rolemodel-rails 0.26.0 → 1.1.0

data/lib/generators/rolemodel/mcp/templates/app/assets/stylesheets/components/doorkeeper.css

@@ -0,0 +1,140 @@
+.doorkeeper {
+  position: fixed;
+  inset: 0;
+  box-sizing: border-box;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: var(--op-space-x-large) var(--op-space-large);
+  overflow: auto;
+  background-color: var(--op-color-neutral-plus-eight);
+  color: var(--op-color-neutral-minus-max);
+  font-family: var(--op-font-family);
+}
+
+.doorkeeper__card {
+  width: min(100%, 48rem);
+  background-color: var(--op-color-white);
+  border: var(--op-border-width) solid var(--op-color-neutral-plus-six);
+  border-radius: var(--op-radius-x-large);
+  box-shadow: var(--op-shadow-large);
+  display: flex;
+  flex-direction: column;
+  gap: var(--op-space-large);
+  padding: var(--op-space-2x-large);
+}
+
+.doorkeeper__brand {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: var(--op-space-large);
+  margin-bottom: var(--op-space-small);
+}
+
+.doorkeeper__logo {
+  width: 180px;
+  height: auto;
+}
+
+.doorkeeper__title {
+  margin: 0;
+  font-size: var(--op-font-2x-large);
+  font-weight: var(--op-font-weight-bold);
+  color: var(--op-color-primary-minus-two);
+  text-align: center;
+  letter-spacing: -0.04em;
+}
+
+.doorkeeper__prompt {
+  margin: 0;
+  font-size: var(--op-font-large);
+  line-height: var(--op-line-height-loose);
+  color: var(--op-color-neutral-minus-three);
+  text-align: center;
+}
+
+.doorkeeper__client-name {
+  color: var(--op-color-primary-base);
+  font-weight: var(--op-font-weight-bold);
+}
+
+.doorkeeper__permissions {
+  background-color: var(--op-color-primary-plus-eight);
+  border: var(--op-border-width) solid var(--op-color-primary-plus-six);
+  border-radius: var(--op-radius-medium);
+  padding: var(--op-space-large);
+  display: flex;
+  flex-direction: column;
+  gap: var(--op-space-medium);
+}
+
+.doorkeeper__permissions-label {
+  margin: 0;
+  font-size: var(--op-font-small);
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  font-weight: var(--op-font-weight-bold);
+  color: var(--op-color-primary-minus-three);
+}
+
+.doorkeeper__scope-list {
+  margin: 0;
+  padding-left: var(--op-space-large);
+  display: grid;
+  gap: var(--op-space-small);
+  color: var(--op-color-primary-minus-max);
+}
+
+.doorkeeper__scope-item {
+  line-height: var(--op-line-height-base);
+  font-weight: var(--op-font-weight-medium);
+}
+
+.doorkeeper__actions {
+  display: flex;
+  flex-direction: column;
+  gap: var(--op-space-medium);
+  margin-top: var(--op-space-medium);
+}
+
+.doorkeeper__error {
+  align-self: stretch;
+}
+
+.doorkeeper__error-description {
+  margin: 0;
+  font-size: var(--op-font-medium);
+  line-height: var(--op-line-height-base);
+  white-space: pre-wrap;
+  overflow-wrap: anywhere;
+}
+
+.doorkeeper__form {
+  margin: 0;
+}
+
+.doorkeeper__button {
+  width: 100%;
+  justify-content: center;
+  font-weight: var(--op-font-weight-semi-bold);
+}
+
+@media (max-width: 640px) {
+  .doorkeeper {
+    padding: var(--op-space-large) var(--op-space-medium);
+  }
+
+  .doorkeeper__card {
+    padding: var(--op-space-large);
+    border-radius: var(--op-radius-large);
+  }
+
+  .doorkeeper__logo {
+    width: 140px;
+  }
+
+  .doorkeeper__title {
+    font-size: var(--op-font-x-large);
+  }
+}

data/lib/generators/rolemodel/mcp/templates/app/controllers/doorkeeper/base_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  class BaseController < ::ApplicationController
+    skip_forgery_protection
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/controllers/mcp_controller.rb.tt

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+class MCPController < ApplicationController
+  # skip_before_action :authenticate_user!
+  skip_forgery_protection
+
+  before_action :authorize_mcp
+  before_action :set_current_user
+
+  def handle
+    server = build_server
+    transport = MCP::Server::Transports::StreamableHTTPTransport.new(server, stateless: true)
+    server.transport = transport
+
+    status, response_headers, body = transport.handle_request(request)
+    respond_with(status, response_headers, body)
+  end
+
+  private
+
+  def respond_with(status, headers, body)
+    headers.each { |key, value| response.set_header(key, value) }
+    response.status = status
+    self.response_body = body
+  end
+
+  def authorize_mcp
+    doorkeeper_authorize! :mcp
+    set_mcp_resource_metadata_header if response.status == 401
+  end
+
+  def set_current_user
+    @current_user = User.find_by(id: doorkeeper_token&.resource_owner_id)
+    unauthorized_request if @current_user.blank?
+  end
+
+  def unauthorized_request
+    set_mcp_resource_metadata_header
+    render json: { error: 'Unauthorized' }, status: :unauthorized
+  end
+
+  def set_mcp_resource_metadata_header
+    metadata = %(resource_metadata="#{request.base_url}/.well-known/oauth-protected-resource")
+    response.set_header('WWW-Authenticate', %(Bearer realm="<%= application_name.titleize %>", #{metadata}))
+  end
+
+  def build_server
+    server = MCP::Server.new(**mcp_server_config)
+    handle_resources(server)
+
+    server
+  end
+
+  def handle_resources(server) # rubocop:disable Metrics/MethodLength
+    controllers = [
+      Resources::DocsController
+    ]
+
+    server.resources_read_handler do |params|
+      uri = params[:uri].to_s
+      controller = controllers.find { |h| h.serves?(uri) }
+
+      unless controller
+        raise MCP::Server::RequestHandlerError.new(
+          "Unable to serve resource for URI: #{uri}. Supported schemas: #{controllers.map(&:schema).join(', ')}",
+          params,
+          error_type: :invalid_params
+        )
+      end
+
+      controller.call(params, server_context)
+    end
+  end
+
+  def mcp_server_config # rubocop:disable Metrics/MethodLength
+    {
+      name: '<%= application_name.underscore %>_mcp',
+      version: '1.0.0',
+      tools: [Tools::Sample],
+      prompts: [Prompts::Sample],
+      server_context:,
+      resources: [
+        *Resources::DocsController.resource_list,
+      ],
+    }
+  end
+
+  def server_context
+    @server_context ||= { current_user: @current_user }
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/controllers/oauth_registrations_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+class OauthRegistrationsController < ApplicationController
+  # skip_before_action :authenticate_user!
+  skip_forgery_protection
+
+  def create
+    app = Doorkeeper::Application.new(doorkeeper_params)
+    return client_metadata_error('redirect_uris is required') if app.redirect_uri.blank?
+
+    if app.save
+      render json: base_response(app), status: :created
+    else
+      client_metadata_error(app.errors.full_messages.join(', '))
+    end
+  end
+
+  private
+
+  def base_response(app)
+    {
+      client_id: app.uid,
+      client_name: app.name,
+      redirect_uris: app.redirect_uri.split("\n"),
+      grant_types: %w[authorization_code refresh_token],
+      response_types: ['code'],
+      token_endpoint_auth_method: app.confidential? ? 'client_secret_basic' : 'none',
+      client_id_issued_at: app.created_at.to_i,
+      scope: 'mcp',
+      client_secret: app.confidential? ? app.secret : nil,
+    }.compact
+  end
+
+  def client_metadata_error(description)
+    render json: { error: 'invalid_client_metadata', error_description: description }, status: :bad_request
+  end
+
+  def doorkeeper_params
+    {
+      name: params[:client_name].presence || 'MCP Client',
+      redirect_uri: params[:redirect_uris].is_a?(Array) ? params[:redirect_uris].join("\n") : params[:redirect_uris],
+      scopes: 'mcp',
+      confidential: params[:token_endpoint_auth_method] != 'none',
+    }
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/controllers/well_known_controller.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+class WellKnownController < ApplicationController
+  # skip_before_action :authenticate_user!
+  before_action :set_base_url
+
+  def oauth_protected_resource
+    render json: {
+      resource: "#{@base_url}/mcp",
+      authorization_servers: [@base_url],
+    }
+  end
+
+  def oauth_authorization_server
+    render json: authorization_server_metadata
+  end
+
+  private
+
+  def authorization_server_metadata # rubocop:disable Metrics/MethodLength
+    {
+      issuer: @base_url,
+      authorization_endpoint: "#{@base_url}/oauth/authorize",
+      token_endpoint: "#{@base_url}/oauth/token",
+      registration_endpoint: "#{@base_url}/oauth/register",
+      revocation_endpoint: "#{@base_url}/oauth/revoke",
+      introspection_endpoint: "#{@base_url}/oauth/introspect",
+      scopes_supported: ['mcp'],
+      response_types_supported: ['code'],
+      grant_types_supported: %w[authorization_code client_credentials refresh_token],
+      token_endpoint_auth_methods_supported: %w[none client_secret_basic client_secret_post],
+      code_challenge_methods_supported: ['S256'],
+    }
+  end
+
+  def set_base_url
+    @base_url = request.base_url
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/mcp/prompts/sample.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Prompts
+  class Sample < ::MCP::Prompt
+    prompt_name 'sample_prompt'
+    title 'Sample Prompt'
+    description 'Sample prompt description'
+
+    class << self
+      def template(_args, _server_context: nil)
+        ::MCP::Prompt::Result.new(
+          description: 'Sample prompt result description',
+          messages: [
+            ::MCP::Prompt::Message.new(
+              role: 'assistant',
+              content: ::MCP::Content::Text.new(instructions_text),
+            ),
+          ],
+        )
+      end
+
+      private
+
+      def instructions_text
+        <<~TEXT
+          This is a sample prompt.
+
+          MCP prompts can return instructions for the agent, which can be used to guide the agent's behavior.
+          For example, you might include instructions on how to query a specific resource or use a specific tool.
+          Think of it like a system prompt in a conversational agent, but it can be dynamically generated based on the
+          context of the request.
+        TEXT
+      end
+    end
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/mcp/resources/controller.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Resources
+  class Controller
+    include ActiveModel::Attributes
+    include ActiveModel::API
+
+    attribute :server_context
+    attribute :path, :string
+
+    validates :path, presence: { message: 'is required' } # rubocop:disable Rails/I18nLocaleTexts
+
+    class << self
+      def mime_type(mime_type = nil)
+        @mime_type = mime_type if mime_type
+        @mime_type
+      end
+
+      def schema(schema = nil)
+        @schema = schema if schema
+        @schema
+      end
+
+      def serves?(uri)
+        uri.start_with?(schema)
+      end
+
+      def call(params, server_context)
+        controller = new(params[:uri].sub(schema, ''), server_context)
+
+        unless controller.valid?
+          raise ::MCP::Server::RequestHandlerError.new(
+            controller.errors.full_messages.join(', '),
+            params,
+            error_type: :invalid_params
+          )
+        end
+
+        [{ uri: params[:uri], mimeType: mime_type, text: controller.serve }]
+      end
+    end
+
+    def initialize(path, server_context = nil)
+      super()
+      self.path = path
+      self.server_context = server_context
+    end
+
+    private
+
+    def no_extra_path_parts
+      return if @extra.blank?
+
+      errors.add(:base, "Too many uri parts: #{@extra.join('/')}.")
+    end
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/mcp/resources/docs/SAMPLE_DOC.md

@@ -0,0 +1,4 @@
+# Hello World
+
+This is a sample doc that the MCP can return as a resource.
+It's URI will be doc://SAMPLE_DOC.md as set in the handler.

data/lib/generators/rolemodel/mcp/templates/app/mcp/resources/docs_controller.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Resources
+  class DocsController < Controller
+    FILES = {
+      'SAMPLE_DOC.md' => Rails.root.join('app/mcp/resources/docs/blazer-documentation.md'),
+    }.freeze
+
+    mime_type 'text/markdown'
+    schema 'docs://'
+
+    attribute :file_path
+
+    validates :file_path, presence: { message: ->(controller, _) { "Unknown docs resource: #{controller.path}" } }
+    validate :file_exists
+
+    def initialize(path, _server_context = nil)
+      super
+      self.file_path = FILES[path]
+    end
+
+    def self.resource_list
+      [
+        ::MCP::Resource.new(
+          uri: 'docs://SAMPLE_DOC.md',
+          name: 'sample_doc',
+          title: 'Sample Resource',
+          description: 'Sample resource',
+          mime_type: mime_type,
+        ),
+      ]
+    end
+
+    def serve
+      file_path.read
+    end
+
+    private
+
+    def file_exists
+      return if file_path.blank? || file_path.exist?
+
+      errors.add(:file_path, "Missing docs file for #{path}")
+    end
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/mcp/tools/sample.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+module Tools
+  class Sample < ::MCP::Tool
+    tool_name 'sample_tool'
+    title 'Sample Tool'
+    description 'Sample tool description'
+    input_schema(
+      properties: {
+        name: { type: 'string', minLength: 1 },
+      },
+      required: ['name'],
+    )
+    annotations(
+      read_only_hint: true,
+      destructive_hint: false,
+      idempotent_hint: true,
+      open_world_hint: false,
+      title: 'Sample Tool',
+    )
+
+    class << self
+      def call(name:, server_context:)
+        payload = payload_for(name)
+
+        ::MCP::Tool::Response.new(
+          [{ type: 'text', text: payload.to_json }],
+          structured_content: { sample: payload },
+        )
+      end
+
+      private
+
+      def payload_for(name)
+        {
+          time: Time.current.iso8601,
+          user_count: User.count
+        }
+      end
+    end
+  end
+end

data/lib/generators/rolemodel/mcp/templates/app/views/doorkeeper/authorizations/error.html.slim.tt

@@ -0,0 +1,13 @@
+- content_for :page_title do
+  = '<%= application_name.titleize %> - Error Authorizing Application'
+
+main.doorkeeper role="main"
+  .doorkeeper__card.card.card--padded.card--shadow-medium
+    .doorkeeper__brand
+      = image_tag 'logo.svg', alt: '<%= application_name.titleize %>', class: 'doorkeeper__logo'
+      h1.doorkeeper__title= t('doorkeeper.authorizations.error.title')
+
+    .doorkeeper__error.alert.alert--danger role="alert"
+      .alert__messages
+        p.doorkeeper__error-description.alert__description
+          = (local_assigns[:error_response] ? error_response : @pre_auth.error_response).body[:error_description]

data/lib/generators/rolemodel/mcp/templates/app/views/doorkeeper/authorizations/new.html.slim.tt

@@ -0,0 +1,41 @@
+- content_for :page_title do
+  = '<%= application_name.titleize %> - Authorize Application'
+
+main.doorkeeper role="main"
+  .doorkeeper__card.card.card--padded.card--shadow-medium
+    .doorkeeper__brand
+      = image_tag 'logo.svg', alt: '<%= application_name.titleize %>', class: 'doorkeeper__logo'
+      h1.doorkeeper__title= t('.title')
+
+    p.doorkeeper__prompt
+      == t('.prompt', client_name: content_tag(:strong, @pre_auth.client.name, class: 'doorkeeper__client-name'))
+
+    - if @pre_auth.scopes.count > 0
+      #oauth-permissions.doorkeeper__permissions
+        p.doorkeeper__permissions-label= t('.able_to') + ":"
+        ul.doorkeeper__scope-list
+          - @pre_auth.scopes.each do |scope|
+            li.doorkeeper__scope-item= t scope, scope: [:doorkeeper, :scopes]
+
+    .doorkeeper__actions
+      = form_tag oauth_authorization_path, method: :post, class: 'doorkeeper__form', data: { turbo: false } do
+        = hidden_field_tag :client_id, @pre_auth.client.uid, id: nil
+        = hidden_field_tag :redirect_uri, @pre_auth.redirect_uri, id: nil
+        = hidden_field_tag :state, @pre_auth.state, id: nil
+        = hidden_field_tag :response_type, @pre_auth.response_type, id: nil
+        = hidden_field_tag :response_mode, @pre_auth.response_mode, id: nil
+        = hidden_field_tag :scope, @pre_auth.scope, id: nil
+        = hidden_field_tag :code_challenge, @pre_auth.code_challenge, id: nil
+        = hidden_field_tag :code_challenge_method, @pre_auth.code_challenge_method, id: nil
+        = submit_tag t('doorkeeper.authorizations.buttons.authorize'), class: 'btn btn--primary doorkeeper__button'
+
+      = form_tag oauth_authorization_path, method: :delete, class: 'doorkeeper__form' do
+        = hidden_field_tag :client_id, @pre_auth.client.uid, id: nil
+        = hidden_field_tag :redirect_uri, @pre_auth.redirect_uri, id: nil
+        = hidden_field_tag :state, @pre_auth.state, id: nil
+        = hidden_field_tag :response_type, @pre_auth.response_type, id: nil
+        = hidden_field_tag :response_mode, @pre_auth.response_mode, id: nil
+        = hidden_field_tag :scope, @pre_auth.scope, id: nil
+        = hidden_field_tag :code_challenge, @pre_auth.code_challenge, id: nil
+        = hidden_field_tag :code_challenge_method, @pre_auth.code_challenge_method, id: nil
+        = submit_tag t('doorkeeper.authorizations.buttons.deny'), class: 'btn btn--destructive doorkeeper__button'

data/lib/generators/rolemodel/mcp/templates/app/views/layouts/doorkeeper.html.slim

@@ -0,0 +1,7 @@
+doctype html
+html
+  / Use whatever partial you have for the head
+  = render 'head'
+
+  body
+    = yield