vector_mcp 0.4.0 → 0.6.0

data/lib/vector_mcp/transport/http_stream.rb

@@ -52,6 +52,8 @@ module VectorMCP
       DEFAULT_SESSION_TIMEOUT = 300 # 5 minutes
       DEFAULT_EVENT_RETENTION = 100 # Keep last 100 events for resumability
       DEFAULT_REQUEST_TIMEOUT = 30 # Default timeout for server-initiated requests
+      DEFAULT_MIN_THREADS = 4
+      DEFAULT_MAX_THREADS = 32
 
       # Default allowed origins — restrict to localhost by default for security.
       DEFAULT_ALLOWED_ORIGINS = %w[
@@ -72,6 +74,8 @@ module VectorMCP
       # @option options [String] :path_prefix ("/mcp") The base path for HTTP endpoints
       # @option options [Integer] :session_timeout (300) Session timeout in seconds
       # @option options [Integer] :event_retention (100) Number of events to retain for resumability
+      # @option options [Integer] :min_threads (4) Minimum Puma thread pool size
+      # @option options [Integer] :max_threads (32) Maximum Puma thread pool size
       # @option options [Array<String>] :allowed_origins Allowed origins for CORS validation.
       #   Defaults to localhost origins only. Pass ["*"] to allow all origins (NOT recommended for production).
       def initialize(server, options = {})
@@ -264,7 +268,7 @@ module VectorMCP
       #
       # @return [void]
       def start_puma_server
-        @puma_server = Puma::Server.new(self)
+        @puma_server = Puma::Server.new(self, nil, min_threads: @min_threads, max_threads: @max_threads)
         @puma_server.add_tcp_listener(@host, @port)
 
         @running = true
@@ -345,6 +349,7 @@ module VectorMCP
       # Validates origin and dispatches to the appropriate handler by HTTP method.
       def validate_and_dispatch(method, env)
         return forbidden_response("Origin not allowed") unless valid_origin?(env)
+        return unauthorized_oauth_response(env) if oauth_gate_should_reject?(env)
 
         case method
         when "POST"
@@ -358,6 +363,70 @@ module VectorMCP
         end
       end
 
+      # True when OAuth 2.1 resource server mode is enabled and the incoming
+      # request has not successfully authenticated. Opt-in: only activates when the
+      # server was configured with a +resource_metadata_url+ via +enable_authentication!+.
+      #
+      # @param env [Hash] The Rack environment
+      # @return [Boolean]
+      def oauth_gate_should_reject?(env)
+        return false unless oauth_resource_server_enabled?
+
+        !authenticate_transport_request(env).authenticated?
+      end
+
+      # @return [Boolean] true when the server is configured to act as an OAuth 2.1 resource server.
+      def oauth_resource_server_enabled?
+        return false unless @server.respond_to?(:oauth_resource_metadata_url)
+        return false if @server.oauth_resource_metadata_url.nil?
+
+        @server.auth_manager.required?
+      end
+
+      # Runs the configured authentication strategy against the Rack env and returns
+      # the resulting SessionContext. The request is carried as a
+      # {VectorMCP::RequestContext} — the same type the in-handler auth path uses —
+      # so +:custom+ strategy handlers see one contract everywhere. Errors in the
+      # strategy are logged and treated as unauthenticated rather than propagated,
+      # so a malformed token can never crash the request pipeline.
+      #
+      # @param env [Hash] The Rack environment
+      # @return [VectorMCP::Security::SessionContext]
+      def authenticate_transport_request(env)
+        request_context = VectorMCP::RequestContext.from_rack_env(env, "http_stream")
+        @server.security_middleware.authenticate_request(request_context)
+      rescue StandardError => e
+        VectorMCP.logger_for("security").warn do
+          "OAuth transport auth strategy raised #{e.class}: #{e.message}"
+        end
+        VectorMCP::Security::SessionContext.anonymous
+      end
+
+      # Returns a 401 Rack response carrying a WWW-Authenticate header that points
+      # Claude Desktop (and other RFC 9728 clients) at the configured OAuth 2.1
+      # protected resource metadata document. The JSON-RPC error envelope in the
+      # body is for clients that parse bodies regardless of status code; the header
+      # and status are the parts that drive the discovery flow.
+      #
+      # @param env [Hash] The Rack environment
+      # @return [Array] Rack response triplet
+      def unauthorized_oauth_response(env)
+        VectorMCP.logger_for("security").info do
+          "OAuth 401 challenge issued for #{env["REQUEST_METHOD"]} #{env["PATH_INFO"]}"
+        end
+
+        header_value = %(Bearer realm="mcp", resource_metadata="#{@server.oauth_resource_metadata_url}")
+        body = {
+          jsonrpc: "2.0",
+          id: nil,
+          error: { code: -32_401, message: "Authentication required" }
+        }.to_json
+
+        [401,
+         { "Content-Type" => "application/json", "WWW-Authenticate" => header_value },
+         [body]]
+      end
+
       # Handles POST requests (client-to-server JSON-RPC)
       #
       # @param env [Hash] The Rack environment
@@ -405,24 +474,35 @@ module VectorMCP
           return [202, { "Mcp-Session-Id" => session.id }, []]
         end
 
+        # Each request is dispatched through its own Invocation so that
+        # request-scoped state (headers, params, resolved auth) never leaks
+        # between concurrent requests on the same session.
+        invocation = VectorMCP::Invocation.new(
+          session,
+          request_context: VectorMCP::RequestContext.from_rack_env(env, "http_stream")
+        )
+
         # Notifications: has method, no id -> 202 Accepted with no body (MCP spec requirement)
         if message["method"] && !message.key?("id")
-          @server.handle_message(message, session.context, session.id)
+          @server.handle_message(message, invocation)
           return [202, { "Mcp-Session-Id" => session.id }, []]
         end
 
-        result = @server.handle_message(message, session.context, session.id)
+        result = @server.handle_message(message, invocation)
         build_rpc_response(env, result, message["id"], session.id)
       rescue VectorMCP::ProtocolError => e
         build_protocol_error_response(env, e, session_id: session.id)
       end
 
       # Resolves or creates the session for a POST request following MCP spec rules:
-      # - session_id present and known  → return existing session (updating request context)
+      # - session_id present and known  → return existing session
       # - session_id present but unknown/expired → 404 Not Found
       # - no session_id + initialize request → create new session
       # - no session_id + other request → 400 Bad Request
       #
+      # Request-scoped data is NOT written to the session here; each request
+      # carries its own context via the Invocation built at dispatch time.
+      #
       # @param session_id [String, nil] Client-supplied Mcp-Session-Id header value
       # @param message [Hash] Parsed JSON-RPC message
       # @param env [Hash] Rack environment
@@ -431,14 +511,7 @@ module VectorMCP
         is_initialize = message.is_a?(Hash) && message["method"] == "initialize"
 
         if session_id
-          session = @session_manager.get_session(session_id)
-          return not_found_response("Unknown or expired session") unless session
-
-          if env
-            request_context = VectorMCP::RequestContext.from_rack_env(env, "http_stream")
-            session.context.request_context = request_context
-          end
-          session
+          @session_manager.get_session(session_id) || not_found_response("Unknown or expired session")
         elsif is_initialize
           @session_manager.create_session(nil, env)
         else
@@ -762,15 +835,12 @@ module VectorMCP
 
       # Request tracking helpers for server-initiated requests
 
-      # Sets up tracking for an outgoing request using pooled condition variables.
+      # Sets up tracking for an outgoing request.
       #
       # @param request_id [String] The request ID to track
       # @return [void]
       def setup_request_tracking(request_id)
-        @request_mutex.synchronize do
-          # Create IVar for thread-safe request tracking (no race conditions)
-          @outgoing_request_ivars[request_id] = Concurrent::IVar.new
-        end
+        @outgoing_request_ivars[request_id] = Concurrent::IVar.new
       end
 
       # Waits for a response to an outgoing request.
@@ -781,11 +851,7 @@ module VectorMCP
       # @return [Hash] The response data
       # @raise [VectorMCP::SamplingTimeoutError] if timeout occurs
       def wait_for_response(request_id, method, timeout)
-        ivar = nil
-        @request_mutex.synchronize do
-          ivar = @outgoing_request_ivars[request_id]
-        end
-
+        ivar = @outgoing_request_ivars[request_id]
         return nil unless ivar
 
         begin
@@ -827,24 +893,11 @@ module VectorMCP
         response[:result]
       end
 
-      # Cleans up tracking for a request and returns condition variable to pool.
+      # Cleans up tracking for a request.
       #
       # @param request_id [String] The request ID to clean up
       # @return [void]
       def cleanup_request_tracking(request_id)
-        @request_mutex.synchronize do
-          cleanup_request_tracking_unsafe(request_id)
-        end
-      end
-
-      # Internal cleanup method that assumes mutex is already held.
-      # This prevents recursive locking when called from within synchronized blocks.
-      #
-      # @param request_id [String] The request ID to clean up
-      # @return [void]
-      # @api private
-      def cleanup_request_tracking_unsafe(request_id)
-        # Remove IVar for this request (no condition variable cleanup needed)
         @outgoing_request_ivars.delete(request_id)
       end
 
@@ -873,10 +926,7 @@ module VectorMCP
       def handle_outgoing_response(message)
         request_id = message["id"]
 
-        ivar = nil
-        @request_mutex.synchronize do
-          ivar = @outgoing_request_ivars[request_id]
-        end
+        ivar = @outgoing_request_ivars[request_id]
 
         unless ivar
           logger.debug { "Received response for request ID #{request_id} but no thread is waiting (likely timed out)" }
@@ -885,11 +935,6 @@ module VectorMCP
 
         # Convert keys to symbols for consistency and put response in IVar
         response_data = deep_transform_keys(message, &:to_sym)
-
-        # Store in both places for compatibility with tests
-        @outgoing_request_responses[request_id] = response_data
-
-        # IVar handles thread-safe response delivery - no race conditions possible
         if ivar.try_set(response_data)
           logger.debug { "Response delivered to waiting thread for request ID #{request_id}" }
         else
@@ -937,6 +982,8 @@ module VectorMCP
         @path_prefix = normalize_path_prefix(options[:path_prefix] || DEFAULT_PATH_PREFIX)
         @session_timeout = options[:session_timeout] || DEFAULT_SESSION_TIMEOUT
         @event_retention = options[:event_retention] || DEFAULT_EVENT_RETENTION
+        @min_threads = options[:min_threads] || DEFAULT_MIN_THREADS
+        @max_threads = options[:max_threads] || DEFAULT_MAX_THREADS
         @allowed_origins = options[:allowed_origins] || DEFAULT_ALLOWED_ORIGINS
         @mounted = options.fetch(:mounted, false)
 
@@ -960,11 +1007,7 @@ module VectorMCP
 
       # Initialize request tracking system and ID generation for server-initiated requests
       def initialize_request_tracking
-        # Use IVars for thread-safe request/response handling (eliminates condition variable races)
         @outgoing_request_ivars = Concurrent::Hash.new
-        # Keep compatibility with tests that expect @outgoing_request_responses
-        @outgoing_request_responses = Concurrent::Hash.new
-        @request_mutex = Mutex.new
         initialize_request_id_generation
       end
 
@@ -1008,15 +1051,12 @@ module VectorMCP
 
         logger.debug { "Cleaning up #{@outgoing_request_ivars.size} pending requests" }
 
-        @request_mutex.synchronize do
-          # IVars will timeout naturally, just clear the tracking
-          @outgoing_request_ivars.clear
-        end
+        @outgoing_request_ivars.clear
       end
 
       # Finds the first session with an active streaming connection.
       #
-      # @return [SessionManager::Session, nil] The first streaming session or nil if none found
+      # @return [VectorMCP::Session, nil] The first streaming session or nil if none found
       def find_streaming_session
         @session_manager.active_session_ids.each do |session_id|
           session = @session_manager.get_session(session_id)
@@ -1027,7 +1067,7 @@ module VectorMCP
 
       # Finds the first available session (streaming or non-streaming).
       #
-      # @return [SessionManager::Session, nil] The first available session or nil if none found
+      # @return [VectorMCP::Session, nil] The first available session or nil if none found
       def find_first_session
         session_ids = @session_manager.active_session_ids
         return nil if session_ids.empty?

data/lib/vector_mcp/util/token_sweeper.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module VectorMCP
+  module Util
+    # Stateless recursive traversal utility for parsed JSON-like structures.
+    #
+    # {.sweep} walks Hashes, Arrays, and String leaves, yielding each String
+    # value together with its parent Hash key (or the enclosing Hash key of
+    # the nearest containing Array). The block's return value replaces the
+    # String in the output. All other scalar types (Integer, Float, nil,
+    # Boolean, etc.) are returned unchanged and are not yielded.
+    #
+    # The method is purely functional: it never mutates the input structure
+    # and always returns a fresh Hash/Array spine when containers are
+    # encountered. Circular references are detected via an identity-compared
+    # visited set and the originally-referenced node is returned unchanged
+    # on cycles.
+    module TokenSweeper
+      # Traverse +obj+ and return a new structure with String leaves
+      # transformed by +block+.
+      #
+      # @param obj [Object] the object to sweep (typically Hash/Array/String/scalar).
+      # @yield [value, parent_key] invoked for each String leaf.
+      # @yieldparam value [String] the String value.
+      # @yieldparam parent_key [Object, nil] the Hash key under which +value+
+      #   lives, or +nil+ when the String is a top-level scalar; propagated
+      #   from the nearest containing Hash when inside Arrays.
+      # @yieldreturn [Object] the replacement value.
+      # @return [Object] the transformed structure.
+      def self.sweep(obj, &block)
+        raise ArgumentError, "TokenSweeper.sweep requires a block" unless block
+
+        walk(obj, nil, {}.compare_by_identity, &block)
+      end
+
+      class << self
+        private
+
+        def walk(obj, parent_key, visited, &)
+          case obj
+          when Hash  then walk_hash(obj, visited, &)
+          when Array then walk_array(obj, parent_key, visited, &)
+          when String then yield(obj, parent_key)
+          else obj
+          end
+        end
+
+        def walk_hash(hash, visited, &)
+          return hash if visited[hash]
+
+          visited[hash] = true
+          begin
+            hash.each_with_object({}) do |(key, value), out|
+              out[key] = walk(value, key, visited, &)
+            end
+          ensure
+            visited.delete(hash)
+          end
+        end
+
+        def walk_array(array, parent_key, visited, &)
+          return array if visited[array]
+
+          visited[array] = true
+          begin
+            array.map { |element| walk(element, parent_key, visited, &) }
+          ensure
+            visited.delete(array)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vector_mcp/version.rb

@@ -2,5 +2,5 @@
 
 module VectorMCP
   # The current version of the VectorMCP gem.
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/vector_mcp.rb

@@ -7,7 +7,10 @@ require_relative "vector_mcp/version"
 require_relative "vector_mcp/errors"
 require_relative "vector_mcp/definitions"
 require_relative "vector_mcp/session"
+require_relative "vector_mcp/invocation"
 require_relative "vector_mcp/util"
+require_relative "vector_mcp/util/token_sweeper"
+require_relative "vector_mcp/token_store"
 require_relative "vector_mcp/log_filter"
 require_relative "vector_mcp/image_util"
 require_relative "vector_mcp/handlers/core"
@@ -59,6 +62,14 @@ module VectorMCP
       @logger ||= Logger.for("vectormcp")
     end
 
+    # Emit a deprecation warning. Centralized so tests and applications can
+    # intercept or silence deprecations in one place.
+    # @param message [String] description of the deprecated usage and its replacement
+    # @return [void]
+    def deprecation_warning(message)
+      warn("[DEPRECATION] VectorMCP: #{message}")
+    end
+
     # Creates a new {VectorMCP::Server} instance. This is a **thin wrapper** around
     # `VectorMCP::Server.new`; it exists purely for syntactic sugar so you can write
     # `VectorMCP.new` instead of `VectorMCP::Server.new`.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vector_mcp
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Sergio Bayona
@@ -129,9 +129,11 @@ files:
 - lib/vector_mcp/errors.rb
 - lib/vector_mcp/handlers/core.rb
 - lib/vector_mcp/image_util.rb
+- lib/vector_mcp/invocation.rb
 - lib/vector_mcp/log_filter.rb
 - lib/vector_mcp/logger.rb
 - lib/vector_mcp/middleware.rb
+- lib/vector_mcp/middleware/anonymizer.rb
 - lib/vector_mcp/middleware/base.rb
 - lib/vector_mcp/middleware/context.rb
 - lib/vector_mcp/middleware/hook.rb
@@ -142,6 +144,7 @@ files:
 - lib/vector_mcp/sampling/result.rb
 - lib/vector_mcp/security.rb
 - lib/vector_mcp/security/auth_manager.rb
+- lib/vector_mcp/security/auth_result.rb
 - lib/vector_mcp/security/authorization.rb
 - lib/vector_mcp/security/middleware.rb
 - lib/vector_mcp/security/session_context.rb
@@ -153,6 +156,7 @@ files:
 - lib/vector_mcp/server/message_handling.rb
 - lib/vector_mcp/server/registry.rb
 - lib/vector_mcp/session.rb
+- lib/vector_mcp/token_store.rb
 - lib/vector_mcp/tool.rb
 - lib/vector_mcp/transport/base_session_manager.rb
 - lib/vector_mcp/transport/http_stream.rb
@@ -160,6 +164,7 @@ files:
 - lib/vector_mcp/transport/http_stream/session_manager.rb
 - lib/vector_mcp/transport/http_stream/stream_handler.rb
 - lib/vector_mcp/util.rb
+- lib/vector_mcp/util/token_sweeper.rb
 - lib/vector_mcp/version.rb
 homepage: https://github.com/sergiobayona/vector_mcp
 licenses: