@burdenoff/mcp-libs 2026.1008.4 → 2026.1009.2

package/dist/modules/rbac/index.cjs

@@ -37,12 +37,6 @@ function mcpToolName(productName, ...parts) {
 }
 
 // src/core/result.ts
-function jsonResult(data, structured) {
-  const result = {
-    content: [{ type: "text", text: JSON.stringify(data, null, 2) }]
-  };
-  return result;
-}
 function errorResult(message, hint) {
   const text = hint ? `${message}
 
@@ -50,421 +44,103 @@ Hint: ${hint}` : message;
   return { content: [{ type: "text", text }], isError: true };
 }
 
-// src/modules/rbac/operations.ts
-var LIST_ROLES = `
-  query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {
-    roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {
-      id
-      name
-      description
-      isSystem
-      scopeId
-      priority
-      defaultPermissions {
-        level
-        resourceType
-      }
-    }
-  }
-`;
-var GET_ROLE = `
-  query GetRole($id: ID!) {
-    role(id: $id) {
-      id
-      name
-      description
-      isSystem
-      scopeId
-      priority
-      defaultPermissions {
-        level
-        resourceType
-      }
-    }
-  }
-`;
-var CREATE_ROLE = `
-  mutation CreateRole($input: CreateRoleInput!) {
-    createRole(input: $input) {
-      id
-      name
-      description
-      scopeId
-    }
-  }
-`;
-var UPDATE_ROLE = `
-  mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {
-    updateRole(id: $id, input: $input) {
-      id
-      name
-      description
-      priority
-    }
-  }
-`;
-var DELETE_ROLE = `
-  mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {
-    deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)
-  }
-`;
-var CHECK_PERMISSION = `
-  query CheckPermission($input: PermissionCheckInput!) {
-    checkPermission(input: $input) {
-      allowed
-      decisionPath
-      roleName
-      roleLevel
-      overrideType
-    }
-  }
-`;
-var LIST_POLICY_REFERENCES = `
-  query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {
-    policyReferences(filter: $filter, pagination: $pagination) {
-      id
-      name
-      description
-      opaPackage
-      resourceType
-      action
-      isActive
-      priority
-      createdAt
-      updatedAt
-    }
-  }
-`;
-var ATTACH_POLICY = `
-  mutation AttachPolicy($roleId: ID!, $policyId: ID!) {
-    attachPolicyToRole(roleId: $roleId, policyId: $policyId) {
-      id
-      name
-      resourceType
-      action
-      isActive
-    }
-  }
-`;
-var DETACH_POLICY = `
-  mutation DetachPolicy($roleId: ID!, $policyId: ID!) {
-    detachPolicyFromRole(roleId: $roleId, policyId: $policyId)
-  }
-`;
-
 // src/modules/rbac/tools.ts
-var LayerEnum = zod.z.enum(["workspace", "global"]);
-var ActorTypeEnum = zod.z.enum(["USER", "BOT", "GROUP", "INTEGRATION", "DELEGATED_AGENT"]);
-function clientForLayer(ctx, layer) {
-  return layer === "workspace" ? ctx.gql.workspace : ctx.gql.global;
-}
-function defaultScopeId(ctx, layer) {
-  const auth = ctx.auth.read();
-  if (!auth) return null;
-  if (layer === "workspace") return auth.workspaceId ?? null;
-  return auth.organizationId ?? null;
-}
-function registerRbacTools(server, ctx, track) {
+function stubbedTool(server, toolName, title, description, featureNote, inputSchema, altSuggestions) {
   server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_roles_list")),
+    toolName,
     {
-      title: "List Roles",
-      description: "List RBAC roles for a workspace or global scope.",
-      inputSchema: {
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)"),
-        scopeId: zod.z.string().optional().describe("Override scope id (workspace or tenant)"),
-        includeSystem: zod.z.boolean().optional().describe("Include system roles"),
-        limit: zod.z.number().optional().describe("Page size")
-      }
+      title,
+      description: `${description} [STUB]`,
+      inputSchema
     },
-    async ({ layer, scopeId, includeSystem, limit }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);
-        if (!resolvedScope) {
-          return errorResult(
-            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`
-          );
-        }
-        const filter = {};
-        if (includeSystem) filter.includeSystem = true;
-        const data = await clientForLayer(ctx, targetLayer).request(
-          LIST_ROLES,
-          {
-            filter: Object.keys(filter).length ? filter : void 0,
-            pagination: { limit: limit ?? 100, offset: 0 },
-            scopeId: resolvedScope
-          }
-        );
-        return jsonResult(data.roles);
-      } catch (error) {
-        ctx.logger.error("rbac_roles_list failed", { error: String(error) });
-        return errorResult(
-          `Failed to list roles: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+    async () => errorResult(
+      `[stubbed] ${featureNote} Use ${altSuggestions.join(", ")} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`
+    )
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_roles_get")),
-    {
-      title: "Get Role",
-      description: "Get a role by id from the workspace or global layer.",
-      inputSchema: {
-        id: zod.z.string().describe("Role ID"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
-      }
-    },
-    async ({ id, layer }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const data = await clientForLayer(ctx, targetLayer).request(
-          GET_ROLE,
-          { id }
-        );
-        if (!data.role) return errorResult(`Role ${id} not found`);
-        return jsonResult(data.role);
-      } catch (error) {
-        ctx.logger.error("rbac_roles_get failed", { error: String(error) });
-        return errorResult(
-          `Failed to get role: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+}
+function registerRbacTools(server, _ctx, track) {
+  const featureNote = "Live alpha removed the rbac policies surface (no `attachPolicyToRole` / `detachPolicyFromRole` mutations; `roles` / `policies` queries are gone).";
+  const alts = ["the next alpha release that re-exposes the rbac surface"];
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_check")),
+    "Check Permission",
+    "Check whether the calling actor has a given permission.",
+    featureNote,
+    { permission: zod.z.string() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_roles_create")),
-    {
-      title: "Create Role",
-      description: "Create a new RBAC role at the workspace or global layer.",
-      inputSchema: {
-        name: zod.z.string().describe("Role name"),
-        description: zod.z.string().optional().describe("Role description"),
-        parentId: zod.z.string().optional().describe("Parent role id"),
-        priority: zod.z.number().optional().describe("Priority"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)"),
-        scopeId: zod.z.string().optional().describe("Override scope id"),
-        scopeType: zod.z.string().optional().describe("wspace|entity (global layer only)")
-      }
-    },
-    async ({ name, description, parentId, priority, layer, scopeId, scopeType }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);
-        if (!resolvedScope) {
-          return errorResult(
-            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`
-          );
-        }
-        const input = { name, scopeId: resolvedScope };
-        if (description !== void 0) input.description = description;
-        if (parentId !== void 0) input.parentId = parentId;
-        if (priority !== void 0) input.priority = priority;
-        if (targetLayer === "global" && scopeType) input.scopeType = scopeType;
-        const data = await clientForLayer(ctx, targetLayer).request(
-          CREATE_ROLE,
-          { input }
-        );
-        return jsonResult(data.createRole);
-      } catch (error) {
-        ctx.logger.error("rbac_roles_create failed", { error: String(error) });
-        return errorResult(
-          `Failed to create role: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_policies_list")),
+    "List Policy References",
+    "List references to a policy across the system.",
+    featureNote,
+    { policyId: zod.z.string() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_roles_update")),
-    {
-      title: "Update Role",
-      description: "Update an existing role.",
-      inputSchema: {
-        id: zod.z.string().describe("Role ID"),
-        name: zod.z.string().optional().describe("Updated name"),
-        description: zod.z.string().optional().describe("Updated description"),
-        priority: zod.z.number().optional().describe("Updated priority"),
-        parentId: zod.z.string().optional().describe("Updated parent role id"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
-      }
-    },
-    async ({ id, name, description, priority, parentId, layer }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const input = {};
-        if (name !== void 0) input.name = name;
-        if (description !== void 0) input.description = description;
-        if (priority !== void 0) input.priority = priority;
-        if (parentId !== void 0) input.parentId = parentId;
-        if (!Object.keys(input).length) {
-          return errorResult("No updates specified");
-        }
-        const data = await clientForLayer(ctx, targetLayer).request(
-          UPDATE_ROLE,
-          { id, input }
-        );
-        return jsonResult(data.updateRole);
-      } catch (error) {
-        ctx.logger.error("rbac_roles_update failed", { error: String(error) });
-        return errorResult(
-          `Failed to update role: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_policies_attach")),
+    "Attach Policy to Role",
+    "Attach a policy to a role.",
+    featureNote,
+    { roleId: zod.z.string(), policyId: zod.z.string() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_roles_delete")),
-    {
-      title: "Delete Role",
-      description: "Delete a role, optionally reassigning actors to another role.",
-      inputSchema: {
-        id: zod.z.string().describe("Role ID"),
-        reassignToRoleId: zod.z.string().optional().describe("Reassign actors to this role"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
-      }
-    },
-    async ({ id, reassignToRoleId, layer }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const data = await clientForLayer(ctx, targetLayer).request(
-          DELETE_ROLE,
-          { id, reassignToRoleId }
-        );
-        return jsonResult({ deleted: data.deleteRole, roleId: id });
-      } catch (error) {
-        ctx.logger.error("rbac_roles_delete failed", { error: String(error) });
-        return errorResult(
-          `Failed to delete role: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_policies_detach")),
+    "Detach Policy from Role",
+    "Detach a policy from a role.",
+    featureNote,
+    { roleId: zod.z.string(), policyId: zod.z.string() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_policies_list")),
-    {
-      title: "List Policy References",
-      description: "List OPA policy references registered on the chosen gateway (workspace or global), optionally filtered by resource/action/active state. Returns an array of PolicyReference.",
-      inputSchema: {
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)"),
-        resourceType: zod.z.string().optional().describe("Filter by resource type (e.g. project)"),
-        action: zod.z.string().optional().describe("Filter by action (e.g. read/write/delete)"),
-        isActive: zod.z.boolean().optional().describe("Only active/inactive policies"),
-        limit: zod.z.number().int().optional().describe("Page size (default 100)"),
-        offset: zod.z.number().int().optional().describe("Pagination offset (default 0)")
-      }
-    },
-    async ({ layer, resourceType, action, isActive, limit, offset }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const filter = {};
-        if (resourceType !== void 0) filter.resourceType = resourceType;
-        if (action !== void 0) filter.action = action;
-        if (isActive !== void 0) filter.isActive = isActive;
-        const data = await clientForLayer(ctx, targetLayer).request(LIST_POLICY_REFERENCES, {
-          filter: Object.keys(filter).length ? filter : void 0,
-          pagination: { limit: limit ?? 100, offset: offset ?? 0 }
-        });
-        return jsonResult(data.policyReferences);
-      } catch (error) {
-        ctx.logger.error("rbac_policies_list failed", { error: String(error) });
-        return errorResult(
-          `Failed to list policy references: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_roles_list")),
+    "List Roles",
+    "List roles (workspace or global layer).",
+    featureNote,
+    { layer: zod.z.enum(["workspace", "global"]).optional() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_policies_attach")),
-    {
-      title: "Attach Policy To Role",
-      description: "Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.",
-      inputSchema: {
-        roleId: zod.z.string().describe("Role ID"),
-        policyId: zod.z.string().describe("PolicyReference ID"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
-      }
-    },
-    async ({ roleId, policyId, layer }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const data = await clientForLayer(ctx, targetLayer).request(ATTACH_POLICY, { roleId, policyId });
-        return jsonResult(data.attachPolicyToRole);
-      } catch (error) {
-        ctx.logger.error("rbac_policies_attach failed", { error: String(error) });
-        return errorResult(
-          `Failed to attach policy: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_roles_get")),
+    "Get Role",
+    "Get a role by ID.",
+    featureNote,
+    { id: zod.z.string() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_policies_detach")),
-    {
-      title: "Detach Policy From Role",
-      description: "Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.",
-      inputSchema: {
-        roleId: zod.z.string().describe("Role ID"),
-        policyId: zod.z.string().describe("PolicyReference ID"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
-      }
-    },
-    async ({ roleId, policyId, layer }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const data = await clientForLayer(ctx, targetLayer).request(DETACH_POLICY, { roleId, policyId });
-        return jsonResult({ detached: data.detachPolicyFromRole, roleId, policyId });
-      } catch (error) {
-        ctx.logger.error("rbac_policies_detach failed", { error: String(error) });
-        return errorResult(
-          `Failed to detach policy: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_roles_create")),
+    "Create Role",
+    "Create a new role.",
+    featureNote,
+    { name: zod.z.string() },
+    alts
   );
-  server.registerTool(
-    track(mcpToolName(ctx.productName, "rbac_check")),
-    {
-      title: "Check Permission",
-      description: "Check whether an actor has permission for an action on a resource.",
-      inputSchema: {
-        actorId: zod.z.string().describe("Actor id (user/app/service/super_admin)"),
-        action: zod.z.string().describe("Action like read/write/delete"),
-        resourceType: zod.z.string().describe("Resource type like project/task"),
-        actorType: ActorTypeEnum.optional().describe("Actor type (default: USER)"),
-        resourceId: zod.z.string().optional().describe("Specific resource id (optional)"),
-        scopeId: zod.z.string().optional().describe("Scope id (workspaceId or tenantId)"),
-        layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
-      }
-    },
-    async ({ actorId, action, resourceType, actorType, resourceId, scopeId, layer }) => {
-      try {
-        const targetLayer = layer ?? "workspace";
-        const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);
-        if (!resolvedScope) {
-          return errorResult(
-            `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`
-          );
-        }
-        const input = {
-          actorId,
-          actorType: actorType ?? "USER",
-          action,
-          resourceType,
-          scopeId: resolvedScope
-        };
-        if (resourceId !== void 0) input.resourceId = resourceId;
-        const data = await clientForLayer(ctx, targetLayer).request(
-          CHECK_PERMISSION,
-          { input }
-        );
-        return jsonResult(data.checkPermission);
-      } catch (error) {
-        ctx.logger.error("rbac_check failed", { error: String(error) });
-        return errorResult(
-          `Failed to check permission: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_roles_update")),
+    "Update Role",
+    "Update a role.",
+    featureNote,
+    { id: zod.z.string() },
+    alts
+  );
+  stubbedTool(
+    server,
+    track(mcpToolName(_ctx.productName, "rbac_roles_delete")),
+    "Delete Role",
+    "Delete a role.",
+    featureNote,
+    { id: zod.z.string() },
+    alts
   );
 }