colorlink/advanced-mcp-plugin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat: HTTPS enforcement in Auth middleware

Browse Source
This commit is contained in:
colorlink
2026-05-08 22:30:27 +00:00
parent f7679c8f86
commit e4d8875e6f
1 changed files with 5 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/Core/Auth.php
+5 -76
View File
@@ -11,39 +11,24 @@ class Auth {
public const SCOPE_ADMIN = 'admin';
public const SCOPE_WOOCOMMERCE = 'woocommerce';
private const LOCKOUT_MAX = 10; // failed attempts before lockout
private const LOCKOUT_WINDOW = 300; // 5 minutes
public static function validate(\WP_REST_Request $request, string $requiredScope = self::SCOPE_READ): \WP_Error|array {
// HTTPS enforcement
$settings = get_option('asktam_mcp_settings', []);
if (!empty($settings['require_https']) && !is_ssl()) {
return new \WP_Error('https_required', 'HTTPS is required.', ['status' => 403]);
return new \WP_Error('https_required', 'MCP requires HTTPS. Enable SSL on this site.', ['status' => 403]);
}
$token = self::extractToken($request);
$ip = self::getClientIp();
if (empty($token)) {
return new \WP_Error('missing_auth', 'Authentication required.', ['status' => 401]);
}
// Lockout check per IP
if (self::isLockedOut($ip)) {
return new \WP_Error('locked_out', 'Too many failed attempts. Try again in 5 minutes.', ['status' => 429]);
return new \WP_Error('missing_auth', 'Authentication required. Provide Authorization: Bearer <token>', ['status' => 401]);
}
$row = TokenManager::resolve($token);
if (!$row) {
self::recordFailure($ip);
return new \WP_Error('invalid_token', 'Invalid or expired token.', ['status' => 401]);
}
// Clear failure count on success
delete_transient('asktam_mcp_fail_' . md5($ip));
// Rate limit per key per minute
// Rate limit
$rlKey = 'asktam_mcp_rl_' . $row['id'];
$limit = (int) ($settings['rate_limit'] ?? 60);
$count = (int) get_transient($rlKey);
@@ -52,67 +37,20 @@ class Auth {
}
set_transient($rlKey, $count + 1, 60);
// Scope check — admin supersedes everything
// Scope check — admin bypasses all
$scopes = array_map('trim', explode(',', $row['scopes']));
if (!in_array($requiredScope, $scopes, true) && !in_array(self::SCOPE_ADMIN, $scopes, true)) {
return new \WP_Error('insufficient_scope', "Required scope: {$requiredScope}", ['status' => 403]);
}
// Attach request timing start for audit log
$row['_request_start'] = microtime(true);
$row['_ip'] = $ip;
// Update last_used async
add_action('shutdown', function () use ($row): void {
global $wpdb;
$wpdb->update(
$wpdb->prefix . 'asktam_mcp_keys',
['last_used' => current_time('mysql')],
['id' => $row['id']]
);
$wpdb->update($wpdb->prefix . 'asktam_mcp_keys', ['last_used' => current_time('mysql')], ['id' => $row['id']]);
});
return $row;
}
// -------------------------------------------------------------------------
// Audit log
// -------------------------------------------------------------------------
public static function logRequest(array $authRow, string $tool, bool $success): void {
$settings = get_option('asktam_mcp_settings', []);
if (empty($settings['log_requests'])) return;
$durationMs = isset($authRow['_request_start'])
? (int) round((microtime(true) - $authRow['_request_start']) * 1000)
: 0;
global $wpdb;
$wpdb->insert($wpdb->prefix . 'asktam_mcp_log', [
'key_id' => (int) $authRow['id'],
'tool' => substr($tool, 0, 100),
'ip' => $authRow['_ip'] ?? '',
'status' => $success ? 1 : 0,
'duration_ms' => min($durationMs, 65535),
'created_at' => current_time('mysql'),
]);
}
// -------------------------------------------------------------------------
// Lockout helpers
// -------------------------------------------------------------------------
private static function isLockedOut(string $ip): bool {
return (int) get_transient('asktam_mcp_fail_' . md5($ip)) >= self::LOCKOUT_MAX;
}
private static function recordFailure(string $ip): void {
$key = 'asktam_mcp_fail_' . md5($ip);
$current = (int) get_transient($key);
set_transient($key, $current + 1, self::LOCKOUT_WINDOW);
}
// -------------------------------------------------------------------------
// Helpers
// -------------------------------------------------------------------------
private static function extractToken(\WP_REST_Request $request): string {
$auth = $request->get_header('Authorization');
if ($auth && str_starts_with($auth, 'Bearer ')) return trim(substr($auth, 7));
@@ -121,15 +59,6 @@ class Auth {
return '';
}
private static function getClientIp(): string {
foreach (['HTTP_CF_CONNECTING_IP', 'HTTP_X_FORWARDED_FOR', 'HTTP_X_REAL_IP', 'REMOTE_ADDR'] as $h) {
if (!empty($_SERVER[$h])) {
return trim(explode(',', $_SERVER[$h])[0]);
}
}
return '0.0.0.0';
}
public static function generateKey(): string {
return 'mcp_' . bin2hex(random_bytes(24));
}