Skip to content

Add devise token authentication + options#1

Open
lloydwatkin wants to merge 14 commits intobetacraft:mainfrom
OLIOEX:main
Open

Add devise token authentication + options#1
lloydwatkin wants to merge 14 commits intobetacraft:mainfrom
OLIOEX:main

Conversation

@lloydwatkin
Copy link
Copy Markdown

See updated readme for details

lloydwatkin and others added 14 commits March 17, 2026 16:16
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds timing-safe comparison note, token prefix, last_used_at
throttling, missing-table error handling, clarifies ActiveAdmin
page registration and ResourceRegistry isolation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…admin_path and auth CLI options

- mount_path config option (default: /mcp)
- current_user_method config option (default: current_admin_user)
- menu_parent config option (default: nil)
- --auth accepts method name (e.g., devise_token) instead of boolean
- --admin-path option for ActiveAdmin page location
- Fix page_action routes for create/destroy
- Migration guards against existing table
- Use prepend for engine route mounting
- Remove foreign key from migration

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Adds a mount_strategy configuration option that controls how the engine
mounts its routes. Accepts :prepend (default), :append, or :none.

This allows host applications with route constraints (e.g. hostname-based
admin routing) to mount the engine manually inside their constraint blocks
instead of relying on the auto-prepend which places the mount outside
any constraints.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Allow the HTTP header used for Bearer token authentication to be
customised. Defaults to "Authorization" for backwards compatibility.

Useful when the application sits behind a reverse proxy (e.g. AWS
Verified Access) that strips the standard Authorization header before
forwarding requests to the origin.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant