Add Passport OAuth admin MCP server

.env.example

@@ -94,6 +94,12 @@ ANYSTACK_TRIAL_POLICY_ID=
 
 FILAMENT_USERS=
 
+# Passport OAuth keys for the admin MCP server (/mcp/oauth/admin, scope mcp:admin).
+# Generate with: php artisan passport:keys
+# Optionally override with multiline PEM values (use \n in env):
+# PASSPORT_PRIVATE_KEY=
+# PASSPORT_PUBLIC_KEY=
+
 # Public subscribe endpoint for the newsletter list, and the honeypot field name
 # configured on it. Both default to the live NativePHP list in config/services.php,
 # so only set these to point at a different Mailcoach list.

app/Enums/TokenAbility.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Enums;
+
+enum TokenAbility: string
+{
+    case AdminMcpServer = 'mcp:admin';
+}

app/Http/Controllers/OAuth/McpOAuthController.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Http\Controllers\OAuth;
+
+use App\Enums\TokenAbility;
+use App\Http\Controllers\Controller;
+use App\Support\OAuth\McpAccessToken;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Laravel\Passport\Passport;
+use Symfony\Component\HttpFoundation\Response;
+
+class McpOAuthController extends Controller
+{
+    public function adminProtectedResource(): JsonResponse
+    {
+        return response()->json([
+            'resource' => McpAccessToken::adminResource(),
+            'authorization_servers' => [rtrim(config('app.url'), '/')],
+            'scopes_supported' => [TokenAbility::AdminMcpServer->value],
+            'bearer_methods_supported' => ['header'],
+        ]);
+    }
+
+    public function authorizationServer(): JsonResponse
+    {
+        $issuer = rtrim(config('app.url'), '/');
+
+        return response()->json([
+            'issuer' => $issuer,
+            'authorization_endpoint' => $issuer.'/oauth/authorize',
+            'token_endpoint' => $issuer.'/oauth/token',
+            'registration_endpoint' => $issuer.'/oauth/register',
+            'response_types_supported' => ['code'],
+            'code_challenge_methods_supported' => ['S256'],
+            'scopes_supported' => [
+                TokenAbility::AdminMcpServer->value,
+            ],
+            'grant_types_supported' => ['authorization_code', 'refresh_token'],
+            'token_endpoint_auth_methods_supported' => ['none'],
+        ]);
+    }
+
+    public function revoke(Request $request, string $token): Response
+    {
+        $tokens = Passport::token()->newQuery()->where('user_id', $request->user()->getAuthIdentifier());
+        $connection = (clone $tokens)->findOrFail($token);
+
+        Passport::authCode()->newQuery()
+            ->where('user_id', $request->user()->getAuthIdentifier())
+            ->where('client_id', $connection->client_id)
+            ->update(['revoked' => true]);
+
+        $tokens->where('client_id', $connection->client_id)->each(function ($accessToken): void {
+            $accessToken->refreshToken()->update(['revoked' => true]);
+            $accessToken->revoke();
+        });
+
+        return response()->noContent();
+    }
+}

app/Http/Controllers/OAuth/RegisterClientController.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers\OAuth;
+
+use App\Enums\TokenAbility;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Laravel\Mcp\Server\Http\Controllers\OAuthRegisterController;
+
+class RegisterClientController extends OAuthRegisterController
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $response = parent::__invoke($request);
+
+        if ($response->getStatusCode() === 201) {
+            $data = $response->getData(true);
+            $data['scope'] = TokenAbility::AdminMcpServer->value;
+            $response->setData($data);
+        }
+
+        return $response;
+    }
+
+    protected function isValidRedirectUri(string $value): bool
+    {
+        $parts = parse_url($value);
+
+        if ($parts === false || isset($parts['fragment']) || isset($parts['user']) || isset($parts['pass'])) {
+            return false;
+        }
+
+        if (($parts['scheme'] ?? null) === 'http'
+            && ! in_array($parts['host'] ?? null, ['127.0.0.1', '[::1]', 'localhost'], true)) {
+            return false;
+        }
+
+        return parent::isValidRedirectUri($value);
+    }
+}

app/Http/Middleware/AddMcpOAuthChallenge.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enums\TokenAbility;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class AddMcpOAuthChallenge
+{
+    /**
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $response = $next($request);
+
+        if ($response->getStatusCode() === 401) {
+            $metadataPath = '/.well-known/oauth-protected-resource/mcp/oauth/admin';
+            $scope = TokenAbility::AdminMcpServer->value;
+
+            $response->headers->set('WWW-Authenticate', 'Bearer realm="mcp", resource_metadata="'
+                .rtrim(config('app.url'), '/').$metadataPath.'", scope="'.$scope.'"');
+        }
+
+        return $response;
+    }
+}

app/Http/Middleware/EnsureAdminMcpOAuthAccess.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enums\TokenAbility;
+use App\Models\User;
+use Closure;
+use Illuminate\Http\Request;
+use Laravel\Passport\AccessToken;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureAdminMcpOAuthAccess
+{
+    /**
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        /** @var User|null $user */
+        $user = $request->user();
+        $token = $user?->currentAccessToken();
+
+        abort_unless($token instanceof AccessToken, 401);
+        abort_unless(
+            $token->can(TokenAbility::AdminMcpServer->value) && $user->isAdmin(),
+            403,
+            'This connection cannot be used with the NativePHP admin MCP server. Only site admins with the mcp:admin scope may connect.'
+        );
+
+        return $next($request);
+    }
+}

app/Http/Middleware/EnsureMcpOAuthRequest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Support\OAuth\McpAccessToken;
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureMcpOAuthRequest
+{
+    /**
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $resource = $request->input('resource');
+        $expectedScope = is_string($resource) ? McpAccessToken::scopeForResource($resource) : null;
+
+        if ($expectedScope === null) {
+            return response()->json([
+                'error' => 'invalid_target',
+                'error_description' => 'Specify the exact NativePHP admin OAuth MCP resource URL.',
+            ], 400);
+        }
+
+        if ($request->isMethod('get')
+            && ($request->input('code_challenge_method') !== 'S256'
+                || ! is_string($request->input('code_challenge'))
+                || ! preg_match('/^[A-Za-z0-9_-]{43}$/D', $request->input('code_challenge')))) {
+            return response()->json([
+                'error' => 'invalid_request',
+                'error_description' => 'An S256 PKCE code challenge is required.',
+            ], 400);
+        }
+
+        if ($request->isMethod('post')
+            && ! in_array($request->input('grant_type'), ['authorization_code', 'refresh_token'], true)) {
+            return response()->json(['error' => 'unsupported_grant_type'], 400);
+        }
+
+        if ($request->isMethod('get') && ! $request->has('scope')) {
+            $request->merge(['scope' => $expectedScope]);
+        }
+
+        if ($request->has('scope') && $request->input('scope') !== $expectedScope) {
+            return response()->json(['error' => 'invalid_scope'], 400);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/RejectNonAdminMcpOAuthScope.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Enums\TokenAbility;
+use App\Support\OAuth\McpAccessToken;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use League\OAuth2\Server\RequestTypes\AuthorizationRequestInterface;
+use Symfony\Component\HttpFoundation\Response;
+
+class RejectNonAdminMcpOAuthScope
+{
+    /**
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = Auth::guard('web')->user();
+
+        if ($user && $this->requestsAdminAccess($request) && ! $user->isAdmin()) {
+            abort(403, 'Only NativePHP site admins may connect the admin MCP server.');
+        }
+
+        return $next($request);
+    }
+
+    private function requestsAdminAccess(Request $request): bool
+    {
+        if ($request->input('resource') === McpAccessToken::adminResource()) {
+            return true;
+        }
+
+        $scope = $request->input('scope');
+
+        if (is_string($scope) && $scope === TokenAbility::AdminMcpServer->value) {
+            return true;
+        }
+
+        if (! $request->hasSession() || ! $request->session()->has('authRequest')) {
+            return false;
+        }
+
+        $authRequest = unserialize($request->session()->get('authRequest'));
+
+        if (! $authRequest instanceof AuthorizationRequestInterface) {
+            return false;
+        }
+
+        foreach ($authRequest->getScopes() as $requestedScope) {
+            if ($requestedScope->getIdentifier() === TokenAbility::AdminMcpServer->value) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+}

app/Mcp/Servers/AdminNativePhpServer.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace App\Mcp\Servers;
+
+use App\Mcp\Tools\Admin\AdminCreateBlogPost;
+use App\Mcp\Tools\Admin\AdminGetBlogPost;
+use App\Mcp\Tools\Admin\AdminGetCompany;
+use App\Mcp\Tools\Admin\AdminGetSupportTicket;
+use App\Mcp\Tools\Admin\AdminGetUser;
+use App\Mcp\Tools\Admin\AdminListBlogPosts;
+use App\Mcp\Tools\Admin\AdminListCompanies;
+use App\Mcp\Tools\Admin\AdminListSignups;
+use App\Mcp\Tools\Admin\AdminSalesSummary;
+use App\Mcp\Tools\Admin\AdminSearchPlugins;
+use App\Mcp\Tools\Admin\AdminSearchSupportTickets;
+use App\Mcp\Tools\Admin\AdminSearchUsers;
+use Laravel\Mcp\Server;
+use Laravel\Mcp\Server\Tool;
+
+class AdminNativePhpServer extends Server
+{
+    protected string $name = 'NativePHP Admin';
+
+    protected string $version = '1.0.0';
+
+    protected string $instructions = <<<'MARKDOWN'
+        NativePHP Admin MCP is for site-admin support use only (OAuth scope `mcp:admin`).
+
+        Rules:
+        - Never return passwords, remember tokens, GitHub tokens, license keys, Stripe secrets, or raw API credentials.
+        - Blog: create unpublished drafts only in v1 (no publish tool).
+        - Other tools are read-only ops helpers (signups, users, companies, plugins, sales summaries, support).
+
+        Tools:
+        1. admin-create-blog-post — create an unpublished article.
+        2. admin-get-blog-post / admin-list-blog-posts — inspect drafts and published posts.
+        3. admin-list-signups / admin-search-users / admin-get-user — user support lookups.
+        4. admin-list-companies / admin-get-company — email-domain company rollups.
+        5. admin-search-plugins / admin-sales-summary — marketplace/plugin ops (no secrets).
+        6. admin-search-support-tickets / admin-get-support-ticket — support summaries.
+    MARKDOWN;
+
+    /**
+     * @var array<int, class-string<Tool>>
+     */
+    protected array $tools = [
+        AdminCreateBlogPost::class,
+        AdminGetBlogPost::class,
+        AdminListBlogPosts::class,
+        AdminListSignups::class,
+        AdminSearchUsers::class,
+        AdminGetUser::class,
+        AdminListCompanies::class,
+        AdminGetCompany::class,
+        AdminSearchPlugins::class,
+        AdminSalesSummary::class,
+        AdminSearchSupportTickets::class,
+        AdminGetSupportTicket::class,
+    ];
+}