Module: McpAuthenticator::ScopedServices

Included in:

AuthResult, OAuthAuthResult

Defined in:

app/mcp/mcp_authenticator.rb

Overview

Shared service scoping for both auth paths.

Every request is scoped by TWO gates: what the credential (token / OAuth app)
asks for, and what the user behind it is allowed. A credential can never
grant more than its owner has — so the effective set is the intersection.
Without this, an OAuth app with empty permitted_services would hand any
mcp_access employee every non-sensitive service regardless of who they are.

Instance Method Summary

• #can_access_service?(service_key) ⇒ Boolean
• #scoped_to_account(credential_services) ⇒ Array<String>

  That scope narrowed to the account's own grant.

Instance Method Details

#can_access_service?(service_key) ⇒ Boolean

Parameters:

• service_key (String, Symbol)

Returns:

• (Boolean)

# File 'app/mcp/mcp_authenticator.rb', line 84

def can_access_service?(service_key)
  effective_services.include?(service_key.to_s)
end

#scoped_to_account(credential_services) ⇒ Array<String>

Returns that scope narrowed to the account's own grant.

Parameters:

• credential_services (Array<String>) —

  scope from the token/OAuth app.

Returns:

• (Array<String>) —

  that scope narrowed to the account's own grant.

# File 'app/mcp/mcp_authenticator.rb', line 78

def scoped_to_account(credential_services)
  (credential_services & account.effective_mcp_services).sort
end