woods 1.6.2 → 1.6.4

data/lib/woods/console/sql_table_scanner.rb

@@ -38,20 +38,20 @@ module Woods
       # identifier so it does not hide the table name. ANSI-89 comma joins
       # are handled separately — see FROM_CLAUSE.
       JOIN_REFERENCE = /
-        \b(?:STRAIGHT_)?JOIN\s+
-        (?:ONLY\s+)?
+        \b(?:STRAIGHT_)?JOIN(?=[\s("`])\s*
+        (?:ONLY(?=[\s("`])\s*\(?\s*)?
         (?:
           (?:
-            `(?<jschema_bt>[^`]+)` |
-            "(?<jschema_dq>[^"]+)" |
-            (?<jschema_bare>\w+)
+            `(?<jschema_bt>(?:``|[^`])+)` |
+            "(?<jschema_dq>(?:""|[^"])+)" |
+            (?<jschema_bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+)
           )
-          \.
+          \s* \. \s*
         )?
         (?:
-          `(?<backtick>[^`]+)` |
-          "(?<double>[^"]+)"   |
-          (?<bare>\w+(?:\.\w+)?)
+          `(?<backtick>(?:``|[^`])+)` |
+          "(?<double>(?:""|[^"])+)"   |
+          (?<bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+(?:\.[A-Za-z0-9_$\u0080-\u{10ffff}]+)?)
         )
       /xi
 
@@ -66,7 +66,7 @@ module Woods
       # every `FROM` as its own independent scan match is what keeps CTEs,
       # UNIONs, and nested subqueries in coverage.
       FROM_CLAUSE = /
-        \bFROM\s+
+        \bFROM(?=[\s("`])\s*
         (?<clause>.+?)
         (?=
           \b(?:WHERE|GROUP|HAVING|ORDER|LIMIT|OFFSET|UNION|INTERSECT|EXCEPT|
@@ -85,16 +85,16 @@ module Woods
         \A
         (?:
           (?:
-            `(?<schema_bt>[^`]+)` |
-            "(?<schema_dq>[^"]+)" |
-            (?<schema_bare>\w+)
+            `(?<schema_bt>(?:``|[^`])+)` |
+            "(?<schema_dq>(?:""|[^"])+)" |
+            (?<schema_bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+)
           )
-          \.
+          \s* \. \s*
         )?
         (?:
-          `(?<backtick>[^`]+)` |
-          "(?<double>[^"]+)"   |
-          (?<bare>\w+(?:\.\w+)?)
+          `(?<backtick>(?:``|[^`])+)` |
+          "(?<double>(?:""|[^"])+)"   |
+          (?<bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+(?:\.[A-Za-z0-9_$\u0080-\u{10ffff}]+)?)
         )
       /xi
 
@@ -102,45 +102,140 @@ module Woods
       # identifier. Strip it so the lead-identifier regex sees the table
       # directly. Anchored with `\A` because callers strip leading whitespace
       # first via #strip.
-      ONLY_PREFIX = /\AONLY\s+/i
+      ONLY_PREFIX = /\AONLY(?=[\s("`])\s*/i
+
+      # Matches a MySQL executable comment (`/*!...*/` or the version-guarded
+      # `/*!NNNNN...*/`), capturing the body. Mirrors
+      # SqlValidator::EXECUTABLE_COMMENT_PATTERN — {SqlNoiseStripper}
+      # deliberately leaves these markers in place because their meaning is
+      # version-dependent; .executable_comment_views scans both of their
+      # possible semantics.
+      EXECUTABLE_COMMENT_PATTERN = %r{/\*(?:M)?!(?:\d{5,6})?(.*?)\*/}m
+
+      # Matches the standalone SQL `TABLE name` statement (PostgreSQL, and
+      # MySQL 8.0.19+) — shorthand for `SELECT * FROM name`. It appears as a
+      # full statement, inside a CTE body (`WITH x AS (TABLE blocked) ...`),
+      # or as a FROM-clause subquery (`FROM (TABLE blocked) AS t`), so it is
+      # scanned independently of FROM_CLAUSE/JOIN_REFERENCE rather than as
+      # part of either. The identifier grammar mirrors LEAD_IDENT.
+      TABLE_STATEMENT = /
+        \bTABLE(?=[\s("`])\s*
+        (?:ONLY(?=[\s("`])\s*\(?\s*)?
+        (?:
+          (?:
+            `(?<schema_bt>(?:``|[^`])+)` |
+            "(?<schema_dq>(?:""|[^"])+)" |
+            (?<schema_bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+)
+          )
+          \s* \. \s*
+        )?
+        (?:
+          `(?<backtick>(?:``|[^`])+)` |
+          "(?<double>(?:""|[^"])+)"   |
+          (?<bare>[A-Za-z0-9_$\u0080-\u{10ffff}]+(?:\.[A-Za-z0-9_$\u0080-\u{10ffff}]+)?)
+        )
+      /xi
 
       # Returns every table/schema-qualified identifier referenced in the SQL
       # string. Noise (comments, string literals, dollar-quoted bodies) is
       # stripped before scanning. Both JOIN-style and ANSI-89 comma-join syntax
       # are handled.
       #
-      # Literals are stripped under BOTH supported dialects and the scans
-      # unioned. This scanner backs TableGate, so it may over-detect but must
-      # never under-detect: stripping with the wrong dialect's escape rules
-      # can swallow a real FROM clause — e.g. MySQL's `\'` escape applied on
-      # a PostgreSQL host (where backslash is literal under
-      # standard_conforming_strings) folds `'x\' FROM blocked WHERE y = '`
-      # into one literal, hiding `blocked` from the gate while PostgreSQL
-      # genuinely reads that table.
+      # A known adapter restricts the dialect, but not its session quote modes.
+      # Without known session settings, MySQL scans every quote-mode combination. An unknown
+      # adapter also scans PostgreSQL. This may over-detect, but must not hide a
+      # table merely because the server uses a different quote interpretation.
+      #
+      # MySQL executable comments (`/*! ... */`) are scanned under both of
+      # their possible semantics (see .executable_comment_views) so a table
+      # hidden at FROM/JOIN/subquery lead position is still surfaced.
       #
       # @param sql [String, nil] the SQL string to scan
       # @return [Array<String>] identifiers in first-encounter order, deduplicated
-      def self.identifiers_in(sql)
+      def self.identifiers_in(sql, dialect: nil, mysql_modes: nil)
         return [] if sql.nil? || sql.empty?
 
         results = []
-        %i[postgres mysql].each do |dialect|
-          stripped = strip_noise(sql, dialect: dialect)
-          collect_join_identifiers(stripped, results)
-          collect_from_identifiers(stripped, results)
+        (dialect ? [dialect] : %i[postgres mysql]).each do |dialect|
+          views = SqlNoiseStripper.security_views(sql, dialect: dialect, mysql_modes: mysql_modes)
+          views.flat_map { |stripped| executable_comment_views(stripped) }.each do |view|
+            collect_join_identifiers(view, results)
+            collect_from_identifiers(view, results)
+            collect_table_statement_identifiers(view, results)
+          end
         end
         results.uniq
       end
 
+      # Table-factor prefixes, retaining commas after balanced subqueries and
+      # JOIN predicates. Each nested FROM/JOIN is also scanned independently.
+      # SQL punctuation separates tokens without mandatory whitespace. Keep
+      # compact quoted targets and parenthesized relations in the same policy.
+      # @param sql [String] noise-stripped SQL
+      # @return [Array<String>]
+      def self.relation_factors(sql)
+        sql.to_enum(:scan, /\b(?:FROM|(?:STRAIGHT_)?JOIN)(?=[\s("`])\s*/i).flat_map do
+          suffix = sql[Regexp.last_match.end(0)..]
+          split_top_level_commas(relation_clause(suffix))
+        end
+      end
+
+      # Quoted tokens shield punctuation and clause words; a closing parenthesis
+      # at depth zero ends this query's clause, not a nested table expression.
+      def self.relation_clause(suffix)
+        depth = 0
+        tokens = /
+          "(?:[^"]|"")*"|`(?:[^`]|``)*`|''|[()]|
+          \b(?:WHERE|GROUP|HAVING|ORDER|LIMIT|OFFSET|UNION|INTERSECT|EXCEPT|WINDOW)\b
+        /ix
+        suffix.to_enum(:scan, tokens).each do
+          token = Regexp.last_match[0]
+          start = Regexp.last_match.begin(0)
+          finish = Regexp.last_match.end(0)
+          boundary = token == ')' || relation_keyword_boundary?(suffix[0...start], suffix[finish..], token)
+          return suffix[0...start] if depth.zero? && boundary
+
+          depth += 1 if token == '('
+          depth -= 1 if token == ')'
+        end
+        suffix
+      end
+      private_class_method :relation_clause
+
+      def self.relation_keyword_boundary?(prefix, rest, token)
+        return false unless token.match?(/\A[A-Za-z]/)
+        return false if prefix.strip.empty? || prefix.match?(/(?:,|\bAS)\s*\z/i) || rest.lstrip.start_with?(',')
+        return rest.match?(/\A\s+BY\b/i) if %w[GROUP ORDER].include?(token.upcase)
+        return rest.match?(/\A\s+[A-Za-z0-9_$\u0080-\u{10ffff}]+\s+AS\b/i) if token.casecmp?('WINDOW')
+
+        true
+      end
+      private_class_method :relation_keyword_boundary?
+
       # @api private
-      # Comments and literals must be stripped in a single combined pass —
-      # stripping them separately lets a comment marker inside a literal
-      # (`'-- '`) hide a real FROM clause from the gate. See
-      # {SqlNoiseStripper.strip_noise}.
-      def self.strip_noise(sql, dialect:)
-        SqlNoiseStripper.strip_noise(sql, dialect: dialect)
+      # Every view of the stripped SQL the FROM/JOIN scans must consider for
+      # MySQL executable comments (`/*! ... */`). {SqlNoiseStripper} leaves
+      # these forms in place because MySQL executes their body, but the lead
+      # grammars (FROM_CLAUSE/LEAD_IDENT/JOIN_REFERENCE) cannot start on a
+      # comment marker, so `SELECT * FROM /*!authorizations*/` surfaced no
+      # identifier and a blocked table slipped past TableGate. Each view
+      # interprets the form under one of its two possible semantics, mirroring
+      # SqlValidator#lock_clause_views: the whole construct replaced by its
+      # body (version guard satisfied — the body executes in place) and the
+      # whole construct dropped (guard unsatisfied — the form is inert
+      # whitespace). The stripped text itself is always scanned too: it keeps
+      # the preserved-form behavior the post-comma executable-comment shape
+      # relies on, and no comment body is ever hidden from the union.
+      #
+      # Over-detection on PostgreSQL (where the `/*!` form is a syntax error)
+      # is acceptable: the gate may reject more than a server would execute,
+      # never less.
+      def self.executable_comment_views(stripped)
+        [stripped,
+         stripped.gsub(EXECUTABLE_COMMENT_PATTERN) { Regexp.last_match[1] },
+         stripped.gsub(EXECUTABLE_COMMENT_PATTERN, ' ')]
       end
-      private_class_method :strip_noise
+      private_class_method :executable_comment_views
 
       # @api private
       def self.collect_join_identifiers(sql, results)
@@ -153,23 +248,30 @@ module Woods
 
       # @api private
       def self.collect_from_identifiers(sql, results)
-        sql.scan(FROM_CLAUSE) do
-          clause = Regexp.last_match[:clause]
-          split_top_level_commas(clause).each do |chunk|
-            ident = lead_identifier(chunk)
-            results << ident if ident
-          end
+        relation_factors(sql).each do |chunk|
+          ident = lead_identifier(chunk)
+          results << ident if ident
         end
       end
       private_class_method :collect_from_identifiers
 
+      # @api private
+      # Collect identifiers referenced by the standalone `TABLE name`
+      # statement (see {TABLE_STATEMENT}).
+      def self.collect_table_statement_identifiers(sql, results)
+        sql.scan(TABLE_STATEMENT) do
+          results << qualified_identifier(Regexp.last_match)
+        end
+      end
+      private_class_method :collect_table_statement_identifiers
+
       # @api private
       # Split a comma-separated list at depth 0, skipping commas inside parens.
       def self.split_top_level_commas(clause) # rubocop:disable Metrics/MethodLength
         depth = 0
         buf = +''
         parts = []
-        clause.each_char do |ch|
+        clause.scan(/"(?:[^"]|"")*"|`(?:[^`]|``)*`|''|./m).each do |ch|
           case ch
           when '('
             depth += 1
@@ -199,8 +301,9 @@ module Woods
       # PostgreSQL `ONLY` inheritance keyword is stripped first so it does
       # not hide the table.
       def self.lead_identifier(chunk)
-        stripped = chunk.to_s.strip.sub(ONLY_PREFIX, '')
-        return nil if stripped.empty?
+        stripped = chunk.to_s.strip.sub(/\A(?:\(\s*)+/, '').sub(ONLY_PREFIX, '')
+        stripped = stripped.sub(/\A(?:\(\s*)+/, '')
+        return nil if stripped.empty? || stripped.match?(/\A(?:SELECT|WITH|TABLE)\b/i)
 
         match = LEAD_IDENT.match(stripped)
         return nil unless match
@@ -213,14 +316,22 @@ module Woods
       # Combine a schema prefix with the table identifier captured by
       # JOIN_REFERENCE / LEAD_IDENT into a single `schema.table` string.
       def self.qualified_identifier(match)
-        table = match[:backtick] || match[:double] || match[:bare]
-        schema = match.named_captures.values_at(
-          'schema_bt', 'schema_dq', 'schema_bare',
-          'jschema_bt', 'jschema_dq', 'jschema_bare'
-        ).compact.first
+        captures = match.named_captures
+        table = decoded_identifier(*captures.values_at('backtick', 'double', 'bare'))
+        schema = decoded_identifier(captures['schema_bt'] || captures['jschema_bt'],
+                                    captures['schema_dq'] || captures['jschema_dq'],
+                                    captures['schema_bare'] || captures['jschema_bare'])
         schema ? "#{schema}.#{table}" : table
       end
       private_class_method :qualified_identifier
+
+      def self.decoded_identifier(backtick, double, bare)
+        return backtick.gsub('``', '`') if backtick
+        return double.gsub('""', '"') if double
+
+        bare
+      end
+      private_class_method :decoded_identifier
     end
   end
 end

data/lib/woods/console/sql_validator.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'woods/console/sql_noise_stripper'
+require 'woods/console/sqlite_read_guard'
 
 # @see Woods
 module Woods
@@ -23,7 +24,7 @@ module Woods
     #   validator.validate!('DELETE FROM users')            # raises SqlValidationError
     #   validator.valid?('SELECT 1')                       # => true
     #
-    class SqlValidator
+    class SqlValidator # rubocop:disable Metrics/ClassLength -- dialect views and delimiter checks supplement legacy validation
       # Forbidden statement prefixes (case-insensitive).
       #
       # Expanded beyond DML/DDL to cover:
@@ -95,17 +96,22 @@ module Woods
         [kw, /\b#{kw}\b/i]
       end.freeze
 
-      # Frozen map of dangerous function name => regex matching a call to that function.
-      # Used by {#check_dangerous_functions!}.
-      DANGEROUS_FUNCTION_REGEXES = DANGEROUS_FUNCTIONS.to_h do |func|
-        [func, /\b#{func}\s*\(/i]
-      end.freeze
+      # @param dialect [Symbol, nil] Known connection dialect, when available
+      def initialize(dialect: nil, mysql_modes: nil)
+        @dialect = dialect
+        @mysql_modes = mysql_modes
+      end
+
+      KNOWN_DIALECTS = %i[postgres mysql sqlite].freeze
 
       # @raise [SqlValidationError] if the SQL is not a safe read-only statement
       def validate!(sql)
         raise SqlValidationError, 'SQL is empty' if sql.nil? || sql.strip.empty?
 
         normalized = sql.strip
+        check_balanced_delimiters!(normalized)
+        check_supported_identifier_syntax!(normalized)
+        SqliteReadGuard.validate!(normalized) if @dialect == :sqlite
 
         # Reject multiple statements (semicolons not inside string literals)
         if contains_multiple_statements?(normalized)
@@ -146,14 +152,59 @@ module Woods
 
       private
 
+      def validation_views(sql)
+        dialects = @dialect ? [@dialect] : KNOWN_DIALECTS
+        dialects.flat_map do |dialect|
+          modes = if dialect == :mysql
+                    @mysql_modes ? [@mysql_modes] : SqlNoiseStripper::MYSQL_QUOTE_MODES
+                  else
+                    [{}]
+                  end
+          modes.map do |mode|
+            SqlNoiseStripper.strip_noise(sql, dialect: dialect, **mode) do |comment|
+              next unless comment.match?(/['"`$\\]/)
+
+              raise SqlValidationError,
+                    'Rejected: quoted executable comments have ambiguous SQL grammar; use ordinary SQL.'
+            end
+          end
+        end
+      end
+
+      # The policy scanners retain ordinary quoted identifiers but do not
+      # decode PostgreSQL Unicode escapes. Refuse that grammar before the
+      # adapter can resolve an identifier differently from the policy gates.
+      def check_supported_identifier_syntax!(sql)
+        return if @dialect && @dialect != :postgres
+
+        stripped = SqlNoiseStripper.strip_noise(sql, dialect: :postgres)
+        tokens = stripped.scan(/"(?:[^"]|"")*"|(?<![A-Za-z0-9_$\u0080-\u{10ffff}])[uU]&"/)
+        return unless tokens.any? { |token| token.start_with?('U&"', 'u&"') }
+
+        raise SqlValidationError,
+              'Rejected: PostgreSQL escaped identifiers are unsupported; use ordinary quoted identifiers ' \
+              'or a structured Console tool.'
+      end
+
+      def check_balanced_delimiters!(sql)
+        validation_views(sql).each do |stripped|
+          depth = 0
+          stripped.scan(/"(?:[^"]|"")*"|`(?:[^`]|``)*`|''|[()]/).each do |token|
+            depth += 1 if token == '('
+            depth -= 1 if token == ')'
+            raise SqlValidationError, 'Rejected: unbalanced SQL parentheses' if depth.negative?
+          end
+          raise SqlValidationError, 'Rejected: unbalanced SQL parentheses' unless depth.zero?
+        end
+      end
+
       # Check if the SQL contains multiple statements separated by semicolons.
       # Strips SQL comments and string literals before checking.
       #
       # @param sql [String]
       # @return [Boolean]
       def contains_multiple_statements?(sql)
-        stripped = SqlNoiseStripper.strip_noise(sql)
-        stripped.include?(';')
+        validation_views(sql).any? { |stripped| stripped.include?(';') }
       end
 
       # Check if the SQL starts with a forbidden keyword.
@@ -191,8 +242,17 @@ module Woods
       # @param sql [String]
       # @raise [SqlValidationError] if a dangerous function is found
       def check_dangerous_functions!(sql)
-        DANGEROUS_FUNCTION_REGEXES.each do |func, pattern|
-          raise SqlValidationError, "Rejected: dangerous function #{func} is not allowed" if sql.match?(pattern)
+        validation_views(sql).each do |view|
+          check_dangerous_functions_in_view!(view)
+        end
+      end
+
+      def check_dangerous_functions_in_view!(view)
+        view.scan(/(?:"([^"\n]+)"|`([^`]+)`|\b([a-z_][a-z0-9_]*))\s*\(/i) do |quoted, backtick, bare|
+          func = (quoted || backtick || bare).downcase
+          next unless DANGEROUS_FUNCTIONS.include?(func)
+
+          raise SqlValidationError, "Rejected: dangerous function #{func} is not allowed"
         end
       end
 

data/lib/woods/console/sqlite_read_guard.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'woods/console/sql_noise_stripper'
+require 'woods/console/sql_table_scanner'
+
+module Woods
+  module Console
+    # Refuse SQLite-specific syntax outside the scanner's supported grammar.
+    # This is a conservative read boundary, not a general-purpose SQL parser.
+    module SqliteReadGuard
+      SIMPLE_IDENTIFIER = /\A[A-Za-z_][A-Za-z0-9_]*\z/
+      UNSUPPORTED_SYNTAX = /\b(?:FROM|JOIN)(?=['"`(])/i
+      QUOTED_IDENTIFIER = /"(?:[^"]|"")*"|`(?:[^`]|``)*`/
+
+      # @param sql [String] SQL to execute on SQLite
+      # @raise [SqlValidationError] when an identifier or table factor cannot be checked
+      # @return [void]
+      def self.validate!(sql)
+        view = SqlNoiseStripper.strip_noise(sql, dialect: :sqlite)
+        refuse! if view.match?(UNSUPPORTED_SYNTAX)
+        SqlTableScanner.relation_factors(view).each do |factor|
+          factor.scan(QUOTED_IDENTIFIER) { |quoted| refuse! unless quoted[1...-1].match?(SIMPLE_IDENTIFIER) }
+          refuse! unless supported_factor?(factor.strip)
+        end
+      end
+
+      # A SELECT/WITH subquery has its own independently scanned table factors.
+      # Parenthesized table groups and string-quoted names are refused rather
+      # than silently omitted from the blocked-table scan.
+      def self.supported_factor?(factor)
+        return true if factor.match?(/\A\(\s*(?:SELECT|WITH)\b/i)
+
+        match = SqlTableScanner::LEAD_IDENT.match(factor)
+        match && factor[match.end(0)..].match?(/\A(?:\s|,|\)|\z)/)
+      end
+      private_class_method :supported_factor?
+
+      def self.refuse!
+        raise SqlValidationError,
+              'Rejected: unsupported SQLite identifier or table-reference syntax. ' \
+              'Use simple bare or double-quoted identifiers and SELECT subqueries.'
+      end
+      private_class_method :refuse!
+    end
+  end
+end

data/lib/woods/console/table_gate.rb

@@ -32,10 +32,10 @@ module Woods
 
       def active? = !(@blocked_bare.empty? && @blocked_qualified.empty?)
 
-      def check_sql!(sql)
+      def check_sql!(sql, dialect: nil)
         return unless active? && sql&.length&.positive?
 
-        SqlTableScanner.identifiers_in(sql).each do |raw|
+        SqlTableScanner.identifiers_in(sql, dialect: dialect).each do |raw|
           raise TableGateError, reject_message(raw) if blocked?(raw)
         end
       end

data/lib/woods/mcp/bearer_auth.rb

@@ -16,23 +16,31 @@ module Woods
       # Matches OWASP "session ID entropy" guidance (>= 128 bits ≈ 32 hex chars).
       MIN_TOKEN_LENGTH = 32
 
-      def initialize(app, token:)
-        raise ArgumentError, 'token must be a non-empty string' if token.nil? || token.empty?
-        if token.to_s.length < MIN_TOKEN_LENGTH
-          raise ArgumentError,
-                "bearer token must be at least #{MIN_TOKEN_LENGTH} characters " \
-                "(got #{token.to_s.length}); generate with `SecureRandom.hex(32)`"
-        end
+      # Rails 6 forwards middleware keywords as a positional options Hash.
+      def initialize(app, options = {}, **keywords)
+        raise TypeError, 'middleware options must be a Hash' unless options.is_a?(Hash)
+
+        initialize_options(app, **options, **keywords)
+      end
 
+      def initialize_options(app, token:, path: nil)
         @app = app
-        @token = token.to_s
+        @path = path
+        @token = token
+        validate_token!(token) unless token.respond_to?(:call)
+        @token = token.to_s unless token.respond_to?(:call)
       end
+      private :initialize_options
 
       def call(env)
+        return @app.call(env) if @path && !env['PATH_INFO'].to_s.start_with?(@path)
+
+        token = @token.respond_to?(:call) ? @token.call : @token
         header = env['HTTP_AUTHORIZATION'].to_s
-        presented = header.start_with?('Bearer ') ? header.sub(/\ABearer /, '') : nil
+        presented = header.b.match?(/\A[Bb][Ee][Aa][Rr][Ee][Rr] /) ? header.byteslice(7..) : nil
 
-        if presented && Rack::Utils.secure_compare(@token, presented)
+        if token.is_a?(String) && token.length >= MIN_TOKEN_LENGTH && presented &&
+           Rack::Utils.secure_compare(token, presented)
           @app.call(env)
         else
           [401,
@@ -40,6 +48,17 @@ module Woods
            [UNAUTHORIZED_BODY]]
         end
       end
+
+      private
+
+      def validate_token!(token)
+        raise ArgumentError, 'token must be a non-empty string' if token.nil? || token.to_s.empty?
+        return unless token.to_s.length < MIN_TOKEN_LENGTH
+
+        raise ArgumentError,
+              "bearer token must be at least #{MIN_TOKEN_LENGTH} characters " \
+              "(got #{token.to_s.length}); generate with `SecureRandom.hex(32)`"
+      end
     end
   end
 end

data/lib/woods/mcp/http_transport_options.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'uri'
+require_relative 'origin_policy'
 
 module Woods
   module MCP
@@ -8,16 +8,7 @@ module Woods
     # Empty configuration retains the SDK's strict loopback defaults.
     module HttpTransportOptions
       def self.for(origins)
-        normalized = Array(origins).map { |origin| origin.strip.downcase.delete_suffix('/') }.reject(&:empty?)
-        return {} if normalized.empty?
-
-        hosts = normalized.filter_map do |origin|
-          uri = URI.parse(origin)
-          uri.host if %w[http https].include?(uri.scheme)
-        rescue URI::InvalidURIError
-          nil
-        end
-        { allowed_origins: normalized, allowed_hosts: hosts.uniq }
+        OriginPolicy.new(allowed_origins: origins).transport_options
       end
     end
   end