Rails.env.test?
+      warn "mcp-auth: signing secret: #{secret_problem}"
+    else
+      puts 'mcp-auth: signing configuration OK.'
+    end
+
+    exit 1 unless healthy
+  end
+
   desc "Show MCP Auth statistics"
   task stats: :environment do
     puts "\nMCP Auth Statistics"
@@ -55,9 +81,14 @@ namespace :mcp_auth do
 
     puts "Revoking all tokens for client: #{client_id}"
 
-    auth_codes = Mcp::Auth::AuthorizationCode.where(client_id: client_id).delete_all
-    access_tokens = Mcp::Auth::AccessToken.where(client_id: client_id).delete_all
-    refresh_tokens = Mcp::Auth::RefreshToken.where(client_id: client_id).delete_all
+    auth_codes = access_tokens = refresh_tokens = 0
+    # Wrap the three deletes in a transaction so a mid-way failure can't leave a
+    # client partially revoked (tokens gone but codes still live, or similar).
+    ActiveRecord::Base.transaction do
+      auth_codes = Mcp::Auth::AuthorizationCode.where(client_id: client_id).delete_all
+      access_tokens = Mcp::Auth::AccessToken.where(client_id: client_id).delete_all
+      refresh_tokens = Mcp::Auth::RefreshToken.where(client_id: client_id).delete_all
+    end
 
     puts "  - Removed #{auth_codes} authorization codes"
     puts "  - Removed #{access_tokens} access tokens"
@@ -77,9 +108,12 @@ namespace :mcp_auth do
 
     puts "Revoking all tokens for user: #{user_id}"
 
-    auth_codes = Mcp::Auth::AuthorizationCode.where(user_id: user_id).delete_all
-    access_tokens = Mcp::Auth::AccessToken.where(user_id: user_id).delete_all
-    refresh_tokens = Mcp::Auth::RefreshToken.where(user_id: user_id).delete_all
+    auth_codes = access_tokens = refresh_tokens = 0
+    ActiveRecord::Base.transaction do
+      auth_codes = Mcp::Auth::AuthorizationCode.where(user_id: user_id).delete_all
+      access_tokens = Mcp::Auth::AccessToken.where(user_id: user_id).delete_all
+      refresh_tokens = Mcp::Auth::RefreshToken.where(user_id: user_id).delete_all
+    end
 
     puts "  - Removed #{auth_codes} authorization codes"
     puts "  - Removed #{access_tokens} access tokens"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mcp-auth
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Serhii Borozenets
@@ -211,18 +211,24 @@ files:
 - app/models/mcp/auth/refresh_token.rb
 - app/views/mcp/auth/consent.html.erb
 - config/routes.rb
+- lib/generators/mcp/auth/hash_secrets_generator.rb
 - lib/generators/mcp/auth/install_generator.rb
 - lib/generators/mcp/auth/templates/README
+- lib/generators/mcp/auth/templates/add_mcp_auth_confidential_client_and_reuse.rb.erb
 - lib/generators/mcp/auth/templates/create_access_tokens.rb.erb
 - lib/generators/mcp/auth/templates/create_authorization_codes.rb.erb
 - lib/generators/mcp/auth/templates/create_oauth_clients.rb.erb
 - lib/generators/mcp/auth/templates/create_refresh_tokens.rb.erb
+- lib/generators/mcp/auth/templates/hash_mcp_auth_secrets_at_rest.rb.erb
 - lib/generators/mcp/auth/templates/initializer.rb
 - lib/generators/mcp/auth/templates/views/consent.html.erb
+- lib/generators/mcp/auth/upgrade_generator.rb
 - lib/mcp/auth.rb
 - lib/mcp/auth/engine.rb
 - lib/mcp/auth/protected_resource.rb
+- lib/mcp/auth/schema_guard.rb
 - lib/mcp/auth/scope_registry.rb
+- lib/mcp/auth/secret_hashing.rb
 - lib/mcp/auth/services/authorization_service.rb
 - lib/mcp/auth/services/token_service.rb
 - lib/mcp/auth/version.rb
@@ -235,6 +241,17 @@ metadata:
   changelog_uri: https://github.com/SerhiiBorozenets/mcp-auth/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/SerhiiBorozenets/mcp-auth/issues
   rubygems_mfa_required: 'true'
+post_install_message: |
+  mcp-auth installed. Run pending migrations before starting your app:
+
+    rails generate mcp:auth:install   # first-time install
+    rails generate mcp:auth:upgrade   # upgrading an existing install
+    rails db:migrate
+
+  Upgrading from <= 0.5.0? Read the 0.6.0 CHANGELOG "Upgrade" section first:
+  secrets are hashed in a separate, later step (mcp:auth:hash_secrets).
+
+  Verify the schema any time with: bin/rails mcp_auth:doctor
 rdoc_options: []
 require_paths:
 - lib