solidus_mcp 0.2.0.rc1

data/app/tools/solidus_mcp/tools/get_variant_prices.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class GetVariantPrices < Base
+      tool_name :get_variant_prices
+      description "List exact price rows for a variant, including currency and country context."
+      category "Pricing"
+      permission "get_variant_prices"
+      read_only true
+      ability :read, "Spree::Product"
+      ability :read, "Spree::Variant"
+      ability :read, "Spree::Price"
+      input :variant_id, type: "integer", minimum: 1, required: true
+      pagination
+
+      protected
+
+      def call(variant_id:, after_id: 0, limit: 25)
+        serializers.variant(variants.find(variant_id))
+        page(policy.scope(Spree::Price).where(variant_id: variant_id), after_id: after_id, limit: limit) { |price| serializers.price(price) }
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/search_inventory.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class SearchInventory < Base
+      tool_name :search_inventory
+      description "Search stock levels by variant SKU or product name, with keyset pagination."
+      category "Inventory"
+      permission "search_inventory"
+      read_only true
+      ability :read, "Spree::Product"
+      ability :read, "Spree::Variant"
+      ability :read, "Spree::StockItem"
+      ability :read, "Spree::StockLocation"
+      input :query, type: "string", minLength: 1, maxLength: 100, required: true
+      pagination
+
+      protected
+
+      def call(query:, after_id: 0, limit: 25)
+        pattern = "%#{ActiveRecord::Base.sanitize_sql_like(query)}%"
+        matching = variants.joins(:product).where("spree_variants.sku ILIKE ? OR spree_products.name ILIKE ?", pattern, pattern)
+        page(stock_items.where(variant_id: matching.select(:id)), after_id: after_id, limit: limit) { |item| serializers.inventory(item) }
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/search_orders.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class SearchOrders < Base
+      tool_name :search_orders
+      description "Search orders by exact number, state or store ID. Returns bounded order totals and statuses without customer contact information."
+      category "Orders"
+      permission "search_orders"
+      read_only true
+      ability :read, "Spree::Order"
+      input :number, type: "string", minLength: 1, maxLength: 100
+      input :state, type: "string", enum: %w[cart address delivery payment confirm complete canceled resumed]
+      input :store_id, type: "integer", minimum: 1
+      pagination
+
+      protected
+
+      def call(number: nil, state: nil, store_id: nil, after_id: 0, limit: 25)
+        orders = policy.scope(Spree::Order)
+        orders = orders.where(number: number) if number
+        orders = orders.where(state: state) if state
+        orders = orders.where(store_id: store_id) if store_id
+        page(orders, after_id: after_id, limit: limit) { |order| serializers.order(order) }
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/search_products.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class SearchProducts < Base
+      tool_name :search_products
+      description "Search authorized products by product name or variant SKU, with keyset pagination."
+      category "Products"
+      permission "search_products"
+      read_only true
+      ability :read, "Spree::Product"
+      ability :read, "Spree::Variant"
+      input :query, type: "string", minLength: 1, maxLength: 100, required: true
+      pagination
+
+      protected
+
+      def call(query:, after_id: 0, limit: 25)
+        pattern = "%#{ActiveRecord::Base.sanitize_sql_like(query)}%"
+        sku_ids = variants.where("spree_variants.sku ILIKE ?", pattern).select(:product_id)
+        products = policy.scope(Spree::Product)
+        matching = products.where("spree_products.name ILIKE ?", pattern).or(products.where(id: sku_ids))
+        page(matching, after_id: after_id, limit: limit) { |product| serializers.product(product) }
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/update_product.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class UpdateProduct < Base
+      tool_name :update_product
+      description "Update explicitly supported product attributes using Solidus validation. Changes take effect immediately."
+      category "Products"
+      permission "update_product"
+      read_only false
+      ability :update, "Spree::Product"
+      input :product_id, type: "integer", minimum: 1, required: true
+      input :changes, type: "object", minProperties: 1, additionalProperties: false, required: true,
+        properties: {name: {type: "string", minLength: 1, maxLength: 255},
+                     description: {type: "string", maxLength: 50000},
+                     meta_title: {type: "string", maxLength: 255},
+                     meta_description: {type: "string", maxLength: 1000},
+                     meta_keywords: {type: "string", maxLength: 1000}}
+
+      protected
+
+      def call(product_id:, changes:)
+        product = policy.scope(Spree::Product, :update).find(product_id)
+        product.with_lock do
+          authorize!
+          policy.authorize_record!(:update, product)
+          product.assign_attributes(changes)
+          policy.authorize_record!(:update, product)
+          product.save!
+        end
+        {product_id: product.id, updated: true}
+      end
+    end
+  end
+end

data/app/tools/solidus_mcp/tools/update_variant_price.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module SolidusMcp
+  module Tools
+    class UpdateVariantPrice < Base
+      tool_name :update_variant_price
+      description "Update one existing variant price in an explicit currency and country context. Decimal amounts are strings; country_iso null selects the general-country price."
+      category "Pricing"
+      permission "update_variant_price"
+      read_only false
+      ability :update, "Spree::Product"
+      ability :update, "Spree::Variant"
+      ability :update, "Spree::Price"
+      input :variant_id, type: "integer", minimum: 1, required: true
+      input :currency, type: "string", pattern: "^[A-Z]{3}$", required: true
+      input :country_iso, type: ["string", "null"], pattern: "^[A-Z]{2}$", required: true
+      input :amount, type: "string", required: true
+
+      protected
+
+      def call(variant_id:, currency:, country_iso:, amount:)
+        PriceUpdate.new(policy).call(variant_id: variant_id, currency: currency,
+          country_iso: country_iso, amount: amount) { authorize! }
+      end
+    end
+  end
+end

data/app/views/solidus_admin/mcp_administrators/_account_search.html.erb

@@ -0,0 +1,161 @@
+<%= javascript_tag nonce: true do %>
+  if (!customElements.get("solidus-mcp-account-search")) {
+    customElements.define("solidus-mcp-account-search", class extends HTMLElement {
+      connectedCallback() {
+        this.query = this.querySelector("[data-account-query]");
+        this.results = this.querySelector("[data-account-results]");
+        this.status = this.querySelector("[data-account-status]");
+        this.accountId = this.querySelector("[data-account-id]");
+        this.version = this.querySelector("[data-account-version]");
+        this.submit = this.closest("form").querySelector("[data-assign-account]");
+        this.items = [];
+        this.active = -1;
+        this.onFocus ||= () => this.search();
+        this.onBlur ||= () => this.close();
+        this.onInput ||= () => {
+          this.accountId.value = "";
+          this.version.value = "-1";
+          this.submit.disabled = true;
+          this.submit.value = "Assign MCP administrator";
+          this.query.setCustomValidity("Choose an account from the search results.");
+          this.items = [];
+          this.close();
+          this.status.textContent = "Searching accounts…";
+          this.timer = setTimeout(() => this.search(), 200);
+        };
+        this.onKeydown ||= event => this.handleKeydown(event);
+        this.onPointerdown ||= event => {
+          if (event.target.closest("[role=option]")) event.preventDefault();
+        };
+        this.onClick ||= event => {
+          const option = event.target.closest("[role=option]");
+          if (option) this.choose(Number(option.dataset.index));
+        };
+        this.query.addEventListener("focus", this.onFocus);
+        this.query.addEventListener("blur", this.onBlur);
+        this.query.addEventListener("input", this.onInput);
+        this.query.addEventListener("keydown", this.onKeydown);
+        this.results.addEventListener("pointerdown", this.onPointerdown);
+        this.results.addEventListener("click", this.onClick);
+        this.submit.disabled = !this.accountId.value;
+        this.query.setCustomValidity(this.accountId.value ? "" : "Choose an account from the search results.");
+      }
+
+      disconnectedCallback() {
+        this.close();
+        this.query.removeEventListener("focus", this.onFocus);
+        this.query.removeEventListener("blur", this.onBlur);
+        this.query.removeEventListener("input", this.onInput);
+        this.query.removeEventListener("keydown", this.onKeydown);
+        this.results.removeEventListener("pointerdown", this.onPointerdown);
+        this.results.removeEventListener("click", this.onClick);
+      }
+
+      async search() {
+        clearTimeout(this.timer);
+        this.request?.abort();
+        const request = this.request = new AbortController();
+        this.status.textContent = "Searching accounts…";
+        try {
+          const url = new URL(this.dataset.searchUrl, window.location.href);
+          url.searchParams.set("query", this.query.value);
+          const response = await fetch(url, {
+            headers: {Accept: "application/json"}, credentials: "same-origin", signal: request.signal
+          });
+          if (!response.ok) throw new Error("Search unavailable");
+          const result = await response.json();
+          if (request.signal.aborted || !this.isConnected) return;
+          this.items = result.items;
+          this.active = -1;
+          this.query.removeAttribute("aria-activedescendant");
+          this.results.replaceChildren();
+          this.items.forEach((item, index) => {
+            const option = document.createElement("li");
+            option.id = this.results.id + "-" + index;
+            option.setAttribute("role", "option");
+            option.setAttribute("aria-selected", "false");
+            option.dataset.index = index;
+            option.textContent = item.email;
+            if (item.lock_version >= 0) {
+              const note = document.createElement("small");
+              note.textContent = "Previously assigned — select to restore";
+              option.append(note);
+            }
+            this.results.append(option);
+          });
+          this.results.hidden = this.items.length === 0;
+          this.query.setAttribute("aria-expanded", String(this.items.length > 0));
+          this.status.textContent = !this.items.length ? "No eligible accounts found."
+            : result.more ? "Showing 20 matches. Keep typing to narrow the search."
+            : this.items.length + " matching account(s). Choose one to continue.";
+          if (this.openDirection && this.items.length) {
+            this.highlight(this.openDirection > 0 ? 0 : this.items.length - 1);
+          }
+          this.openDirection = null;
+        } catch (error) {
+          if (error.name !== "AbortError") {
+            this.results.hidden = true;
+            this.query.setAttribute("aria-expanded", "false");
+            this.status.textContent = "Account search is unavailable. Try again.";
+          }
+        }
+      }
+
+      handleKeydown(event) {
+        if (["ArrowDown", "ArrowUp"].includes(event.key)) {
+          event.preventDefault();
+          const direction = event.key === "ArrowDown" ? 1 : -1;
+          if (!this.items.length) {
+            this.openDirection = direction;
+            this.search();
+          } else {
+            this.results.hidden = false;
+            this.query.setAttribute("aria-expanded", "true");
+            const index = this.active < 0 ? (direction > 0 ? 0 : this.items.length - 1)
+              : (this.active + direction + this.items.length) % this.items.length;
+            this.highlight(index);
+          }
+        } else if (event.key === "Enter" && !this.results.hidden && this.active >= 0) {
+          event.preventDefault();
+          this.choose(this.active);
+        } else if (event.key === "Escape") {
+          event.preventDefault();
+          this.close();
+        }
+      }
+
+      highlight(index) {
+        this.active = index;
+        Array.from(this.results.children).forEach((option, position) => {
+          option.setAttribute("aria-selected", String(position === index));
+        });
+        const option = this.results.children[index];
+        this.query.setAttribute("aria-activedescendant", option.id);
+        option.scrollIntoView({block: "nearest"});
+      }
+
+      choose(index) {
+        const item = this.items[index];
+        if (!item) return;
+        this.query.value = item.email;
+        this.accountId.value = item.id;
+        this.version.value = item.lock_version;
+        this.submit.disabled = false;
+        this.submit.value = item.lock_version >= 0 ? "Restore MCP administrator" : "Assign MCP administrator";
+        this.query.setCustomValidity("");
+        this.status.textContent = item.email + " selected.";
+        this.close();
+      }
+
+      close() {
+        clearTimeout(this.timer);
+        this.request?.abort();
+        this.results.hidden = true;
+        this.query.setAttribute("aria-expanded", "false");
+        this.query.removeAttribute("aria-activedescendant");
+        this.active = -1;
+        this.openDirection = null;
+      }
+    });
+  }
+<% end %>

data/app/views/solidus_admin/mcp_administrators/index.html.erb

@@ -0,0 +1,67 @@
+<%= stylesheet_link_tag "solidus_mcp/admin", "data-turbo-track": "reload" %>
+<div class="solidus-mcp-admin">
+  <%= link_to "AI connections", solidus_admin.mcp_connections_path %>
+  <h1 class="solidus-mcp-connection-title">MCP administrators</h1>
+  <p>Superadministrators assign MCP administrators. MCP administrators can manage ordinary MCP users' connections; only superadministrators can change privileged connections.</p>
+  <h2 class="solidus-mcp-audit-heading">Superadministrators</h2>
+  <p>These accounts are designated in server configuration and cannot be changed here. Solidus administrator status is still required.</p>
+  <ul>
+    <% @superadmins.each do |user| %>
+      <li><%= user.email %><%= " (not currently a Solidus administrator)" unless user.admin? %></li>
+    <% end %>
+  </ul>
+
+  <h2 class="solidus-mcp-audit-heading">Assign an MCP administrator</h2>
+  <%= form_with url: solidus_admin.mcp_administrators_path, method: :post, local: true, class: "solidus-mcp-role-form" do %>
+    <solidus-mcp-account-search data-search-url="<%= solidus_admin.search_mcp_administrators_path %>">
+      <%= label_tag "administrator_account_email", "Account login email" %>
+      <div class="solidus-mcp-account-field">
+        <%= search_field_tag nil, nil, id: "administrator_account_email", required: true,
+          autocomplete: "off", maxlength: 100, placeholder: "Search by email…", role: "combobox",
+          aria: {autocomplete: "list", expanded: "false", controls: "administrator_account_results"}, data: {account_query: true} %>
+        <ul id="administrator_account_results" role="listbox" aria-label="Matching administrator accounts" hidden data-account-results></ul>
+      </div>
+      <%= hidden_field_tag "administrator[user_id]", "", id: nil, data: {account_id: true} %>
+      <%= hidden_field_tag "administrator[lock_version]", "-1", id: nil, data: {account_version: true} %>
+      <p role="status" aria-live="polite" data-account-status>Search for an existing Solidus administrator, then choose an account.</p>
+    </solidus-mcp-account-search>
+    <%= submit_tag "Assign MCP administrator", disabled: true, data: {assign_account: true}, class: "solidus-mcp-button solidus-mcp-button-primary" %>
+    <%= render "solidus_admin/mcp_administrators/account_search" %>
+  <% end %>
+  <p>The account must already be a Solidus administrator. This assignment does not enable tools or expand OAuth consent.</p>
+
+  <h2 class="solidus-mcp-audit-heading">Assignments</h2>
+  <div class="solidus-mcp-table-scroll">
+    <table class="solidus-mcp-table">
+      <thead><tr><th scope="col">User</th><th scope="col">MCP access</th><th scope="col">Change role</th></tr></thead>
+      <tbody>
+        <% @administrators.each do |assignment| %>
+          <% user = @users[assignment.user_id] %>
+          <% configured_superadmin = SolidusMcp::Administration.superadmin_user_ids.include?(assignment.user_id.to_s) %>
+          <tr>
+            <td><%= user&.email || "Deleted account" %></td>
+            <td><%= configured_superadmin ? "Superadministrator (server configuration)" : (assignment.enabled? && user&.admin? ? "MCP administrator" : "MCP user or inactive account") %></td>
+            <td>
+              <% unless configured_superadmin %>
+                <%= form_with url: solidus_admin.mcp_administrator_path(assignment), method: :patch, local: true do %>
+                  <%= hidden_field_tag "administrator[lock_version]", assignment.lock_version, id: nil %>
+                  <%= hidden_field_tag "administrator[enabled]", assignment.enabled? ? "0" : "1", id: nil %>
+                  <%= submit_tag(assignment.enabled? ? "Remove MCP administrator" : "Restore MCP administrator", class: "solidus-mcp-button") %>
+                <% end %>
+              <% end %>
+            </td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+  <% if @administrators.empty? %><p>No MCP administrators have been assigned.</p><% end %>
+  <nav class="solidus-mcp-pagination" aria-label="Administrator assignment pages">
+    <% if @page > 1 %><%= link_to "Previous", solidus_admin.mcp_administrators_path(page: @page - 1) %><% end %>
+    <% if @more %><%= link_to "Next", solidus_admin.mcp_administrators_path(page: @page + 1) %><% end %>
+  </nav>
+  <h2 class="solidus-mcp-audit-heading">Recent role changes</h2>
+  <% @changes.each do |change| %>
+    <p><%= change.created_at.iso8601 %> — superadministrator <%= @audit_users[change.actor_id]&.email || "Deleted account" %> <%= change.enabled? ? "assigned" : "removed" %> MCP administrator access for <%= @audit_users[change.administrator.user_id]&.email || "Deleted account" %>.</p>
+  <% end %>
+</div>

data/app/views/solidus_admin/mcp_connections/_permission_selection.html.erb

@@ -0,0 +1,51 @@
+<%= javascript_tag nonce: true do %>
+  if (!customElements.get("solidus-mcp-permissions")) {
+    customElements.define("solidus-mcp-permissions", class extends HTMLElement {
+      connectedCallback() {
+        this.onChange ||= this.handleChange.bind(this);
+        this.addEventListener("change", this.onChange);
+        this.querySelectorAll("[data-selection-control]").forEach(control => {
+          control.hidden = false;
+        });
+        this.syncSelection();
+      }
+
+      disconnectedCallback() {
+        this.removeEventListener("change", this.onChange);
+      }
+
+      permissions(container = this) {
+        return Array.from(container.querySelectorAll("input[data-permission]:not(:disabled)"));
+      }
+
+      handleChange(event) {
+        const control = event.target;
+        if (control.matches("[data-select-all], [data-select-group]")) {
+          const container = control.matches("[data-select-group]")
+            ? control.closest("[data-permission-group]")
+            : this;
+          this.permissions(container).forEach(permission => {
+            permission.checked = control.checked;
+          });
+        }
+        this.syncSelection();
+      }
+
+      syncSelection() {
+        this.syncControl(this.querySelector("[data-select-all]"), this);
+        this.querySelectorAll("[data-permission-group]").forEach(group => {
+          this.syncControl(group.querySelector("[data-select-group]"), group);
+        });
+      }
+
+      syncControl(control, container) {
+        if (!control) return;
+        const permissions = this.permissions(container);
+        const selected = permissions.filter(permission => permission.checked).length;
+        control.checked = permissions.length > 0 && selected === permissions.length;
+        control.indeterminate = selected > 0 && selected < permissions.length;
+        control.disabled = permissions.length === 0;
+      }
+    });
+  }
+<% end %>

data/app/views/solidus_admin/mcp_connections/_permissions.html.erb

@@ -0,0 +1,54 @@
+<solidus-mcp-permissions>
+  <div class="solidus-mcp-permissions-heading">
+    <h2 id="tool-permissions-heading">Tool permissions</h2>
+    <% if manage_connection_permissions? %>
+      <label data-selection-control hidden>
+        <input type="checkbox" data-select-all>
+        Select all permissions
+      </label>
+    <% end %>
+  </div>
+  <div class="solidus-mcp-permissions-scroll">
+    <table class="solidus-mcp-table" aria-labelledby="tool-permissions-heading">
+      <thead>
+        <tr>
+          <th scope="col">Permission</th>
+          <th scope="col">Description</th>
+          <th scope="col">Access</th>
+          <th scope="col">OAuth authorization</th>
+        </tr>
+      </thead>
+      <% @registry.tools.values.group_by(&:category).each do |category, tools| %>
+        <tbody data-permission-group>
+          <tr class="solidus-mcp-permissions-category">
+            <th scope="rowgroup" colspan="4">
+              <div class="solidus-mcp-permissions-group-heading">
+                <span><%= category %></span>
+                <% if manage_connection_permissions? %>
+                  <label data-selection-control hidden>
+                    <input type="checkbox" data-select-group aria-label="Select all <%= category %> permissions">
+                    Select all
+                  </label>
+                <% end %>
+              </div>
+            </th>
+          </tr>
+          <% tools.each do |tool| %>
+            <tr>
+              <th scope="row">
+                <label>
+                  <%= check_box_tag "connection_policy[permissions][]", tool.permission, @policy.permissions.include?(tool.permission), id: "permission_#{tool.name}", data: {permission: true}, disabled: !manage_connection_permissions? %>
+                  <span><%= tool.name.humanize %></span>
+                </label>
+              </th>
+              <td><%= tool.description %></td>
+              <td><%= tool.read_only ? "Read" : "Write" %></td>
+              <td><%= @scope_status.warning(tool) || "Authorized by active tokens" %></td>
+            </tr>
+          <% end %>
+        </tbody>
+      <% end %>
+    </table>
+  </div>
+</solidus-mcp-permissions>
+<%= render "solidus_admin/mcp_connections/permission_selection" if manage_connection_permissions? %>

data/app/views/solidus_admin/mcp_connections/edit.html.erb

@@ -0,0 +1,59 @@
+<%= stylesheet_link_tag "solidus_mcp/admin", "data-turbo-track": "reload" %>
+<div class="solidus-mcp-admin">
+  <%= link_to "All AI connections", solidus_admin.mcp_connections_path, class: "solidus-mcp-link" %>
+  <h1 class="solidus-mcp-connection-title"><%= @application.name %></h1>
+  <p class="solidus-mcp-connected-by">Connected by <strong><%= @user.email %></strong></p>
+  <p class="solidus-mcp-notice">Changes apply to this person's connection, including refreshed tokens. An unchecked permission blocks every tool that needs it.</p>
+  <p class="solidus-mcp-intro">Scopes on active tokens (tokens may differ): <%= @scopes.presence&.join(", ") || "No unexpired access tokens. Reconnect or refresh to use this connection." %>. Enabling a permission here does not add scopes to an existing token.</p>
+
+  <% if @policy.deleted_at? %>
+    <p class="solidus-mcp-notice">This permission set was deleted and access is disabled. <%= manage_connection_permissions? ? "To restore it, choose permissions, enable the connection, and select Restore permission set." : "Ask an MCP administrator to restore it." %> OAuth scope limits still apply.</p>
+  <% end %>
+
+  <% if manage_connection_permissions? %>
+    <%= form_with url: solidus_admin.mcp_connection_path(@application, user_id: @user.id), method: :patch, local: true do %>
+      <%= hidden_field_tag "connection_policy[lock_version]", @policy.persisted? ? @policy.lock_version : -1 %>
+      <%= hidden_field_tag "connection_policy[enabled]", "0", id: nil %>
+      <label class="solidus-mcp-connection-toggle">
+        <%= check_box_tag "connection_policy[enabled]", "1", @policy.enabled? %>
+        Connection enabled
+      </label>
+      <%= hidden_field_tag "connection_policy[permissions][]", "", id: nil %>
+      <%= render "solidus_admin/mcp_connections/permissions" %>
+      <%= submit_tag(@policy.deleted_at? ? "Restore permission set" : "Save permissions", class: "solidus-mcp-button solidus-mcp-button-primary") %>
+    <% end %>
+  <% else %>
+    <p class="solidus-mcp-notice"><%= mcp_administrator? ? "This is a privileged connection. An MCP superadministrator manages its permissions, including your own grants." : "You are an MCP user. An MCP administrator manages your tool permissions and connection access." %></p>
+    <p><strong>Connection status:</strong> <%= @policy.deleted_at? ? "Deleted" : (@policy.enabled? ? "Enabled" : "Disabled") %></p>
+    <%= render "solidus_admin/mcp_connections/permissions" %>
+  <% end %>
+
+  <% if manage_connection_permissions? && !@policy.deleted_at? %>
+    <section class="solidus-mcp-section" aria-labelledby="delete-permissions-heading">
+      <h2 id="delete-permissions-heading">Delete permission set</h2>
+      <p>Remove all tool permissions and disable this connection. The permission set moves to Deleted permission sets; its audit history is retained. Other users and OAuth client registrations are unaffected.</p>
+      <%= form_with url: solidus_admin.mcp_connection_path(@application, user_id: @user.id), method: :delete, local: true, data: {turbo_confirm: "Delete this permission set and disable its access?"} do %>
+        <%= hidden_field_tag "connection_policy[lock_version]", @policy.persisted? ? @policy.lock_version : -1, id: nil %>
+        <%= submit_tag "Delete permission set", class: "solidus-mcp-button" %>
+      <% end %>
+    </section>
+  <% end %>
+
+  <section class="solidus-mcp-section" aria-labelledby="reconnect-heading">
+    <h2 id="reconnect-heading">Reconnect to authorize additional access</h2>
+    <p>Saving permissions here does not expand OAuth consent. The person who connected this application must start Reconnect or Authorize again in their MCP client, request the required scopes, and approve them on the store's consent screen. Then refresh the client's tool list.</p>
+    <p>Refreshing an existing token cannot add scopes. An expired token can be refreshed only with the access previously authorized. Reconnecting does not automatically enable any store permissions.</p>
+  </section>
+
+  <h2 class="solidus-mcp-audit-heading">Recent permission changes</h2>
+  <% if @changes.empty? %><p>No permission changes recorded.</p><% end %>
+  <% @changes.each do |change| %>
+    <details class="solidus-mcp-audit-entry">
+      <summary><%= change.created_at.iso8601 %> — administrator #<%= change.actor_id %></summary>
+      <% if change.new_values["deleted_at"].present? %><p>Permission set deleted.</p><% elsif change.previous_values["deleted_at"].present? %><p>Permission set restored.</p><% end %>
+      <p>Enabled: <%= change.previous_values["enabled"] %> → <%= change.new_values["enabled"] %></p>
+      <p>Removed: <%= (change.previous_values["permissions"] - change.new_values["permissions"]).join(", ").presence || "None" %></p>
+      <p>Added: <%= (change.new_values["permissions"] - change.previous_values["permissions"]).join(", ").presence || "None" %></p>
+    </details>
+  <% end %>
+</div>

data/app/views/solidus_admin/mcp_connections/index.html.erb

@@ -0,0 +1,48 @@
+<%= stylesheet_link_tag "solidus_mcp/admin", "data-turbo-track": "reload" %>
+<div class="solidus-mcp-admin">
+  <h1 class="solidus-mcp-page-title"><%= @show_deleted ? "Deleted permission sets" : "AI connections" %></h1>
+  <p class="solidus-mcp-intro"><%= if mcp_superadministrator?
+      "You are an MCP superadministrator. Manage all connections and assign MCP administrators."
+    elsif mcp_administrator?
+      "You are an MCP administrator. Manage MCP users' connections; your own permissions require a superadministrator."
+    else
+      "You are an MCP user. Only your own connections are shown; an MCP administrator manages their permissions."
+    end %> Permissions also remain limited by the connection owner's store access and OAuth consent.</p>
+
+  <% if mcp_superadministrator? %>
+    <p><%= link_to "Manage MCP administrators", solidus_admin.mcp_administrators_path %></p>
+  <% end %>
+
+  <p class="solidus-mcp-notice">
+    <% if @show_deleted %>
+      <%= link_to "Active connections", solidus_admin.mcp_connections_path, class: "solidus-mcp-link" %>
+    <% else %>
+      <%= link_to "Deleted permission sets", solidus_admin.mcp_connections_path(deleted: "1"), class: "solidus-mcp-link" %>
+    <% end %>
+  </p>
+
+  <div class="solidus-mcp-table-scroll">
+    <table class="solidus-mcp-table solidus-mcp-connections-table">
+      <thead><tr><th scope="col">Application</th><th scope="col">Connected by</th><th scope="col">Authorization</th><th scope="col">Permissions</th><th scope="col"><%= mcp_administrator? ? "Manage" : "View" %></th></tr></thead>
+      <tbody>
+        <% @connections.each do |connection| %>
+          <% application = @applications[connection.application_id]; user = @users[connection.resource_owner_id] %>
+          <% next unless application && user %>
+          <% policy = @policies[[application.id, user.id]] %>
+          <tr>
+            <td><%= application.name %></td>
+            <td><%= user.email %></td>
+            <td><%= @active_connections.include?([application.id, user.id]) ? "Active token" : "No active token" %></td>
+            <td><%= policy ? (policy.deleted_at? ? "Deleted" : (policy.enabled? ? "Custom permissions" : "Disabled")) : "No tools enabled" %></td>
+            <td><%= link_to(can_manage_connection?(user) ? (@show_deleted ? "Review or restore" : "Edit permissions") : "View permissions", solidus_admin.edit_mcp_connection_path(application, user_id: user.id), class: "solidus-mcp-link") %></td>
+          </tr>
+        <% end %>
+      </tbody>
+    </table>
+  </div>
+  <% if @connections.empty? %><p class="solidus-mcp-empty-state"><%= @show_deleted ? "No deleted permission sets." : "No active connections. Connect an MCP client or review deleted permission sets." %></p><% end %>
+  <nav class="solidus-mcp-pagination" aria-label="Connections pages">
+    <% if @page > 1 %><%= link_to "Previous", solidus_admin.mcp_connections_path(page: @page - 1, deleted: @show_deleted ? "1" : nil) %><% end %>
+    <% if @more %><%= link_to "Next", solidus_admin.mcp_connections_path(page: @page + 1, deleted: @show_deleted ? "1" : nil) %><% end %>
+  </nav>
+</div>