otto 1.5.0 → 1.6.0

data/lib/otto/mcp/validation.rb

@@ -0,0 +1,119 @@
+require 'json'
+
+begin
+  require 'json_schemer'
+rescue LoadError
+  # json_schemer is optional - graceful fallback
+end
+
+class Otto
+  module MCP
+    class ValidationError < StandardError; end
+
+    class Validator
+      def initialize
+        @schemas                = {}
+        @json_schemer_available = defined?(JSONSchemer)
+      end
+
+      def validate_request(data)
+        return true unless @json_schemer_available
+
+        schema            = mcp_request_schema
+        validation_errors = schema.validate(data).to_a
+
+        unless validation_errors.empty?
+          error_messages = validation_errors.map { |error| error['details'] || error['error'] || error.to_s }.join(', ')
+          raise ValidationError, "Invalid MCP request: #{error_messages}"
+        end
+
+        true
+      end
+
+      def validate_tool_arguments(tool_name, arguments, schema)
+        return true unless @json_schemer_available && schema
+
+        schemer           = JSONSchemer.schema(schema)
+        validation_errors = schemer.validate(arguments).to_a
+
+        unless validation_errors.empty?
+          error_messages = validation_errors.map { |error| error['details'] || error['error'] || error.to_s }.join(', ')
+          raise ValidationError, "Invalid arguments for tool #{tool_name}: #{error_messages}"
+        end
+
+        true
+      end
+
+      private
+
+      def mcp_request_schema
+        @schemas[:mcp_request] ||= JSONSchemer.schema({
+          type: 'object',
+          required: %w[jsonrpc method id],
+          properties: {
+            jsonrpc: { const: '2.0' },
+            method: { type: 'string' },
+            id: {},
+            params: { type: 'object' },
+          },
+          additionalProperties: false,
+        },
+                                                     )
+      end
+    end
+
+    class ValidationMiddleware
+      def initialize(app, _security_config = nil)
+        @app       = app
+        @validator = Validator.new
+      end
+
+      def call(env)
+        # Only validate MCP endpoints
+        return @app.call(env) unless mcp_endpoint?(env)
+
+        request = Rack::Request.new(env)
+
+        if request.post? && request.content_type&.include?('application/json')
+          begin
+            body = request.body.read
+            data = JSON.parse(body)
+            @validator.validate_request(data)
+
+            # Reset body for downstream middleware
+            request.body.rewind if request.body.respond_to?(:rewind)
+          rescue JSON::ParserError => ex
+            return validation_error_response(nil, "Invalid JSON: #{ex.message}")
+          rescue ValidationError => ex
+            return validation_error_response(data&.dig('id'), ex.message)
+          end
+        end
+
+        @app.call(env)
+      end
+
+      private
+
+      def mcp_endpoint?(env)
+        endpoint = env['otto.mcp_http_endpoint'] || '/_mcp'
+        path     = env['PATH_INFO'].to_s
+        path.start_with?(endpoint)
+      end
+
+      def validation_error_response(id, message)
+        body = JSON.generate({
+          jsonrpc: '2.0',
+          id: id,
+          error: {
+            code: -32_600,
+            message: 'Invalid Request',
+            data: message,
+          },
+        },
+                            )
+
+        [400, { 'content-type' => 'application/json' }, [body]]
+      end
+    end
+  end
+end

data/lib/otto/route_definition.rb

@@ -35,22 +35,22 @@ class Otto
     attr_reader :keys
 
     def initialize(verb, path, definition, pattern: nil, keys: nil)
-      @verb = verb.to_s.upcase.to_sym
-      @path = path
+      @verb       = verb.to_s.upcase.to_sym
+      @path       = path
       @definition = definition
-      @pattern = pattern
-      @keys = keys || []
+      @pattern    = pattern
+      @keys       = keys || []
 
       # Parse the definition into target and options
-      parsed = parse_definition(definition)
-      @target = parsed[:target]
+      parsed   = parse_definition(definition)
+      @target  = parsed[:target]
       @options = parsed[:options].freeze
 
       # Parse the target into class, method, and kind
       target_parsed = parse_target(@target)
-      @klass_name = target_parsed[:klass_name]
-      @method_name = target_parsed[:method_name]
-      @kind = target_parsed[:kind]
+      @klass_name   = target_parsed[:klass_name]
+      @method_name  = target_parsed[:method_name]
+      @kind         = target_parsed[:kind]
 
       # Freeze for immutability
       freeze
@@ -118,7 +118,7 @@ class Otto
         kind: @kind,
         options: @options,
         pattern: @pattern,
-        keys: @keys
+        keys: @keys,
       }
     end
 
@@ -131,7 +131,7 @@ class Otto
     # Detailed inspection
     # @return [String]
     def inspect
-      "#<Otto::RouteDefinition #{to_s} options=#{@options.inspect}>"
+      "#<Otto::RouteDefinition #{self} options=#{@options.inspect}>"
     end
 
     private
@@ -140,17 +140,17 @@ class Otto
     # @param definition [String] The route definition
     # @return [Hash] Hash with :target and :options keys
     def parse_definition(definition)
-      parts = definition.split(/\s+/)
-      target = parts.shift
+      parts   = definition.split(/\s+/)
+      target  = parts.shift
       options = {}
 
       parts.each do |part|
         key, value = part.split('=', 2)
         if key && value
           options[key.to_sym] = value
-        else
+        elsif Otto.debug
           # Malformed parameter, log warning if debug enabled
-          Otto.logger.warn "Ignoring malformed route parameter: #{part}" if Otto.debug
+          Otto.logger.warn "Ignoring malformed route parameter: #{part}"
         end
       end
 

data/lib/otto/route_handlers.rb

@@ -4,7 +4,6 @@ class Otto
   # Pluggable Route Handler Factory (Phase 4)
   # Enables different execution patterns while maintaining backward compatibility
   module RouteHandlers
-
     # Factory for creating appropriate handlers based on route definitions
     class HandlerFactory
       # Create a handler for the given route definition
@@ -32,7 +31,7 @@ class Otto
 
       def initialize(route_definition, otto_instance = nil)
         @route_definition = route_definition
-        @otto_instance = otto_instance
+        @otto_instance    = otto_instance
       end
 
       # Execute the route handler
@@ -40,7 +39,7 @@ class Otto
       # @param extra_params [Hash] Additional parameters
       # @return [Array] Rack response array
       def call(env, extra_params = {})
-        raise NotImplementedError, "Subclasses must implement #call"
+        raise NotImplementedError, 'Subclasses must implement #call'
       end
 
       protected
@@ -63,20 +62,20 @@ class Otto
         res.request = req
 
         # Make security config available to response helpers
-        if otto_instance&.respond_to?(:security_config) && otto_instance.security_config
+        if otto_instance.respond_to?(:security_config) && otto_instance.security_config
           env['otto.security_config'] = otto_instance.security_config
         end
 
         # Make route definition and options available to middleware and handlers
         env['otto.route_definition'] = route_definition
-        env['otto.route_options'] = route_definition.options
+        env['otto.route_options']    = route_definition.options
 
         # Process parameters through security layer
         req.params.merge! extra_params
         req.params.replace Otto::Static.indifferent_params(req.params)
 
         # Add security headers
-        if otto_instance&.respond_to?(:security_config) && otto_instance.security_config
+        if otto_instance.respond_to?(:security_config) && otto_instance.security_config
           otto_instance.security_config.security_headers.each do |header, value|
             res.headers[header] = value
           end
@@ -89,7 +88,7 @@ class Otto
         end
 
         # Add security helpers if CSRF is enabled
-        if otto_instance&.respond_to?(:security_config) && otto_instance.security_config&.csrf_enabled?
+        if otto_instance.respond_to?(:security_config) && otto_instance.security_config&.csrf_enabled?
           res.extend Otto::Security::CSRFHelpers
         end
 
@@ -133,8 +132,8 @@ class Otto
         name.split('::').inject(Object) do |scope, const_name|
           scope.const_get(const_name)
         end
-      rescue NameError => e
-        raise NameError, "Unknown class: #{name} (#{e})"
+      rescue NameError => ex
+        raise NameError, "Unknown class: #{name} (#{ex})"
       end
     end
 
@@ -152,7 +151,7 @@ class Otto
           # Initialize Logic class with standard parameters
           # Logic classes expect: session, user, params, locale
           logic_params = req.params.merge(extra_params)
-          locale = env['otto.locale'] || 'en'
+          locale       = env['otto.locale'] || 'en'
 
           logic = if target_class.instance_method(:initialize).arity == 4
                     # Standard Logic class constructor
@@ -160,7 +159,7 @@ class Otto
                       auth_result&.session,
                       auth_result&.user,
                       logic_params,
-                      locale
+                      locale,
                     )
                   else
                     # Fallback for custom constructors
@@ -182,28 +181,38 @@ class Otto
           handle_response(result, res, {
             logic_instance: logic,
             request: req,
-            status_code: logic.respond_to?(:status_code) ? logic.status_code : nil
-          })
-
-        rescue => e
-          # Error handling - return 500 with proper headers like main Otto error handler
-          error_id = SecureRandom.hex(8)
-          Otto.logger.error "[#{error_id}] #{e.class}: #{e.message}"
-          Otto.logger.debug "[#{error_id}] Backtrace: #{e.backtrace.join("\n")}" if Otto.debug
+            status_code: logic.respond_to?(:status_code) ? logic.status_code : nil,
+          }
+          )
+        rescue StandardError => ex
+          # Check if we're being called through Otto's integrated context (vs direct handler testing)
+          # In integrated context, let Otto's centralized error handler manage the response
+          # In direct testing context, handle errors locally for unit testing
+          if otto_instance
+            # Log error for handler-specific context but let Otto's centralized error handler manage the response
+            Otto.logger.error "[LogicClassHandler] #{ex.class}: #{ex.message}"
+            Otto.logger.debug "[LogicClassHandler] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
+            raise ex  # Re-raise to let Otto's centralized error handler manage the response
+          else
+            # Direct handler testing context - handle errors locally with security improvements
+            error_id = SecureRandom.hex(8)
+            Otto.logger.error "[#{error_id}] #{ex.class}: #{ex.message}"
+            Otto.logger.debug "[#{error_id}] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
 
-          res.status = 500
-          res.headers['content-type'] = 'text/plain'
+            res.status                  = 500
+            res.headers['content-type'] = 'text/plain'
 
-          if Otto.env?(:dev, :development)
-            res.write "Server error (ID: #{error_id}). Check logs for details."
-          else
-            res.write "An error occurred. Please try again later."
-          end
+            if Otto.env?(:dev, :development)
+              res.write "Server error (ID: #{error_id}). Check logs for details."
+            else
+              res.write 'An error occurred. Please try again later.'
+            end
 
-          # Add security headers if available
-          if otto_instance&.respond_to?(:security_config) && otto_instance.security_config
-            otto_instance.security_config.security_headers.each do |header, value|
-              res.headers[header] = value
+            # Add security headers if available
+            if otto_instance.respond_to?(:security_config) && otto_instance.security_config
+              otto_instance.security_config.security_headers.each do |header, value|
+                res.headers[header] = value
+              end
             end
           end
         end
@@ -225,35 +234,45 @@ class Otto
 
           # Create instance and call method (existing Otto behavior)
           instance = target_class.new(req, res)
-          result = instance.send(route_definition.method_name)
+          result   = instance.send(route_definition.method_name)
 
           # Only handle response if response_type is not default
           if route_definition.response_type != 'default'
             handle_response(result, res, {
               instance: instance,
-              request: req
-            })
+              request: req,
+            }
+            )
           end
+        rescue StandardError => ex
+          # Check if we're being called through Otto's integrated context (vs direct handler testing)
+          # In integrated context, let Otto's centralized error handler manage the response
+          # In direct testing context, handle errors locally for unit testing
+          if otto_instance
+            # Log error for handler-specific context but let Otto's centralized error handler manage the response
+            Otto.logger.error "[InstanceMethodHandler] #{ex.class}: #{ex.message}"
+            Otto.logger.debug "[InstanceMethodHandler] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
+            raise ex  # Re-raise to let Otto's centralized error handler manage the response
+          else
+            # Direct handler testing context - handle errors locally with security improvements
+            error_id = SecureRandom.hex(8)
+            Otto.logger.error "[#{error_id}] #{ex.class}: #{ex.message}"
+            Otto.logger.debug "[#{error_id}] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
 
-        rescue => e
-          # Error handling - return 500 with proper headers like main Otto error handler
-          error_id = SecureRandom.hex(8)
-          Otto.logger.error "[#{error_id}] #{e.class}: #{e.message}"
-          Otto.logger.debug "[#{error_id}] Backtrace: #{e.backtrace.join("\n")}" if Otto.debug
-
-          res.status = 500
-          res.headers['content-type'] = 'text/plain'
+            res.status                  = 500
+            res.headers['content-type'] = 'text/plain'
 
-          if Otto.env?(:dev, :development)
-            res.write "Server error (ID: #{error_id}). Check logs for details."
-          else
-            res.write "An error occurred. Please try again later."
-          end
+            if Otto.env?(:dev, :development)
+              res.write "Server error (ID: #{error_id}). Check logs for details."
+            else
+              res.write 'An error occurred. Please try again later.'
+            end
 
-          # Add security headers if available
-          if otto_instance&.respond_to?(:security_config) && otto_instance.security_config
-            otto_instance.security_config.security_headers.each do |header, value|
-              res.headers[header] = value
+            # Add security headers if available
+            if otto_instance.respond_to?(:security_config) && otto_instance.security_config
+              otto_instance.security_config.security_headers.each do |header, value|
+                res.headers[header] = value
+              end
             end
           end
         end
@@ -280,48 +299,58 @@ class Otto
           if route_definition.response_type != 'default'
             handle_response(result, res, {
               class: target_class,
-              request: req
-            })
+              request: req,
+            }
+            )
           end
-
-        rescue => e
-          # Error handling - return 500 with proper headers like main Otto error handler
-          error_id = SecureRandom.hex(8)
-          Otto.logger.error "[#{error_id}] #{e.class}: #{e.message}"
-          Otto.logger.debug "[#{error_id}] Backtrace: #{e.backtrace.join("\n")}" if Otto.debug
-
-          res.status = 500
-
-          # Content negotiation for error response
-          accept_header = env['HTTP_ACCEPT'].to_s
-          if accept_header.include?('application/json')
-            res.headers['content-type'] = 'application/json'
-            error_data = if Otto.env?(:dev, :development)
-              {
-                error: 'Internal Server Error',
-                message: 'Server error occurred. Check logs for details.',
-                error_id: error_id,
-              }
-            else
-              {
-                error: 'Internal Server Error',
-                message: 'An error occurred. Please try again later.',
-              }
-            end
-            res.write JSON.generate(error_data)
+        rescue StandardError => ex
+          # Check if we're being called through Otto's integrated context (vs direct handler testing)
+          # In integrated context, let Otto's centralized error handler manage the response
+          # In direct testing context, handle errors locally for unit testing
+          if otto_instance
+            # Log error for handler-specific context but let Otto's centralized error handler manage the response
+            Otto.logger.error "[ClassMethodHandler] #{ex.class}: #{ex.message}"
+            Otto.logger.debug "[ClassMethodHandler] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
+            raise ex  # Re-raise to let Otto's centralized error handler manage the response
           else
-            res.headers['content-type'] = 'text/plain'
-            if Otto.env?(:dev, :development)
-              res.write "Server error (ID: #{error_id}). Check logs for details."
+            # Direct handler testing context - handle errors locally with security improvements
+            error_id = SecureRandom.hex(8)
+            Otto.logger.error "[#{error_id}] #{ex.class}: #{ex.message}"
+            Otto.logger.debug "[#{error_id}] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
+
+            res.status = 500
+
+            # Content negotiation for error response
+            accept_header = env['HTTP_ACCEPT'].to_s
+            if accept_header.include?('application/json')
+              res.headers['content-type'] = 'application/json'
+              error_data                  = if Otto.env?(:dev, :development)
+                {
+                  error: 'Internal Server Error',
+                  message: 'Server error occurred. Check logs for details.',
+                  error_id: error_id,
+                }
+              else
+                {
+                  error: 'Internal Server Error',
+                  message: 'An error occurred. Please try again later.',
+                }
+              end
+              res.write JSON.generate(error_data)
             else
-              res.write "An error occurred. Please try again later."
+              res.headers['content-type'] = 'text/plain'
+              if Otto.env?(:dev, :development)
+                res.write "Server error (ID: #{error_id}). Check logs for details."
+              else
+                res.write 'An error occurred. Please try again later.'
+              end
             end
-          end
 
-          # Add security headers if available
-          if otto_instance&.respond_to?(:security_config) && otto_instance.security_config
-            otto_instance.security_config.security_headers.each do |header, value|
-              res.headers[header] = value
+            # Add security headers if available
+            if otto_instance.respond_to?(:security_config) && otto_instance.security_config
+              otto_instance.security_config.security_headers.each do |header, value|
+                res.headers[header] = value
+              end
             end
           end
         end
@@ -339,7 +368,7 @@ class Otto
         begin
           # Security: Lambda handlers require pre-configured procs from Otto instance
           # This prevents code injection via eval and maintains security
-          handler_name = route_definition.klass_name
+          handler_name    = route_definition.klass_name
           lambda_registry = otto_instance&.config&.dig(:lambda_handlers) || {}
 
           lambda_proc = lambda_registry[handler_name]
@@ -351,25 +380,25 @@ class Otto
 
           handle_response(result, res, {
             lambda: lambda_proc,
-            request: req
-          })
-
-        rescue => e
+            request: req,
+          }
+          )
+        rescue StandardError => ex
           error_id = SecureRandom.hex(8)
-          Otto.logger.error "[#{error_id}] #{e.class}: #{e.message}"
-          Otto.logger.debug "[#{error_id}] Backtrace: #{e.backtrace.join("\n")}" if Otto.debug
+          Otto.logger.error "[#{error_id}] #{ex.class}: #{ex.message}"
+          Otto.logger.debug "[#{error_id}] Backtrace: #{ex.backtrace.join("\n")}" if Otto.debug
 
-          res.status = 500
+          res.status                  = 500
           res.headers['content-type'] = 'text/plain'
 
           if Otto.env?(:dev, :development)
             res.write "Lambda handler error (ID: #{error_id}). Check logs for details."
           else
-            res.write "An error occurred. Please try again later."
+            res.write 'An error occurred. Please try again later.'
           end
 
           # Add security headers if available
-          if otto_instance&.respond_to?(:security_config) && otto_instance.security_config
+          if otto_instance.respond_to?(:security_config) && otto_instance.security_config
             otto_instance.security_config.security_headers.each do |header, value|
               res.headers[header] = value
             end

data/lib/otto/security/config.rb

@@ -25,7 +25,8 @@ class Otto
         :max_request_size, :max_param_depth, :max_param_keys,
         :trusted_proxies, :require_secure_cookies,
         :security_headers, :input_validation,
-        :csp_nonce_enabled, :debug_csp
+        :csp_nonce_enabled, :debug_csp, :mcp_auth,
+        :rate_limiting_config
 
       # Initialize security configuration with safe defaults
       #
@@ -45,6 +46,7 @@ class Otto
         @input_validation       = true
         @csp_nonce_enabled      = false
         @debug_csp              = false
+        @rate_limiting_config   = {}
       end
 
       # Enable CSRF (Cross-Site Request Forgery) protection

data/lib/otto/security/rate_limiting.rb

@@ -0,0 +1,111 @@
+require 'json'
+
+begin
+  require 'rack/attack'
+rescue LoadError
+  # rack-attack is optional - graceful fallback
+end
+
+class Otto
+  module Security
+    class RateLimiting
+      def self.configure_rack_attack!(config = {})
+        return unless defined?(Rack::Attack)
+
+        # Use provided cache store or default
+        if config[:cache_store]
+          Rack::Attack.cache.store = config[:cache_store]
+        end
+
+        # Default rules
+        default_requests_per_minute = config.fetch(:requests_per_minute, 100)
+
+        # General request throttling
+        Rack::Attack.throttle('requests', limit: default_requests_per_minute, period: 60) do |request|
+          request.ip unless request.path.start_with?('/_') # Skip internal paths by default
+        end
+
+        # Apply custom rules if provided
+        if config[:custom_rules]
+          config[:custom_rules].each do |name, rule_config|
+            limit = rule_config[:limit]
+            period = rule_config[:period] || 60
+            condition = rule_config[:condition]
+
+            Rack::Attack.throttle(name.to_s, limit: limit, period: period) do |request|
+              if condition
+                request.ip if condition.call(request)
+              else
+                request.ip
+              end
+            end
+          end
+        end
+
+        # Custom response for rate limited requests
+        Rack::Attack.throttled_responder = lambda do |request|
+          match_data = request.env['rack.attack.match_data']
+          now = match_data[:epoch_time]
+
+          headers = {
+            'content-type' => 'application/json',
+            'retry-after' => (match_data[:period] - (now % match_data[:period])).to_s,
+          }
+
+          # Check if request expects JSON
+          accept_header = request.env['HTTP_ACCEPT'].to_s
+          if accept_header.include?('application/json')
+            error_response = {
+              error: 'Rate limit exceeded',
+              message: 'Too many requests',
+              retry_after: headers['retry-after'].to_i,
+              limit: match_data[:limit],
+              period: match_data[:period],
+            }
+            [429, headers, [JSON.generate(error_response)]]
+          else
+            body = "Rate limit exceeded. Retry after #{headers['retry-after']} seconds."
+            headers['content-type'] = 'text/plain'
+            [429, headers, [body]]
+          end
+        end
+
+        # Log blocked requests if ActiveSupport is available
+        return unless defined?(ActiveSupport::Notifications)
+
+        ActiveSupport::Notifications.subscribe('rack.attack') do |_name, _start, _finish, _request_id, payload|
+          req = payload[:request]
+          Otto.logger.warn "[Otto] Rate limit #{payload[:match_type]} for #{req.ip}: #{payload[:matched]}"
+        end
+      end
+    end
+
+    class RateLimitMiddleware
+      def initialize(app, security_config = nil)
+        @app = app
+        @security_config = security_config
+        @rate_limiter_available = defined?(Rack::Attack)
+
+        if @rate_limiter_available
+          configure_rate_limiting
+        else
+          Otto.logger.warn '[Otto] rack-attack not available - rate limiting disabled'
+        end
+      end
+
+      def call(env)
+        return @app.call(env) unless @rate_limiter_available
+
+        # Let rack-attack handle the rate limiting
+        @app.call(env)
+      end
+
+      private
+
+      def configure_rate_limiting
+        config = @security_config&.rate_limiting_config || {}
+        RateLimiting.configure_rack_attack!(config)
+      end
+    end
+  end
+end