Class: RubyLLM::MCP::Auth::SessionManager

Inherits:
Object
  • Object
show all
Defined in:
lib/ruby_llm/mcp/auth/session_manager.rb

Overview

Service for managing OAuth session state (PKCE and CSRF state) Handles creation, validation, and cleanup of temporary session data

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(storage) ⇒ SessionManager

Returns a new instance of SessionManager.



11
12
13
 
# File 'lib/ruby_llm/mcp/auth/session_manager.rb', line 11

def initialize(storage)
  @storage = storage
end

Instance Attribute Details

#storage ⇒ Object (readonly)

Returns the value of attribute storage.



9
10
11
 
# File 'lib/ruby_llm/mcp/auth/session_manager.rb', line 9

def storage
  @storage
end

Instance Method Details

#cleanup_session(server_url) ⇒ Object

Clean up temporary session data

Parameters:

  • server_url (String) —

    MCP server URL



47
48
49
50
 
# File 'lib/ruby_llm/mcp/auth/session_manager.rb', line 47

def cleanup_session(server_url)
  storage.delete_pkce(server_url)
  storage.delete_state(server_url)
end

#create_session(server_url) ⇒ Hash

Create a new OAuth session with PKCE and CSRF state

Parameters:

  • server_url (String) —

    MCP server URL

Returns:

  • (Hash) —

    session data with :pkce and :state



18
19
20
21
22
23
24
25
26
 
# File 'lib/ruby_llm/mcp/auth/session_manager.rb', line 18

def create_session(server_url)
  pkce = PKCE.new
  state = SecureRandom.urlsafe_base64(CSRF_STATE_SIZE)

  storage.set_pkce(server_url, pkce)
  storage.set_state(server_url, state)

  { pkce: pkce, state: state }
end

#validate_and_retrieve_session(server_url, state) ⇒ Hash

Validate state parameter and retrieve session data

Parameters:

  • server_url (String) —

    MCP server URL

  • state (String) —

    state parameter from callback

Returns:

  • (Hash) —

    session data with :pkce and :client_info

Raises:

  • (ArgumentError) —

    if state is invalid



33
34
35
36
37
38
39
40
41
42
43
 
# File 'lib/ruby_llm/mcp/auth/session_manager.rb', line 33

def validate_and_retrieve_session(server_url, state)
  stored_state = storage.get_state(server_url)
  unless stored_state && Security.secure_compare(stored_state, state)
    raise ArgumentError, "Invalid state parameter"
  end

  {
    pkce: storage.get_pkce(server_url),
    client_info: storage.get_client_info(server_url)
  }
end