admin_suite 0.5.0 → 0.6.2

data/test/integration/mcp_authorization_test.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpAuthorizationFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([])
+    def self.find_by(id:) = new
+  end
+end
+
+module Admin
+  module Resources
+    class McpAuthorizationWidgetResource < Admin::Base::Resource
+      model McpAuthorizationFixtures::Widget
+      portal :ops
+      section :observability
+      index { columns { column :name } }
+    end
+
+    class McpAuthorizationDisabledResource < Admin::Base::Resource
+      model McpAuthorizationFixtures::Widget
+      portal :ops
+      section :observability
+      mcp false
+    end
+  end
+end
+
+class McpAuthorizationTest < McpIntegrationTest
+  def rpc(method, params = {})
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: method, params: params }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  def call_tool(name, arguments = {})
+    rpc("tools/call", { name: name, arguments: arguments })
+  end
+
+  test "a nil authorize hook advertises no tools" do
+    with_authorize(nil) do
+      assert_empty rpc("tools/list").dig("result", "tools")
+    end
+  end
+
+  test "a nil authorize hook denies a direct call to every tool" do
+    ctx = { actor: "x" }
+
+    with_authorize(nil) do
+      [
+        AdminSuite::Mcp::Tools::DescribeResources.call(server_context: ctx),
+        AdminSuite::Mcp::Tools::ListRecords.call(resource: "mcp_authorization_widget", server_context: ctx),
+        AdminSuite::Mcp::Tools::GetRecord.call(resource: "mcp_authorization_widget", id: "1", server_context: ctx),
+        AdminSuite::Mcp::Tools::Aggregate.call(resource: "mcp_authorization_widget", server_context: ctx)
+      ].each do |response|
+        assert response.error?, response.inspect
+        assert_equal AdminSuite::Mcp::Authorization::DENIED_MESSAGE, response.content.first[:text]
+      end
+    end
+  end
+
+  test "the authorize hook receives an mcp surface and a read action" do
+    seen = []
+    hook = lambda do |action:, record:, context:, **|
+      seen << [action, context.surface, record]
+      true
+    end
+
+    with_authorize(hook) do
+      call_tool("list_records", { resource: "mcp_authorization_widget" })
+    end
+
+    assert_includes seen, [:read, :mcp, nil]
+  end
+
+  test "describe_resources omits resources the hook denies" do
+    hook = ->(resource:, **) { resource.resource_name != "mcp_authorization_widget" }
+
+    with_authorize(hook) do
+      refute_match(/mcp_authorization_widget/, call_tool("describe_resources").to_s)
+    end
+  end
+
+  test "an mcp-disabled resource is invisible and unreachable" do
+    with_authorize(->(**) { true }) do
+      refute_match(/mcp_authorization_disabled/, call_tool("describe_resources").to_s)
+      assert call_tool("list_records", { resource: "mcp_authorization_disabled" }).dig("result", "isError")
+    end
+  end
+
+  test "a raising authorize hook denies instead of returning a server error" do
+    with_authorize(->(**) { raise "boom" }) do
+      result = call_tool("list_records", { resource: "mcp_authorization_widget" })
+
+      assert result.dig("result", "isError"), result.inspect
+    end
+  end
+end

data/test/integration/mcp_endpoint_test.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpEndpointFixtures
+  class Widget
+    extend ActiveModel::Naming
+  end
+end
+
+module Admin
+  module Resources
+    class McpEndpointWidgetResource < Admin::Base::Resource
+      model McpEndpointFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        columns { column :name }
+      end
+      actions do
+        action :approve
+        bulk_action :archive
+      end
+    end
+  end
+end
+
+class McpEndpointTest < McpIntegrationTest
+  def rpc(method, params = {}, id: 1)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: id, method: method, params: params }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "tools/list advertises the read tools when an authorize hook permits" do
+    with_authorize(->(**) { true }) do
+      names = rpc("tools/list").dig("result", "tools").map { |tool| tool["name"] }
+
+      assert_includes names, "describe_resources"
+    end
+  end
+
+  test "describe_resources returns declared resources and their fields" do
+    with_authorize(->(**) { true }) do
+      result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+
+      refute result.dig("result", "isError"), result.inspect
+      assert_match(/mcp_endpoint_widget/, result.to_s)
+      assert_match(/name/, result.to_s)
+    end
+  end
+
+  test "describe_resources includes portal, section, and declared actions" do
+    with_authorize(->(**) { true }) do
+      result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+      payload = JSON.parse(result.dig("result", "content", 0, "text"))
+      widget = payload.find { |resource| resource["name"] == "mcp_endpoint_widget" }
+
+      assert_equal "ops", widget.fetch("portal")
+      assert_equal "observability", widget.fetch("section")
+      assert_includes widget.fetch("actions"), { "name" => "approve", "kind" => "member" }
+      assert_includes widget.fetch("actions"), { "name" => "archive", "kind" => "bulk" }
+    end
+  end
+
+  test "describe_resources returns a generic error without the raised message" do
+    with_authorize(->(**) { true }) do
+      AdminSuite::Mcp::Tools::DescribeResources.stub(:describe, proc { raise "SECRET-/db/password-detail" }) do
+        result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+
+        refute result["error"], result.inspect
+        assert result.dig("result", "isError")
+        body = result.to_s
+        assert_match(/describe_resources failed/, body)
+        refute_match(/SECRET-\/db\/password-detail/, body)
+      end
+    end
+  end
+
+  test "a nil authorize hook advertises no tools and denies direct calls" do
+    with_authorize(nil) do
+      assert_empty rpc("tools/list").dig("result", "tools")
+
+      result = rpc("tools/call", { name: "describe_resources", arguments: {} })
+      assert result["error"], result.inspect
+    end
+  end
+end

data/test/integration/mcp_get_record_test.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpGetRecordFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :secret_token
+
+    def initialize(id: 1, name: "Widget", secret_token: "sh-hh")
+      @id = id
+      @name = name
+      @secret_token = secret_token
+    end
+
+    def self.find_by(id:)
+      new if id.to_s == "1"
+    end
+  end
+end
+
+module Admin
+  module Resources
+    class McpGetRecordWidgetResource < Admin::Base::Resource
+      model McpGetRecordFixtures::Widget
+      portal :ops
+      section :observability
+      show { panel :identity, fields: %i[id name] }
+    end
+  end
+end
+
+class McpGetRecordTest < McpIntegrationTest
+  def call_tool(arguments)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: "get_record", arguments: arguments } }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "returns one record using only the show field set" do
+    result = with_authorize(->(**) { true }) do
+      call_tool(resource: "mcp_get_record_widget", id: "1")
+    end
+
+    refute result.dig("result", "isError"), result.inspect
+    assert_match(/Widget/, result.to_s)
+    refute_match(/sh-hh/, result.to_s)
+  end
+
+  test "a missing id is indistinguishable from a denied read" do
+    missing = with_authorize(->(**) { true }) do
+      call_tool(resource: "mcp_get_record_widget", id: "999999")
+    end
+    denied = with_authorize(->(**) { false }) do
+      call_tool(resource: "mcp_get_record_widget", id: "1")
+    end
+
+    assert_equal missing.dig("result", "content"), denied.dig("result", "content")
+  end
+end

data/test/integration/mcp_instrumentation_test.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpInstrumentationFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([])
+  end
+end
+
+module Admin
+  module Resources
+    class McpInstrumentationWidgetResource < Admin::Base::Resource
+      model McpInstrumentationFixtures::Widget
+      portal :ops
+      section :observability
+      index { columns { column :name } }
+    end
+  end
+end
+
+class McpInstrumentationTest < McpIntegrationTest
+  AuditActor = Struct.new(:id)
+  def call_tool(arguments = { resource: "mcp_instrumentation_widget" })
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: "tools/call", params: {
+        name: "list_records", arguments: arguments
+      } }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+  end
+
+  test "every tool call emits one complete event whether allowed or denied" do
+    events = []
+    subscriber = ActiveSupport::Notifications.subscribe("admin_suite.mcp.tool_call") do |*args|
+      events << ActiveSupport::Notifications::Event.new(*args).payload
+    end
+
+    with_authorize(->(**) { true }) { call_tool }
+    with_authorize(nil) { AdminSuite::Mcp::Tools::ListRecords.call(
+      resource: "mcp_instrumentation_widget", server_context: { actor: nil }
+    ) }
+
+    assert_equal [true, false], events.map { |event| event[:allowed] }
+    assert events.all? { |event| event[:tool] == "list_records" }
+    assert events.all? { |event| event[:action] == :read }
+    assert events.all? { |event| event[:duration_ms].is_a?(Numeric) }
+  ensure
+    ActiveSupport::Notifications.unsubscribe(subscriber) if subscriber
+  end
+
+  test "a raise inside authorize_resource! is not logged as an authorized read" do
+    events = []
+    subscriber = ActiveSupport::Notifications.subscribe("admin_suite.mcp.tool_call") do |*args|
+      events << ActiveSupport::Notifications::Event.new(*args).payload
+    end
+
+    AdminSuite::Mcp::Authorization.stub(:authorize_resource!, proc { raise "boom" }) do
+      AdminSuite::Mcp::Tools::ListRecords.call(
+        resource: "mcp_instrumentation_widget",
+        server_context: { actor: "x" }
+      )
+    end
+
+    assert_equal false, events.last[:allowed]
+  ensure
+    ActiveSupport::Notifications.unsubscribe(subscriber) if subscriber
+  end
+
+  test "audit metadata identifies the operator and distinguishes tool failures" do
+    actor = AuditActor.new(42)
+    request = Struct.new(:request_id).new("audit-request-123")
+    events = []
+    subscriber = ActiveSupport::Notifications.subscribe("admin_suite.mcp.tool_call") do |*args|
+      events << ActiveSupport::Notifications::Event.new(*args).payload
+    end
+
+    AdminSuite::Mcp.instrument(tool: "list_records", actor: actor, request: request) do
+      [MCP::Tool::Response.new([{ type: "text", text: "failed" }], error: true), nil, true]
+    end
+
+    assert_equal "42", events.first.fetch(:actor_id)
+    assert_equal actor.class.name, events.first.fetch(:actor_type)
+    assert_equal "audit-request-123", events.first.fetch(:request_id)
+    assert_equal true, events.first.fetch(:error)
+    assert_equal true, events.first.fetch(:allowed)
+  ensure
+    ActiveSupport::Notifications.unsubscribe(subscriber) if subscriber
+  end
+
+  test "the audit event carries the applied filter set" do
+    events = []
+    subscriber = ActiveSupport::Notifications.subscribe("admin_suite.mcp.tool_call") do |*args|
+      events << ActiveSupport::Notifications::Event.new(*args).payload
+    end
+
+    with_authorize(->(**) { true }) do
+      call_tool(resource: "mcp_instrumentation_widget", q: "alpha", filters: { state: "open" })
+    end
+
+    assert_equal "alpha", events.last.fetch(:q)
+    assert_equal({ state: "open" }, events.last.fetch(:filters))
+  ensure
+    ActiveSupport::Notifications.unsubscribe(subscriber) if subscriber
+  end
+end

data/test/integration/mcp_list_records_test.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpListRecordsFixtures
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :secret_token
+
+    def initialize(id: 1, name: "Widget", secret_token: "sh-hh")
+      @id = id
+      @name = name
+      @secret_token = secret_token
+    end
+
+    def self.all = ReadOnlyResourceFixtures::Relation.new([new])
+  end
+end
+
+module Admin
+  module Resources
+    class McpListRecordsWidgetResource < Admin::Base::Resource
+      model McpListRecordsFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        columns do
+          column :id
+          column :name
+        end
+      end
+    end
+  end
+end
+
+class McpListRecordsTest < McpIntegrationTest
+  def call_tool(name, arguments)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name: name, arguments: arguments } }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    JSON.parse(response.body)
+  end
+
+  test "returns rows limited to declared columns" do
+    result = with_authorize(->(**) { true }) do
+      call_tool("list_records", { resource: "mcp_list_records_widget" })
+    end
+
+    refute result.dig("result", "isError"), result.inspect
+    assert_match(/Widget/, result.to_s)
+    refute_match(/sh-hh/, result.to_s)
+  end
+
+  test "clamps per_page to the configured maximum and says so" do
+    result = with_authorize(->(**) { true }) do
+      call_tool("list_records", { resource: "mcp_list_records_widget", per_page: 5000 })
+    end
+
+    payload = JSON.parse(result.dig("result", "content", 0, "text"))
+    assert_equal 100, payload.fetch("applied_per_page")
+  end
+
+  test "an unknown resource and a denied resource return identical errors" do
+    unknown = with_authorize(->(**) { true }) do
+      call_tool("list_records", { resource: "no_such_thing" })
+    end
+    denied = with_authorize(->(**) { false }) do
+      call_tool("list_records", { resource: "mcp_list_records_widget" })
+    end
+
+    assert_equal unknown.dig("result", "content"), denied.dig("result", "content"),
+      "an existence oracle: an unknown resource must be indistinguishable from a denied one"
+  end
+end

data/test/integration/mcp_parity_test.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+module McpParityFixtures
+  class Relation
+    include Enumerable
+
+    def initialize(records, offset: 0)
+      @records = records
+      @offset = offset
+    end
+
+    def each(&block) = @records.each(&block)
+    def count(*) = @records.size
+    def offset(value) = self.class.new(@records, offset: value)
+    def limit(value) = @records[@offset, value] || []
+
+    def where(condition, search:)
+      fields = condition.scan(/(\w+) ILIKE/).flatten
+      term = search.delete("%").downcase
+      self.class.new(@records.select do |record|
+        fields.any? { |field| record.public_send(field).to_s.downcase.include?(term) }
+      end)
+    end
+
+    def order(ordering)
+      field, direction = ordering.first
+      rows = @records.sort_by { |record| record.public_send(field).to_s }
+      rows.reverse! if direction.to_sym == :desc
+      self.class.new(rows)
+    end
+  end
+
+  class Application < ActiveRecord::Base
+    attr_reader :id, :name
+
+    def initialize(id:, name:)
+      @id = id
+      @name = name
+    end
+
+    def to_param = id.to_s
+  end
+
+  class Widget
+    extend ActiveModel::Naming
+
+    attr_reader :id, :name, :created_at, :application
+
+    def initialize(id:, name:, created_at: Time.utc(2026, 9, 10, 12, 0, 0), application: Application.new(id: 7, name: "Acme"))
+      @id = id
+      @name = name
+      @created_at = created_at
+      @application = application
+    end
+
+    ROWS = [new(id: 1, name: "Zulu"), new(id: 2, name: "Alpha"), new(id: 3, name: "Bravo")].freeze
+
+    def self.all = Relation.new(ROWS)
+    def self.column_names = %w[id name]
+    def self.primary_key = "id"
+    def self.columns_hash = { "id" => Struct.new(:type).new(:integer) }
+    def to_param = id.to_s
+  end
+end
+
+module Admin
+  module Resources
+    class McpParityWidgetResource < Admin::Base::Resource
+      model McpParityFixtures::Widget
+      portal :ops
+      section :observability
+      index do
+        searchable :name
+        sortable :name, default: :name, direction: :asc
+        columns do
+          column :id
+          column :name, sortable: true
+          column :listings_count, ->(_r) { 42 }
+          column :status, ->(_r) { "active" }, type: :label
+          column :created_at
+          column :application
+        end
+      end
+    end
+  end
+end
+
+class McpParityTest < McpIntegrationTest
+  PATH = "/internal/admin_suite/ops/mcp_parity_widgets"
+
+  def mcp_payload(tool, arguments)
+    post "/internal/admin_suite/mcp",
+      params: { jsonrpc: "2.0", id: 1, method: "tools/call", params: {
+        name: tool, arguments: arguments
+      } }.to_json,
+      headers: { "CONTENT_TYPE" => "application/json", "HTTP_ACCEPT" => "application/json, text/event-stream" }
+    rpc = JSON.parse(response.body)
+    JSON.parse(rpc.dig("result", "content", 0, "text"))
+  end
+
+  test "list_records and the index return identical ids for one query" do
+    with_authorize(->(**) { true }) do
+      get PATH, params: { sort: "name", direction: "asc" }
+      assert_response :success
+      ui_ids = css_select("tbody tr").map { |row| row["data-record-id"] }
+
+      mcp_ids = mcp_payload("list_records", {
+        resource: "mcp_parity_widget", sort: "name", direction: "asc"
+      }).fetch("rows").map { |row| row.fetch("id").to_s }
+
+      assert_equal %w[2 3 1], ui_ids
+      assert_equal ui_ids, mcp_ids
+
+      get PATH, params: { search: "alpha" }
+      search_ui_ids = css_select("tbody tr").map { |row| row["data-record-id"] }
+      search_mcp_ids = mcp_payload("list_records", {
+        resource: "mcp_parity_widget", q: "alpha"
+      }).fetch("rows").map { |row| row.fetch("id").to_s }
+      assert_equal search_ui_ids, search_mcp_ids
+    end
+  end
+
+  test "lambda columns match the index cell and object fields serialize as primitives" do
+    with_authorize(->(**) { true }) do
+      get PATH
+      assert_response :success
+      cells = css_select("tbody tr[data-record-id='1'] td")
+      row = mcp_payload("list_records", { resource: "mcp_parity_widget" })
+        .fetch("rows").find { |item| item.fetch("id") == 1 }
+
+      assert_equal "42", cells[2].text.strip
+      assert_equal 42, row.fetch("listings_count")
+      assert_includes cells[3].text, "active"
+      assert_equal "active", row.fetch("status")
+      assert_equal Time.utc(2026, 9, 10, 12, 0, 0), Time.iso8601(row.fetch("created_at"))
+      assert_equal "Acme", row.fetch("application")
+      refute_match(/#<|0x[0-9a-f]+/i, row.fetch("application"))
+    end
+  end
+
+  test "aggregate count matches the shared query's index total" do
+    with_authorize(->(**) { true }) do
+      get PATH, params: { search: "alpha" }
+      ui_total = css_select("tbody tr").size
+
+      mcp_total = mcp_payload("aggregate", {
+        resource: "mcp_parity_widget", q: "alpha"
+      }).fetch("count")
+
+      assert_equal ui_total, mcp_total
+    end
+  end
+end