Class: VectorMCP::Security::RequestAuthenticator

Inherits:
Object
  • Object
show all
Defined in:
lib/vector_mcp/security/request_authenticator.rb

Overview

Authenticates one request-scoped invocation and runs the auth middleware hooks. The resolved identity is cached only on Invocation, never on the shared Session.

Constant Summary collapse

OPERATION_TYPES = 
{
  "tools/list" => :tool_list,
  "tools/call" => :tool_call,
  "resources/list" => :resource_list,
  "resources/read" => :resource_read,
  "prompts/list" => :prompt_list,
  "prompts/get" => :prompt_get,
  "roots/list" => :root_list
}.freeze
OPERATION_NAME_PARAMS = 
{
  "tools/call" => "name",
  "resources/read" => "uri",
  "prompts/get" => "name"
}.freeze

Class Method Summary collapse

Class Method Details

.authenticate!(session, server, operation_type:, operation_name:) ⇒ Object

Authenticate the current request and return its resolved identity.



38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
 
# File 'lib/vector_mcp/security/request_authenticator.rb', line 38

def authenticate!(session, server, operation_type:, operation_name:)
  return session.security_context if authentication_resolved?(session)

  context = nil
  request = request_context_for(session)
  context = auth_context(operation_type, operation_name, request.to_h, session, server)
  context = server.middleware_manager.execute_hooks(:before_auth, context)
  raise context.error if context.error?

  session_context = server.security_middleware.authenticate_request(context.params)
  session.security_context = session_context

  raise VectorMCP::UnauthorizedError, "Authentication required" if server.auth_manager.required? && !session_context.authenticated?

  context.result = session_context
  server.middleware_manager.execute_hooks(:after_auth, context)
  session_context
rescue StandardError => e
  handle_auth_error(e, context, server)
end

.authenticate_message!(method, params, session, server) ⇒ Object

Authenticate a protocol message using operation metadata derived from its method.



29
30
31
32
33
34
35
 
# File 'lib/vector_mcp/security/request_authenticator.rb', line 29

def authenticate_message!(method, params, session, server)
  operation_type = OPERATION_TYPES.fetch(method, :request)
  name_param = OPERATION_NAME_PARAMS[method]
  operation_name = name_param ? params[name_param] || params[name_param.to_sym] : method

  authenticate!(session, server, operation_type: operation_type, operation_name: operation_name)
end

.request_context_for(session) ⇒ Object

Extract the immutable request context carried by the invocation/session.



60
61
62
63
64
65
66
67
 
# File 'lib/vector_mcp/security/request_authenticator.rb', line 60

def request_context_for(session)
  unless session.respond_to?(:request_context) && session.request_context
    raise VectorMCP::InternalError,
          "Session missing request_context - transport layer integration error. Session ID: #{session.id}"
  end

  session.request_context
end