mcp_on_ruby 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac6effb14117c29ebe4aab9f0178aa7ded445b448c80f7438956cbfc088c1934
-  data.tar.gz: 052b0c6053db07aee0ebe0991949bae91ec268d9911b5512527b54fb2fb7c503
+  metadata.gz: a99b9f1fff3f7a9639c85c82826690264ca0a2032321c227a3424719d73fbdd5
+  data.tar.gz: a977652f5dd0e15d31142a1561f9ab9302a1f34abcfc21a759d5b4ce3600b460
 SHA512:
-  metadata.gz: deafb7ff0545ab491e495fba46d21d27ff66e9c397d7466c1800b74206c98aa19569855148f4b0015e9cd5ce3a78bdc29b591a7599ca95b2afdf97d191b54054
-  data.tar.gz: 5da7f45bc3087d683a1f17283709f14b3e020b8f69ab270fa00156953abec498593e843c01278644ee57bf08fca227e2df1a9745ea9e747cb9b79974e1727a9e
+  metadata.gz: 1b8dda36e0e1a44f7b67cbb5f1bcbfe91065ff6304c60682a289f524187532a625e1e691c99ef5bd71424ee19f35a2c9151561ffdfe53b34c1aa56919956e25e
+  data.tar.gz: e484ae0cee070df784e3621e63d78b982b5bd70bcd02d566f3a74127781c026a0bf683a271814936118ce67416879fd0d4bbf596646d8952d5e61c5ec3e5eea8

data/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project are documented in this file.
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Entries from 2.0.0 onward
 are generated by [release-please](https://github.com/googleapis/release-please) from Conventional Commit PR titles.
 
+## [2.0.2](https://github.com/nagstler/mcp_on_ruby/compare/v2.0.1...v2.0.2) (2026-10-31)
+
+
+### Bug Fixes
+
+* leave belongs_to foreign keys out of scaffolded params ([#37](https://github.com/nagstler/mcp_on_ruby/issues/37)) ([7b7ec5b](https://github.com/nagstler/mcp_on_ruby/commit/7b7ec5bbe40f0dfeec88da94c9deef6de90167bc))
+* report redirects to a sign-in page as not authenticated ([#38](https://github.com/nagstler/mcp_on_ruby/issues/38)) ([949a340](https://github.com/nagstler/mcp_on_ruby/commit/949a34059e925bdad17586cf5bfdab0a68aca031))
+
 ## [2.0.1](https://github.com/nagstler/mcp_on_ruby/compare/v2.0.0...v2.0.1) (2026-10-31)
 
 

data/README.md

@@ -172,7 +172,30 @@ McpOnRuby.configure do |config|
 end
 ```
 
-For Devise and Warden, the user is signed in with the `:user` scope (change it with `config.warden_scope`). Apps with custom authentication can read the stdio user with `mcp_user` in their own `before_action`.
+For Devise and Warden, the user is signed in with the `:user` scope (change it with `config.warden_scope`). Other apps read the stdio user with `mcp_user`.
+
+**Rails 8 authentication** (`bin/rails generate authentication`) uses neither Warden nor tokens. Teach its concern about API tokens for HTTP clients and about `mcp_user` for stdio:
+
+```ruby
+# app/controllers/concerns/authentication.rb
+def resume_session
+  Current.session ||= find_session_by_cookie || find_session_by_token || find_session_for_mcp
+end
+
+# HTTP clients send `Authorization: Bearer <api_token>` (add `has_secure_token :api_token` to User).
+def find_session_by_token
+  authenticate_with_http_token do |token, _options|
+    User.find_by(api_token: token)&.sessions&.new(user_agent: request.user_agent, ip_address: request.remote_ip)
+  end
+end
+
+# `bin/rails mcp:stdio` sessions act as config.stdio_user.
+def find_session_for_mcp
+  mcp_user&.sessions&.new
+end
+```
+
+The sessions are built but never saved, so tool calls don't add rows to `sessions` or set cookies.
 
 If authentication fails, the agent gets a clear "Not authenticated (401)" tool error and nothing runs.
 
@@ -209,7 +232,8 @@ See [SECURITY.md](SECURITY.md) for the full threat model.
 | `401` / `403` / `404` | Tool error: not authenticated / not permitted / not found |
 | `422` with JSON | Tool error including your validation messages, so the agent can correct itself |
 | Other `4xx` | Tool error with the status, plus the body when it is JSON |
-| `3xx` | Tool error naming the redirect target (redirects are not followed) |
+| `3xx` to a sign-in page | Tool error: not authenticated (Rails 8 authentication and Devise redirect unauthenticated requests) |
+| Other `3xx` | Tool error naming the redirect target (redirects are not followed) |
 | HTML | Tool error asking for JSON. Use `respond_to` with `format.json`. |
 | `5xx` or an exception | Generic tool error. Details are reported to `Rails.error`, never sent. |
 
@@ -265,19 +289,26 @@ claude mcp add my-app -e MCP_USER=alice@example.com -- bin/rails mcp:stdio
 <details>
 <summary><b>Claude Desktop</b></summary>
 
-Claude Desktop does not load your shell profile, so start Rails through a login shell to pick up rbenv, asdf, or chruby:
+Claude Desktop starts servers without your shell environment, so rbenv, asdf, and mise aren't loaded. Point it at your app's Ruby directly, and use `-C` to run from the app's directory:
+
+```bash
+# In your app directory, print the Ruby to use:
+ruby -e 'puts RbConfig.ruby'
+```
 
 ```json
 {
   "mcpServers": {
     "my-app": {
-      "command": "bash",
-      "args": ["-lc", "cd /path/to/my-app && bin/rails mcp:stdio"],
+      "command": "/Users/you/.rbenv/versions/3.4.7/bin/ruby",
+      "args": ["-C", "/path/to/my-app", "bin/rails", "mcp:stdio"],
       "env": { "MCP_USER": "alice@example.com" }
     }
   }
 }
 ```
+
+Update `command` when you upgrade Ruby.
 </details>
 
 <details>

data/lib/generators/mcp_on_ruby/expose/expose_generator.rb

@@ -90,12 +90,19 @@ module McpOnRuby
         }.fetch(action) { "TODO: describe what #{action} does for the agent" }
       end
 
+      # Foreign keys of belongs_to associations usually come from the signed-in user or the URL, not the agent.
+      def owner_keys(model)
+        return [] unless model.respond_to?(:reflect_on_all_associations)
+
+        model.reflect_on_all_associations(:belongs_to).map { |association| association.foreign_key.to_s }
+      end
+
       # A params block built from the model's columns, when the controller has an ActiveRecord model.
       def model_params
         model = controller.split("/").last.classify.safe_constantize
         return unless model.respond_to?(:columns_hash)
 
-        columns = model.columns_hash.except(model.primary_key, *SKIPPED_COLUMNS)
+        columns = model.columns_hash.except(model.primary_key, *SKIPPED_COLUMNS, *owner_keys(model))
         return if columns.empty?
 
         lines = columns.map do |name, column|

data/lib/mcp_on_ruby/result.rb

@@ -6,6 +6,10 @@ module McpOnRuby
     JSON_TYPE = %r{\Aapplication/(?:[\w.+-]+\+)?json\b}i
     HTML_TYPE = %r{\Atext/html\b}i
 
+    # Sign-in pages apps redirect unauthenticated requests to: Rails 8 authentication (/session/new),
+    # Devise (/users/sign_in), and common /login and /signin routes.
+    SIGN_IN_PATH = %r{/(?:session/new|sign_?in|log_?in)/?\z}i
+
     module_function
 
     def from_rack(status, headers, body)
@@ -15,8 +19,7 @@ module McpOnRuby
 
       case status
       when 200..299 then success(status, text, json, content_type)
-      when 300..399 then error(status, "Redirected to #{header(headers, "location") || "another page"}; " \
-                                       "redirects are not followed")
+      when 300..399 then redirect(status, header(headers, "location"))
       when 400..499 then client_error(status, text, json)
       else error(status, "Internal server error (#{status})")
       end
@@ -36,6 +39,16 @@ module McpOnRuby
       text_response(text)
     end
 
+    def redirect(status, location)
+      if location && URI(location).path.to_s.match?(SIGN_IN_PATH)
+        error(status, "Not authenticated: the app redirected to its sign-in page (#{location})")
+      else
+        error(status, "Redirected to #{location || "another page"}; redirects are not followed")
+      end
+    rescue URI::InvalidURIError
+      error(status, "Redirected to #{location}; redirects are not followed")
+    end
+
     def client_error(status, text, json)
       message = {
         401 => "Not authenticated (401)",

data/lib/mcp_on_ruby/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module McpOnRuby
-  VERSION = "2.0.1"
+  VERSION = "2.0.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mcp_on_ruby
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Nagendra Dhanakeerthi