solidus_mcp 0.2.0.rc1

data/app/assets/stylesheets/solidus_mcp/admin.css

@@ -0,0 +1,284 @@
+.solidus-mcp-admin {
+  box-sizing: border-box;
+  min-width: 0;
+  padding: 1.5rem;
+  color: #222222;
+  line-height: 1.5;
+}
+
+.solidus-mcp-admin p {
+  margin: 0.75rem 0;
+}
+
+.solidus-mcp-admin h1,
+.solidus-mcp-admin h2 {
+  font-weight: 600;
+  line-height: 1.3;
+}
+
+.solidus-mcp-admin .solidus-mcp-page-title {
+  margin: 0 0 0.5rem;
+  font-size: 1.5rem;
+}
+
+.solidus-mcp-admin .solidus-mcp-connection-title {
+  margin: 1rem 0 0.5rem;
+  font-size: 1.25rem;
+}
+
+.solidus-mcp-admin h2 {
+  margin: 0 0 0.75rem;
+  font-size: 1.125rem;
+}
+
+.solidus-mcp-admin .solidus-mcp-intro {
+  margin-bottom: 1.5rem;
+}
+
+.solidus-mcp-admin a {
+  color: inherit;
+  text-decoration: underline;
+  text-underline-offset: 0.15em;
+}
+
+.solidus-mcp-admin .solidus-mcp-connection-toggle {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 1.5rem;
+  cursor: pointer;
+}
+
+.solidus-mcp-admin input[type="checkbox"] {
+  width: 1rem;
+  height: 1rem;
+  margin: 0;
+  flex-shrink: 0;
+  accent-color: #222222;
+}
+
+.solidus-mcp-admin .solidus-mcp-section,
+.solidus-mcp-admin .solidus-mcp-audit-heading {
+  margin-top: 2rem;
+}
+
+.solidus-mcp-admin .solidus-mcp-audit-entry {
+  margin-bottom: 0.75rem;
+}
+
+.solidus-mcp-admin summary {
+  cursor: pointer;
+}
+
+.solidus-mcp-admin .solidus-mcp-button {
+  display: inline-block;
+  box-sizing: border-box;
+  padding: 0.5rem 1rem;
+  border: 1px solid #757575;
+  border-radius: 0.25rem;
+  background: #ffffff;
+  color: #222222;
+  font: inherit;
+  line-height: 1.5;
+  cursor: pointer;
+}
+
+.solidus-mcp-admin .solidus-mcp-button-primary {
+  background: #222222;
+  color: #ffffff;
+  border-color: #222222;
+}
+
+.solidus-mcp-admin .solidus-mcp-button:hover {
+  filter: brightness(0.95);
+}
+
+.solidus-mcp-admin :is(a, button, input, summary):focus-visible {
+  outline: 2px solid #2563eb;
+  outline-offset: 3px;
+}
+
+.solidus-mcp-admin .solidus-mcp-pagination {
+  display: flex;
+  gap: 1rem;
+  margin-top: 1rem;
+}
+
+solidus-mcp-permissions {
+  display: block;
+  min-width: 0;
+  margin: 1.5rem 0;
+}
+
+.solidus-mcp-permissions-heading,
+.solidus-mcp-permissions-group-heading {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  flex-wrap: wrap;
+  gap: 0.75rem 1rem;
+}
+
+.solidus-mcp-permissions-heading {
+  margin-bottom: 1rem;
+}
+
+.solidus-mcp-permissions-heading h2 {
+  font-size: 1.125rem;
+  font-weight: 600;
+  margin: 0;
+}
+
+.solidus-mcp-table-scroll,
+.solidus-mcp-permissions-scroll {
+  overflow-x: auto;
+  border: 1px solid #d8dad8;
+  border-radius: 0.5rem;
+}
+
+.solidus-mcp-admin .solidus-mcp-table {
+  width: 100%;
+  min-width: 48rem;
+  border-collapse: collapse;
+  text-align: left;
+}
+
+.solidus-mcp-admin .solidus-mcp-table th,
+.solidus-mcp-admin .solidus-mcp-table td {
+  padding: 0.875rem 1rem;
+  border-bottom: 1px solid #d8dad8;
+  vertical-align: top;
+}
+
+.solidus-mcp-admin .solidus-mcp-table thead {
+  background: #f5f3f0;
+  font-size: 0.875rem;
+}
+
+.solidus-mcp-admin .solidus-mcp-table th {
+  font-weight: 600;
+  text-align: inherit;
+}
+
+.solidus-mcp-permissions-category {
+  background: #f5f3f0;
+}
+
+.solidus-mcp-admin .solidus-mcp-table tbody:last-child tr:last-child > * {
+  border-bottom: 0;
+}
+
+solidus-mcp-permissions th[scope="row"] {
+  min-width: 12rem;
+  font-weight: 600;
+}
+
+solidus-mcp-permissions td:nth-child(3) {
+  white-space: nowrap;
+}
+
+solidus-mcp-permissions label {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.5rem;
+  cursor: pointer;
+}
+
+solidus-mcp-permissions [data-selection-control] {
+  align-items: center;
+  font-size: 0.875rem;
+  font-weight: 400;
+}
+
+solidus-mcp-permissions [hidden] {
+  display: none;
+}
+
+
+.solidus-mcp-admin input[type="checkbox"]:disabled {
+  cursor: default;
+  opacity: 0.65;
+}
+
+.solidus-mcp-admin .solidus-mcp-role-form {
+  display: flex;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 0.75rem;
+}
+
+solidus-mcp-account-search {
+  display: block;
+  width: 28rem;
+  max-width: 100%;
+}
+
+solidus-mcp-account-search label {
+  display: block;
+  margin-bottom: 0.25rem;
+  font-weight: 600;
+}
+
+.solidus-mcp-account-field {
+  position: relative;
+}
+
+solidus-mcp-account-search input[type="search"] {
+  box-sizing: border-box;
+  width: 100%;
+  padding: 0.625rem 0.75rem;
+  border: 1px solid #757575;
+  border-radius: 0.25rem;
+  background: #ffffff;
+  color: #222222;
+  font: inherit;
+}
+
+solidus-mcp-account-search [role="listbox"] {
+  box-sizing: border-box;
+  position: absolute;
+  top: 100%;
+  left: 0;
+  right: 0;
+  z-index: 30;
+  max-height: 16rem;
+  overflow-y: auto;
+  margin: 0.25rem 0 0;
+  padding: 0.25rem;
+  border: 1px solid #757575;
+  border-radius: 0.25rem;
+  background: #ffffff;
+  color: #222222;
+  list-style: none;
+  box-shadow: 0 0.5rem 1rem rgba(0, 0, 0, 0.12);
+}
+
+solidus-mcp-account-search [role="option"] {
+  padding: 0.5rem;
+  border-radius: 0.125rem;
+  overflow-wrap: anywhere;
+  cursor: pointer;
+}
+
+solidus-mcp-account-search [role="option"]:hover,
+solidus-mcp-account-search [aria-selected="true"] {
+  background: #f5f3f0;
+}
+
+solidus-mcp-account-search small {
+  display: block;
+}
+
+.solidus-mcp-admin solidus-mcp-account-search [role="status"] {
+  margin: 0.375rem 0 0;
+  font-size: 0.875rem;
+}
+
+solidus-mcp-account-search [hidden] {
+  display: none;
+}
+
+.solidus-mcp-admin .solidus-mcp-button:disabled {
+  cursor: default;
+  opacity: 0.5;
+}

data/app/controllers/concerns/solidus_mcp/http_access.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module HttpAccess
+    extend ActiveSupport::Concern
+
+    included do
+      before_action :prepare_mcp_request
+    end
+
+    def preflight
+      response.set_header("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS")
+      response.set_header("Access-Control-Allow-Headers", "Content-Type, Authorization, MCP-Protocol-Version, MCP-Session-Id")
+      head :no_content
+    end
+
+    private
+
+    def prepare_mcp_request
+      config = SolidusMcp.configuration
+      return head :not_found unless config.enabled?
+      config.validate!
+      response.set_header("Cache-Control", "no-store")
+      response.set_header("Vary", "Origin")
+      origin = request.headers["Origin"]
+      if origin.present?
+        return head :forbidden unless config.allowed_origins.include?(origin)
+        response.set_header("Access-Control-Allow-Origin", origin)
+        response.set_header("Access-Control-Expose-Headers", "WWW-Authenticate, MCP-Session-Id")
+      end
+    end
+  end
+end

data/app/controllers/solidus_admin/mcp_administrators_controller.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+module SolidusAdmin
+  class McpAdministratorsController < BaseController
+    before_action :require_superadministrator
+
+    rescue_from SolidusMcp::AccessDenied do
+      head :forbidden
+    end
+
+    def index
+      @superadmins = Spree.user_class.where(id: SolidusMcp::Administration.superadmin_user_ids)
+      @page = [params[:page].to_i, 1].max
+      entries = SolidusMcp::Administrator.order(:id).offset((@page - 1) * 25).limit(26).to_a
+      @more = entries.size > 25
+      @administrators = entries.first(25)
+      @users = Spree.user_class.where(id: @administrators.map(&:user_id)).index_by(&:id)
+      @changes = SolidusMcp::AdministratorChange.includes(:administrator).order(id: :desc).limit(20).to_a
+      audit_ids = @changes.flat_map { |change| [change.actor_id, change.administrator.user_id] }
+      @audit_users = Spree.user_class.where(id: audit_ids).index_by(&:id)
+    end
+
+    def search
+      response.set_header("Cache-Control", "no-store")
+      query = params.fetch(:query, "")
+      unless query.is_a?(String) && query.length <= 100
+        raise ActionController::BadRequest, "Invalid account search"
+      end
+      accounts = administrator_accounts
+        .where("LOWER(email) LIKE ?", "#{Spree.user_class.sanitize_sql_like(query.strip.downcase)}%")
+        .where.not(id: SolidusMcp::Administration.superadmin_user_ids)
+        .where.not(id: SolidusMcp::Administrator.where(enabled: true).select(:user_id))
+        .order(:email, :id).limit(21).to_a.select(&:admin?)
+      more = accounts.length > 20
+      accounts = accounts.first(20)
+      assignments = SolidusMcp::Administrator.where(user_id: accounts.map(&:id)).index_by(&:user_id)
+      render json: {items: accounts.map { |user|
+        {id: user.id.to_s, email: user.email, lock_version: assignments[user.id]&.lock_version || -1}
+      }, more: more}
+    end
+
+    def create
+      submitted = params.require(:administrator).permit(:user_id, :lock_version)
+      version = submitted.fetch(:lock_version, "-1").to_s
+      raise ActionController::BadRequest, "Invalid assignment version" unless version.match?(/\A(?:-1|[0-9]+)\z/)
+      user = Spree.user_class.find(submitted.fetch(:user_id))
+      assignment = SolidusMcp::Administrator.find_or_initialize_by(user: user)
+      assignment.change!(actor: current_solidus_admin_user, enabled: true, lock_version: version.to_i)
+      redirect_to solidus_admin.mcp_administrators_path, notice: "MCP administrator assigned.", status: :see_other
+    rescue ActiveRecord::StaleObjectError, ActiveRecord::RecordNotUnique
+      redirect_to solidus_admin.mcp_administrators_path, alert: "This user already has an assignment. Use its current controls below.", status: :see_other
+    rescue ActiveRecord::RecordInvalid => error
+      redirect_to solidus_admin.mcp_administrators_path, alert: error.record.errors.full_messages.to_sentence, status: :see_other
+    end
+
+    def update
+      submitted = params.require(:administrator).permit(:enabled, :lock_version)
+      version = submitted[:lock_version]
+      unless version.is_a?(String) && version.match?(/\A[0-9]+\z/) && %w[0 1].include?(submitted[:enabled])
+        raise ActionController::BadRequest, "Invalid administrator assignment"
+      end
+      assignment = SolidusMcp::Administrator.find(params[:id])
+      assignment.change!(actor: current_solidus_admin_user, enabled: submitted[:enabled] == "1", lock_version: version.to_i)
+      redirect_to solidus_admin.mcp_administrators_path, notice: "MCP administrator assignment updated.", status: :see_other
+    rescue ActiveRecord::StaleObjectError
+      redirect_to solidus_admin.mcp_administrators_path, alert: "Another superadministrator changed this assignment. Reload before trying again.", status: :see_other
+    rescue ActiveRecord::RecordInvalid => error
+      redirect_to solidus_admin.mcp_administrators_path, alert: error.record.errors.full_messages.to_sentence, status: :see_other
+    end
+
+    private
+
+    def administrator_accounts
+      users = Spree.user_class
+      if users.reflect_on_association(:spree_roles)
+        users.joins(:spree_roles).merge(Spree::Role.where(name: "admin")).distinct
+      else
+        # Custom user models may expose admin status as a boolean column.
+        users.where(admin: true)
+      end
+    end
+
+    def authorization_subject
+      :mcp_administrators
+    end
+
+    def require_superadministrator
+      head :forbidden unless SolidusMcp::Administration.superadmin?(current_solidus_admin_user)
+    end
+  end
+end

data/app/controllers/solidus_admin/mcp_connections_controller.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module SolidusAdmin
+  class McpConnectionsController < BaseController
+    before_action :require_mcp_user
+    helper_method :mcp_administrator?, :mcp_superadministrator?, :manage_connection_permissions?, :can_manage_connection?
+
+    rescue_from SolidusMcp::AccessDenied do
+      head :forbidden
+    end
+    before_action :load_connection, only: [:edit, :update, :destroy]
+    before_action :require_permission_manager, only: [:update, :destroy]
+
+    def index
+      @show_deleted = params[:deleted] == "1"
+      @page = [params[:page].to_i, 1].max
+      connections = Doorkeeper::AccessToken.where(resource: SolidusMcp.configuration.endpoint_url).where.not(application_id: nil).where.not(resource_owner_id: nil)
+      connections = SolidusMcp::Administration.visible_connections(connections, current_solidus_admin_user)
+      @connections = connections.where("#{@show_deleted ? "" : "NOT "}EXISTS (SELECT 1 FROM solidus_mcp_connection_policies p WHERE p.application_id = oauth_access_tokens.application_id AND p.user_id = oauth_access_tokens.resource_owner_id AND p.deleted_at IS NOT NULL)")
+        .select(:application_id, :resource_owner_id).distinct.order(:application_id, :resource_owner_id)
+        .offset((@page - 1) * 25).limit(26).to_a
+      @more = @connections.size > 25
+      @connections = @connections.first(25)
+      @applications = Doorkeeper::Application.where(id: @connections.map(&:application_id)).index_by(&:id)
+      @users = Spree.user_class.where(id: @connections.map(&:resource_owner_id)).index_by(&:id)
+      @active_connections = Doorkeeper::AccessToken.where(resource: SolidusMcp.configuration.endpoint_url,
+        application_id: @applications.keys, resource_owner_id: @users.keys, revoked_at: nil)
+        .where("expires_in IS NULL OR created_at + expires_in * interval '1 second' > ?", Time.current)
+        .distinct.pluck(:application_id, :resource_owner_id)
+      @policies = SolidusMcp::ConnectionPolicy.where(application_id: @applications.keys, user_id: @users.keys)
+        .index_by { |policy| [policy.application_id, policy.user_id] }
+    end
+
+    def edit
+      # GET forms in the admin navigation replace query parameters on submission.
+      # Keep the connection owner in the path before rendering those forms.
+      if !request.path_parameters.key?(:user_id) || request.path_parameters[:legacy_owner_path]
+        redirect_to solidus_admin.edit_mcp_connection_path(@application, user_id: @user.id), status: :see_other
+      end
+    end
+
+    def update
+      submitted = params.require(:connection_policy).permit(:enabled, :lock_version, permissions: [])
+      version = submitted[:lock_version]
+      raise ActionController::BadRequest, "Missing policy version" unless version.is_a?(String) && version.match?(/\A(?:-1|[0-9]+)\z/)
+      raise ActionController::BadRequest, "Invalid connection status" unless %w[0 1].include?(submitted[:enabled])
+
+      @policy.change!(actor: current_solidus_admin_user,
+        permissions: submitted.fetch(:permissions, []).reject(&:blank?),
+        enabled: submitted[:enabled] == "1", lock_version: version.to_i)
+      needs_reconnect = @registry.tools.values.any? do |tool|
+        (tool.permissions - @policy.permissions).empty? && @scope_status.warning(tool)
+      end
+      notice = if @policy.enabled? && needs_reconnect
+        "Connection permissions saved. OAuth access is still missing for some tools; follow the reconnect instructions below."
+      else
+        "Connection permissions saved. They apply to the next request, within the token's OAuth scopes."
+      end
+      redirect_to solidus_admin.edit_mcp_connection_path(@application, user_id: @user.id), notice: notice, status: :see_other
+    rescue ActiveRecord::StaleObjectError, ActiveRecord::RecordNotUnique
+      @policy.reload if @policy.persisted?
+      flash.now[:error] = "Another administrator changed this connection. Reload the page before saving again."
+      render :edit, status: :conflict
+    rescue ActiveRecord::RecordInvalid => e
+      flash.now[:error] = e.record.errors.full_messages.to_sentence
+      render :edit, status: :unprocessable_entity
+    end
+
+    def destroy
+      version = params.require(:connection_policy).permit(:lock_version)[:lock_version]
+      raise ActionController::BadRequest, "Missing policy version" unless version.is_a?(String) && version.match?(/\A(?:-1|[0-9]+)\z/)
+      @policy.delete_permissions!(actor: current_solidus_admin_user, lock_version: version.to_i)
+      redirect_to solidus_admin.mcp_connections_path,
+        notice: "Permission set deleted. Access is disabled; its audit history is retained under Deleted permission sets.", status: :see_other
+    rescue ActiveRecord::StaleObjectError, ActiveRecord::RecordNotUnique
+      @policy.reload if @policy.persisted?
+      flash.now[:error] = "Another administrator changed this connection. Reload the page before deleting it."
+      render :edit, status: :conflict
+    rescue ActiveRecord::RecordInvalid => e
+      flash.now[:error] = e.record.errors.full_messages.to_sentence
+      render :edit, status: :unprocessable_entity
+    end
+
+    private
+
+    def authorization_subject
+      :mcp_connections
+    end
+
+    def require_mcp_user
+      head :forbidden unless SolidusMcp::Administration.user?(current_solidus_admin_user)
+    end
+
+    def require_permission_manager
+      head :forbidden unless manage_connection_permissions?
+    end
+
+    def mcp_administrator?
+      @mcp_administrator ||= SolidusMcp::Administration.administrator?(current_solidus_admin_user)
+    end
+
+    def mcp_superadministrator?
+      SolidusMcp::Administration.superadmin?(current_solidus_admin_user)
+    end
+
+    def can_manage_connection?(owner)
+      SolidusMcp::Administration.can_manage?(current_solidus_admin_user, owner)
+    end
+
+    def manage_connection_permissions?
+      @can_manage_permissions
+    end
+
+    def load_connection
+      @user = Spree.user_class.find(params.require(:user_id))
+      unless SolidusMcp::Administration.can_view?(current_solidus_admin_user, @user)
+        raise ActiveRecord::RecordNotFound
+      end
+      @application = Doorkeeper::Application.find(params[:id])
+      @can_manage_permissions = can_manage_connection?(@user)
+      tokens = Doorkeeper::AccessToken.where(application_id: @application.id, resource_owner_id: @user.id, resource: SolidusMcp.configuration.endpoint_url)
+      raise ActiveRecord::RecordNotFound unless tokens.exists?
+      scope_sets = tokens.where(revoked_at: nil).where("expires_in IS NULL OR created_at + expires_in * interval '1 second' > ?", Time.current).pluck(:scopes)
+      @scopes = scope_sets.flat_map { |scopes| scopes.to_s.split }.uniq.sort
+      @scope_status = SolidusMcp::ConnectionScopes.new(scope_sets)
+      @policy = SolidusMcp::ConnectionPolicy.find_or_initialize_by(application: @application, user: @user)
+      @policy.permissions = [] if @policy.new_record?
+      @registry = SolidusMcp.registry
+      @changes = @policy.persisted? ? @policy.policy_changes.order(id: :desc).limit(10) : []
+    end
+  end
+end

data/app/controllers/solidus_mcp/authorizations_controller.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class AuthorizationsController < Doorkeeper::AuthorizationsController
+    layout false
+    before_action :validate_mcp_request
+    helper_method :scope_options
+
+    private
+
+    def scope_options
+      registered = @pre_auth.client.application.scopes.to_a
+      configured = Doorkeeper.config.default_scopes.to_a | Doorkeeper.config.optional_scopes.to_a
+      Credential::SCOPES & configured & (registered.empty? ? Credential::SCOPES : registered)
+    end
+
+    def validate_mcp_request
+      return head :not_found unless SolidusMcp.configuration.enabled?
+      return render json: {error: "invalid_target"}, status: :bad_request unless params[:resource] == SolidusMcp.configuration.endpoint_url
+      if params.key?(:requested_scopes) || params.key?(:review_scopes)
+        selected = params[:requested_scopes]
+        unless action_name == "new" && request.get? && selected.is_a?(Array) && selected.any? &&
+            selected.all? { |scope| scope.is_a?(String) } && (selected - Credential::SCOPES).empty?
+          return render json: {error: "invalid_scope"}, status: :bad_request
+        end
+        # Review prepares a new consent summary, never a grant. Doorkeeper
+        # still validates the client, callback and registered scope ceiling.
+        params[:scope] = selected.uniq.join(" ")
+      end
+      scopes = params[:scope].presence || "mcp:read"
+      unless scopes.is_a?(String) && scopes.split.any? && (scopes.split - Credential::SCOPES).empty?
+        return render json: {error: "invalid_scope"}, status: :bad_request
+      end
+      params[:scope] = scopes
+      unless params[:code_challenge_method] == "S256" && params[:code_challenge].to_s.match?(/\A[A-Za-z0-9_-]{43}\z/)
+        render json: {error: "invalid_request", error_description: "S256 PKCE is required"}, status: :bad_request
+      end
+    end
+  end
+end

data/app/controllers/solidus_mcp/endpoint_controller.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class EndpointController < ActionController::API
+    MAX_REQUEST_BYTES = 1.megabyte
+
+    include HttpAccess
+    before_action :authenticate, except: :preflight
+
+    def handle
+      # A scope challenge belongs to HTTP, not an MCP tool error. Inspect only
+      # the tool identity; SDK parsing/validation still owns the protocol.
+      if request.post? && request.media_type == "application/json"
+        body = request.body.read(MAX_REQUEST_BYTES + 1)
+        request.body.rewind
+        return head :payload_too_large if body.bytesize > MAX_REQUEST_BYTES
+        payload = parse_payload(body)
+        if payload.is_a?(Hash) && payload["method"] == "tools/call" && payload["params"].is_a?(Hash)
+          tool = SolidusMcp.registry.tools[payload["params"]["name"]]
+          begin
+            Policy.new(@credential).authorize!(tool) if tool
+          rescue InsufficientScope => e
+            response.set_header("WWW-Authenticate", %(Bearer error="insufficient_scope", scope="#{e.scopes.join(" ")}", resource_metadata="#{SolidusMcp.configuration.endpoint_url}/metadata"))
+            return render json: {error: "insufficient_scope"}, status: :forbidden
+          rescue AccessDenied
+            # Normal tool permission failures remain protocol errors.
+          end
+        end
+      end
+      config = SolidusMcp.configuration
+      transport = MCP::Server::Transports::StreamableHTTPTransport.new(
+        Server.build(credential: @credential), stateless: true, serve_subscriptions_listen: false,
+        allowed_hosts: [URI(config.endpoint_url).host], allowed_origins: config.allowed_origins
+      )
+      status, headers, body = transport.handle_request(request)
+      self.status = status
+      headers.each { |key, value| response.set_header(key, value) }
+      self.response_body = body
+      response.set_header("Cache-Control", "no-store")
+    end
+
+    private
+
+    def parse_payload(body)
+      JSON.parse(body)
+    rescue JSON::ParserError
+      nil
+    end
+
+    def authenticate
+      bearer = request.authorization&.match(/\ABearer ([^\s]+)\z/i)&.captures&.first
+      @credential = Credential.authenticate(bearer)
+      unless @credential
+        response.set_header("WWW-Authenticate", %(Bearer resource_metadata="#{SolidusMcp.configuration.endpoint_url}/metadata"))
+        return head :unauthorized
+      end
+      connection = ConnectionPolicy.find_by(application_id: @credential.token.application_id, user_id: @credential.user.id)
+      head :forbidden if connection && (!connection.enabled? || connection.deleted_at?)
+    end
+  end
+end

data/app/controllers/solidus_mcp/metadata_controller.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  class MetadataController < ActionController::API
+    include HttpAccess
+
+    def resource
+      render json: {resource: SolidusMcp.configuration.endpoint_url,
+                    authorization_servers: [SolidusMcp.configuration.issuer_url],
+                    scopes_supported: Credential::SCOPES, bearer_methods_supported: ["header"]}
+    end
+
+    def authorization_server
+      base = SolidusMcp.configuration.endpoint_url
+      render json: {issuer: SolidusMcp.configuration.issuer_url,
+                    authorization_endpoint: "#{base}/oauth/authorize", token_endpoint: "#{base}/oauth/token",
+                    revocation_endpoint: "#{base}/oauth/revoke", registration_endpoint: "#{base}/oauth/register",
+                    response_types_supported: ["code"], grant_types_supported: %w[authorization_code refresh_token],
+                    token_endpoint_auth_methods_supported: %w[client_secret_basic client_secret_post none],
+                    code_challenge_methods_supported: ["S256"], scopes_supported: Credential::SCOPES}
+    end
+  end
+end