tina4ruby 3.13.39 → 3.13.40

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 62dc42240a6abd35572f17207f42c631ebf2c36cc73b94adad4b163b3a2924a5
-  data.tar.gz: e9ea35e0aad4bee25bc42f7ee7a37973144265ed538b5e6127e5a546278a62cf
+  metadata.gz: 0bb742a8cdfa909ee27c95cce703f14f678f03f93b764aea62501b4afde78e91
+  data.tar.gz: 3e0da501f8911d1df438ecebdab6b2f8ef67be7b66d39927672c23f089b351c4
 SHA512:
-  metadata.gz: 58cf9b41857e5905b5eeda37a6881f812aad230a12533051d4510724222453f344ae1a0e05120e915a69450a05788dad7468eb1b99925e44a5bd8a625dca4c59
-  data.tar.gz: 8ff5447f091aafe2ff0a06c7e23a8f7838190545ec96f99bc2329753ee0a9ed0714cc1a7293d127805efe504552293fbb6f08e3fa7651e8423998cc8939869f5
+  metadata.gz: 1f6998cc599c7ebae85a3a0020b8146721ca653a84f7f65635226072781aac2ad41ccec3cf3a749063960e3f1bae47c3e3eca97fe58375d6c01c0a5df7359487
+  data.tar.gz: ce0653713c6f9e0659b5f26a6068690db7915ccbc8cdeb87ca54c8cfe609c2b700f6e90a5f6ca90b8f6c198d33edbcea70599bb050855259504fd831f16b90f6

data/lib/tina4/auth.rb

@@ -15,7 +15,11 @@ module Tina4
     BLANK_SECRET_WARNING =
       "Auth: TINA4_SECRET is not set — JWT signing is insecure. Set TINA4_SECRET " \
       "to a random value (e.g. `openssl rand -hex 32`) in your environment or " \
-      ".env before serving traffic."
+      ".env before serving traffic. " \
+      "For LOCAL DEV, set TINA4_DEBUG=true and a per-machine secret is generated " \
+      "automatically into .env.local (gitignored). Seeing this warning means the " \
+      "run was NOT detected as dev - typically a container or CI without " \
+      "TINA4_DEBUG set, or TINA4_ENV=production."
 
     class << self
       def setup(root_dir = Dir.pwd)

data/lib/tina4/dev_admin.rb

@@ -644,22 +644,25 @@ module Tina4
           json_response(deps_install(body))
         when ["GET", "/__dev/api/git/status"]
           json_response(git_status_payload)
+        # All four MCP surfaces (REST shim + JSON-RPC + SSE) go through
+        # with_mcp_gate: capability (Tina4.mcp_enabled?) decides whether MCP
+        # runs at all (off → route behaves as unmounted, nil → RackApp 404,
+        # no info leak); per-request authorisation on the RAW socket peer +
+        # token decides whether THIS caller may use it (loopback always,
+        # remote only with TINA4_MCP_REMOTE + a valid TINA4_MCP_TOKEN — denied
+        # → 404 mcp_forbidden). The dev tools expose powerful ops (DB query,
+        # file read/WRITE, route listing). Mirrors the Python master gate.
         when ["GET", "/__dev/api/mcp/tools"]
-          json_response(mcp_tools_list)
+          with_mcp_gate(env) { json_response(mcp_tools_list) }
         when ["POST", "/__dev/api/mcp/call"]
-          body = read_json_body(env) || {}
-          json_response(mcp_tool_call(body))
-        # JSON-RPC + SSE endpoints that real MCP clients (Claude Code/Desktop)
-        # speak. The dev tools expose powerful ops (DB query, file read/WRITE,
-        # route listing), so beyond the dev-toolbar's TINA4_DEBUG check they are
-        # gated on Tina4.mcp_enabled? — explicit TINA4_MCP wins on any host, else
-        # dev auto-enable is LOCALHOST-ONLY unless TINA4_MCP_REMOTE=true. Not
-        # enabled → falls through to the `else` (nil), so RackApp 404s it. They
-        # share the default MCP server's tool registry with the REST shim.
+          with_mcp_gate(env) do
+            body = read_json_body(env) || {}
+            json_response(mcp_tool_call(body))
+          end
         when ["POST", "/__dev/mcp"], ["POST", "/__dev/mcp/message"]
-          Tina4.mcp_enabled? ? mcp_jsonrpc(env) : nil
+          with_mcp_gate(env) { mcp_jsonrpc(env) }
         when ["GET", "/__dev/mcp/sse"]
-          Tina4.mcp_enabled? ? mcp_sse_handshake : nil
+          with_mcp_gate(env) { mcp_sse_handshake }
         when ["GET", "/__dev/api/scaffold"]
           json_response(scaffold_templates)
         when ["POST", "/__dev/api/scaffold/run"]
@@ -1586,6 +1589,70 @@ module Tina4
         end
       end
 
+      # Gate an MCP surface. Yields to the handler block only for an authorised
+      # caller. Returns:
+      #   nil            — capability off (route behaves as unmounted → 404, no
+      #                    "MCP exists" info leak; matches PHP not mounting it)
+      #   mcp_forbidden  — capability on but this caller is denied (explicit 404)
+      #   block result   — authorised caller proceeds
+      def with_mcp_gate(env)
+        return nil unless Tina4.mcp_enabled?
+        return mcp_forbidden unless mcp_request_allowed?(env)
+
+        yield
+      end
+
+      # 404 payload for a disallowed MCP request (parity with Python/PHP).
+      def mcp_forbidden
+        [404, { "content-type" => "application/json; charset=utf-8" },
+         [JSON.generate({ "error" => "MCP forbidden" })]]
+      end
+
+      # Per-request MCP authorisation using the RAW socket peer.
+      #
+      # Reads env["REMOTE_ADDR"] (never X-Forwarded-For — spoofable) and the
+      # token, then delegates to Tina4.request_allowed?. Loopback is always
+      # allowed; a remote caller needs TINA4_MCP_REMOTE=true plus a valid
+      # token. Mirrors the Python dev_admin _mcp_request_allowed.
+      def mcp_request_allowed?(env)
+        remote_ip = (env["REMOTE_ADDR"] || "").to_s
+        Tina4.request_allowed?(remote_ip, has_valid_token: mcp_token_ok?(env))
+      end
+
+      # Whether the request carried a token matching TINA4_MCP_TOKEN.
+      #
+      # Token transports (in order): Authorization: Bearer, X-MCP-Token,
+      # X-Api-Key. Compared timing-safe against TINA4_MCP_TOKEN (fallback
+      # TINA4_API_KEY). With NO configured token this returns false, so a
+      # remote caller can never present a "valid" token by accident.
+      def mcp_token_ok?(env)
+        expected = ENV["TINA4_MCP_TOKEN"]
+        expected = ENV["TINA4_API_KEY"] if expected.nil? || expected.empty?
+        return false if expected.nil? || expected.empty?
+
+        provided = ""
+        auth = (env["HTTP_AUTHORIZATION"] || "").to_s
+        provided = auth[7..].to_s.strip if auth.downcase.start_with?("bearer ")
+        provided = (env["HTTP_X_MCP_TOKEN"] || "").to_s if provided.empty?
+        provided = (env["HTTP_X_API_KEY"] || "").to_s if provided.empty?
+        return false if provided.empty?
+
+        secure_equal?(expected.to_s, provided)
+      end
+
+      # Constant-time string comparison (length check first so the
+      # fixed-length compare never raises on a mismatch).
+      def secure_equal?(expected, provided)
+        return false unless expected.bytesize == provided.bytesize
+
+        OpenSSL.fixed_length_secure_compare(expected, provided)
+      rescue StandardError
+        # Fallback for very old OpenSSL without fixed_length_secure_compare.
+        res = 0
+        expected.bytes.zip(provided.bytes) { |a, b| res |= (a ^ b.to_i) }
+        res.zero?
+      end
+
       def mcp_tools_list
         return { tools: [], count: 0 } unless defined?(Tina4::McpServer)
         server = Tina4._default_mcp_server