mcp_authorization 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63bcf798beee003e44d7894f8e2e80177a6ddb1e7357b68507a74464c2665ce6
-  data.tar.gz: 047560ce4c65b3b960f7c66904ca48c70b513e90510d7714edbd93996c39f919
+  metadata.gz: 7998105e5a6828b9673a8b97918503842f5eea467ee3ced5c8fd8298c1000f15
+  data.tar.gz: 4a130479e78bdd4ec696ee78623ff233331afebbd968c715eb9b87296163c94b
 SHA512:
-  metadata.gz: 41b2c6a57ffeda77b7c74e2d2a849da6653d6678f78e9a76b9dec0cdaef5059b4ea00449063c57254e526c9cf6ebc780a7f43b59bfefeb57fabcc12e2f966842
-  data.tar.gz: 7dc31d4854025087e495bc9963ee46079a35f3cc6cc6fcbd3a904b00383017e6f68b7718db51a49fb78585657d86158e637fcbd5a182a72b1ad6d09ec83f362e
+  metadata.gz: 02ae2178372da419ccbaffe5e7df67bc030e158cfd2b055cfa6682e5cf89d1daa428983c1687479e40de9fc466da01e9f5c2313fa561d5b815a48e884a95b4c0
+  data.tar.gz: 14ac5790e1e7f12d36c05331a8193744b2355fd30610416265f7d8f8e0aa730654ff2bdf4bf514d3c3b4d3f677e66916014719fdcda9dfc62b90a7dc4891402a

data/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this gem are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this project
 adheres to [Semantic Versioning](https://semver.org/).
 
+## [0.6.2] - 2026-07-01
+
+### Fixed
+- **A record field whose type is an inline string-literal union with a single field-level tag was misclassified as a per-member-tagged union.** `compile_tagged_record` routes a field into `compile_tagged_union` (which gates each `|`-separated member individually, e.g. `stage: a @feature(x) | b @feature(y)`) whenever `tagged_union_field?` sees an `@` anywhere in the type string plus more than one `|`-separated part. A plain literal union with one *field-level* tag trailing the whole thing — `logic: "AND" | "OR" @desc(...)` — matches that same heuristic even though the tag applies to the field, not an individual member. Misrouting sends each bare literal (`"AND"`, `"OR"`) through `resolve_type`, which only resolves *named alias references*; each literal fell back to `{type: "object"}`, producing `{type: "object", oneOf: [{type: "object"}, {type: "object"}]}` instead of `{type: "string", enum: ["AND", "OR"]}`. `tagged_union_field?` and `tagged_array_union_inner` now require at least one *non-final* `|`-separated member to carry a tag before treating a field as per-member-gated — every genuine per-member-tagged union in this codebase tags each gated member individually, so a tag trailing only the last member is never sufficient on its own. Field-level tags on inline literal unions now fall through to the normal RBS-library path (`visit_rbs_union`), which already resolved them correctly.
+
+## [0.6.1] - 2026-07-01
+
+### Fixed
+- **Single-line string-literal-union type aliases (e.g. `type logic = "AND" | "OR"`) lost every member after the first.** Both the `# @rbs type` inline-comment parser and the shared `sig/shared/*.rbs` file parser only scanned *subsequent lines* for `| "value"` continuations, so a union written entirely on one line — the common shape for short enums like `"AND" | "OR"` — resolved to `{type: "string", enum: ["AND"]}` instead of `["AND", "OR"]`. Multi-line unions (`"low"\n| "medium"\n| "high"`) were unaffected. Literal unions written directly inline on a record field (not behind a named alias) were also unaffected, since those go through the RBS-parser union visitor rather than the alias collector.
+
 ## [0.6.0] - 2026-06-25
 
 Per-request work is now scoped to what each MCP method needs, and the

data/lib/mcp_authorization/rbs_schema_compiler.rb

@@ -1094,10 +1094,19 @@ module McpAuthorization
       # True when a record field's type is a multi-member union that carries a
       # predicate tag — i.e. per-member gating is intended. A `|` at bracket
       # depth 0 marks a real union (not one inside a nested generic/record).
+      #
+      # A tag trailing only the *final* member (e.g. a plain literal union
+      # with one field-level `@desc(...)`, as in `"AND" | "OR" @desc(...)`)
+      # is NOT per-member gating — every genuine per-member-tagged union in
+      # this codebase tags each gated member individually
+      # (`a @feature(x) | b @feature(y)`), so at least one *non-final*
+      # member must carry a tag before we route into compile_tagged_union.
+      # Otherwise the field falls through to the normal RBS-library path,
+      # which resolves inline literal unions correctly via visit_rbs_union.
       #: (String) -> bool
       def tagged_union_field?(type_str)
         return false unless type_str.include?("@")
-        split_at_depth_zero(type_str, "|").size > 1
+        per_member_tagged_union?(type_str, "|")
       end
 
       # If a field type is +Array[<multi-member tagged union>]+, return the inner
@@ -1111,7 +1120,18 @@ module McpAuthorization
         return nil unless m
 
         inner = m[1].to_s
-        split_at_depth_zero(inner, "|").size > 1 ? inner : nil
+        per_member_tagged_union?(inner, "|") ? inner : nil
+      end
+
+      # True when a `|`-separated type expression has more than one member
+      # AND at least one *non-final* member carries a predicate tag. See
+      # tagged_union_field? for why the final member alone doesn't count.
+      #: (String, String) -> bool
+      def per_member_tagged_union?(type_str, delimiter)
+        parts = split_at_depth_zero(type_str, delimiter)
+        return false unless parts.size > 1
+
+        parts[0..-2].any? { |part| part.include?("@") }
       end
 
       # Compile a union-style output type (+# @rbs type output = success | admin_detail @requires(:admin)+)
@@ -1364,7 +1384,7 @@ module McpAuthorization
             current_name = $1.to_s
             current_base = nil
             current_body = "{"
-          elsif stripped =~ /\Atype (\w+) = "([^"]+)"/
+          elsif stripped =~ /\Atype (\w+) = ("[^"]*"(?:\s*\|\s*"[^"]*")*)/
             aliases[$1.to_s] = parse_rbs_string_union($2.to_s, line, content)
           elsif current_name
             current_body << strip_rbs_comment(stripped)
@@ -1380,15 +1400,24 @@ module McpAuthorization
         aliases
       end
 
-      # Parse a multi-line string literal union from an .rbs file:
+      # Parse a string literal union from an .rbs file, either written on
+      # one line:
+      #   type logic = "AND" | "OR"
+      # or continued across multiple lines:
       #   type priority = "low"
       #                 | "medium"
       #                 | "high"
       #
+      # +first_segment+ is everything captured after the +=+ on the
+      # opening line, which may itself already contain the full
+      # +"a" | "b" | "c"+ union — a single-line union has no continuation
+      # lines, so capturing only its first quoted literal (the prior
+      # behavior) silently dropped every member after the first.
+      #
       # @return [Hash] +{type: "string", enum: ["low", "medium", "high"]}+
       #: (String, String, String) -> Hash[Symbol, untyped]
-      def parse_rbs_string_union(first_value, line, content)
-        values = [first_value]
+      def parse_rbs_string_union(first_segment, line, content)
+        values = first_segment.scan(/"([^"]*)"/).flatten
         content.each_line.drop_while { |l| l != line }.drop(1).each do |next_line|
           if next_line =~ /^\s*\|\s*"([^"]+)"/
             values << $1.to_s
@@ -1491,7 +1520,7 @@ module McpAuthorization
               current_name = nil
               current_body = +""
             end
-          elsif line =~ /#\s*@rbs type (\w+)\s*=\s*"([^"]+)"/
+          elsif line =~ /#\s*@rbs type (\w+)\s*=\s*("[^"]*"(?:\s*\|\s*"[^"]*")*)/
             aliases[$1.to_s] = parse_string_union($2.to_s, line, content)
           elsif current_name
             stripped = strip_rbs_comment(line.strip.sub(/^#\s*/, ""))
@@ -1961,15 +1990,24 @@ module McpAuthorization
         str.count("{") == str.count("}")
       end
 
-      # Parse a multi-line string literal union from handler source comments:
+      # Parse a string literal union from handler source comments, either
+      # written on one line:
+      #   # @rbs type logic = "AND" | "OR"
+      # or continued across multiple lines:
       #   # @rbs type priority = "low"
       #   #                    | "medium"
       #   #                    | "high"
       #
+      # +first_segment+ is everything captured after the +=+ on the
+      # opening line, which may itself already contain the full
+      # +"a" | "b" | "c"+ union — a single-line union has no continuation
+      # lines, so capturing only its first quoted literal (the prior
+      # behavior) silently dropped every member after the first.
+      #
       # @return [Hash] +{type: "string", enum: ["low", "medium", "high"]}+
       #: (String, String, String) -> Hash[Symbol, untyped]
-      def parse_string_union(first_value, line, content)
-        values = [first_value]
+      def parse_string_union(first_segment, line, content)
+        values = first_segment.scan(/"([^"]*)"/).flatten
         content.each_line.drop_while { |l| l != line }.drop(1).each do |next_line|
           if next_line =~ /^\s*#\s*\|\s*"([^"]+)"/
             values << $1.to_s

data/lib/mcp_authorization/version.rb

@@ -1,3 +1,3 @@
 module McpAuthorization
-  VERSION = "0.6.0"
+  VERSION = "0.6.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: mcp_authorization
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - AndyGauge
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-25 00:00:00.000000000 Z
+date: 2026-07-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails