postnhost 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 627ae55fdce85eb1586f9dd686b9b637a83443c5b3752bb9b932f563d972cc72
-  data.tar.gz: 29b259e49deacd46af93786df0bb5ee347a91ebc5ec8902d1b56cceb16c0a7d7
+  metadata.gz: eeff5b8e47da4271aa4b1b5240c98fa2e5fcf89ef59ea86f775c41c7fbf3c64e
+  data.tar.gz: 8784beb69048bba221cfbda8306a57eb1366b470996b02b4325bb2dec8feaacc
 SHA512:
-  metadata.gz: e163ba13b11fed2c1840ccedb5d48523f89ea9039f5bf3b2d9fccc3ca02f2c2d82ed1d25133d08b6c5a0856ad3ff1df4b8ef0ba168603d3c9600862317a15ad3
-  data.tar.gz: f85efaf4ef237bb6119101c673ef8f57f1623f79e94fd488637590342b58b2c8c994d8189436f41bb8a7be9e41d068d069cd6e5a683e9f005dc83d6e0f60af03
+  metadata.gz: 8317f464ba035086b326e0537c157f8957ad250080201d32af7e74955e0909e546f59e13bf2dfcbdd648e4476be75a3bbf6dea0fcee4df3ed90a47fb04c718d0
+  data.tar.gz: db9ff2f49ee7727d9e8156288de193e01992eef8f0b1cf06aa59fe9a41339b46bc8d5370d9c1cf72f45edceaeac8953bc8dcfd36b717c8194090b443a199dac1

data/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 All notable changes to PostnHost are documented in this file.
 
+## [0.2.1] - 2026-11-03
+
+### Fixed
+
+- Show all users' articles in the CMS article list and suggestion picker, including articles whose creator has been deleted.
+- Preserve shared article suggestions when the editor displays validation errors.
+
 ## [0.2.0] - 2026-10-24
 
 ### Added
@@ -56,6 +63,7 @@ First open source release of PostnHost.
 
 Authored by Kirill Shevchenko (Ruby/Rails engineering) and Maxim Sova (technical SEO expertise).
 
+[0.2.1]: https://github.com/postnhost/postnhost/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/postnhost/postnhost/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/postnhost/postnhost/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/postnhost/postnhost/releases/tag/v0.1.0

data/README.md

@@ -306,6 +306,22 @@ and publishing workflows.
 Discover commands at `/api/v1/commands`, OpenAPI at `/api/v1/openapi`, and
 connect MCP clients to `/api/v1/mcp`, relative to the engine mount path.
 
+MCP clients can authenticate through OAuth: add the endpoint URL, sign in to the
+CMS in your browser, and approve the connection. OAuth grants full CMS access
+with a single `mcp` scope. Access tokens do not expire; revoke individual
+connections under **API & MCP**. No refresh tokens or copied secrets are needed.
+Existing manually created bearer tokens remain supported.
+
+The engine provides client registration, authorization-code exchange with S256
+PKCE, and discovery metadata. Authorization codes expire after five minutes and
+can only be used once. OAuth access tokens are bound to the MCP endpoint.
+After upgrading, install and run the new engine migration:
+
+```bash
+bin/rails postnhost:install:migrations
+bin/rails db:migrate
+```
+
 ## Routes
 
 The engine mounts at `/blog` by default. You can change this in `config/routes.rb`:

data/app/controllers/postnhost/api/base_controller.rb

@@ -14,13 +14,18 @@ module Postnhost
       def authenticate_token!
         scheme, secret = request.authorization.to_s.split(" ", 2)
         token = ApiToken.authenticate(secret) if scheme&.casecmp?("Bearer")
+        token = nil if token&.resource.present? && token.resource != request.base_url + request.path
         @api_user = token&.user
         return if api_user
 
-        response.set_header("WWW-Authenticate", 'Bearer realm="PostnHost"')
+        response.set_header("WWW-Authenticate", bearer_challenge)
         render json: { errors: ["A valid bearer token is required"] }, status: :unauthorized
       end
 
+      def bearer_challenge
+        'Bearer realm="PostnHost"'
+      end
+
       def prevent_caching
         response.set_header("Cache-Control", "no-store")
       end

data/app/controllers/postnhost/api/v1/mcp_controller.rb

@@ -23,6 +23,10 @@ module Postnhost
 
         private
 
+        def bearer_challenge
+          %(Bearer resource_metadata="#{postnhost.oauth_resource_metadata_url}", scope="mcp")
+        end
+
         def validate_transport!
           origin = request.headers["Origin"]
           if origin.present? && origin != request.base_url

data/app/controllers/postnhost/articles_controller.rb

@@ -11,10 +11,9 @@ module Postnhost
       @status = Postnhost::Article.normalize_status(params[:status])
       @sort = Postnhost::Article.normalize_sort(params[:sort])
 
-      articles = current_user.articles
-                             .includes(:language, :article_snapshot)
-                             .with_status(@status)
-                             .sorted_by(@sort)
+      articles = Postnhost::Article.includes(:language, :article_snapshot)
+                                   .with_status(@status)
+                                   .sorted_by(@sort)
 
       @pagy, @articles = pagy(:offset, articles, limit: PAGE_SIZE)
     end
@@ -30,7 +29,7 @@ module Postnhost
       @categories = Postnhost::Category.all
       @users = Postnhost::User.order(:name, :email)
       @languages = Postnhost::Language.order(default: :desc, name: :asc)
-      @articles = current_user.articles.where.not(id: @article.id).order(:title)
+      @articles = Postnhost::Article.where.not(id: @article.id).order(:title)
     end
 
     def update
@@ -45,7 +44,7 @@ module Postnhost
         @categories = Postnhost::Category.all
         @users = Postnhost::User.order(:name, :email)
         @languages = Postnhost::Language.order(default: :desc, name: :asc)
-        @articles = current_user.articles.where.not(id: @article.id).order(:title)
+        @articles = Postnhost::Article.where.not(id: @article.id).order(:title)
         render :edit, status: :unprocessable_content
       end
     end

data/app/controllers/postnhost/oauth/authorizations_controller.rb

@@ -0,0 +1,50 @@
+module Postnhost
+  module Oauth
+    class AuthorizationsController < ApplicationController
+      protect_from_forgery with: :exception
+      before_action :prevent_caching
+      before_action :validate_request!
+      before_action :require_oauth_user!
+      layout "postnhost/product"
+
+      def new; end
+
+      def create
+        result = if params[:decision] == "approve"
+                   { code: OauthGrant.issue!(oauth_client: @client, user: current_user,
+                                             **@oauth_request.slice(:redirect_uri, :resource, :code_challenge).symbolize_keys) }
+                 else
+                   { error: "access_denied" }
+                 end
+        uri = URI.parse(@oauth_request[:redirect_uri])
+        uri.query = [uri.query.presence, { **result, state: @oauth_request[:state] }.to_query].compact.join("&")
+        redirect_to uri.to_s, allow_other_host: true
+      end
+
+      private
+
+      def prevent_caching
+        response.set_header("Cache-Control", "no-store")
+        response.set_header("Referrer-Policy", "no-referrer")
+      end
+
+      def validate_request!
+        @oauth_request = params.permit(:client_id, :redirect_uri, :response_type, :scope, :state,
+                                       :code_challenge, :code_challenge_method, :resource).to_h.with_indifferent_access
+        @client = OauthClient.find_by(client_id: @oauth_request[:client_id])
+        valid = @client&.redirect_uris&.include?(@oauth_request[:redirect_uri]) &&
+                @oauth_request[:response_type] == "code" && @oauth_request[:code_challenge_method] == "S256" &&
+                @oauth_request[:code_challenge].to_s.match?(/\A[A-Za-z0-9_-]{43}\z/) &&
+                @oauth_request[:scope].to_s.in?(["", "mcp"]) && @oauth_request[:resource] == postnhost.api_v1_mcp_url
+        render plain: "Invalid OAuth authorization request", status: :bad_request unless valid
+      end
+
+      def require_oauth_user!
+        return if user_signed_in?
+
+        session[:oauth_return_to] = postnhost.oauth_authorize_path(@oauth_request)
+        authenticate_user!
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/metadata_controller.rb

@@ -0,0 +1,25 @@
+module Postnhost
+  module Oauth
+    class MetadataController < PublicController
+      def resource
+        render json: {
+          resource: postnhost.api_v1_mcp_url,
+          authorization_servers: [request.base_url + request.script_name],
+          scopes_supported: ["mcp"], bearer_methods_supported: ["header"]
+        }
+      end
+
+      def server
+        render json: {
+          issuer: request.base_url + request.script_name,
+          authorization_endpoint: postnhost.oauth_authorize_url,
+          token_endpoint: postnhost.oauth_token_url,
+          registration_endpoint: postnhost.oauth_register_url,
+          response_types_supported: ["code"], grant_types_supported: ["authorization_code"],
+          token_endpoint_auth_methods_supported: ["none"],
+          code_challenge_methods_supported: ["S256"], scopes_supported: ["mcp"]
+        }
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/public_controller.rb

@@ -0,0 +1,16 @@
+module Postnhost
+  module Oauth
+    # OAuth protocol endpoints do not use CMS sessions for authentication.
+    # rubocop:disable-next Rails/ApplicationController
+    class PublicController < ActionController::Base
+      skip_forgery_protection
+      before_action :prevent_caching
+
+      private
+
+      def prevent_caching
+        response.set_header("Cache-Control", "no-store")
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/registrations_controller.rb

@@ -0,0 +1,29 @@
+module Postnhost
+  module Oauth
+    class RegistrationsController < PublicController
+      def create
+        unless params[:token_endpoint_auth_method].to_s.in?(["", "none"]) &&
+               supported_grants? &&
+               (params[:response_types].nil? || params[:response_types] == ["code"])
+          render json: { error: "invalid_client_metadata" }, status: :bad_request
+          return
+        end
+
+        client = OauthClient.create!(name: params[:client_name].presence || "MCP client", redirect_uris: params[:redirect_uris])
+        render json: {
+          client_id: client.client_id, client_name: client.name, redirect_uris: client.redirect_uris,
+          token_endpoint_auth_method: "none", grant_types: ["authorization_code"], response_types: ["code"]
+        }, status: :created
+      rescue ActiveRecord::RecordInvalid
+        render json: { error: "invalid_client_metadata" }, status: :bad_request
+      end
+
+      private
+
+      def supported_grants?
+        grants = params[:grant_types] || ["authorization_code"]
+        grants.is_a?(Array) && grants.include?("authorization_code") && (grants - %w[authorization_code refresh_token]).empty?
+      end
+    end
+  end
+end

data/app/controllers/postnhost/oauth/tokens_controller.rb

@@ -0,0 +1,19 @@
+module Postnhost
+  module Oauth
+    class TokensController < PublicController
+      def create
+        unless params[:grant_type] == "authorization_code"
+          render json: { error: "unsupported_grant_type" }, status: :bad_request
+          return
+        end
+
+        secret = OauthGrant.exchange(**%i[code client_id redirect_uri resource code_verifier].index_with { |key| params[key].to_s })
+        if secret
+          render json: { access_token: secret, token_type: "Bearer", scope: "mcp" }
+        else
+          render json: { error: "invalid_grant" }, status: :bad_request
+        end
+      end
+    end
+  end
+end

data/app/controllers/postnhost/sessions_controller.rb

@@ -9,8 +9,9 @@ module Postnhost
       user = Postnhost::User.find_by(email: session_params[:email].to_s.downcase.strip)
 
       if user&.authenticate(session_params[:password].to_s)
+        oauth_return_to = session[:oauth_return_to]
         sign_in(user)
-        redirect_to articles_path
+        redirect_to oauth_return_to || articles_path
       else
         flash.now[:alert] = "Invalid email or password."
         render :new, status: :unprocessable_content

data/app/models/postnhost/api_token.rb

@@ -7,9 +7,9 @@ module Postnhost
     validates :name, :token_digest, presence: true
     validates :token_digest, uniqueness: true
 
-    def self.issue!(user:, name:)
+    def self.issue!(user:, name:, resource: nil)
       secret = "pnh_#{SecureRandom.urlsafe_base64(32)}"
-      token = create!(user:, name:, token_digest: Digest::SHA256.hexdigest(secret))
+      token = create!(user:, name:, resource:, token_digest: Digest::SHA256.hexdigest(secret))
       [token, secret]
     end
 

data/app/models/postnhost/oauth_client.rb

@@ -0,0 +1,29 @@
+require "uri"
+
+module Postnhost
+  class OauthClient < ApplicationRecord
+    has_many :oauth_grants, class_name: "Postnhost::OauthGrant", dependent: :destroy
+    has_secure_token :client_id, length: 32
+
+    validates :name, presence: true, length: { maximum: 100 }
+    validate :safe_redirect_uris
+
+    private
+
+    def safe_redirect_uris
+      return if redirect_uris.is_a?(Array) && redirect_uris.size.between?(1, 10) && redirect_uris.all? { |value| safe_redirect_uri?(value) }
+
+      errors.add(:redirect_uris, "must contain HTTPS URLs or HTTP loopback URLs")
+    end
+
+    def safe_redirect_uri?(value)
+      return false unless value.is_a?(String) && value.length <= 2048
+
+      uri = URI.parse(value)
+      uri.host.present? && uri.userinfo.nil? && uri.fragment.nil? &&
+        (uri.scheme == "https" || (uri.scheme == "http" && %w[localhost 127.0.0.1 [::1]].include?(uri.host)))
+    rescue URI::InvalidURIError
+      false
+    end
+  end
+end

data/app/models/postnhost/oauth_grant.rb

@@ -0,0 +1,32 @@
+require "base64"
+require "digest"
+
+module Postnhost
+  class OauthGrant < ApplicationRecord
+    belongs_to :oauth_client, class_name: "Postnhost::OauthClient"
+    belongs_to :user, class_name: "Postnhost::User"
+
+    def self.issue!(**attributes)
+      code = SecureRandom.urlsafe_base64(32)
+      create!(**attributes, code_digest: Digest::SHA256.hexdigest(code), expires_at: 5.minutes.from_now)
+      code
+    end
+
+    def self.exchange(code:, client_id:, redirect_uri:, resource:, code_verifier:)
+      return unless code_verifier.match?(/\A[A-Za-z0-9._~-]{43,128}\z/)
+
+      transaction do
+        grant = lock.find_by(code_digest: Digest::SHA256.hexdigest(code))
+        return unless grant&.expires_at&.future? && grant.oauth_client.client_id == client_id &&
+                      grant.redirect_uri == redirect_uri && grant.resource == resource
+
+        challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+        return unless ActiveSupport::SecurityUtils.secure_compare(grant.code_challenge, challenge)
+
+        token = ApiToken.issue!(user: grant.user, name: grant.oauth_client.name, resource: grant.resource)
+        grant.destroy!
+        token.last
+      end
+    end
+  end
+end

data/app/models/postnhost/user.rb

@@ -6,6 +6,7 @@ module Postnhost
     self.table_name = "postnhost_users"
 
     has_many :api_tokens, class_name: "Postnhost::ApiToken", dependent: :destroy
+    has_many :oauth_grants, class_name: "Postnhost::OauthGrant", dependent: :destroy
 
     has_secure_password
 

data/app/views/postnhost/api_tokens/index.html.erb

@@ -35,7 +35,7 @@
     <section class="<%= form_card_classes %>" aria-labelledby="connection-title">
       <div>
         <h2 id="connection-title" class="text-lg font-medium text-gray-900">Connection details</h2>
-        <p class="mt-2 text-sm text-gray-500">Use your token to authenticate either connection.</p>
+        <p class="mt-2 text-sm text-gray-500">Connect an MCP client by signing in through your browser, or use a token for the management API.</p>
       </div>
       <dl class="space-y-5">
         <div>
@@ -45,7 +45,7 @@
         <div>
           <dt class="text-sm font-medium text-gray-700">MCP · v1</dt>
           <dd class="mt-2 rounded-xl bg-gray-50 p-3 text-xs text-gray-900 break-all"><code><%= api_v1_mcp_url %></code></dd>
-          <dd class="mt-2 text-xs text-gray-500">Connect using Streamable HTTP.</dd>
+          <dd class="mt-2 text-xs text-gray-500">Connect using Streamable HTTP and OAuth. Access remains active until revoked.</dd>
         </div>
         <div>
           <dt class="text-sm font-medium text-gray-700">Authorization header</dt>

data/app/views/postnhost/oauth/authorizations/new.html.erb

@@ -0,0 +1,18 @@
+<% content_for :title, "Connect MCP" %>
+
+<section class="max-w-xl space-y-6" aria-labelledby="oauth-title">
+  <h1 id="oauth-title" class="text-xl font-medium text-gray-900">Connect <%= @client.name %>?</h1>
+  <p class="text-gray-700">This application will be able to read and manage your CMS content and settings, including publishing and deleting content.</p>
+  <p class="text-sm text-gray-500">Access remains active until you revoke it in API &amp; MCP.</p>
+  <dl class="space-y-2">
+    <dt class="text-sm font-medium text-gray-700">Application callback</dt>
+    <dd class="text-sm text-gray-700 break-all"><%= @oauth_request[:redirect_uri] %></dd>
+  </dl>
+  <%= form_with url: oauth_authorize_path, data: { turbo: false }, class: "flex gap-3" do |form| %>
+    <% @oauth_request.each do |key, value| %>
+      <%= hidden_field_tag key, value %>
+    <% end %>
+    <%= form.button "Connect", name: "decision", value: "approve", class: button_classes %>
+    <%= form.button "Cancel", name: "decision", value: "deny", class: button_classes(variant: :secondary) %>
+  <% end %>
+</section>

data/config/routes.rb

@@ -33,6 +33,15 @@ Postnhost::Engine.routes.draw do
   end
 
   # Admin routes
+  namespace :oauth do
+    get "resource_metadata", to: "metadata#resource"
+    get "server_metadata", to: "metadata#server"
+    get "authorize", to: "authorizations#new"
+    post "authorize", to: "authorizations#create"
+    post "register", to: "registrations#create"
+    post "token", to: "tokens#create"
+  end
+
   resources :api_tokens, only: %i[index create destroy]
   resource :onboarding, only: %i[show update], controller: "onboarding"
   resource :session, only: %i[new create destroy], controller: "sessions"

data/db/migrate/20261025120000_add_mcp_oauth.rb

@@ -0,0 +1,23 @@
+class AddMcpOauth < ActiveRecord::Migration[7.2]
+  def change
+    create_table :postnhost_oauth_clients do |t|
+      t.string :client_id, null: false
+      t.string :name, null: false
+      t.json :redirect_uris, null: false
+      t.timestamps
+    end
+    add_index :postnhost_oauth_clients, :client_id, unique: true
+
+    create_table :postnhost_oauth_grants do |t|
+      t.references :oauth_client, null: false, foreign_key: { to_table: :postnhost_oauth_clients }
+      t.references :user, null: false, foreign_key: { to_table: :postnhost_users }
+      t.string :code_digest, null: false
+      t.string :code_challenge, null: false
+      t.string :redirect_uri, null: false
+      t.string :resource, null: false
+      t.datetime :expires_at, null: false
+    end
+    add_index :postnhost_oauth_grants, :code_digest, unique: true
+    add_column :postnhost_api_tokens, :resource, :string
+  end
+end

data/lib/postnhost/engine.rb

@@ -1,7 +1,14 @@
+require_relative "oauth_discovery"
+
 module Postnhost
   class Engine < ::Rails::Engine
     isolate_namespace Postnhost
 
+    initializer "postnhost.oauth" do |app|
+      app.middleware.use Postnhost::OauthDiscovery
+      app.config.filter_parameters += %i[code code_verifier access_token]
+    end
+
     # Initialize configuration before other initializers
     initializer "postnhost.configuration", before: :load_config_initializers do
       Postnhost.configure

data/lib/postnhost/oauth_discovery.rb

@@ -0,0 +1,22 @@
+module Postnhost
+  # Well-known discovery lives at the origin even when the engine is mounted at /blog.
+  class OauthDiscovery
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      path = env["PATH_INFO"]
+      if env["REQUEST_METHOD"] == "GET" && path.match?(%r{\A/\.well-known/oauth-authorization-server(?:/.*)?\z})
+        status, headers, body = @app.call(env)
+        return [status, headers, body] unless status == 404
+
+        body.close if body.respond_to?(:close)
+        mount = path.delete_prefix("/.well-known/oauth-authorization-server")
+        return @app.call(env.merge("PATH_INFO" => "#{mount}/oauth/server_metadata"))
+      end
+
+      @app.call(env)
+    end
+  end
+end

data/lib/postnhost/version.rb

@@ -1,3 +1,3 @@
 module Postnhost
-  VERSION = "0.2.0"
+  VERSION = "0.2.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: postnhost
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Kirill Shevchenko
@@ -338,6 +338,11 @@ files:
 - app/controllers/postnhost/category_variants_controller.rb
 - app/controllers/postnhost/languages_controller.rb
 - app/controllers/postnhost/management_preview_controller.rb
+- app/controllers/postnhost/oauth/authorizations_controller.rb
+- app/controllers/postnhost/oauth/metadata_controller.rb
+- app/controllers/postnhost/oauth/public_controller.rb
+- app/controllers/postnhost/oauth/registrations_controller.rb
+- app/controllers/postnhost/oauth/tokens_controller.rb
 - app/controllers/postnhost/onboarding_controller.rb
 - app/controllers/postnhost/page_variants_controller.rb
 - app/controllers/postnhost/pages/images_controller.rb
@@ -416,6 +421,8 @@ files:
 - app/models/postnhost/language.rb
 - app/models/postnhost/navigation.rb
 - app/models/postnhost/navigation_item.rb
+- app/models/postnhost/oauth_client.rb
+- app/models/postnhost/oauth_grant.rb
 - app/models/postnhost/page.rb
 - app/models/postnhost/page_variant.rb
 - app/models/postnhost/public_site_revision.rb
@@ -537,6 +544,7 @@ files:
 - app/views/postnhost/languages/index.html.erb
 - app/views/postnhost/languages/new.html.erb
 - app/views/postnhost/languages/show.html.erb
+- app/views/postnhost/oauth/authorizations/new.html.erb
 - app/views/postnhost/onboarding/_post_install_checklist.html.erb
 - app/views/postnhost/onboarding/_step_1.html.erb
 - app/views/postnhost/onboarding/_step_2.html.erb
@@ -690,6 +698,7 @@ files:
 - db/migrate/20260709090000_create_snapshots.rb
 - db/migrate/20260726130000_create_site_scripts.rb
 - db/migrate/20261008120000_create_api_tokens.rb
+- db/migrate/20261025120000_add_mcp_oauth.rb
 - lib/generators/postnhost/install/install_generator.rb
 - lib/generators/postnhost/install/templates/carrierwave.rb
 - lib/generators/postnhost/install/templates/postnhost.rb
@@ -704,6 +713,7 @@ files:
 - lib/postnhost/css_build.rb
 - lib/postnhost/css_scope.rb
 - lib/postnhost/engine.rb
+- lib/postnhost/oauth_discovery.rb
 - lib/postnhost/sample_data.rb
 - lib/postnhost/settings/i18n_overrides.rb
 - lib/postnhost/settings/i18n_patch.rb