zip-ai / lib / mcp-adapter / includes / Transport / Infrastructure / HttpSessionValidator.php

HttpSessionValidator.php in ZIP AI – AI Website Builder & AI Agent (Beta) 0.0.8, at lib/mcp-adapter/includes/Transport/Infrastructure/HttpSessionValidator.php

124 lines 3.8 KB

Raw Download Zip

1	<?php
2	/**
3	* HTTP Session Validator for MCP Transport
4	*
5	* @package McpAdapter
6	*/
7
8	declare( strict_types=1 );
9
10	namespace WP\MCP\Transport\Infrastructure;
11
12	use WP\MCP\Infrastructure\ErrorHandling\McpErrorFactory;
13
14	/**
15	* Handles HTTP-specific session validation logic for MCP transports.
16	*
17	* Centralizes HTTP request context validation and session management coordination
18	* to eliminate duplication across transport implementations.
19	*/
20	class HttpSessionValidator {
21
22	/**
23	* Validate session for MCP HTTP requests.
24	*
25	* Performs complete session validation including HTTP headers, user authentication,
26	* and session validity in a single method to reduce method call overhead.
27	*
28	* @param \WP\MCP\Transport\Infrastructure\HttpRequestContext $context The HTTP request context.
29	*
30	* @return array\|true Returns true if valid, error array if invalid.
31	*/
32	public static function validate_session( HttpRequestContext $context ) {
33	// Check session header presence
34	$session_id = $context->session_id;
35	if ( ! $session_id ) {
36	return McpErrorFactory::invalid_request( null, 'Missing Mcp-Session-Id header' )->toArray();
37	}
38
39	// Check user authentication
40	$user_id = get_current_user_id();
41	if ( ! $user_id ) {
42	return McpErrorFactory::unauthorized( null, 'User not authenticated' )->toArray();
43	}
44
45	// Validate session using SessionManager
46	if ( ! SessionManager::validate_session( $user_id, $session_id ) ) {
47	return McpErrorFactory::session_not_found( null, 'Invalid or expired session' )->toArray();
48	}
49
50	return true;
51	}
52
53	/**
54	* Validate session header presence in HTTP request.
55	*
56	* @param \WP\MCP\Transport\Infrastructure\HttpRequestContext $context The HTTP request context.
57	*
58	* @return string\|array Session ID on success, error array on failure.
59	*/
60	public static function validate_session_header( HttpRequestContext $context ) {
61	$session_id = $context->session_id;
62
63	if ( ! $session_id ) {
64	return McpErrorFactory::invalid_request( null, 'Missing Mcp-Session-Id header' )->toArray();
65	}
66
67	return $session_id;
68	}
69
70	/**
71	* Create a new session for the current user with HTTP context awareness.
72	*
73	* Validates user authentication and creates session, providing better error
74	* context than direct SessionManager calls.
75	*
76	* @param array $params The client parameters from initialize request.
77	*
78	* @return string\|array Session ID on success, error array on failure.
79	*/
80	public static function create_session( array $params = array() ) {
81	$user_id = get_current_user_id();
82	if ( ! $user_id ) {
83	return McpErrorFactory::unauthorized( null, 'User authentication required for session creation' )->toArray();
84	}
85
86	$session_id = SessionManager::create_session( $user_id, $params );
87
88	if ( ! $session_id ) {
89	return McpErrorFactory::internal_error( null, 'Failed to create session' )->toArray();
90	}
91
92	return $session_id;
93	}
94
95	/**
96	* Terminate a session with full HTTP context validation.
97	*
98	* Performs complete validation workflow for session termination including
99	* header validation, user authentication, and session cleanup.
100	*
101	* @param \WP\MCP\Transport\Infrastructure\HttpRequestContext $context The HTTP request context.
102	*
103	* @return array\|true Returns true on success, error array on failure.
104	*/
105	public static function terminate_session( HttpRequestContext $context ) {
106	// Validate session header
107	$session_id = $context->session_id;
108	if ( ! $session_id ) {
109	return McpErrorFactory::invalid_request( null, 'Missing Mcp-Session-Id header' )->toArray();
110	}
111
112	// Validate user authentication
113	$user_id = get_current_user_id();
114	if ( ! $user_id ) {
115	return McpErrorFactory::unauthorized( null, 'User not authenticated' )->toArray();
116	}
117
118	// Terminate the session
119	SessionManager::delete_session( $user_id, $session_id );
120
121	return true;
122	}
123	}
124