woods 1.6.2 → 1.6.4

data/lib/woods/mcp/origin_guard.rb

@@ -2,7 +2,7 @@
 
 require 'json'
 
-require_relative '../util/host_guard'
+require_relative 'origin_policy'
 
 module Woods
   module MCP
@@ -21,17 +21,12 @@ module Woods
     # also requiring Host to appear in the allow-list (or to be a loopback
     # address), we close that gap even when Rails is bound to 0.0.0.0.
     #
-    # Port-matching: an allow-list entry WITHOUT a port (`http://localhost`)
-    # matches that host on any port. An entry WITH a port (`http://localhost:3000`)
-    # requires an exact port match. Specify explicit ports when port isolation
-    # matters.
+    # Cross-origin entries match exact origins, with equivalent default ports.
+    # Portless entries also permit same-authority requests on other ports.
     #
     # Also answers CORS preflight (OPTIONS) with the matching allow-list.
     class OriginGuard
-      DEFAULT_ALLOWED = %w[
-        http://localhost http://127.0.0.1 http://[::1]
-        https://localhost https://127.0.0.1 https://[::1]
-      ].freeze
+      DEFAULT_ALLOWED = OriginPolicy::DEFAULT_ORIGINS
 
       # Hosts that always pass the Host-header check even without an explicit
       # allow-list entry — they resolve to loopback by definition and cannot
@@ -39,7 +34,7 @@ module Woods
       LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1 [::1]].freeze
 
       ALLOWED_METHODS = 'GET, POST, DELETE, OPTIONS'
-      ALLOWED_HEADERS = 'Authorization, Content-Type, Mcp-Session-Id'
+      ALLOWED_HEADERS = 'Authorization, Content-Type, MCP-Protocol-Version, Mcp-Session-Id'
 
       # Response bodies are emitted as constants so the rejected Origin /
       # Host value is NEVER echoed back to the caller — preventing a
@@ -48,65 +43,44 @@ module Woods
       FORBIDDEN_BODY = { jsonrpc: '2.0', error: { code: -32_002, message: 'Origin not allowed' }, id: nil }.to_json.freeze
       FORBIDDEN_HOST_BODY = { jsonrpc: '2.0', error: { code: -32_002, message: 'Host not allowed' }, id: nil }.to_json.freeze
 
-      def initialize(app, allowed_origins: nil)
+      attr_reader :policy
+
+      # Rails 6 passes middleware keyword options as a positional Hash on Ruby 3.
+      def initialize(app, options = {}, **keywords)
+        raise TypeError, 'middleware options must be a Hash' unless options.is_a?(Hash)
+
+        initialize_options(app, **options, **keywords)
+      end
+
+      def initialize_options(app, allowed_origins: nil, policy: nil, path: nil)
         @app = app
-        @allowed = Array(allowed_origins).compact.reject { |o| o.to_s.strip.empty? }.map { |o| normalize(o) }
-        @allowed = DEFAULT_ALLOWED.dup if @allowed.empty?
-        @allowed_hosts = @allowed.map { |o| extract_host(o) }.compact.uniq
+        @path = path
+        origins = allowed_origins.respond_to?(:call) ? allowed_origins.call : allowed_origins
+        @policy = policy || OriginPolicy.new(allowed_origins: origins)
       end
+      private :initialize_options
 
       def call(env)
+        return @app.call(env) if @path && !env['PATH_INFO'].to_s.start_with?(@path)
+
         origin = env['HTTP_ORIGIN']
         method = env['REQUEST_METHOD']
         host = env['HTTP_HOST']
 
-        return forbidden if origin && !origin_allowed?(origin)
-        return forbidden_host if host && !host_allowed?(host)
+        return forbidden unless policy.origin_allowed?(origin, host: host)
+        return forbidden_host unless policy.host_allowed?(host)
 
         return preflight(origin) if method == 'OPTIONS'
 
         status, headers, body = @app.call(env)
-        headers = cors_headers(origin).merge(headers) if origin && origin_allowed?(origin)
+        headers = cors_headers(origin).merge(headers) if origin
         [status, headers, body]
       end
 
       private
 
-      def normalize(origin)
-        origin.to_s.sub(%r{/\z}, '').downcase
-      end
-
-      def extract_host(origin)
-        host = origin.to_s.sub(%r{\Ahttps?://}, '').sub(%r{/.*\z}, '').downcase
-        host.empty? ? nil : host
-      end
-
-      def host_allowed?(host)
-        # Canonicalize (strip port, trailing dot, IPv6 brackets) via the
-        # shared helper so Qdrant and OriginGuard stay in sync on bypass
-        # notations. `normalized` keeps the port for literal allow-list
-        # lookups; `bare` drops it for loopback matching.
-        normalized = host.to_s.downcase.sub(/\.\z/, '')
-        bare = Util::HostGuard.canonicalize(host)
-
-        # Reject non-canonical numeric hosts. Net::HTTP / getaddrinfo
-        # would happily resolve `0x7f000001` or `2130706433` to 127.0.0.1,
-        # bypassing the loopback allow-list.
-        return false if Util::HostGuard.suspicious_numeric_host?(bare)
-
-        return true if LOOPBACK_HOSTS.include?(bare)
-
-        @allowed_hosts.include?(normalized) || @allowed_hosts.include?(bare)
-      end
-
-      def origin_allowed?(origin)
-        return false if origin.match?(/[[:cntrl:]]/)
-
-        @allowed.include?(normalize(origin)) || @allowed.include?(normalize(origin).sub(/:\d+\z/, ''))
-      end
-
       def preflight(origin)
-        headers = origin && origin_allowed?(origin) ? cors_headers(origin) : {}
+        headers = origin ? cors_headers(origin) : {}
         [204, headers, []]
       end
 

data/lib/woods/mcp/origin_policy.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require 'uri'
+require_relative '../util/host_guard'
+
+module Woods
+  module MCP
+    # One immutable policy for the outer Rack guard and the legacy MCP SDK.
+    # Keep SDK rebinding protection active and pass original request headers.
+    class OriginPolicy
+      LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+      DEFAULT_ORIGINS = %w[
+        http://localhost http://127.0.0.1 http://[::1]
+        https://localhost https://127.0.0.1 https://[::1]
+      ].freeze
+
+      attr_reader :transport_options
+
+      def initialize(allowed_origins: nil)
+        entries = Array(allowed_origins).compact.reject do |entry|
+          entry.to_s.valid_encoding? && entry.to_s.strip.empty?
+        end
+        @explicit = entries.map { |entry| configured_origin(entry) }.uniq.freeze
+        @allowed = @explicit.empty? ? DEFAULT_ORIGINS : @explicit
+        @hosts = @explicit.map do |origin|
+          host = authority(origin)
+          (host.end_with?(']') ? host[1...-1] : host).freeze
+        end.uniq.freeze
+        @transport_options = if @explicit.empty?
+                               {}.freeze
+                             else
+                               { allowed_origins: transport_origins, allowed_hosts: @hosts }.freeze
+                             end
+        freeze
+      end
+
+      def host_allowed?(host)
+        return true if host.nil?
+        return false unless host.is_a?(String) && host.valid_encoding?
+
+        parsed = parsed_origin("http://#{host}")
+        return false unless parsed
+
+        hostname = parsed.hostname.downcase
+        return false if Util::HostGuard.suspicious_numeric_host?(hostname)
+        return true if LOOPBACK_HOSTS.include?(hostname)
+
+        @hosts.include?(host.downcase) || @hosts.include?(hostname)
+      end
+
+      def origin_allowed?(origin, host:)
+        return true if origin.nil?
+        return false unless parsed_origin(origin)
+
+        normalized = normalized_origin(origin)
+        return true if @explicit.include?(normalized)
+        return false unless @allowed.include?(normalized) || @allowed.include?(normalized.sub(/:\d+\z/, ''))
+        return false unless host.is_a?(String) && host.valid_encoding?
+
+        default_port = normalized.start_with?('https://') ? ':443' : ':80'
+        authority(normalized).delete_suffix(default_port) == host.downcase.delete_suffix(default_port)
+      end
+
+      private
+
+      def configured_origin(entry)
+        raw = entry.to_s
+        value = raw.strip.downcase.delete_suffix('/') if raw.valid_encoding?
+        unless parsed_origin(value)
+          label = raw.b.byteslice(0, 160).inspect
+          raise ArgumentError, "Invalid MCP allowed origin #{label}: expected http(s)://host[:port] without a path"
+        end
+
+        normalized_origin(value).freeze
+      end
+
+      def normalized_origin(origin)
+        value = origin.downcase
+        value.delete_suffix(value.start_with?('https://') ? ':443' : ':80')
+      end
+
+      # SDK 0.23 and 0.25 compare explicit entries literally. Both default-port
+      # spellings are needed for cross-origin requests; same-authority matching
+      # is otherwise performed independently by both layers.
+      def transport_origins
+        @explicit.flat_map do |origin|
+          parsed = parsed_origin(origin)
+          port = parsed.scheme == 'https' ? 443 : 80
+          parsed.port == port ? [origin, "#{origin}:#{port}"] : [origin]
+        end.uniq.map(&:freeze).freeze
+      end
+
+      def authority(origin)
+        origin.sub(%r{\Ahttps?://}, '')
+      end
+
+      def parsed_origin(origin)
+        return unless origin.is_a?(String) && origin.valid_encoding? && origin.ascii_only?
+        return if origin.match?(/[[:space:][:cntrl:]]/)
+
+        parsed = URI.parse(origin)
+        return unless %w[http https].include?(parsed.scheme&.downcase)
+        return unless parsed.host && !parsed.host.empty?
+        return unless parsed.path.to_s.empty? && !parsed.userinfo && !parsed.query && !parsed.fragment
+        return unless parsed.port&.between?(1, 65_535)
+
+        parsed
+      rescue URI::InvalidURIError, ArgumentError
+        nil
+      end
+    end
+  end
+end

data/lib/woods/railtie.rb

@@ -34,7 +34,7 @@ module Woods
       )
     end
 
-    initializer 'woods.console_mcp' do |app|
+    initializer 'woods.console_mcp' do |app| # rubocop:disable Metrics/BlockLength -- validates and scopes the legacy HTTP middleware stack
       config = Woods.configuration
       next unless config.console_mcp_enabled
 
@@ -63,15 +63,22 @@ module Woods
         next
       end
 
+      if token.to_s.length < Woods::MCP::BearerAuth::MIN_TOKEN_LENGTH
+        raise Woods::ConfigurationError, '[Woods Console] console_mcp_token must be at least 32 characters.'
+      end
+
       # Origin guard first — rejects cross-origin POSTs before any auth cost.
       # BearerAuth next — requires `Authorization: Bearer <token>` on every request.
-      app.middleware.use(Woods::MCP::OriginGuard, allowed_origins: Array(config.console_mcp_allowed_origins))
-      app.middleware.use(Woods::MCP::BearerAuth, token: token)
+      origin_policy = Woods::MCP::OriginPolicy.new(allowed_origins: config.console_mcp_allowed_origins)
+      app.middleware.use(Woods::MCP::OriginGuard, policy: origin_policy, path: config.console_mcp_path)
+      app.middleware.use(Woods::MCP::BearerAuth,
+                         token: -> { Woods.configuration.console_mcp_token }, path: config.console_mcp_path)
 
       app.middleware.use(
         Woods::Console::RackMiddleware,
         path: config.console_mcp_path,
-        embedded_read_tools: config.console_embedded_read_tools
+        embedded_read_tools: config.console_embedded_read_tools,
+        origin_policy: origin_policy
       )
     end
   end

data/lib/woods/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Woods
-  VERSION = '1.6.2'
+  VERSION = '1.6.4'
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: woods
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.6.4
 platform: ruby
 authors:
 - Leah Armstrong
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-09-18 00:00:00.000000000 Z
+date: 2026-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: mcp
@@ -152,6 +152,7 @@ files:
 - lib/woods/cache/solid_cache_store.rb
 - lib/woods/chunking/chunk.rb
 - lib/woods/chunking/semantic_chunker.rb
+- lib/woods/console/adapter_family.rb
 - lib/woods/console/adapters/cache_adapter.rb
 - lib/woods/console/adapters/good_job_adapter.rb
 - lib/woods/console/adapters/job_adapter.rb
@@ -178,8 +179,10 @@ files:
 - lib/woods/console/scope_predicate_parser.rb
 - lib/woods/console/server.rb
 - lib/woods/console/sql_noise_stripper.rb
+- lib/woods/console/sql_output_policy.rb
 - lib/woods/console/sql_table_scanner.rb
 - lib/woods/console/sql_validator.rb
+- lib/woods/console/sqlite_read_guard.rb
 - lib/woods/console/table_gate.rb
 - lib/woods/console/tool_specs.rb
 - lib/woods/console/tools/tier1.rb
@@ -280,6 +283,7 @@ files:
 - lib/woods/mcp/http_transport_options.rb
 - lib/woods/mcp/index_reader.rb
 - lib/woods/mcp/origin_guard.rb
+- lib/woods/mcp/origin_policy.rb
 - lib/woods/mcp/provider_probe.rb
 - lib/woods/mcp/renderers/claude_renderer.rb
 - lib/woods/mcp/renderers/json_renderer.rb
@@ -359,10 +363,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/lost-in-the/woods
-  source_code_uri: https://github.com/lost-in-the/woods/tree/v1.6.2
-  changelog_uri: https://github.com/lost-in-the/woods/blob/v1.6.2/CHANGELOG.md
+  source_code_uri: https://github.com/lost-in-the/woods/tree/v1.6.4
+  changelog_uri: https://github.com/lost-in-the/woods/blob/v1.6.4/CHANGELOG.md
   bug_tracker_uri: https://github.com/lost-in-the/woods/issues
-  documentation_uri: https://github.com/lost-in-the/woods/tree/v1.6.2/docs
+  documentation_uri: https://github.com/lost-in-the/woods/tree/v1.6.4/docs
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []