toolchest 0.3.5 → 0.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: db7d29ec671adac8f24512bf3d190dedb55250dfd846b31c5906feac16771130
-  data.tar.gz: a3c7414f1c60e5997942fdacfa70ee3a368e6a0cd2b237eab2b1d187351cb10d
+  metadata.gz: 4ee7ad9222681a140d6978cbe7f9f8ffccbc87409f8fc67b361625049fa1d7fa
+  data.tar.gz: de305206530622d0e29ad038e5de13fb872ca7758a25e4266271240463077909
 SHA512:
-  metadata.gz: 68779c02c513ba5dc8052407a015de6fddda8e44c5aa6add4daeb204eb08fe7b41b997a6a2791e90b62ab1dc558d467d3ad722cbee5baca32fccbe7a04692203
-  data.tar.gz: d63e96b09cdf89b09a31e902b593f55b4399ab347c5af3daa033c50c03054c654e0338fe2f9eb31544f19522e65bb1c30f9181c33a040e14a2c26dbf91b5371c
+  metadata.gz: 3f6945c51b3a496589c4f0f5f582b7582b59a3d2b4e422bece7b3c81f40ec3e56e6994860dd6a018d09851c8a80b2437179c4a2d155160b5440a0e6fe01a42a0
+  data.tar.gz: 274c31289b34696fb6f8b7c5469ebe9d627d94880aa57b9b7fd1834f0eca9706078a75e64917198bb966f153f18547fddb276f4ffd6151a5cb2fa8732e3b147e

data/LLMS.txt

@@ -374,6 +374,9 @@ config.required_scopes = ["orders:read"]         # always granted, can't uncheck
 config.allowed_scopes_for do |user, requested|   # per-user gating (default: show all)
   user.admin? ? requested : requested - ["admin:write"]
 end
+config.authorize_link do |user|            # block user from linking (OAuth only, default: allow all)
+  !user.banned?
+end
 ```
 
 ## Resources and prompts

data/README.md

@@ -523,10 +523,23 @@ config.required_scopes = ["orders:read"]
 config.allowed_scopes_for do |user, requested_scopes|
   user.admin? ? requested_scopes : requested_scopes - ["admin:write"]
 end
+
 ```
 
 Scopes hidden by `allowed_scopes_for` never appear on the consent screen and can't be granted even if the POST is tampered with.
 
+### Blocking users from linking
+
+Gate who can link an MCP client to their account with `authorize_link`. If it returns falsy, the user is redirected with `access_denied` before they ever see a consent screen.
+
+```ruby
+config.authorize_link do |user|
+  !user.banned?
+end
+```
+
+Only applies when using `auth: :oauth`. For `auth: :token` or custom strategies, gate access in your own authentication layer.
+
 ## Multi-mount
 
 Separate MCP endpoints, different auth, different toolboxes:

data/app/controllers/toolchest/oauth/authorizations_controller.rb

@@ -11,6 +11,16 @@ module Toolchest
         @optional = toolchest_config.optional_scopes
         @original_scope = requested_scopes.join(" ")
 
+        unless toolchest_config.authorize_link?(@current_resource_owner)
+          redirect_url = build_redirect(params[:redirect_uri],
+            error: "access_denied",
+            error_description: "User is not authorized to connect",
+            state: params[:state]
+          )
+          redirect_to redirect_url, allow_other_host: true
+          return
+        end
+
         requested = requested_scopes
         allowed = toolchest_config.resolve_allowed_scopes(@current_resource_owner, requested)
         known = toolchest_config.scopes.keys
@@ -36,6 +46,16 @@ module Toolchest
 
       # POST /mcp/oauth/authorize — approve and redirect with code
       def create
+        unless toolchest_config.authorize_link?(@current_resource_owner)
+          redirect_url = build_redirect(params[:redirect_uri],
+            error: "access_denied",
+            error_description: "User is not authorized to connect",
+            state: params[:state]
+          )
+          redirect_to redirect_url, allow_other_host: true
+          return
+        end
+
         requested = original_requested_scopes
         allowed = toolchest_config.resolve_allowed_scopes(@current_resource_owner, requested)
         known = toolchest_config.scopes.keys

data/app/controllers/toolchest/oauth/metadata_controller.rb

@@ -37,14 +37,9 @@ module Toolchest
       # Returns [mount_path, config] or renders 404 and returns [nil, nil].
       def resolve_mount
         if params[:rest].present?
-          # Suffixed path (RFC 8414) — must match a configured mount exactly.
           path = "/#{params[:rest]}"
           key = Toolchest.mount_keys.find { |k| Toolchest.configuration(k).mount_path == path }
-          unless key
-            head :not_found
-            return [nil, nil]
-          end
-          return [path, Toolchest.configuration(key)]
+          return [path, Toolchest.configuration(key)] if key
         end
 
         # No suffix (e.g. Cursor). Use default_oauth_mount if set.

data/lib/generators/toolchest/auth_generator.rb

@@ -19,7 +19,7 @@ module Toolchest
         end
       end
 
-      def create_migration
+      def copy_migration
         case strategy
         when "token"
           migration_template "create_toolchest_tokens.rb.tt",

data/lib/toolchest/app.rb

@@ -17,6 +17,12 @@ module Toolchest
     def call(env)
       Engine.ensure_initialized!
       env["toolchest.mount_key"] = @mount_key.to_s
+
+      cfg = Toolchest.configuration(@mount_key)
+      if cfg.mount_path.nil? && env["SCRIPT_NAME"].present?
+        cfg.mount_path = env["SCRIPT_NAME"]
+      end
+
       @router.call(env)
     end
 

data/lib/toolchest/configuration.rb

@@ -23,6 +23,7 @@ module Toolchest
       @optional_scopes = false
       @required_scopes = []
       @allowed_scopes_for_block = nil
+      @authorize_link_block = nil
       @additional_view_paths = []
       @access_token_expires_in = 7200
       @toolboxes = nil
@@ -52,6 +53,19 @@ module Toolchest
       @authenticate_block.call(token)
     end
 
+    def authorize_link(&block)
+      if block
+        @authorize_link_block = block
+      else
+        @authorize_link_block
+      end
+    end
+
+    def authorize_link?(user)
+      return true unless @authorize_link_block
+      @authorize_link_block.call(user)
+    end
+
     def allowed_scopes_for(&block)
       if block
         @allowed_scopes_for_block = block

data/lib/toolchest/version.rb

@@ -1,3 +1,3 @@
 module Toolchest
-  VERSION = "0.3.5"
+  VERSION = "0.3.7"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: toolchest
 version: !ruby/object:Gem::Version
-  version: 0.3.5
+  version: 0.3.7
 platform: ruby
 authors:
 - Nora