Module: Iron::Oauth::Resource

Defined in:
app/models/iron/oauth/resource.rb

Overview

The MCP endpoint is the only resource this authorization server protects. RFC 8707 resource indicators bind every grant and token to it, so a token a client obtained while talking to a malicious MCP server that advertised this authorization server can never be replayed against this one.

Class Method Summary collapse

Class Method Details

.normalize(resource) ⇒ Object

Scheme and host compare case-insensitively; the path stays byte-exact.



17
18
19
20
21
22
23
24
 
# File 'app/models/iron/oauth/resource.rb', line 17

def self.normalize(resource)
  uri = URI.parse(resource.to_s)
  uri.scheme = uri.scheme.downcase if uri.scheme
  uri.host = uri.host.downcase if uri.host
  uri.to_s
rescue URI::Error
  resource
end

.permitted?(resource, base_url:) ⇒ Boolean

Returns:

  • (Boolean) 


12
13
14
 
# File 'app/models/iron/oauth/resource.rb', line 12

def self.permitted?(resource, base_url:)
  resource.is_a?(String) && normalize(resource) == url(base_url)
end

.url(base_url) ⇒ Object 



8
9
10
 
# File 'app/models/iron/oauth/resource.rb', line 8

def self.url(base_url)
  normalize("#{base_url}#{Iron::Engine.routes.url_helpers.api_mcp_path}")
end