| @@ -254,10 +254,56 @@ | ||
| 254 | 254 | * this site's protected-resource metadata so an OAuth-capable client |
| 255 | 255 | * can discover the authorization server and begin the flow. |
| 256 | 256 | */ |
| 257 | 257 | private static function challenge_header(): string { |
| 258 | - $metadata_url = home_url( '/.well-known/oauth-protected-resource' ); | |
| 259 | - return sprintf( 'Bearer resource_metadata="%s"', $metadata_url ); | |
| 258 | + return sprintf( 'Bearer resource_metadata="%s"', self::metadata_url() ); | |
| 259 | + } | |
| 260 | + | |
| 261 | + /** | |
| 262 | + * Where this site actually serves its protected-resource metadata. | |
| 263 | + * | |
| 264 | + * Prefers the canonical /.well-known/…/xspeed/mcp URL, but many hosts own that prefix | |
| 265 | + * for ACME/Let's Encrypt and answer it before WordPress runs — the client | |
| 266 | + * then follows a pointer to a 404 (or a redirect to the homepage) and the | |
| 267 | + * OAuth flow dead-ends. RFC 9728 allows a single resource_metadata value, | |
| 268 | + * so when the pretty path is not ours to serve we advertise the /wp-json | |
| 269 | + * fallback, which no ACME tooling claims. | |
| 270 | + */ | |
| 271 | + private static function metadata_url(): string { | |
| 272 | + // RFC 9728 §3.1: a resource whose identifier carries a path is | |
| 273 | + // discovered at the path-suffixed form. Always this one, never the | |
| 274 | + // root form — even on a site where root is still ours to serve. The | |
| 275 | + // challenge is what steers every re-discovery, so pointing it at the | |
| 276 | + // canonical identity is what eventually moves clients onto it; and | |
| 277 | + // its value must not depend on whether some other plugin happens to | |
| 278 | + // be installed, or a client that cached the header would find the | |
| 279 | + // URL under it change meaning. Root exists for clients that never | |
| 280 | + // read this header at all. (#266) | |
| 281 | + // | |
| 282 | + // Built off untrailingslashit() because get_home_url() concatenates | |
| 283 | + // the `home` option verbatim: with a trailing slash stored there, | |
| 284 | + // home_url( '/.well-known/…' ) returns a doubled slash and the URL | |
| 285 | + // 404s. | |
| 286 | + $pretty = untrailingslashit( home_url( '/' ) ) | |
| 287 | + . '/.well-known/oauth-protected-resource/' . Mcp_Pairing::SITE_ENDPOINT_PATH; | |
| 288 | + | |
| 289 | + /** | |
| 290 | + * Filter the advertised protected-resource metadata URL. | |
| 291 | + * | |
| 292 | + * @param string $pretty The canonical /.well-known/ URL. | |
| 293 | + */ | |
| 294 | + $filtered = apply_filters( 'xspeed_mcp_resource_metadata_url', $pretty ); | |
| 295 | + if ( is_string( $filtered ) && '' !== $filtered && $filtered !== $pretty ) { | |
| 296 | + return $filtered; | |
| 297 | + } | |
| 298 | + | |
| 299 | + // Rewrites absent (plain permalinks, or a flush that never landed) | |
| 300 | + // means the pretty URL cannot resolve at all — use the fallback. | |
| 301 | + if ( ! McpModule::wellknown_rewrites_active() ) { | |
| 302 | + return Mcp_Pairing::absolute( rest_url( McpModule::NS . '/mcp/.well-known/oauth-protected-resource' ) ); | |
| 303 | + } | |
| 304 | + | |
| 305 | + return $pretty; | |
| 260 | 306 | } |
| 261 | 307 | |
| 262 | 308 | /** Pull the token from Bearer or X-XSpeed-MCP-Token, Bearer wins. */ |
| 263 | 309 | private static function extract_token( \WP_REST_Request $request ): string { |
