@adminforth/mcp 1.4.0 → 1.4.2

package/dist/apiTools.d.ts

@@ -1,13 +1,14 @@
 import type { Tool } from '@modelcontextprotocol/server';
 import type { McpAdminPanelConfirmation, McpConnection } from './adminPanelConfirmation.js';
+import type { McpResourceVisibility } from './resourceVisibility.js';
 import type { McpPageSize } from './types.js';
 import type { AdminUser, IAdminForth } from 'adminforth';
 export declare class AdminForthApiTools {
     private readonly adminforth;
-    private readonly hiddenResourceIds;
+    private readonly resourceVisibility;
     private readonly toolTimeoutMs;
     private readonly adminPanelConfirmation;
-    constructor(adminforth: IAdminForth, hiddenResourceIds: ReadonlySet<string>, pageSize: McpPageSize, toolTimeoutMs: number, adminPanelConfirmation: McpAdminPanelConfirmation | undefined);
+    constructor(adminforth: IAdminForth, resourceVisibility: McpResourceVisibility, pageSize: McpPageSize, toolTimeoutMs: number, adminPanelConfirmation: McpAdminPanelConfirmation | undefined);
     private readonly toolOverrides;
     private fullCatalog?;
     private readOnlyCatalog?;

package/dist/apiTools.js

@@ -159,12 +159,12 @@ function createDirectResponse() {
 }
 export class AdminForthApiTools {
     adminforth;
-    hiddenResourceIds;
+    resourceVisibility;
     toolTimeoutMs;
     adminPanelConfirmation;
-    constructor(adminforth, hiddenResourceIds, pageSize, toolTimeoutMs, adminPanelConfirmation) {
+    constructor(adminforth, resourceVisibility, pageSize, toolTimeoutMs, adminPanelConfirmation) {
         this.adminforth = adminforth;
-        this.hiddenResourceIds = hiddenResourceIds;
+        this.resourceVisibility = resourceVisibility;
         this.toolTimeoutMs = toolTimeoutMs;
         this.adminPanelConfirmation = adminPanelConfirmation;
         this.toolOverrides = createToolOverrides(pageSize, adminforth);
@@ -239,12 +239,9 @@ export class AdminForthApiTools {
         if (!schema) {
             return { output: { error: `Unknown tool: ${params.name}` }, isError: true };
         }
-        if (typeof params.arguments?.resourceId === 'string'
-            && this.hiddenResourceIds.has(params.arguments.resourceId)) {
-            return {
-                output: { error: 'This resource is not available through MCP.' },
-                isError: true,
-            };
+        const resourceId = params.arguments?.resourceId;
+        if (typeof resourceId === 'string' && !await this.resourceVisibility.isVisible(params.adminUser, resourceId)) {
+            return { output: { error: `Resource ${resourceId} not found` }, isError: true };
         }
         const override = this.toolOverrides[params.name];
         const args = { ...override?.defaultArguments, ...params.arguments };

package/dist/custom/McpConfirm.vue

@@ -1,28 +1,25 @@
 <template>
   <div class="af-mcp-confirm flex min-h-screen items-center justify-center bg-gray-100 p-4 dark:bg-gray-800">
-    <div class="w-full max-w-lg rounded-lg bg-white p-6 shadow dark:bg-gray-700">
+    <div v-if="resultMessage || error" class="w-full max-w-lg rounded-lg bg-white p-6 shadow dark:bg-gray-700">
       <template v-if="pending">
         <h1 class="text-xl font-medium text-gray-900 dark:text-white">{{ title }}</h1>
         <p class="mt-3 text-sm text-gray-600 dark:text-gray-300">
           <b>{{ pending.connectionName }}</b>
           {{ $t('asks to run this action on your behalf. | asks to run these actions on your behalf.', pending.actions.length) }}
         </p>
-        <template v-if="resultMessage">
-          <p class="mt-4 text-sm font-medium" :class="failed ? 'text-red-700 dark:text-red-300' : 'text-green-700 dark:text-green-300'">
-            {{ resultMessage }}
-          </p>
-          <ul v-if="failedErrors.length" class="mt-2 list-disc space-y-1 pl-5 text-sm text-red-700 dark:text-red-300">
-            <li v-for="(failedError, i) in failedErrors" :key="i">{{ failedError }}</li>
-          </ul>
-        </template>
-        <Spinner v-else class="mx-auto mt-4 h-8 w-8" />
+        <p class="mt-4 text-sm font-medium" :class="failed ? 'text-red-700 dark:text-red-300' : 'text-green-700 dark:text-green-300'">
+          {{ resultMessage }}
+        </p>
+        <ul v-if="failedErrors.length" class="mt-2 list-disc space-y-1 pl-5 text-sm text-red-700 dark:text-red-300">
+          <li v-for="(failedError, i) in failedErrors" :key="i">{{ failedError }}</li>
+        </ul>
       </template>
-      <template v-else-if="error">
+      <template v-else>
         <h1 class="text-xl font-medium text-gray-900 dark:text-white">{{ $t('Cannot run the action') }}</h1>
         <p class="mt-3 text-sm text-gray-600 dark:text-gray-300">{{ error }}</p>
       </template>
-      <Spinner v-else class="mx-auto h-8 w-8" />
     </div>
+    <Spinner v-else-if="running" class="h-8 w-8" />
   </div>
 </template>
 
@@ -49,6 +46,7 @@ const route = useRoute();
 const pending = ref<PendingConfirmation | null>(null);
 const error = ref('');
 const failed = ref(false);
+const running = ref(false);
 const resultMessage = ref('');
 const failedErrors = ref<string[]>([]);
 const ids = computed(() => pending.value!.actions.map((action) => action.id));
@@ -90,6 +88,7 @@ async function confirm() {
       }
       return;
     }
+    running.value = true;
     const response = await callAdminForthApi({ method: 'POST', path: '/mcp/confirmation/run', body: { ids: ids.value, verificationResult } });
     if (!response || response.error) {
       failed.value = true;

package/dist/endpoints/tools.d.ts

@@ -1,2 +1,3 @@
 import type { IAdminForth, IHttpServer } from 'adminforth';
-export declare function registerToolEndpoints(server: IHttpServer, adminforth: IAdminForth): void;
+import type { McpResourceVisibility } from '../resourceVisibility.js';
+export declare function registerToolEndpoints(server: IHttpServer, adminforth: IAdminForth, resourceVisibility: McpResourceVisibility): void;

package/dist/endpoints/tools.js

@@ -1,15 +1,15 @@
 import { resourcesListResponseSchema } from '../schemas/tools.js';
-export function registerToolEndpoints(server, adminforth) {
+export function registerToolEndpoints(server, adminforth, resourceVisibility) {
     server.endpoint({
         method: 'GET',
         path: '/get_resources_list',
-        description: 'Lists the resourceId and label of every resource (data table), including resources the user cannot access: access is checked when a resource is used. Call this first to discover valid resourceId values before using get_resource, get_resource_data, aggregate, create_record, update_record, delete_record or other resource tools.',
+        description: 'Lists the resourceId and label of every resource (data table) whose records the user may list or show. Call this first to discover valid resourceId values before using get_resource, get_resource_data, aggregate, create_record, update_record, delete_record or other resource tools.',
         agent: {
             onlyReadsData: true,
         },
         response_schema: resourcesListResponseSchema,
-        handler: async ({ tr }) => {
-            const resources = await Promise.all(adminforth.config.resources.map(async (resource) => ({
+        handler: async ({ adminUser, tr }) => {
+            const resources = await Promise.all((await resourceVisibility.visibleResources(adminUser)).map(async (resource) => ({
                 resourceId: resource.resourceId,
                 label: await tr(resource.label, `resource.${resource.resourceId}`),
             })));

package/dist/index.d.ts

@@ -6,6 +6,7 @@ export default class AdminForthMcpPlugin extends AdminForthPlugin {
     private authSecretStore;
     private oauth;
     private apiTools;
+    private resourceVisibility;
     private adminPanelConfirmation?;
     private skills;
     private urls;

package/dist/index.js

@@ -12,6 +12,7 @@ import { registerToolEndpoints } from './endpoints/tools.js';
 import { AuthSecretRepository } from './repositories/authSecret.js';
 import { setupOAuth } from './oauth/setup.js';
 import { requestExtra } from './requestExtra.js';
+import { McpResourceVisibility } from './resourceVisibility.js';
 import { createServerReadOnly } from './serverReadOnly.js';
 import { FETCH_SKILL_TOOL_NAME, McpSkills } from './skills.js';
 import { findContextualTwoFactorsAuth } from './twoFactorContext.js';
@@ -42,6 +43,7 @@ export default class AdminForthMcpPlugin extends AdminForthPlugin {
     authSecretStore;
     oauth;
     apiTools;
+    resourceVisibility;
     adminPanelConfirmation;
     skills;
     urls;
@@ -99,7 +101,8 @@ export default class AdminForthMcpPlugin extends AdminForthPlugin {
             default: this.options.pageSize?.default ?? DEFAULT_PAGE_SIZE,
             max: this.options.pageSize?.max ?? MAX_PAGE_SIZE,
         };
-        this.apiTools = new AdminForthApiTools(adminforth, new Set([this.options.authSecretResource.resourceId]), pageSize, toolTimeoutMs, this.adminPanelConfirmation);
+        this.resourceVisibility = new McpResourceVisibility(adminforth, new Set([this.options.authSecretResource.resourceId]));
+        this.apiTools = new AdminForthApiTools(adminforth, this.resourceVisibility, pageSize, toolTimeoutMs, this.adminPanelConfirmation);
         this.skills = new McpSkills(this.customFolderPath, {
             'pageSize.default': pageSize.default,
             'pageSize.max': pageSize.max,
@@ -128,7 +131,7 @@ export default class AdminForthMcpPlugin extends AdminForthPlugin {
         }
     }
     setupEndpoints(server) {
-        registerToolEndpoints(server, this.adminforth);
+        registerToolEndpoints(server, this.adminforth, this.resourceVisibility);
         registerSettingsEndpoints(server, this.authSecretStore, this.urls.mcpUrl, this.serverReadOnly);
         registerOAuthEndpoints(server, this.oauth, adminApiPrefix(this.adminforth.config.baseUrl));
         if (this.adminPanelConfirmation)

package/dist/resourceVisibility.d.ts

@@ -0,0 +1,9 @@
+import { type AdminForthResource, type AdminUser, type IAdminForth } from 'adminforth';
+export declare class McpResourceVisibility {
+    private readonly adminforth;
+    private readonly hiddenResourceIds;
+    constructor(adminforth: IAdminForth, hiddenResourceIds: ReadonlySet<string>);
+    visibleResources(adminUser: AdminUser): Promise<AdminForthResource[]>;
+    isVisible(adminUser: AdminUser, resourceId: string): Promise<boolean>;
+    private canListOrShow;
+}

package/dist/resourceVisibility.js

@@ -0,0 +1,27 @@
+import { ActionCheckSource, interpretResource, } from 'adminforth';
+export class McpResourceVisibility {
+    adminforth;
+    hiddenResourceIds;
+    constructor(adminforth, hiddenResourceIds) {
+        this.adminforth = adminforth;
+        this.hiddenResourceIds = hiddenResourceIds;
+    }
+    async visibleResources(adminUser) {
+        const resources = this.adminforth.config.resources;
+        const visible = await Promise.all(resources.map((resource) => this.canListOrShow(adminUser, resource)));
+        return resources.filter((_, index) => visible[index]);
+    }
+    async isVisible(adminUser, resourceId) {
+        const resource = this.adminforth.config.resources.find((candidate) => candidate.resourceId === resourceId);
+        return resource !== undefined && this.canListOrShow(adminUser, resource);
+    }
+    async canListOrShow(adminUser, resource) {
+        if (this.hiddenResourceIds.has(resource.resourceId))
+            return false;
+        const [{ allowedActions: { list } }, { allowedActions: { show } }] = await Promise.all([
+            interpretResource(adminUser, resource, {}, ActionCheckSource.ListRequest, this.adminforth),
+            interpretResource(adminUser, resource, {}, ActionCheckSource.ShowRequest, this.adminforth),
+        ]);
+        return list === true || show === true;
+    }
+}

package/dist/schemas/tools.js

@@ -3,5 +3,5 @@ export const resourcesListResponseSchema = z.object({
     resources: z.array(z.object({
         resourceId: z.string().describe('Resource identifier. Pass it as resourceId to get_resource, get_resource_data, aggregate, create_record, update_record, delete_record and other resource tools. Call get_resource with it to get the columns and allowed actions of the resource.'),
         label: z.string().describe('Human readable resource name, translated for the current user.'),
-    })).describe('Every resource of the admin panel. Access is checked when a resource is used, so the user may still be forbidden to list, show, create, edit or delete records of a listed resource.'),
+    })).describe('Every resource whose records the user may list or show. Other actions are checked when a resource is used, so the user may still be forbidden to create, edit or delete records of a listed resource.'),
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adminforth/mcp",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Expose AdminForth APIs as an authenticated MCP server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",