Class: McpAuthenticator::OAuthAuthResult

Inherits:
Struct
  • Object
show all
Includes:
ScopedServices
Defined in:
app/mcp/mcp_authenticator.rb

Overview

Result of successful authentication via Doorkeeper OAuth token.
Service access is the OAuth application's permitted_services ∩ the account's
own grant. Dynamic client registration (/oauth/register) is open, so an app's
permitted_services is usually empty — the account grant is what actually
bounds these clients.

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from ScopedServices

#can_access_service?, #scoped_to_account

Instance Attribute Details

#account ⇒ Object

Returns the value of attribute account

Returns:

  • (Object) —

    the current value of account



114
115
116
 
# File 'app/mcp/mcp_authenticator.rb', line 114

def 
  @account
end

#doorkeeper_token ⇒ Object

Returns the value of attribute doorkeeper_token

Returns:

  • (Object) —

    the current value of doorkeeper_token



114
115
116
 
# File 'app/mcp/mcp_authenticator.rb', line 114

def doorkeeper_token
  @doorkeeper_token
end

Instance Method Details

#account_name ⇒ Object 



117
118
119
 
# File 'app/mcp/mcp_authenticator.rb', line 117

def 
  .full_name
end

#effective_services ⇒ Object

Effective services: the app's scope (or all non-sensitive when the app is
unscoped) narrowed to the account's own grant. Sensitive services (e.g.
call_recordings) are never granted by the unscoped fallback and must be
named explicitly by the app.



134
135
136
137
138
139
140
141
142
143
 
# File 'app/mcp/mcp_authenticator.rb', line 134

def effective_services
  services = permitted_services
  app_scope = if services.any?
                (services | ApiAuthentication::DEFAULT_SERVICES).sort
              else
                (ApiAuthentication::UPSTREAM_SERVICES.keys - ApiAuthentication::SENSITIVE_SERVICES).sort
              end

  (app_scope)
end

#oauth? ⇒ Boolean

Returns:

  • (Boolean) 


121
122
123
 
# File 'app/mcp/mcp_authenticator.rb', line 121

def oauth?
  true
end

#permitted_services ⇒ Object

Raw permitted_services from the OAuth application (empty = app-unscoped)



126
127
128
 
# File 'app/mcp/mcp_authenticator.rb', line 126

def permitted_services
  doorkeeper_token.application&.permitted_services.presence || []
end