toolchest 0.3.5 → 0.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db7d29ec671adac8f24512bf3d190dedb55250dfd846b31c5906feac16771130
-  data.tar.gz: a3c7414f1c60e5997942fdacfa70ee3a368e6a0cd2b237eab2b1d187351cb10d
+  metadata.gz: c73baf6206cfd9d1f744867f2b3e35e6094a2f4304dec858ce0350c1d54c03ba
+  data.tar.gz: 82c480aa62bdcb7c19df80a1aebeb4a7cf4dbb4ec8a199b25fb4a8abe6da69a1
 SHA512:
-  metadata.gz: 68779c02c513ba5dc8052407a015de6fddda8e44c5aa6add4daeb204eb08fe7b41b997a6a2791e90b62ab1dc558d467d3ad722cbee5baca32fccbe7a04692203
-  data.tar.gz: d63e96b09cdf89b09a31e902b593f55b4399ab347c5af3daa033c50c03054c654e0338fe2f9eb31544f19522e65bb1c30f9181c33a040e14a2c26dbf91b5371c
+  metadata.gz: 82bcf0c2b9ee5c5d0e9365641dcd7e2e6119be86e66dadee37b1bfaa44582511b2c3e7a5f2cbf31b0164dd31d4c3823090900bb4dd9bf18ea9f215babeaa2e47
+  data.tar.gz: f0e79e3d5cd3ad4bd09fe68975e129a3528f78f5f5ec7eaa822bf37c85631a295df2d0e10acbaf483ee62fa243ce563bd1a264688e3f3b90e1884a96d5173e1c

data/LLMS.txt

@@ -374,6 +374,9 @@ config.required_scopes = ["orders:read"]         # always granted, can't uncheck
 config.allowed_scopes_for do |user, requested|   # per-user gating (default: show all)
   user.admin? ? requested : requested - ["admin:write"]
 end
+config.authorize_link do |user|            # block user from linking (OAuth only, default: allow all)
+  !user.banned?
+end
 ```
 
 ## Resources and prompts

data/README.md

@@ -523,10 +523,23 @@ config.required_scopes = ["orders:read"]
 config.allowed_scopes_for do |user, requested_scopes|
   user.admin? ? requested_scopes : requested_scopes - ["admin:write"]
 end
+
 ```
 
 Scopes hidden by `allowed_scopes_for` never appear on the consent screen and can't be granted even if the POST is tampered with.
 
+### Blocking users from linking
+
+Gate who can link an MCP client to their account with `authorize_link`. If it returns falsy, the user is redirected with `access_denied` before they ever see a consent screen.
+
+```ruby
+config.authorize_link do |user|
+  !user.banned?
+end
+```
+
+Only applies when using `auth: :oauth`. For `auth: :token` or custom strategies, gate access in your own authentication layer.
+
 ## Multi-mount
 
 Separate MCP endpoints, different auth, different toolboxes:

data/app/controllers/toolchest/oauth/authorizations_controller.rb

@@ -11,6 +11,16 @@ module Toolchest
         @optional = toolchest_config.optional_scopes
         @original_scope = requested_scopes.join(" ")
 
+        unless toolchest_config.authorize_link?(@current_resource_owner)
+          redirect_url = build_redirect(params[:redirect_uri],
+            error: "access_denied",
+            error_description: "User is not authorized to connect",
+            state: params[:state]
+          )
+          redirect_to redirect_url, allow_other_host: true
+          return
+        end
+
         requested = requested_scopes
         allowed = toolchest_config.resolve_allowed_scopes(@current_resource_owner, requested)
         known = toolchest_config.scopes.keys
@@ -36,6 +46,16 @@ module Toolchest
 
       # POST /mcp/oauth/authorize — approve and redirect with code
       def create
+        unless toolchest_config.authorize_link?(@current_resource_owner)
+          redirect_url = build_redirect(params[:redirect_uri],
+            error: "access_denied",
+            error_description: "User is not authorized to connect",
+            state: params[:state]
+          )
+          redirect_to redirect_url, allow_other_host: true
+          return
+        end
+
         requested = original_requested_scopes
         allowed = toolchest_config.resolve_allowed_scopes(@current_resource_owner, requested)
         known = toolchest_config.scopes.keys

data/lib/toolchest/configuration.rb

@@ -23,6 +23,7 @@ module Toolchest
       @optional_scopes = false
       @required_scopes = []
       @allowed_scopes_for_block = nil
+      @authorize_link_block = nil
       @additional_view_paths = []
       @access_token_expires_in = 7200
       @toolboxes = nil
@@ -52,6 +53,19 @@ module Toolchest
       @authenticate_block.call(token)
     end
 
+    def authorize_link(&block)
+      if block
+        @authorize_link_block = block
+      else
+        @authorize_link_block
+      end
+    end
+
+    def authorize_link?(user)
+      return true unless @authorize_link_block
+      @authorize_link_block.call(user)
+    end
+
     def allowed_scopes_for(&block)
       if block
         @allowed_scopes_for_block = block

data/lib/toolchest/version.rb

@@ -1,3 +1,3 @@
 module Toolchest
-  VERSION = "0.3.5"
+  VERSION = "0.3.6"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: toolchest
 version: !ruby/object:Gem::Version
-  version: 0.3.5
+  version: 0.3.6
 platform: ruby
 authors:
 - Nora