colorlink/advanced-mcp-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: add Bearer token auth for Claude.ai connector compatibility

Browse Source
This commit is contained in:
colorlink
2026-05-08 04:02:53 +00:00
parent 1879cca1e4
commit 0df02bd8a1
1 changed files with 44 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/Core/Auth.php
+44 -23
View File
@@ -5,8 +5,13 @@ namespace AskTamMCP\Core;
defined('ABSPATH') || exit; defined('ABSPATH') || exit;
/** /**
* Authenticates incoming requests by API key. * Authenticates incoming requests.
* Validates key existence, active status, and scope. *
* Supports two auth methods:
* 1. Bearer token (Authorization: Bearer <key>) — for Claude.ai connectors + standard OAuth clients
* 2. X-MCP-API-Key header — for direct API / OpenAI GPT Actions
*
* Both resolve to the same DB key row. Bearer is checked first.
*/ */
class Auth { class Auth {
@@ -16,17 +21,18 @@ class Auth {
public const SCOPE_WOOCOMMERCE = 'woocommerce'; public const SCOPE_WOOCOMMERCE = 'woocommerce';
/** /**
* Validate the API key from request headers and check required scope. * Validate request auth and check required scope.
* * Returns the key row on success, WP_Error on failure.
* @param \WP_REST_Request $request
* @param string $requiredScope
* @return \WP_Error|array WP_Error on failure, key row array on success
*/ */
public static function validate(\WP_REST_Request $request, string $requiredScope = self::SCOPE_READ): \WP_Error|array { public static function validate(\WP_REST_Request $request, string $requiredScope = self::SCOPE_READ): \WP_Error|array {
$apiKey = $request->get_header('X-MCP-API-Key'); $apiKey = self::extractKey($request);
if (empty($apiKey)) { if (empty($apiKey)) {
return new \WP_Error('missing_api_key', 'X-MCP-API-Key header is required.', ['status' => 401]); return new \WP_Error(
'missing_api_key',
'Authentication required. Provide key via: Authorization: Bearer <key> or X-MCP-API-Key: <key>',
['status' => 401]
);
} }
global $wpdb; global $wpdb;
@@ -40,33 +46,28 @@ class Auth {
return new \WP_Error('invalid_api_key', 'Invalid or inactive API key.', ['status' => 401]); return new \WP_Error('invalid_api_key', 'Invalid or inactive API key.', ['status' => 401]);
} }
// Rate limiting — transient per key, per minute // Rate limiting — transient per key per minute
$rateLimitKey = 'asktam_mcp_rl_' . md5($apiKey); $rlKey = 'asktam_mcp_rl_' . md5($apiKey);
$settings = get_option('asktam_mcp_settings', []); $settings = get_option('asktam_mcp_settings', []);
$limit = (int) ($settings['rate_limit'] ?? 60); $limit = (int) ($settings['rate_limit'] ?? 60);
$currentCount = (int) get_transient($rateLimitKey); $currentCount = (int) get_transient($rlKey);
if ($currentCount >= $limit) { if ($currentCount >= $limit) {
return new \WP_Error('rate_limit_exceeded', 'Rate limit exceeded. Retry in 60 seconds.', ['status' => 429]); return new \WP_Error('rate_limit_exceeded', 'Rate limit exceeded. Retry in 60 seconds.', ['status' => 429]);
} }
set_transient($rlKey, $currentCount + 1, 60);
if ($currentCount === 0) { // Scope check — admin keys bypass all scope requirements
set_transient($rateLimitKey, 1, 60);
} else {
set_transient($rateLimitKey, $currentCount + 1, 60);
}
// Scope check — 'admin' keys get all scopes
$scopes = array_map('trim', explode(',', $row['scopes'])); $scopes = array_map('trim', explode(',', $row['scopes']));
if (!in_array($requiredScope, $scopes, true) && !in_array(self::SCOPE_ADMIN, $scopes, true)) { if (!in_array($requiredScope, $scopes, true) && !in_array(self::SCOPE_ADMIN, $scopes, true)) {
return new \WP_Error( return new \WP_Error(
'insufficient_scope', 'insufficient_scope',
"This key does not have the required scope: {$requiredScope}", "Insufficient scope. Required: {$requiredScope}",
['status' => 403] ['status' => 403]
); );
} }
// Update last_used timestamp (async-ish via shutdown) // Record last_used on shutdown
add_action('shutdown', function () use ($wpdb, $table, $apiKey): void { add_action('shutdown', function () use ($wpdb, $table, $apiKey): void {
$wpdb->update($table, ['last_used' => current_time('mysql')], ['api_key' => $apiKey]); $wpdb->update($table, ['last_used' => current_time('mysql')], ['api_key' => $apiKey]);
}); });
@@ -74,6 +75,26 @@ class Auth {
return $row; return $row;
} }
/**
* Extract API key from request.
* Checks: Authorization: Bearer <key> then X-MCP-API-Key header.
*/
private static function extractKey(\WP_REST_Request $request): string {
// 1. Bearer token — Claude.ai connectors use this
$authHeader = $request->get_header('Authorization');
if ($authHeader && str_starts_with($authHeader, 'Bearer ')) {
return trim(substr($authHeader, 7));
}
// 2. X-MCP-API-Key — OpenAI GPT Actions + direct use
$xKey = $request->get_header('X-MCP-API-Key');
if ($xKey) {
return trim($xKey);
}
return '';
}
/** /**
* Generate a cryptographically secure API key. * Generate a cryptographically secure API key.
*/ */