| @@ -254,10 +254,41 @@ | ||
| 254 | 254 | * this site's protected-resource metadata so an OAuth-capable client |
| 255 | 255 | * can discover the authorization server and begin the flow. |
| 256 | 256 | */ |
| 257 | 257 | private static function challenge_header(): string { |
| 258 | - $metadata_url = home_url( '/.well-known/oauth-protected-resource' ); | |
| 259 | - return sprintf( 'Bearer resource_metadata="%s"', $metadata_url ); | |
| 258 | + return sprintf( 'Bearer resource_metadata="%s"', self::metadata_url() ); | |
| 259 | + } | |
| 260 | + | |
| 261 | + /** | |
| 262 | + * Where this site actually serves its protected-resource metadata. | |
| 263 | + * | |
| 264 | + * Prefers the canonical /.well-known/ URL, but many hosts own that prefix | |
| 265 | + * for ACME/Let's Encrypt and answer it before WordPress runs — the client | |
| 266 | + * then follows a pointer to a 404 (or a redirect to the homepage) and the | |
| 267 | + * OAuth flow dead-ends. RFC 9728 allows a single resource_metadata value, | |
| 268 | + * so when the pretty path is not ours to serve we advertise the /wp-json | |
| 269 | + * fallback, which no ACME tooling claims. | |
| 270 | + */ | |
| 271 | + private static function metadata_url(): string { | |
| 272 | + $pretty = home_url( '/.well-known/oauth-protected-resource' ); | |
| 273 | + | |
| 274 | + /** | |
| 275 | + * Filter the advertised protected-resource metadata URL. | |
| 276 | + * | |
| 277 | + * @param string $pretty The canonical /.well-known/ URL. | |
| 278 | + */ | |
| 279 | + $filtered = apply_filters( 'xspeed_mcp_resource_metadata_url', $pretty ); | |
| 280 | + if ( is_string( $filtered ) && '' !== $filtered && $filtered !== $pretty ) { | |
| 281 | + return $filtered; | |
| 282 | + } | |
| 283 | + | |
| 284 | + // Rewrites absent (plain permalinks, or a flush that never landed) | |
| 285 | + // means the pretty URL cannot resolve at all — use the fallback. | |
| 286 | + if ( ! McpModule::wellknown_rewrites_active() ) { | |
| 287 | + return rest_url( McpModule::NS . '/mcp/.well-known/oauth-protected-resource' ); | |
| 288 | + } | |
| 289 | + | |
| 290 | + return $pretty; | |
| 260 | 291 | } |
| 261 | 292 | |
| 262 | 293 | /** Pull the token from Bearer or X-XSpeed-MCP-Token, Bearer wins. */ |
| 263 | 294 | private static function extract_token( \WP_REST_Request $request ): string { |
