feat: MCP サーバ用 OAuth2 scope と firewall を追加

Command/CleanupDcrClientsCommand.php

@@ -0,0 +1,99 @@
+<?php
+
+/*
+ * This file is part of EC-CUBE
+ *
+ * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
+ *
+ * http://www.ec-cube.co.jp/
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Plugin\Api44\Command;
+
+use Plugin\Api44\Service\DcrClientCleaner;
+use Psr\Log\LoggerInterface;
+use Symfony\Component\Console\Attribute\AsCommand;
+use Symfony\Component\Console\Command\Command;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Input\InputOption;
+use Symfony\Component\Console\Output\OutputInterface;
+use Symfony\Component\Console\Style\SymfonyStyle;
+
+/**
+ * DCR (動的クライアント登録) で量産される死蔵クライアントを掃除する。
+ *
+ * 登録から --days を過ぎ、 有効な access/refresh トークンを持たない DCR クライアントを削除する。
+ * 定期実行 (cron) を想定。 --dry-run で対象だけ確認できる。
+ * 掃除対象は追跡レコードのある client のみ (導入前/記録漏れの client は対象外)。
+ */
+#[AsCommand(
+    name: 'eccube:api:mcp:cleanup-dcr-clients',
+    description: 'Remove abandoned DCR-registered OAuth clients that have no valid tokens.'
+)]
+class CleanupDcrClientsCommand extends Command
+{
+    private const DEFAULT_GRACE_DAYS = 30;
+
+    public function __construct(
+        private readonly DcrClientCleaner $cleaner,
+        private readonly LoggerInterface $logger,
+    ) {
+        parent::__construct();
+    }
+
+    protected function configure(): void
+    {
+        $this
+            ->addOption('days', null, InputOption::VALUE_REQUIRED, 'Grace period in days; clients registered within this window are never removed', (string) self::DEFAULT_GRACE_DAYS)
+            ->addOption('dry-run', null, InputOption::VALUE_NONE, 'List clients that would be removed without deleting them');
+    }
+
+    protected function execute(InputInterface $input, OutputInterface $output): int
+    {
+        $io = new SymfonyStyle($input, $output);
+
+        $days = filter_var($input->getOption('days'), FILTER_VALIDATE_INT);
+        if (false === $days || $days < 0) {
+            $io->error('--days must be a non-negative integer.');
+
+            return Command::INVALID;
+        }
+        $dryRun = (bool) $input->getOption('dry-run');
+
+        try {
+            $result = $this->cleaner->cleanup(new \DateTime(), $days, $dryRun);
+        } catch (\Throwable $e) {
+            // 破壊的操作の失敗を握り潰さず記録する (トランザクションは rollback 済み = 未変更)
+            $this->logger->error('DCR cleanup failed', ['exception' => $e, 'days' => $days, 'dry_run' => $dryRun]);
+            $io->error('DCR cleanup failed; no clients were removed. See logs for details.');
+
+            return Command::FAILURE;
+        }
+
+        // 破壊的・自動実行の監査証跡として、 いつ何件消したかを残す
+        $this->logger->info('DCR cleanup completed', [
+            'dry_run' => $dryRun,
+            'examined' => $result->examinedCount,
+            'kept_active' => $result->keptActiveCount,
+            'deleted' => $result->deletedCount(),
+            'deleted_client_ids' => $result->deletedClientIdentifiers,
+        ]);
+
+        $io->title($dryRun ? 'DCR cleanup (dry-run)' : 'DCR cleanup');
+        $io->listing($result->deletedClientIdentifiers);
+        $io->table(['examined', 'kept (active)', $dryRun ? 'to delete' : 'deleted'], [
+            [$result->examinedCount, $result->keptActiveCount, $result->deletedCount()],
+        ]);
+        $io->success(sprintf(
+            '%s %d abandoned DCR client(s); kept %d active.',
+            $dryRun ? 'Would remove' : 'Removed',
+            $result->deletedCount(),
+            $result->keptActiveCount,
+        ));
+
+        return Command::SUCCESS;
+    }
+}

Controller/Admin/McpTokenController.php

@@ -0,0 +1,114 @@
+<?php
+
+/*
+ * This file is part of EC-CUBE
+ *
+ * Copyright(c) EC-CUBE CO.,LTD. All Rights Reserved.
+ *
+ * http://www.ec-cube.co.jp/
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Plugin\Api44\Controller\Admin;
+
+use Eccube\Controller\AbstractController;
+use Eccube\Entity\Master\Authority;
+use Eccube\Entity\Member;
+use Plugin\Api44\Form\Type\Admin\McpTokenType;
+use Plugin\Api44\Repository\McpTokenRepository;
+use Plugin\Api44\Service\McpTokenService;
+use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
+use Symfony\Component\Routing\Attribute\Route;
+
+class McpTokenController extends AbstractController
+{
+    public function __construct(
+        private readonly McpTokenService $mcpTokenService,
+        private readonly McpTokenRepository $mcpTokenRepository,
+    ) {
+    }
+
+    /**
+     * MCP トークン発行画面。 送信時にトークンを発行し、 JWT を 1 度だけ表示する。
+     */
+    #[Route(path: '/%eccube_admin_route%/api/oauth/mcp/new', name: 'admin_api_mcp_token_new', methods: ['GET', 'POST'])]
+    public function create(Request $request): Response
+    {
+        $form = $this->createForm(McpTokenType::class);
+        $form->handleRequest($request);
+
+        if ($form->isSubmitted() && $form->isValid()) {
+            $member = $this->getUser();
+            // 制限管理者 (authority != ADMIN) は URL 認可で受注/顧客画面等を塞がれるが、 stateless な mcp firewall では
+            // その制限が再評価されない。 全 scope トークンを発行させると管理画面の権限制限を第二の扉で回避できるため、
+            // 発行時に ADMIN を要求する (対話型同意フロー AuthorizationRequestResolveListener と対称)。
+            if (!$member instanceof Member || Authority::ADMIN !== $member->getAuthority()?->getId()) {
+                throw new AccessDeniedHttpException();
+            }
+
+            try {
+                // sub はフォーム入力でなく操作中の Member 固定 (なりすまし防止)
+                $token = $this->mcpTokenService->issue(
+                    $member,
+                    (string) $form->get('label')->getData(),
+                    $form->get('scopes')->getData(),
+                    (int) $form->get('expire')->getData(),
+                );
+
+                // 発行直後のみ JWT を表示する (再表示不可)。 redirect すると失われるため render する
+                $response = $this->render('@Api44/admin/OAuth/mcp_token_issued.twig', [
+                    'token' => $token,
+                    'label' => (string) $form->get('label')->getData(),
+                ]);
+                // bearer token を HTML に埋め込む画面なので、 ブラウザや共有端末のキャッシュに残さない
+                $response->headers->set('Cache-Control', 'no-store, private');
+
+                return $response;
+            } catch (\Exception $e) {
+                $this->addError(trans('admin.common.save_error'), 'admin');
+                // 例外クラスと発行者を残し、 万一の発行失敗を追跡可能にする
+                log_error('MCP トークン発行エラー', ['exception' => $e, 'member_id' => $member->getId()]);
+            }
+        }
+
+        return $this->render('@Api44/admin/OAuth/mcp_token.twig', [
+            'form' => $form->createView(),
+        ]);
+    }
+
+    /**
+     * MCP トークンを失効する (league token を revoke → 即 401)。
+     */
+    #[Route(path: '/%eccube_admin_route%/api/oauth/mcp/revoke/{id}', requirements: ['id' => '\d+'], name: 'admin_api_mcp_token_revoke', methods: ['DELETE'])]
+    public function revoke(Request $request, int $id): RedirectResponse
+    {
+        $this->isTokenValid();
+
+        $mcpToken = $this->mcpTokenRepository->find($id);
+        if (null === $mcpToken) {
+            $this->addError('admin.common.delete_error_already_deleted', 'admin');
+
+            return $this->redirectToRoute('admin_api_oauth');
+        }
+
+        try {
+            $found = $this->mcpTokenService->revoke($mcpToken);
+            if ($found) {
+                $this->addSuccess('admin.common.delete_complete', 'admin');
+            } else {
+                // 失効対象の league token が見つからなかった (期限切れ削除済み等)。 メタは削除したが操作者に明示する
+                $this->addWarning('api.admin.oauth.mcp_token.revoke__not_found', 'admin');
+            }
+        } catch (\Exception $e) {
+            $this->addError('admin.common.delete_error', 'admin');
+            log_error('MCP トークン失効エラー', ['exception' => $e, 'id' => $id]);
+        }
+
+        return $this->redirectToRoute('admin_api_oauth');
+    }
+}

Controller/Admin/OAuthController.php

@@ -26,6 +26,8 @@
 use League\Bundle\OAuth2ServerBundle\ValueObject\RedirectUri;
 use League\Bundle\OAuth2ServerBundle\ValueObject\Scope;
 use Plugin\Api44\Form\Type\Admin\ClientType;
+use Plugin\Api44\Repository\McpTokenRepository;
+use Plugin\Api44\Service\McpTokenService;
 use Symfony\Component\Form\FormInterface;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
@@ -58,6 +60,7 @@ public function __construct(
         ClientManagerInterface $clientManager,
         AccessTokenManagerInterface $accessTokenManager,
         RefreshTokenManagerInterface $refreshTokenManager,
+        private readonly McpTokenRepository $mcpTokenRepository,
     ) {
         $this->clientManager = $clientManager;
         $this->accessTokenManager = $accessTokenManager;
@@ -74,10 +77,15 @@ public function __construct(
     public function index(Request $request): Response
     {
         $criteria = ClientFilter::create();
-        $clients = $this->clientManager->list($criteria);
+        // MCP トークン用の内部クライアント (mcp_pat) は API クライアント一覧に出さない
+        $clients = array_values(array_filter(
+            $this->clientManager->list($criteria),
+            static fn (ClientInterface $client): bool => $client->getIdentifier() !== McpTokenService::CLIENT_IDENTIFIER,
+        ));
 
         return $this->render('@Api44/admin/OAuth/index.twig', [
             'clients' => $clients,
+            'mcpTokens' => $this->mcpTokenRepository->findAllOrderByCreateDate(),
         ]);
     }
 
@@ -129,7 +137,7 @@ public function create(Request $request): RedirectResponse|Response
      *
      * @return RedirectResponse
      */
-    #[Route(path: '/%eccube_admin_route%/api/oauth/delete/{identifier}', requirements: ['identifier' => '\w+'], name: 'admin_api_oauth_delete', methods: ['DELETE'])]
+    #[Route(path: '/%eccube_admin_route%/api/oauth/delete/{identifier}', requirements: ['identifier' => '[\w\-]+'], name: 'admin_api_oauth_delete', methods: ['DELETE'])]
     public function delete(Request $request, string $identifier): RedirectResponse
     {
         $this->isTokenValid();