Class: Hitch::AuthorizationsController

Inherits:
ApplicationController
  • Object
show all
Includes:
OauthFormAdmission
Defined in:
app/controllers/hitch/authorizations_controller.rb

Overview

GET /oauth/authorize — render consent screen POST /oauth/authorize — issue authorization code

Session-authenticated. Inherits the host's auth concern through Hitch::ApplicationController. If current_principal is nil, the controller redirects to Hitch.configuration.login_path (or returns 401 if unset).

RFC 8707 audience binding: the resource param sent by the client is persisted on the access token at issue time and validated at token-use time, satisfying the MCP authorization spec's audience MUST.

The flow's HTTP-free reasoning — parameter validation, client and redirect resolution, scope clamping, redirect construction — lives in Hitch::AuthorizationRequest; this controller renders its decisions.

Constant Summary collapse

AUTHORIZATION_PARAMETER_NAMES = 
%i[
  response_type
  client_id
  redirect_uri
  scope
  state
  code_challenge
  code_challenge_method
  resource
].freeze

Constants included from RequestAdmission

RequestAdmission::MAX_REQUEST_BODY_BYTES

Instance Method Summary collapse

Instance Method Details

#create ⇒ Object 



63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
 
# File 'app/controllers/hitch/authorizations_controller.rb', line 63

def create
  return require_principal! unless current_principal

  authorization = authorization_request(*AUTHORIZATION_PARAMETER_NAMES, :decision)
  return authorization_error(authorization) unless authorization.valid?

  # RFC 6749 §4.1.2.1: the user declining is reported to the validated
  # redirect_uri as access_denied — with iss, like every redirect.
  if authorization.deny?
    return redirect_to_client(
      authorization.redirect_uri_for(error: "access_denied", state: authorization.state)
    )
  end

  token = Hitch::AccessToken.create_authorization!(
    principal: current_principal,
    client_id: authorization.client_id,
    client_name: authorization.audit_client_name,
    redirect_uri: authorization.redirect_uri,
    code_challenge: authorization.code_challenge,
    code_challenge_method: authorization.code_challenge_method,
    resource_uri: authorization.resource,
    scopes: authorization.granted_scopes
  )

  redirect_to_client(
    authorization.redirect_uri_for(code: token.raw_authorization_code, state: authorization.state)
  )
end

#new ⇒ Object 



46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
 
# File 'app/controllers/hitch/authorizations_controller.rb', line 46

def new
  return require_principal! unless current_principal

  authorization = authorization_request(*AUTHORIZATION_PARAMETER_NAMES)
  return authorization_error(authorization) unless authorization.valid?

  @oauth_params = authorization.params
  @redirect_host = authorization.redirect_host
  @client_name = authorization.display_client_name
  @brand_name = Hitch.configuration.brand_name
  @resource = authorization.resource
  @localhost_only_client = authorization.localhost_only_client?
  # Show the user exactly what they're approving (clamped to the
  # server allowlist — never echo an unsupported requested scope).
  @scopes = authorization.granted_scopes
end