feat: MCP サーバ用 OAuth2 scope と firewall を追加

Command/CleanupDcrClientsCommand.php

@@ -0,0 +1,99 @@
+<?php
+
+/*
+ * This file is part of EC-CUBE
+ *
+ * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
+ *
+ * http://www.ec-cube.co.jp/
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Plugin\Api44\Command;
+
+use Plugin\Api44\Service\DcrClientCleaner;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * DCR (動的クライアント登録) で量産される死蔵クライアントを掃除する。
+ *
+ * 登録から --days を過ぎ、 有効な access/refresh トークンを持たない DCR クライアントを削除する。
+ * 定期実行 (cron) を想定。 --dry-run で対象だけ確認できる。
+ * 掃除対象は追跡レコードのある client のみ (導入前/記録漏れの client は対象外)。
+ */
+#[AsCommand(
+    name: 'eccube:api:mcp:cleanup-dcr-clients',
+    description: 'Remove abandoned DCR-registered OAuth clients that have no valid tokens.'
+)]
+class CleanupDcrClientsCommand extends Command
+{
+    private const DEFAULT_GRACE_DAYS = 30;
+
+    public function __construct(
+        private readonly DcrClientCleaner $cleaner,
+        private readonly LoggerInterface $logger,
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addOption('days', null, InputOption::VALUE_REQUIRED, 'Grace period in days; clients registered within this window are never removed', (string) self::DEFAULT_GRACE_DAYS)
+            ->addOption('dry-run', null, InputOption::VALUE_NONE, 'List clients that would be removed without deleting them');
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $days = filter_var($input->getOption('days'), FILTER_VALIDATE_INT);
+        if (false === $days || $days < 0) {
+            $io->error('--days must be a non-negative integer.');
+
+            return Command::INVALID;
+        }
+        $dryRun = (bool) $input->getOption('dry-run');
+
+        try {
+            $result = $this->cleaner->cleanup(new \DateTime(), $days, $dryRun);
+        } catch (\Throwable $e) {
+            // 破壊的操作の失敗を握り潰さず記録する (トランザクションは rollback 済み = 未変更)
+            $this->logger->error('DCR cleanup failed', ['exception' => $e, 'days' => $days, 'dry_run' => $dryRun]);
+            $io->error('DCR cleanup failed; no clients were removed. See logs for details.');
+
+            return Command::FAILURE;
+        }
+
+        // 破壊的・自動実行の監査証跡として、 いつ何件消したかを残す
+        $this->logger->info('DCR cleanup completed', [
+            'dry_run' => $dryRun,
+            'examined' => $result->examinedCount,
+            'kept_active' => $result->keptActiveCount,
+            'deleted' => $result->deletedCount(),
+            'deleted_client_ids' => $result->deletedClientIdentifiers,
+        ]);
+
+        $io->title($dryRun ? 'DCR cleanup (dry-run)' : 'DCR cleanup');
+        $io->listing($result->deletedClientIdentifiers);
+        $io->table(['examined', 'kept (active)', $dryRun ? 'to delete' : 'deleted'], [
+            [$result->examinedCount, $result->keptActiveCount, $result->deletedCount()],
+        ]);
+        $io->success(sprintf(
+            '%s %d abandoned DCR client(s); kept %d active.',
+            $dryRun ? 'Would remove' : 'Removed',
+            $result->deletedCount(),
+            $result->keptActiveCount,
+        ));
+
+        return Command::SUCCESS;
+    }
+}

Controller/Admin/McpTokenController.php

@@ -0,0 +1,106 @@
+<?php
+
+/*
+ * This file is part of EC-CUBE
+ *
+ * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
+ *
+ * http://www.ec-cube.co.jp/
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Plugin\Api44\Controller\Admin;
+
+use Eccube\Controller\AbstractController;
+use Eccube\Entity\Member;
+use Plugin\Api44\Form\Type\Admin\McpTokenType;
+use Plugin\Api44\Repository\McpTokenRepository;
+use Plugin\Api44\Service\McpTokenService;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+
+class McpTokenController extends AbstractController
+{
+    public function __construct(
+        private readonly McpTokenService $mcpTokenService,
+        private readonly McpTokenRepository $mcpTokenRepository,
+    ) {
+    }
+
+    /**
+     * MCP トークン発行画面。 送信時にトークンを発行し、 JWT を 1 度だけ表示する。
+     */
+    #[Route(path: '/%eccube_admin_route%/api/oauth/mcp/new', name: 'admin_api_mcp_token_new', methods: ['GET', 'POST'])]
+    public function create(Request $request): Response
+    {
+        $form = $this->createForm(McpTokenType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $member = $this->getUser();
+            if (!$member instanceof Member) {
+                throw new AccessDeniedHttpException();
+            }
+
+            try {
+                // sub はフォーム入力でなく操作中の Member 固定 (なりすまし防止)
+                $token = $this->mcpTokenService->issue(
+                    $member,
+                    (string) $form->get('label')->getData(),
+                    $form->get('scopes')->getData(),
+                    (int) $form->get('expire')->getData(),
+                );
+
+                // 発行直後のみ JWT を表示する (再表示不可)。 redirect すると失われるため render する
+                return $this->render('@Api44/admin/OAuth/mcp_token_issued.twig', [
+                    'token' => $token,
+                    'label' => (string) $form->get('label')->getData(),
+                ]);
+            } catch (\Exception $e) {
+                $this->addError(trans('admin.common.save_error'), 'admin');
+                // 例外クラスと発行者を残し、 万一の発行失敗を追跡可能にする
+                log_error('MCP トークン発行エラー', ['exception' => $e, 'member_id' => $member->getId()]);
+            }
+        }
+
+        return $this->render('@Api44/admin/OAuth/mcp_token.twig', [
+            'form' => $form->createView(),
+        ]);
+    }
+
+    /**
+     * MCP トークンを失効する (league token を revoke → 即 401)。
+     */
+    #[Route(path: '/%eccube_admin_route%/api/oauth/mcp/revoke/{id}', requirements: ['id' => '\d+'], name: 'admin_api_mcp_token_revoke', methods: ['DELETE'])]
+    public function revoke(Request $request, int $id): RedirectResponse
+    {
+        $this->isTokenValid();
+
+        $mcpToken = $this->mcpTokenRepository->find($id);
+        if (null === $mcpToken) {
+            $this->addError('admin.common.delete_error_already_deleted', 'admin');
+
+            return $this->redirectToRoute('admin_api_oauth');
+        }
+
+        try {
+            $found = $this->mcpTokenService->revoke($mcpToken);
+            if ($found) {
+                $this->addSuccess('admin.common.delete_complete', 'admin');
+            } else {
+                // 失効対象の league token が見つからなかった (期限切れ削除済み等)。 メタは削除したが操作者に明示する
+                $this->addWarning('api.admin.oauth.mcp_token.revoke__not_found', 'admin');
+            }
+        } catch (\Exception $e) {
+            $this->addError('admin.common.delete_error', 'admin');
+            log_error('MCP トークン失効エラー', ['exception' => $e, 'id' => $id]);
+        }
+
+        return $this->redirectToRoute('admin_api_oauth');
+    }
+}

Controller/Admin/OAuthController.php

@@ -26,6 +26,8 @@
 use League\Bundle\OAuth2ServerBundle\ValueObject\RedirectUri;
 use League\Bundle\OAuth2ServerBundle\ValueObject\Scope;
 use Plugin\Api44\Form\Type\Admin\ClientType;
+use Plugin\Api44\Repository\McpTokenRepository;
+use Plugin\Api44\Service\McpTokenService;
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
@@ -58,6 +60,7 @@ public function __construct(
         ClientManagerInterface $clientManager,
         AccessTokenManagerInterface $accessTokenManager,
         RefreshTokenManagerInterface $refreshTokenManager,
+        private readonly McpTokenRepository $mcpTokenRepository,
     ) {
         $this->clientManager = $clientManager;
         $this->accessTokenManager = $accessTokenManager;
@@ -74,10 +77,15 @@ public function __construct(
     public function index(Request $request): Response
     {
         $criteria = ClientFilter::create();
-        $clients = $this->clientManager->list($criteria);
+        // MCP トークン用の内部クライアント (mcp_pat) は API クライアント一覧に出さない
+        $clients = array_values(array_filter(
+            $this->clientManager->list($criteria),
+            static fn (ClientInterface $client): bool => $client->getIdentifier() !== McpTokenService::CLIENT_IDENTIFIER,
+        ));
 
         return $this->render('@Api44/admin/OAuth/index.twig', [
             'clients' => $clients,
+            'mcpTokens' => $this->mcpTokenRepository->findAllOrderByCreateDate(),
         ]);
     }
 
@@ -129,7 +137,7 @@ public function create(Request $request): RedirectResponse|Response
      *
      * @return RedirectResponse
      */
-    #[Route(path: '/%eccube_admin_route%/api/oauth/delete/{identifier}', requirements: ['identifier' => '\w+'], name: 'admin_api_oauth_delete', methods: ['DELETE'])]
+    #[Route(path: '/%eccube_admin_route%/api/oauth/delete/{identifier}', requirements: ['identifier' => '[\w\-]+'], name: 'admin_api_oauth_delete', methods: ['DELETE'])]
     public function delete(Request $request, string $identifier): RedirectResponse
     {
         $this->isTokenValid();