@anchrd/intel-api 0.18.0 → 0.19.0

package/README.md

@@ -263,6 +263,21 @@ grants them.
 
 A missing capability answers **`403`**, and the screen says a permission is missing.
 
+⚠️ **`mcp.connect` is the one that gates a whole endpoint rather than an action.** Intel's own MCP
+endpoint (`POST /mcp`, the one an MCP client or a portal connects to) checks it **on every request**
+and answers `403` without it — before any tool runs and before anything is read. Two things follow
+for an operator:
+
+- **Somebody who should use Intel through an MCP client needs `mcp.connect` in Intel**, beside their
+  `nodes.*` capabilities. Without it the client authenticates successfully and every call is refused.
+- **Revoking it takes effect on the next call**, with no new sign-in and nothing to press. If a
+  Cloudflare Access policy in front of the endpoint also compares the `mcp` claim, that layer is the
+  slower of the two — the claim is written once per sign-in and a running session carries it for up
+  to 24 hours, while this check reads the live grant rows every time.
+
+The web UI is unaffected: it speaks the HTTP surface, which is gated by `nodes.*`, `flows.*` and
+`tools.*` as before.
+
 ### Layer two: the grant on the node
 
 What somebody may reach *in this tree*, granted in Intel on a node. Four verbs — `read`, `write`,

package/dist/intel/intel.js

@@ -116,6 +116,32 @@ export function createIntel(deps) {
             context.header("WWW-Authenticate", `Bearer resource_metadata="${resourceMetadataUrl}"`);
             return context.json({ jsonrpc: "2.0", id: null, error: { code: -32003, message: "authentication required" } }, 401);
         }
+        // ⚠️ Intel's OWN portal door, asked per request — and it is deliberately the service-trimmed
+        // `can`, the exact spelling the guard on `/auth/connect` above must never use (anchrd/gate#293).
+        // The two questions are different and both are needed:
+        //
+        //   /auth/connect  "is anything in the SHARED portal for this person"   mcpPortalRefused()
+        //   /mcp           "may they reach THIS server"                         can("mcp", "connect")
+        //
+        // Until now only Cloudflare Access asked the second one, comparing the `mcp` claim of the Access
+        // application against the service name. That claim is collected when the person signs in and a
+        // running Access session carries it for up to 24 hours, so a revoked grant kept working for a
+        // day while `rules` — the same rows, read live on every call — already said no. This line moves
+        // the decision to where the answer is: a revocation lands on the NEXT call, with no new sign-in,
+        // no session revocation and nobody pressing anything. It also lets the Access policy go coarse
+        // ("is a Gate user") without opening the server to everyone.
+        //
+        // ⚠️ NOT `permits(...)`: `intel.admin` is the bootstrap escape for Intel's own resource ACLs
+        // (ADR-0004 §6), and there is no bootstrap here — this grant is set in Gate, not in Intel, so no
+        // admin has to be able to hand it to themselves through this door. Widening it would let people
+        // in whom the Access policy turns away today, which is the opposite of moving a check.
+        //
+        // ⚠️ Fails CLOSED, and that is the whole reason a `403` and not a `401`: the caller IS
+        // authenticated and merely may not, so a `WWW-Authenticate` challenge would send an MCP client
+        // round the OAuth loop it just completed — the certain dead end of #434 in another costume.
+        if (!authorization.can("mcp", "connect")) {
+            return context.json({ jsonrpc: "2.0", id: null, error: { code: -32003, message: "permission required" } }, 403);
+        }
         return await handleMcp(context.req.raw, {
             authorization,
             // ⚠️ The very token this call was authorized with, so a tool that has to speak to Gate does

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anchrd/intel-api",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "type": "module",
   "license": "UNLICENSED",
   "repository": {