Class: TalkToYourApp::Auth::Middleware

Inherits:
Object
  • Object
show all
Defined in:
lib/talk_to_your_app/auth/middleware.rb

Overview

Rack middleware sitting in front of the MCP transport. It authenticates every request and establishes the per-request principal. Requests that fail never reach the transport. Host/Origin validation (DNS-rebinding protection per MCP spec 2025-11-25) is owned by the SDK transport, which receives allowed_hosts/allowed_origins and handles same-origin and case-folding — no duplicate check here.

Instance Method Summary collapse

Constructor Details

#initialize(app) ⇒ Middleware

Returns a new instance of Middleware.



17
18
19
 
# File 'lib/talk_to_your_app/auth/middleware.rb', line 17

def initialize(app)
  @app = app
end

Instance Method Details

#call(env) ⇒ Object 



21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
 
# File 'lib/talk_to_your_app/auth/middleware.rb', line 21

def call(env)
  config = TalkToYourApp.configuration

  principal = authenticate(env, config)
  return unauthorized(config) if principal.nil?

  TalkToYourApp::Current.principal = principal
  TalkToYourApp::Current.session_id = env["HTTP_MCP_SESSION_ID"]
  TalkToYourApp::Current.ip = Rack::Request.new(env).ip
  env["ttya.principal"] = principal

  @app.call(env)
ensure
  TalkToYourApp::Current.reset
end