mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-06-11 02:50:29 +00:00
HolgerHatGarKeineNode
d0544bfac9
- 🔒 Added migrations for `oauth_access_tokens`, `oauth_refresh_tokens`, `oauth_auth_codes`, `oauth_clients`, and `oauth_device_codes`. - 🤖 Created MCP tools (Meetups, Cities, Venues, Courses, Lecturers) for managing entities with authentication and validation. - 🛠️ Implemented Passport-backed OAuth API guard configuration and validation endpoints. - ✅ Added comprehensive feature tests for MCP tools and OAuth functionality (access control, validation, and token-based authentication).
29 lines
852 B
PHP
29 lines
852 B
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* Erzwingt den OAuth-Scope "mcp:use" auf dem MCP-Endpunkt.
|
|
*
|
|
* Greift einheitlich für beide Guards: Sanctum-Tokens (Standard-Ability "*") und
|
|
* Passport-OAuth-Tokens (Scope "mcp:use") erfüllen die Prüfung über tokenCan(), das
|
|
* an das jeweilige Token-Modell delegiert. Ein Passport-Token ohne Scope wird abgelehnt.
|
|
*/
|
|
class EnsureMcpScope
|
|
{
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$user = $request->user();
|
|
|
|
if ($user !== null && method_exists($user, 'tokenCan') && ! $user->tokenCan('mcp:use')) {
|
|
abort(Response::HTTP_FORBIDDEN, 'Das Token besitzt nicht den erforderlichen Scope "mcp:use".');
|
|
}
|
|
|
|
return $next($request);
|
|
}
|
|
}
|