Class: Hitch::MetadataController

Inherits:
PublicEndpointController
  • Object
show all
Includes:
CorsSupport
Defined in:
app/controllers/hitch/metadata_controller.rb

Overview

OAuth + MCP discovery metadata:

GET /.well-known/oauth-authorization-server (RFC 8414)
GET /.well-known/oauth-protected-resource (RFC 9728)

Instance Method Summary collapse

Instance Method Details

#resource ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'app/controllers/hitch/metadata_controller.rb', line 35

def resource
  cache_discovery_metadata

  # RFC 9728 + 2026-07-28 MCP spec: PRM SHOULD include
  # scopes_supported so resource servers can echo per-tool
  # required scopes back in 403 challenges.
  render json: {
    resource: Hitch.configuration.resource_uri.presence || issuer_url,
    authorization_servers: [ issuer_url ],
    bearer_methods_supported: [ "header" ],
    scopes_supported: Hitch.configuration.supported_scopes
  }
end

#show ⇒ Object 



10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
 
# File 'app/controllers/hitch/metadata_controller.rb', line 10

def show
  cache_discovery_metadata

  render json: {
    issuer: issuer_url,
    authorization_endpoint: canonical_endpoint("/oauth/authorize"),
    token_endpoint: canonical_endpoint("/oauth/token"),
    revocation_endpoint: canonical_endpoint("/oauth/revoke"),
    response_types_supported: [ "code" ],
    grant_types_supported: Hitch::GrantTypes.supported,
    code_challenge_methods_supported: [ "S256" ],
    scopes_supported: Hitch.configuration.supported_scopes,
    token_endpoint_auth_methods_supported: Hitch::Client::TOKEN_ENDPOINT_AUTH_METHODS,
    # RFC 9207 §3. Advertising this is a promise the authorization
    # response WILL carry `iss` — a conformant client treats an
    # advertised-but-absent `iss` as a hard failure and refuses the
    # code exchange. It is only ever true because
    # AuthorizationsController#build_redirect_uri appends it
    # unconditionally; the two must never be separated.
    authorization_response_iss_parameter_supported: issuer_is_https?
  }.merge(dynamic_client_registration_advertisement)
    .merge(device_authorization_advertisement)
    .merge(client_id_metadata_advertisement)
end