mirror of
https://github.com/we-promise/sure.git
synced 2026-07-12 04:45:19 +00:00
* feat(mcp): add OAuth well-known discovery endpoints (RFC 8414 + RFC 9728) Serves /.well-known/oauth-protected-resource (RFC 9728) and /.well-known/oauth-authorization-server (RFC 8414) so MCP clients can auto-discover the authorization server. Both endpoints are unauthenticated and respect APP_URL for reverse-proxy deployments. * feat(mcp): add dynamic client registration endpoint (RFC 7591) POST /register creates a public Doorkeeper::Application on demand so MCP clients (e.g. Claude.ai) can self-register without manual setup. Validates redirect_uris (including blank entries), falls back to "MCP Client" name, returns no client_secret (public client, PKCE only). Rate-limited to 10 registrations/min/IP via Rack::Attack. * feat(mcp): authenticate via Doorkeeper OAuth2, keep MCP_API_TOKEN as fallback MCP endpoint now accepts OAuth2 Bearer tokens issued by Doorkeeper. Falls back to the existing MCP_API_TOKEN env-var flow so self-hosted deployments are not broken. Requires MCP_OAUTH_ENABLED or MCP_API_TOKEN to be set — the endpoint returns 503 otherwise. - OauthBase concern provides APP_URL-aware configured_base_url (trailing slash stripped to prevent double-slash URLs) - Bearer scheme parsed case-insensitively (RFC 7235) - Only read_write scope accepted — read scope would allow mutating tools (CreateGoal, ImportBankStatement), so read-only tokens are rejected - Deactivated users rejected even with a valid Doorkeeper token - WWW-Authenticate header on 401 points to RFC 9728 resource metadata - SHA-256 digest used for constant-time env-var comparison - Rack::Attack throttle added for POST /register - Routes wired: /.well-known/*, /register, use_doorkeeper * fix(mcp): disable Turbo on OAuth consent form for external redirect URIs Turbo was intercepting the authorization form POST and XHR-fetching the redirect_uri (e.g. https://claude.ai/api/mcp/auth_callback), which CORS blocks. Extend the existing turbo_disabled guard to cover any redirect_uri that doesn't originate from the app itself. * feat(mcp): add Settings::McpController with connected clients view - Settings > MCP page (under Advanced) shows the MCP server URL with copy button and step-by-step instructions for connecting Claude.ai - Lists active non-mobile OAuth tokens with app name and revoke action; mobile device tokens are excluded to prevent accidental disconnection - Removes the MCP_OAUTH_ENABLED env-var gate — OAuth auth is always available since Doorkeeper handles consent; MCP_API_TOKEN remains as a self-hosted fallback * fix(mcp): remove client_credentials from grant_types_supported metadata Only authorization_code is supported by the registration endpoint. Advertising client_credentials was misleading — a client that reads the metadata and attempts that flow would get an application with the wrong grant type.
117 lines
5.3 KiB
Plaintext
117 lines
5.3 KiB
Plaintext
<%
|
|
nav_sections = [
|
|
{
|
|
header: t(".general_section_title"),
|
|
items: [
|
|
{ label: t(".accounts_label"), path: accounts_path, icon: "layers" },
|
|
{ label: t(".bank_sync_label"), path: settings_providers_path, icon: "banknote", if: Current.user&.admin? },
|
|
{ label: t(".preferences_label"), path: settings_preferences_path, icon: "bolt" },
|
|
{ label: t(".appearance_label"), path: settings_appearance_path, icon: "palette" },
|
|
{ label: t(".profile_label"), path: settings_profile_path, icon: "circle-user" },
|
|
{ label: t(".security_label"), path: settings_security_path, icon: "shield-check" },
|
|
{ label: t(".payment_label"), path: settings_payment_path, icon: "circle-dollar-sign", if: !self_hosted? && Current.family&.can_manage_subscription? }
|
|
]
|
|
},
|
|
{
|
|
header: t(".transactions_section_title"),
|
|
items: [
|
|
{ label: t(".categories_label"), path: categories_path, icon: "shapes" },
|
|
{ label: t(".tags_label"), path: tags_path, icon: "tags" },
|
|
{ label: t(".rules_label"), path: rules_path, icon: "git-branch" },
|
|
{ label: t(".merchants_label"), path: family_merchants_path, icon: "store" },
|
|
{ label: t(".recurring_transactions_label"), path: recurring_transactions_path, icon: "repeat" },
|
|
{ label: t(".statement_vault_label"), path: account_statements_path, icon: "archive", if: Current.user&.admin? }
|
|
]
|
|
},
|
|
(
|
|
Current.user&.admin? ? {
|
|
header: t(".advanced_section_title"),
|
|
items: [
|
|
{ label: t(".ai_prompts_label"), path: settings_ai_prompts_path, icon: "bot" },
|
|
{ label: t(".llm_usage_label"), path: settings_llm_usage_path, icon: "activity" },
|
|
{ label: t(".api_keys_label"), path: settings_api_key_path, icon: "key" },
|
|
{ label: t(".mcp_label"), path: settings_mcp_path, icon: "plug" },
|
|
{ label: t(".debug_label", default: "Debug"), path: settings_debug_path, icon: "bug", if: Current.user&.super_admin? },
|
|
{ label: t(".self_hosting_label"), path: settings_hosting_path, icon: "database", if: self_hosted? },
|
|
{ label: t(".imports_label"), path: imports_path, icon: "download" },
|
|
{ label: t(".exports_label"), path: family_exports_path, icon: "upload" },
|
|
{ label: t(".sso_providers_label"), path: admin_sso_providers_path, icon: "key-round", if: Current.user&.super_admin? },
|
|
{ label: t(".users_label"), path: admin_users_path, icon: "users", if: Current.user&.super_admin? }
|
|
]
|
|
} : nil
|
|
),
|
|
{
|
|
header: t(".other_section_title"),
|
|
items: [
|
|
{ label: t(".guides_label"), path: settings_guides_path, icon: "book-open" },
|
|
{ label: t(".whats_new_label"), path: changelog_path, icon: "box" },
|
|
{ label: t(".feedback_label"), path: feedback_path, icon: "megaphone" }
|
|
]
|
|
}
|
|
]
|
|
%>
|
|
|
|
<div class="space-y-4">
|
|
<div class="hidden lg:flex items-center gap-2 p-1.5">
|
|
<%= render DS::Link.new(
|
|
text: t("settings.settings_nav_link_large.previous"),
|
|
icon: "chevron-left",
|
|
href: previous_path,
|
|
variant: "ghost",
|
|
) %>
|
|
<%= link_to previous_path, class: "hidden md:block uppercase bg-surface-inset-hover rounded-sm px-1 py-0.5 text-xs text-secondary shadow-sm ml-1 pointer-events-none", data: { controller: "hotkey", hotkey: "Escape" } do %>
|
|
<kbd>esc</kbd>
|
|
<% end %>
|
|
</div>
|
|
<nav class="space-y-4 hidden md:block">
|
|
<% nav_sections.compact.each do |section| %>
|
|
<section class="space-y-2">
|
|
<div class="flex items-center gap-2 px-3">
|
|
<h3 class="uppercase text-secondary font-medium text-xs"><%= section[:header] %></h3>
|
|
<%= render "shared/ruler", classes: "w-full" %>
|
|
</div>
|
|
<ul class="space-y-1">
|
|
<% section[:items].each do |item| %>
|
|
<% next if item[:if] == false %>
|
|
<li>
|
|
<%= render "settings/settings_nav_item", name: item[:label], path: item[:path], icon: item[:icon] %>
|
|
</li>
|
|
<% end %>
|
|
</ul>
|
|
</section>
|
|
<% end %>
|
|
<section>
|
|
<%= button_to session_path(Current.session), method: :delete, class: "flex items-center gap-2 px-3 py-2 rounded-lg text-sm text-destructive hover:bg-surface-hover w-full" do %>
|
|
<%= icon("log-out", color: "current") %>
|
|
<span><%= t(".logout") %></span>
|
|
<% end %>
|
|
</section>
|
|
</nav>
|
|
<nav class="space-y-4 overflow-x-auto md:hidden no-scrollbar overscroll-none" id="mobile-settings-nav" data-controller="preserve-scroll scroll-on-connect">
|
|
<ul class="flex flex-nowrap space-x-1">
|
|
<li>
|
|
<%= render DS::Link.new(
|
|
text: t("settings.settings_nav_link_large.previous"),
|
|
icon: "chevron-left",
|
|
href: previous_path,
|
|
variant: "ghost",
|
|
) %>
|
|
</li>
|
|
<% nav_sections.compact.each do |section| %>
|
|
<% section[:items].each do |item| %>
|
|
<% next if item[:if] == false %>
|
|
<li>
|
|
<%= render "settings/settings_nav_item", name: item[:label], path: item[:path], icon: item[:icon] %>
|
|
</li>
|
|
<% end %>
|
|
<% end %>
|
|
<li>
|
|
<%= button_to session_path(Current.session), method: :delete, class: "flex items-center gap-2 px-3 py-2 rounded-lg text-sm text-destructive hover:bg-surface-hover w-full" do %>
|
|
<%= icon("log-out", color: "current") %>
|
|
<span><%= t(".logout") %></span>
|
|
<% end %>
|
|
</li>
|
|
</ul>
|
|
</nav>
|
|
</div>
|