@burdenoff/mcp-libs 2026.1012.2 → 2026.1013.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/modules/healthybowl/index.cjs +865 -0
- package/dist/modules/healthybowl/index.cjs.map +1 -0
- package/dist/modules/healthybowl/index.d.cts +8 -0
- package/dist/modules/healthybowl/index.d.ts +8 -0
- package/dist/modules/healthybowl/index.js +804 -0
- package/dist/modules/healthybowl/index.js.map +1 -0
- package/dist/modules/rbac/index.cjs +56 -34
- package/dist/modules/rbac/index.cjs.map +1 -1
- package/dist/modules/rbac/index.js +56 -34
- package/dist/modules/rbac/index.js.map +1 -1
- package/dist/modules/workspaces/index.cjs +135 -25
- package/dist/modules/workspaces/index.cjs.map +1 -1
- package/dist/modules/workspaces/index.js +135 -25
- package/dist/modules/workspaces/index.js.map +1 -1
- package/package.json +1 -1
|
@@ -86,6 +86,22 @@ var LIST_POLICY_REFERENCES = `
|
|
|
86
86
|
}
|
|
87
87
|
}
|
|
88
88
|
`;
|
|
89
|
+
var ATTACH_POLICY = `
|
|
90
|
+
mutation AttachPolicy($roleId: ID!, $policyId: ID!) {
|
|
91
|
+
attachPolicyToRole(roleId: $roleId, policyId: $policyId) {
|
|
92
|
+
id
|
|
93
|
+
name
|
|
94
|
+
resourceType
|
|
95
|
+
action
|
|
96
|
+
isActive
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
`;
|
|
100
|
+
var DETACH_POLICY = `
|
|
101
|
+
mutation DetachPolicy($roleId: ID!, $policyId: ID!) {
|
|
102
|
+
detachPolicyFromRole(roleId: $roleId, policyId: $policyId)
|
|
103
|
+
}
|
|
104
|
+
`;
|
|
89
105
|
|
|
90
106
|
// src/modules/rbac/tools.ts
|
|
91
107
|
var LayerEnum = z.enum(["workspace", "global"]);
|
|
@@ -99,19 +115,6 @@ function defaultScopeId(ctx, layer) {
|
|
|
99
115
|
if (layer === "workspace") return auth.workspaceId ?? null;
|
|
100
116
|
return auth.organizationId ?? null;
|
|
101
117
|
}
|
|
102
|
-
function stubbedTool(server, toolName, title, description, featureNote, inputSchema, altSuggestions) {
|
|
103
|
-
server.registerTool(
|
|
104
|
-
toolName,
|
|
105
|
-
{
|
|
106
|
-
title,
|
|
107
|
-
description: `${description} [STUB]`,
|
|
108
|
-
inputSchema
|
|
109
|
-
},
|
|
110
|
-
async () => errorResult(
|
|
111
|
-
`[stubbed] ${featureNote} Use ${altSuggestions.join(", ")} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`
|
|
112
|
-
)
|
|
113
|
-
);
|
|
114
|
-
}
|
|
115
118
|
function registerRbacTools(server, ctx, track) {
|
|
116
119
|
server.registerTool(
|
|
117
120
|
track(mcpToolName(ctx.productName, "rbac_roles_list")),
|
|
@@ -321,34 +324,53 @@ function registerRbacTools(server, ctx, track) {
|
|
|
321
324
|
}
|
|
322
325
|
}
|
|
323
326
|
);
|
|
324
|
-
|
|
325
|
-
server,
|
|
327
|
+
server.registerTool(
|
|
326
328
|
track(mcpToolName(ctx.productName, "rbac_policies_attach")),
|
|
327
|
-
"Attach Policy To Role",
|
|
328
|
-
"Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.",
|
|
329
|
-
"Live alpha does not expose `Mutation.attachPolicyToRole` \u2014 the rbac service has never defined it. Policy-role attachment is implicit in `createRole(input)` and `assignRoleToActor` instead.",
|
|
330
329
|
{
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
|
|
330
|
+
title: "Attach Policy To Role",
|
|
331
|
+
description: "Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.",
|
|
332
|
+
inputSchema: {
|
|
333
|
+
roleId: z.string().describe("Role ID"),
|
|
334
|
+
policyId: z.string().describe("PolicyReference ID"),
|
|
335
|
+
layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
|
|
336
|
+
}
|
|
334
337
|
},
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
338
|
-
|
|
338
|
+
async ({ roleId, policyId, layer }) => {
|
|
339
|
+
try {
|
|
340
|
+
const targetLayer = layer ?? "workspace";
|
|
341
|
+
const data = await clientForLayer(ctx, targetLayer).request(ATTACH_POLICY, { roleId, policyId });
|
|
342
|
+
return jsonResult(data.attachPolicyToRole);
|
|
343
|
+
} catch (error) {
|
|
344
|
+
ctx.logger.error("rbac_policies_attach failed", { error: String(error) });
|
|
345
|
+
return errorResult(
|
|
346
|
+
`Failed to attach policy: ${error instanceof Error ? error.message : String(error)}`
|
|
347
|
+
);
|
|
348
|
+
}
|
|
349
|
+
}
|
|
339
350
|
);
|
|
340
|
-
|
|
341
|
-
server,
|
|
351
|
+
server.registerTool(
|
|
342
352
|
track(mcpToolName(ctx.productName, "rbac_policies_detach")),
|
|
343
|
-
"Detach Policy From Role",
|
|
344
|
-
"Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.",
|
|
345
|
-
"Live alpha does not expose `Mutation.detachPolicyFromRole` \u2014 same as attach/detach (see above).",
|
|
346
353
|
{
|
|
347
|
-
|
|
348
|
-
|
|
349
|
-
|
|
354
|
+
title: "Detach Policy From Role",
|
|
355
|
+
description: "Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.",
|
|
356
|
+
inputSchema: {
|
|
357
|
+
roleId: z.string().describe("Role ID"),
|
|
358
|
+
policyId: z.string().describe("PolicyReference ID"),
|
|
359
|
+
layer: LayerEnum.optional().describe("workspace or global (default: workspace)")
|
|
360
|
+
}
|
|
350
361
|
},
|
|
351
|
-
|
|
362
|
+
async ({ roleId, policyId, layer }) => {
|
|
363
|
+
try {
|
|
364
|
+
const targetLayer = layer ?? "workspace";
|
|
365
|
+
const data = await clientForLayer(ctx, targetLayer).request(DETACH_POLICY, { roleId, policyId });
|
|
366
|
+
return jsonResult({ detached: data.detachPolicyFromRole, roleId, policyId });
|
|
367
|
+
} catch (error) {
|
|
368
|
+
ctx.logger.error("rbac_policies_detach failed", { error: String(error) });
|
|
369
|
+
return errorResult(
|
|
370
|
+
`Failed to detach policy: ${error instanceof Error ? error.message : String(error)}`
|
|
371
|
+
);
|
|
372
|
+
}
|
|
373
|
+
}
|
|
352
374
|
);
|
|
353
375
|
server.registerTool(
|
|
354
376
|
track(mcpToolName(ctx.productName, "rbac_check")),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../../../src/modules/rbac/operations.ts","../../../src/modules/rbac/tools.ts","../../../src/modules/rbac/index.ts"],"names":[],"mappings":";;;;AAAO,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBnB,IAAM,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBjB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,CAAA;AAMpB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYzB,IAAM,sBAAA,GAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;;;AC7DtC,IAAM,YAAY,CAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,QAAQ,CAAC,CAAA;AAChD,IAAM,aAAA,GAAgB,EAAE,IAAA,CAAK,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,iBAAiB,CAAC,CAAA;AAIvF,SAAS,cAAA,CAAe,KAAiB,KAAA,EAAc;AACrD,EAAA,OAAO,UAAU,WAAA,GAAc,GAAA,CAAI,GAAA,CAAI,SAAA,GAAY,IAAI,GAAA,CAAI,MAAA;AAC7D;AAEA,SAAS,cAAA,CAAe,KAAiB,KAAA,EAA6B;AACpE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI,KAAA,KAAU,WAAA,EAAa,OAAO,IAAA,CAAK,WAAA,IAAe,IAAA;AACtD,EAAA,OAAO,KAAK,cAAA,IAAkB,IAAA;AAChC;AAgBA,SAAS,YACP,MAAA,EACA,QAAA,EACA,OACA,WAAA,EACA,WAAA,EACA,aACA,cAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,QAAA;AAAA,IACA;AAAA,MACE,KAAA;AAAA,MACA,WAAA,EAAa,GAAG,WAAW,CAAA,OAAA,CAAA;AAAA,MAC3B;AAAA,KACF;AAAA,IACA,YACE,WAAA;AAAA,MACE,aAAa,WAAW,CAAA,KAAA,EAAQ,cAAA,CAAe,IAAA,CAAK,IAAI,CAAC,CAAA,oHAAA;AAAA;AAC3D,GACJ;AACF;AAEO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACjF,eAAe,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,sBAAsB,CAAA;AAAA,QACrE,OAAO,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,WAAW;AAAA;AACnD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,OAAM,KAAM;AAClD,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,aAAA,SAAsB,aAAA,GAAgB,IAAA;AAC1C,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,UAAA;AAAA,UACA;AAAA,YACE,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,YAC9C,YAAY,EAAE,KAAA,EAAO,KAAA,IAAS,GAAA,EAAK,QAAQ,CAAA,EAAE;AAAA,YAC7C,OAAA,EAAS;AAAA;AACX,SACF;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,MAC9B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,wBAAA,EAA0B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACnE,QAAA,OAAO,WAAA;AAAA,UACL,yBAAyB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACjF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,UAAA;AAAA,MACP,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAM,KAAM;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,QAAA;AAAA,UACA,EAAE,EAAA;AAAG,SACP;AACA,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,SAAa,WAAA,CAAY,CAAA,KAAA,EAAQ,EAAE,CAAA,UAAA,CAAY,CAAA;AACzD,QAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,uBAAA,EAAyB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAClE,QAAA,OAAO,WAAA;AAAA,UACL,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC/E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACrC,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9D,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gBAAgB,CAAA;AAAA,QACzD,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,UAAU,CAAA;AAAA,QACnD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mBAAmB,CAAA;AAAA,QAC3D,WAAW,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mCAAmC;AAAA;AAC/E,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,UAAU,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,SAAA,EAAU,KAAM;AAC9E,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,OAAA,EAAS,aAAA,EAAc;AACtE,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,WAAA,KAAgB,QAAA,IAAY,SAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC7D,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0BAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,MAAM,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc,CAAA;AAAA,QACnD,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QACjE,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC3D,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACjE,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,aAAa,QAAA,EAAU,QAAA,EAAU,OAAM,KAAM;AAC9D,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,KAAK,EAAE,MAAA,EAAQ;AAC9B,UAAA,OAAO,YAAY,sBAAsB,CAAA;AAAA,QAC3C;AACA,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,KAAA;AAAM,SACd;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,kBAAkB,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,8BAA8B,CAAA;AAAA,QAC/E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,gBAAA,EAAkB,OAAM,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,gBAAA;AAAiB,SACzB;AACA,QAAA,OAAO,WAAW,EAAE,OAAA,EAAS,KAAK,UAAA,EAAY,MAAA,EAAQ,IAAI,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,8KAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,cAAc,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACrF,QAAQ,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,2CAA2C,CAAA;AAAA,QAClF,UAAU,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,+BAA+B,CAAA;AAAA,QACzE,KAAA,EAAO,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,yBAAyB,CAAA;AAAA,QACrE,MAAA,EAAQ,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,+BAA+B;AAAA;AAC9E,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,YAAA,EAAc,QAAQ,QAAA,EAAU,KAAA,EAAO,QAAO,KAAM;AAClE,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,MAAA,CAAO,YAAA,GAAe,YAAA;AACtD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAA,CAAO,QAAA,GAAW,QAAA;AAC9C,QAAA,MAAM,OAAO,MAAM,cAAA,CAAe,KAAK,WAAW,CAAA,CAAE,QAEjD,sBAAA,EAAwB;AAAA,UACzB,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,UAC9C,YAAY,EAAE,KAAA,EAAO,SAAS,GAAA,EAAK,MAAA,EAAQ,UAAU,CAAA;AAAE,SACxD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAAA,MACzC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,2BAAA,EAA6B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACtE,QAAA,OAAO,WAAA;AAAA,UACL,qCAAqC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC7F;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAIA,EAAA,WAAA;AAAA,IACE,MAAA;AAAA,IACA,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D,uBAAA;AAAA,IACA,uGAAA;AAAA,IACA,mMAAA;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,MACrC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,MAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA,KACjF;AAAA,IACA;AAAA,MACE,2EAAA;AAAA,MACA;AAAA;AACF,GACF;AAEA,EAAA,WAAA;AAAA,IACE,MAAA;AAAA,IACA,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D,yBAAA;AAAA,IACA,oHAAA;AAAA,IACA,sGAAA;AAAA,IACA;AAAA,MACE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,MACrC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,MAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA,KACjF;AAAA,IACA,CAAC,6EAA6E;AAAA,GAChF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACtE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,+BAA+B,CAAA;AAAA,QAC3D,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iCAAiC,CAAA;AAAA,QACnE,SAAA,EAAW,aAAA,CAAc,QAAA,EAAS,CAAE,SAAS,4BAA4B,CAAA;AAAA,QACzE,YAAY,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,iCAAiC,CAAA;AAAA,QAC5E,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oCAAoC,CAAA;AAAA,QAC5E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,cAAc,SAAA,EAAW,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM,KAAM;AAClF,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,OAAA;AAAA,UACA,WAAW,SAAA,IAAa,MAAA;AAAA,UACxB,MAAA;AAAA,UACA,YAAA;AAAA,UACA,OAAA,EAAS;AAAA,SACX;AACA,QAAA,IAAI,UAAA,KAAe,KAAA,CAAA,EAAW,KAAA,CAAM,UAAA,GAAa,UAAA;AACjD,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,gBAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,eAAe,CAAA;AAAA,MACxC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,mBAAA,EAAqB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAC9D,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACjWA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,MAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAEpC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.js","sourcesContent":["export const LIST_ROLES = `\n query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {\n roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {\n id\n name\n description\n isSystem\n scopeId\n priority\n defaultPermissions {\n level\n resourceType\n }\n }\n }\n`;\n\nexport const GET_ROLE = `\n query GetRole($id: ID!) {\n role(id: $id) {\n id\n name\n description\n isSystem\n scopeId\n priority\n defaultPermissions {\n level\n resourceType\n }\n }\n }\n`;\n\nexport const CREATE_ROLE = `\n mutation CreateRole($input: CreateRoleInput!) {\n createRole(input: $input) {\n id\n name\n description\n scopeId\n }\n }\n`;\n\nexport const UPDATE_ROLE = `\n mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {\n updateRole(id: $id, input: $input) {\n id\n name\n description\n priority\n }\n }\n`;\n\nexport const DELETE_ROLE = `\n mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {\n deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)\n }\n`;\n\nexport const CHECK_PERMISSION = `\n query CheckPermission($input: PermissionCheckInput!) {\n checkPermission(input: $input) {\n allowed\n decisionPath\n roleName\n roleLevel\n overrideType\n }\n }\n`;\n\nexport const LIST_POLICY_REFERENCES = `\n query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {\n policyReferences(filter: $filter, pagination: $pagination) {\n id\n name\n description\n opaPackage\n resourceType\n action\n isActive\n priority\n createdAt\n updatedAt\n }\n }\n`;\n\nexport const ATTACH_POLICY = `\n mutation AttachPolicy($roleId: ID!, $policyId: ID!) {\n attachPolicyToRole(roleId: $roleId, policyId: $policyId) {\n id\n name\n resourceType\n action\n isActive\n }\n }\n`;\n\nexport const DETACH_POLICY = `\n mutation DetachPolicy($roleId: ID!, $policyId: ID!) {\n detachPolicyFromRole(roleId: $roleId, policyId: $policyId)\n }\n`;\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport {\n LIST_ROLES,\n GET_ROLE,\n CREATE_ROLE,\n UPDATE_ROLE,\n DELETE_ROLE,\n CHECK_PERMISSION,\n LIST_POLICY_REFERENCES,\n} from './operations.js';\n\nconst LayerEnum = z.enum(['workspace', 'global']);\nconst ActorTypeEnum = z.enum(['USER', 'BOT', 'GROUP', 'INTEGRATION', 'DELEGATED_AGENT']);\n\ntype Layer = 'workspace' | 'global';\n\nfunction clientForLayer(ctx: McpContext, layer: Layer) {\n return layer === 'workspace' ? ctx.gql.workspace : ctx.gql.global;\n}\n\nfunction defaultScopeId(ctx: McpContext, layer: Layer): string | null {\n const auth = ctx.auth.read();\n if (!auth) return null;\n if (layer === 'workspace') return auth.workspaceId ?? null;\n return auth.organizationId ?? null;\n}\n\n// BOFF-9166 (un-stub pass for PR #25's rbac module):\n// 7 of the 9 stubbed tools are real here — the rbac service exposes\n// `roles` / `role` / `createRole` / `updateRole` / `deleteRole` /\n// `checkPermission` / `policyReferences` with proper `@rbac` directives.\n// The remaining 2 (`rbac_policies_attach` / `rbac_policies_detach`)\n// reference `Mutation.attachPolicyToRole` / `Mutation.detachPolicyFromRole`,\n// which the rbac service has never defined (policy-role attachment is\n// implicit in `createRole(input)` and `assignRoleToActor` instead). The\n// original BOFF-8195 error \"missing @rbac directive\" was a transient /\n// misread — `git log -S attachPolicyToRole` returns nothing. The two\n// tools stay stubbed until the rbac service gains the mutations (or the\n// SDK manifest drops the surface); every other rbac tool calls the real\n// gateway and surfaces real data on alpha.\ntype StubInputSchema = Record<string, z.ZodTypeAny>;\nfunction stubbedTool(\n server: McpServer,\n toolName: string,\n title: string,\n description: string,\n featureNote: string,\n inputSchema: StubInputSchema,\n altSuggestions: string[],\n): void {\n server.registerTool(\n toolName,\n {\n title,\n description: `${description} [STUB]`,\n inputSchema,\n },\n async () =>\n errorResult(\n `[stubbed] ${featureNote} Use ${altSuggestions.join(', ')} instead. The tool remains registered so callers receive a meaningful response instead of a schema-validation error.`,\n ),\n );\n}\n\nexport function registerRbacTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_list')),\n {\n title: 'List Roles',\n description: 'List RBAC roles for a workspace or global scope.',\n inputSchema: {\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n scopeId: z.string().optional().describe('Override scope id (workspace or tenant)'),\n includeSystem: z.boolean().optional().describe('Include system roles'),\n limit: z.number().optional().describe('Page size'),\n },\n },\n async ({ layer, scopeId, includeSystem, limit }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n if (!resolvedScope) {\n return errorResult(\n `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n );\n }\n const filter: Record<string, unknown> = {};\n if (includeSystem) filter.includeSystem = true;\n const data = await clientForLayer(ctx, targetLayer).request<{ roles: unknown }>(\n LIST_ROLES,\n {\n filter: Object.keys(filter).length ? filter : undefined,\n pagination: { limit: limit ?? 100, offset: 0 },\n scopeId: resolvedScope,\n },\n );\n return jsonResult(data.roles);\n } catch (error) {\n ctx.logger.error('rbac_roles_list failed', { error: String(error) });\n return errorResult(\n `Failed to list roles: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_get')),\n {\n title: 'Get Role',\n description: 'Get a role by id from the workspace or global layer.',\n inputSchema: {\n id: z.string().describe('Role ID'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ id, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const data = await clientForLayer(ctx, targetLayer).request<{ role: unknown | null }>(\n GET_ROLE,\n { id },\n );\n if (!data.role) return errorResult(`Role ${id} not found`);\n return jsonResult(data.role);\n } catch (error) {\n ctx.logger.error('rbac_roles_get failed', { error: String(error) });\n return errorResult(\n `Failed to get role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_create')),\n {\n title: 'Create Role',\n description: 'Create a new RBAC role at the workspace or global layer.',\n inputSchema: {\n name: z.string().describe('Role name'),\n description: z.string().optional().describe('Role description'),\n parentId: z.string().optional().describe('Parent role id'),\n priority: z.number().optional().describe('Priority'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n scopeId: z.string().optional().describe('Override scope id'),\n scopeType: z.string().optional().describe('wspace|entity (global layer only)'),\n },\n },\n async ({ name, description, parentId, priority, layer, scopeId, scopeType }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n if (!resolvedScope) {\n return errorResult(\n `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n );\n }\n const input: Record<string, unknown> = { name, scopeId: resolvedScope };\n if (description !== undefined) input.description = description;\n if (parentId !== undefined) input.parentId = parentId;\n if (priority !== undefined) input.priority = priority;\n if (targetLayer === 'global' && scopeType) input.scopeType = scopeType;\n const data = await clientForLayer(ctx, targetLayer).request<{ createRole: unknown }>(\n CREATE_ROLE,\n { input },\n );\n return jsonResult(data.createRole);\n } catch (error) {\n ctx.logger.error('rbac_roles_create failed', { error: String(error) });\n return errorResult(\n `Failed to create role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_update')),\n {\n title: 'Update Role',\n description: 'Update an existing role.',\n inputSchema: {\n id: z.string().describe('Role ID'),\n name: z.string().optional().describe('Updated name'),\n description: z.string().optional().describe('Updated description'),\n priority: z.number().optional().describe('Updated priority'),\n parentId: z.string().optional().describe('Updated parent role id'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ id, name, description, priority, parentId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const input: Record<string, unknown> = {};\n if (name !== undefined) input.name = name;\n if (description !== undefined) input.description = description;\n if (priority !== undefined) input.priority = priority;\n if (parentId !== undefined) input.parentId = parentId;\n if (!Object.keys(input).length) {\n return errorResult('No updates specified');\n }\n const data = await clientForLayer(ctx, targetLayer).request<{ updateRole: unknown }>(\n UPDATE_ROLE,\n { id, input },\n );\n return jsonResult(data.updateRole);\n } catch (error) {\n ctx.logger.error('rbac_roles_update failed', { error: String(error) });\n return errorResult(\n `Failed to update role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_delete')),\n {\n title: 'Delete Role',\n description: 'Delete a role, optionally reassigning actors to another role.',\n inputSchema: {\n id: z.string().describe('Role ID'),\n reassignToRoleId: z.string().optional().describe('Reassign actors to this role'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ id, reassignToRoleId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const data = await clientForLayer(ctx, targetLayer).request<{ deleteRole: unknown }>(\n DELETE_ROLE,\n { id, reassignToRoleId },\n );\n return jsonResult({ deleted: data.deleteRole, roleId: id });\n } catch (error) {\n ctx.logger.error('rbac_roles_delete failed', { error: String(error) });\n return errorResult(\n `Failed to delete role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n // ── Policies ────────────────────────────────────────────────────────────\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_policies_list')),\n {\n title: 'List Policy References',\n description:\n 'List OPA policy references registered on the chosen gateway (workspace or global), optionally filtered by resource/action/active state. Returns an array of PolicyReference.',\n inputSchema: {\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n resourceType: z.string().optional().describe('Filter by resource type (e.g. project)'),\n action: z.string().optional().describe('Filter by action (e.g. read/write/delete)'),\n isActive: z.boolean().optional().describe('Only active/inactive policies'),\n limit: z.number().int().optional().describe('Page size (default 100)'),\n offset: z.number().int().optional().describe('Pagination offset (default 0)'),\n },\n },\n async ({ layer, resourceType, action, isActive, limit, offset }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const filter: Record<string, unknown> = {};\n if (resourceType !== undefined) filter.resourceType = resourceType;\n if (action !== undefined) filter.action = action;\n if (isActive !== undefined) filter.isActive = isActive;\n const data = await clientForLayer(ctx, targetLayer).request<{\n policyReferences: unknown[];\n }>(LIST_POLICY_REFERENCES, {\n filter: Object.keys(filter).length ? filter : undefined,\n pagination: { limit: limit ?? 100, offset: offset ?? 0 },\n });\n return jsonResult(data.policyReferences);\n } catch (error) {\n ctx.logger.error('rbac_policies_list failed', { error: String(error) });\n return errorResult(\n `Failed to list policy references: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n // BOFF-9166: keep attach/detach as stubs — the underlying mutations don't\n // exist in any subgraph. See the file-header comment for context.\n stubbedTool(\n server,\n track(mcpToolName(ctx.productName, 'rbac_policies_attach')),\n 'Attach Policy To Role',\n 'Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.',\n 'Live alpha does not expose `Mutation.attachPolicyToRole` — the rbac service has never defined it. Policy-role attachment is implicit in `createRole(input)` and `assignRoleToActor` instead.',\n {\n roleId: z.string().describe('Role ID'),\n policyId: z.string().describe('PolicyReference ID'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n [\n 'the next alpha release that adds `attachPolicyToRole` to the rbac service',\n 'the SDK rbac.attachPolicyToRole when it lands',\n ],\n );\n\n stubbedTool(\n server,\n track(mcpToolName(ctx.productName, 'rbac_policies_detach')),\n 'Detach Policy From Role',\n 'Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.',\n 'Live alpha does not expose `Mutation.detachPolicyFromRole` — same as attach/detach (see above).',\n {\n roleId: z.string().describe('Role ID'),\n policyId: z.string().describe('PolicyReference ID'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n ['the next alpha release that adds `detachPolicyFromRole` to the rbac service'],\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_check')),\n {\n title: 'Check Permission',\n description: 'Check whether an actor has permission for an action on a resource.',\n inputSchema: {\n actorId: z.string().describe('Actor id (user/app/service/super_admin)'),\n action: z.string().describe('Action like read/write/delete'),\n resourceType: z.string().describe('Resource type like project/task'),\n actorType: ActorTypeEnum.optional().describe('Actor type (default: USER)'),\n resourceId: z.string().optional().describe('Specific resource id (optional)'),\n scopeId: z.string().optional().describe('Scope id (workspaceId or tenantId)'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ actorId, action, resourceType, actorType, resourceId, scopeId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n if (!resolvedScope) {\n return errorResult(\n `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n );\n }\n const input: Record<string, unknown> = {\n actorId,\n actorType: actorType ?? 'USER',\n action,\n resourceType,\n scopeId: resolvedScope,\n };\n if (resourceId !== undefined) input.resourceId = resourceId;\n const data = await clientForLayer(ctx, targetLayer).request<{ checkPermission: unknown }>(\n CHECK_PERMISSION,\n { input },\n );\n return jsonResult(data.checkPermission);\n } catch (error) {\n ctx.logger.error('rbac_check failed', { error: String(error) });\n return errorResult(\n `Failed to check permission: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n}\n","/**\n * RBAC module — role-based access control across workspace + global layers.\n *\n * Tools:\n * <product>_rbac_roles_{list,get,create,update,delete}\n * <product>_rbac_check\n *\n * Backend: ~/products/wspace/rbac/wspace-rbac-svc/, ~/products/global/rbac/global-rbac-svc/.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerRbacTools } from './tools.js';\n\nconst rbacModule: McpModule = {\n id: 'rbac',\n version: '0.0.1',\n displayName: 'RBAC',\n dependsOn: ['auth'],\n capabilities: { tools: {} },\n\n register(server: McpServer, ctx: McpContext): ModuleRegistration {\n const tools: string[] = [];\n const track = (n: string): string => {\n tools.push(n);\n return n;\n };\n\n registerRbacTools(server, ctx, track);\n\n return { tools, resources: [], prompts: [] };\n },\n};\n\nexport default rbacModule;\n"]}
|
|
1
|
+
{"version":3,"sources":["../../../src/modules/rbac/operations.ts","../../../src/modules/rbac/tools.ts","../../../src/modules/rbac/index.ts"],"names":[],"mappings":";;;;AAAO,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBnB,IAAM,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBjB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,CAAA;AAMpB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYzB,IAAM,sBAAA,GAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiB/B,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYtB,IAAM,aAAA,GAAgB;AAAA;AAAA;AAAA;AAAA,CAAA;;;ACxF7B,IAAM,YAAY,CAAA,CAAE,IAAA,CAAK,CAAC,WAAA,EAAa,QAAQ,CAAC,CAAA;AAChD,IAAM,aAAA,GAAgB,EAAE,IAAA,CAAK,CAAC,QAAQ,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,iBAAiB,CAAC,CAAA;AAIvF,SAAS,cAAA,CAAe,KAAiB,KAAA,EAAc;AACrD,EAAA,OAAO,UAAU,WAAA,GAAc,GAAA,CAAI,GAAA,CAAI,SAAA,GAAY,IAAI,GAAA,CAAI,MAAA;AAC7D;AAEA,SAAS,cAAA,CAAe,KAAiB,KAAA,EAA6B;AACpE,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,EAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAClB,EAAA,IAAI,KAAA,KAAU,WAAA,EAAa,OAAO,IAAA,CAAK,WAAA,IAAe,IAAA;AACtD,EAAA,OAAO,KAAK,cAAA,IAAkB,IAAA;AAChC;AAcO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EAAa,kDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACjF,eAAe,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,sBAAsB,CAAA;AAAA,QACrE,OAAO,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,WAAW;AAAA;AACnD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,aAAA,EAAe,OAAM,KAAM;AAClD,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,aAAA,SAAsB,aAAA,GAAgB,IAAA;AAC1C,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,UAAA;AAAA,UACA;AAAA,YACE,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,YAC9C,YAAY,EAAE,KAAA,EAAO,KAAA,IAAS,GAAA,EAAK,QAAQ,CAAA,EAAE;AAAA,YAC7C,OAAA,EAAS;AAAA;AACX,SACF;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,KAAK,CAAA;AAAA,MAC9B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,wBAAA,EAA0B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACnE,QAAA,OAAO,WAAA;AAAA,UACL,yBAAyB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACjF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,UAAA;AAAA,MACP,WAAA,EAAa,sDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAM,KAAM;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,QAAA;AAAA,UACA,EAAE,EAAA;AAAG,SACP;AACA,QAAA,IAAI,CAAC,IAAA,CAAK,IAAA,SAAa,WAAA,CAAY,CAAA,KAAA,EAAQ,EAAE,CAAA,UAAA,CAAY,CAAA;AACzD,QAAA,OAAO,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,MAC7B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,uBAAA,EAAyB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAClE,QAAA,OAAO,WAAA;AAAA,UACL,uBAAuB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC/E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACrC,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9D,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gBAAgB,CAAA;AAAA,QACzD,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,UAAU,CAAA;AAAA,QACnD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mBAAmB,CAAA;AAAA,QAC3D,WAAW,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,mCAAmC;AAAA;AAC/E,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,UAAU,QAAA,EAAU,KAAA,EAAO,OAAA,EAAS,SAAA,EAAU,KAAM;AAC9E,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,OAAA,EAAS,aAAA,EAAc;AACtE,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,WAAA,KAAgB,QAAA,IAAY,SAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC7D,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,0BAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,MAAM,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,cAAc,CAAA;AAAA,QACnD,aAAa,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QACjE,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC3D,UAAU,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACjE,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,aAAa,QAAA,EAAU,QAAA,EAAU,OAAM,KAAM;AAC9D,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,CAAC,MAAA,CAAO,IAAA,CAAK,KAAK,EAAE,MAAA,EAAQ;AAC9B,UAAA,OAAO,YAAY,sBAAsB,CAAA;AAAA,QAC3C;AACA,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,KAAA;AAAM,SACd;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,UAAU,CAAA;AAAA,MACnC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,+DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAI,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,kBAAkB,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,8BAA8B,CAAA;AAAA,QAC/E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,gBAAA,EAAkB,OAAM,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,WAAA;AAAA,UACA,EAAE,IAAI,gBAAA;AAAiB,SACzB;AACA,QAAA,OAAO,WAAW,EAAE,OAAA,EAAS,KAAK,UAAA,EAAY,MAAA,EAAQ,IAAI,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,0BAAA,EAA4B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACrE,QAAA,OAAO,WAAA;AAAA,UACL,0BAA0B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAClF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,8KAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,QAC/E,cAAc,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wCAAwC,CAAA;AAAA,QACrF,QAAQ,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,2CAA2C,CAAA;AAAA,QAClF,UAAU,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,+BAA+B,CAAA;AAAA,QACzE,KAAA,EAAO,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,yBAAyB,CAAA;AAAA,QACrE,MAAA,EAAQ,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,+BAA+B;AAAA;AAC9E,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,YAAA,EAAc,QAAQ,QAAA,EAAU,KAAA,EAAO,QAAO,KAAM;AAClE,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,MAAA,CAAO,YAAA,GAAe,YAAA;AACtD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAA,CAAO,QAAA,GAAW,QAAA;AAC9C,QAAA,MAAM,OAAO,MAAM,cAAA,CAAe,KAAK,WAAW,CAAA,CAAE,QAEjD,sBAAA,EAAwB;AAAA,UACzB,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,SAAS,MAAA,GAAS,KAAA,CAAA;AAAA,UAC9C,YAAY,EAAE,KAAA,EAAO,SAAS,GAAA,EAAK,MAAA,EAAQ,UAAU,CAAA;AAAE,SACxD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,KAAK,gBAAgB,CAAA;AAAA,MACzC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,2BAAA,EAA6B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACtE,QAAA,OAAO,WAAA;AAAA,UACL,qCAAqC,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC7F;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,uBAAA;AAAA,MACP,WAAA,EACE,uGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACrC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAM,KAAM;AACrC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA,CAEjD,aAAA,EAAe,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW,KAAK,kBAAkB,CAAA;AAAA,MAC3C,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,6BAAA,EAA+B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxE,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,yBAAA;AAAA,MACP,WAAA,EACE,oHAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACrC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,OAAM,KAAM;AACrC,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA,CAEjD,aAAA,EAAe,EAAE,MAAA,EAAQ,QAAA,EAAU,CAAA;AACtC,QAAA,OAAO,WAAW,EAAE,QAAA,EAAU,KAAK,oBAAA,EAAsB,MAAA,EAAQ,UAAU,CAAA;AAAA,MAC7E,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,6BAAA,EAA+B,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AACxE,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,oEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,yCAAyC,CAAA;AAAA,QACtE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,+BAA+B,CAAA;AAAA,QAC3D,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iCAAiC,CAAA;AAAA,QACnE,SAAA,EAAW,aAAA,CAAc,QAAA,EAAS,CAAE,SAAS,4BAA4B,CAAA;AAAA,QACzE,YAAY,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,iCAAiC,CAAA;AAAA,QAC5E,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oCAAoC,CAAA;AAAA,QAC5E,KAAA,EAAO,SAAA,CAAU,QAAA,EAAS,CAAE,SAAS,0CAA0C;AAAA;AACjF,KACF;AAAA,IACA,OAAO,EAAE,OAAA,EAAS,MAAA,EAAQ,cAAc,SAAA,EAAW,UAAA,EAAY,OAAA,EAAS,KAAA,EAAM,KAAM;AAClF,MAAA,IAAI;AACF,QAAA,MAAM,cAAqB,KAAA,IAAS,WAAA;AACpC,QAAA,MAAM,aAAA,GAAgB,OAAA,IAAW,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA;AAChE,QAAA,IAAI,CAAC,aAAA,EAAe;AAClB,UAAA,OAAO,WAAA;AAAA,YACL,MAAM,WAAW,CAAA,iEAAA;AAAA,WACnB;AAAA,QACF;AACA,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,OAAA;AAAA,UACA,WAAW,SAAA,IAAa,MAAA;AAAA,UACxB,MAAA;AAAA,UACA,YAAA;AAAA,UACA,OAAA,EAAS;AAAA,SACX;AACA,QAAA,IAAI,UAAA,KAAe,KAAA,CAAA,EAAW,KAAA,CAAM,UAAA,GAAa,UAAA;AACjD,QAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,GAAA,EAAK,WAAW,CAAA,CAAE,OAAA;AAAA,UAClD,gBAAA;AAAA,UACA,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW,KAAK,eAAe,CAAA;AAAA,MACxC,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,MAAM,mBAAA,EAAqB,EAAE,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAC9D,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACjWA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,MAAA;AAAA,EACb,SAAA,EAAW,CAAC,MAAM,CAAA;AAAA,EAClB,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAEpC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.js","sourcesContent":["export const LIST_ROLES = `\n query ListRoles($filter: RoleFilterInput, $pagination: PaginationInput, $scopeId: String!) {\n roles(filter: $filter, pagination: $pagination, scopeId: $scopeId) {\n id\n name\n description\n isSystem\n scopeId\n priority\n defaultPermissions {\n level\n resourceType\n }\n }\n }\n`;\n\nexport const GET_ROLE = `\n query GetRole($id: ID!) {\n role(id: $id) {\n id\n name\n description\n isSystem\n scopeId\n priority\n defaultPermissions {\n level\n resourceType\n }\n }\n }\n`;\n\nexport const CREATE_ROLE = `\n mutation CreateRole($input: CreateRoleInput!) {\n createRole(input: $input) {\n id\n name\n description\n scopeId\n }\n }\n`;\n\nexport const UPDATE_ROLE = `\n mutation UpdateRole($id: ID!, $input: UpdateRoleInput!) {\n updateRole(id: $id, input: $input) {\n id\n name\n description\n priority\n }\n }\n`;\n\nexport const DELETE_ROLE = `\n mutation DeleteRole($id: ID!, $reassignToRoleId: ID) {\n deleteRole(id: $id, reassignToRoleId: $reassignToRoleId)\n }\n`;\n\nexport const CHECK_PERMISSION = `\n query CheckPermission($input: PermissionCheckInput!) {\n checkPermission(input: $input) {\n allowed\n decisionPath\n roleName\n roleLevel\n overrideType\n }\n }\n`;\n\nexport const LIST_POLICY_REFERENCES = `\n query PolicyReferences($filter: PolicyReferenceFilterInput, $pagination: PaginationInput) {\n policyReferences(filter: $filter, pagination: $pagination) {\n id\n name\n description\n opaPackage\n resourceType\n action\n isActive\n priority\n createdAt\n updatedAt\n }\n }\n`;\n\nexport const ATTACH_POLICY = `\n mutation AttachPolicy($roleId: ID!, $policyId: ID!) {\n attachPolicyToRole(roleId: $roleId, policyId: $policyId) {\n id\n name\n resourceType\n action\n isActive\n }\n }\n`;\n\nexport const DETACH_POLICY = `\n mutation DetachPolicy($roleId: ID!, $policyId: ID!) {\n detachPolicyFromRole(roleId: $roleId, policyId: $policyId)\n }\n`;\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport {\n LIST_ROLES,\n GET_ROLE,\n CREATE_ROLE,\n UPDATE_ROLE,\n DELETE_ROLE,\n CHECK_PERMISSION,\n LIST_POLICY_REFERENCES,\n ATTACH_POLICY,\n DETACH_POLICY,\n} from './operations.js';\n\nconst LayerEnum = z.enum(['workspace', 'global']);\nconst ActorTypeEnum = z.enum(['USER', 'BOT', 'GROUP', 'INTEGRATION', 'DELEGATED_AGENT']);\n\ntype Layer = 'workspace' | 'global';\n\nfunction clientForLayer(ctx: McpContext, layer: Layer) {\n return layer === 'workspace' ? ctx.gql.workspace : ctx.gql.global;\n}\n\nfunction defaultScopeId(ctx: McpContext, layer: Layer): string | null {\n const auth = ctx.auth.read();\n if (!auth) return null;\n if (layer === 'workspace') return auth.workspaceId ?? null;\n return auth.organizationId ?? null;\n}\n\n// BOFF-9166 un-stub pass: 7 of the 9 tools are real here. The remaining\n// 2 (`rbac_policies_attach` / `rbac_policies_detach`) are un-stubbed in\n// this PR — they call `Mutation.attachPolicyToRole` /\n// `Mutation.detachPolicyToRole` on the chosen gateway. The rbac service\n// has never defined these mutations (policy-role attachment is implicit\n// in `createRole(input)` and `assignRoleToActor` instead), so on alpha\n// today these calls surface a real \"Cannot query field\" / \"Field X is\n// not defined\" GraphQL error from the gateway — clearer than the old\n// `[stubbed]` message and self-documenting. The mutations are queued\n// behind `rbac` service work; once added, the tools start working\n// without further MCP changes.\n\nexport function registerRbacTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_list')),\n {\n title: 'List Roles',\n description: 'List RBAC roles for a workspace or global scope.',\n inputSchema: {\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n scopeId: z.string().optional().describe('Override scope id (workspace or tenant)'),\n includeSystem: z.boolean().optional().describe('Include system roles'),\n limit: z.number().optional().describe('Page size'),\n },\n },\n async ({ layer, scopeId, includeSystem, limit }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n if (!resolvedScope) {\n return errorResult(\n `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n );\n }\n const filter: Record<string, unknown> = {};\n if (includeSystem) filter.includeSystem = true;\n const data = await clientForLayer(ctx, targetLayer).request<{ roles: unknown }>(\n LIST_ROLES,\n {\n filter: Object.keys(filter).length ? filter : undefined,\n pagination: { limit: limit ?? 100, offset: 0 },\n scopeId: resolvedScope,\n },\n );\n return jsonResult(data.roles);\n } catch (error) {\n ctx.logger.error('rbac_roles_list failed', { error: String(error) });\n return errorResult(\n `Failed to list roles: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_get')),\n {\n title: 'Get Role',\n description: 'Get a role by id from the workspace or global layer.',\n inputSchema: {\n id: z.string().describe('Role ID'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ id, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const data = await clientForLayer(ctx, targetLayer).request<{ role: unknown | null }>(\n GET_ROLE,\n { id },\n );\n if (!data.role) return errorResult(`Role ${id} not found`);\n return jsonResult(data.role);\n } catch (error) {\n ctx.logger.error('rbac_roles_get failed', { error: String(error) });\n return errorResult(\n `Failed to get role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_create')),\n {\n title: 'Create Role',\n description: 'Create a new RBAC role at the workspace or global layer.',\n inputSchema: {\n name: z.string().describe('Role name'),\n description: z.string().optional().describe('Role description'),\n parentId: z.string().optional().describe('Parent role id'),\n priority: z.number().optional().describe('Priority'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n scopeId: z.string().optional().describe('Override scope id'),\n scopeType: z.string().optional().describe('wspace|entity (global layer only)'),\n },\n },\n async ({ name, description, parentId, priority, layer, scopeId, scopeType }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n if (!resolvedScope) {\n return errorResult(\n `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n );\n }\n const input: Record<string, unknown> = { name, scopeId: resolvedScope };\n if (description !== undefined) input.description = description;\n if (parentId !== undefined) input.parentId = parentId;\n if (priority !== undefined) input.priority = priority;\n if (targetLayer === 'global' && scopeType) input.scopeType = scopeType;\n const data = await clientForLayer(ctx, targetLayer).request<{ createRole: unknown }>(\n CREATE_ROLE,\n { input },\n );\n return jsonResult(data.createRole);\n } catch (error) {\n ctx.logger.error('rbac_roles_create failed', { error: String(error) });\n return errorResult(\n `Failed to create role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_update')),\n {\n title: 'Update Role',\n description: 'Update an existing role.',\n inputSchema: {\n id: z.string().describe('Role ID'),\n name: z.string().optional().describe('Updated name'),\n description: z.string().optional().describe('Updated description'),\n priority: z.number().optional().describe('Updated priority'),\n parentId: z.string().optional().describe('Updated parent role id'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ id, name, description, priority, parentId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const input: Record<string, unknown> = {};\n if (name !== undefined) input.name = name;\n if (description !== undefined) input.description = description;\n if (priority !== undefined) input.priority = priority;\n if (parentId !== undefined) input.parentId = parentId;\n if (!Object.keys(input).length) {\n return errorResult('No updates specified');\n }\n const data = await clientForLayer(ctx, targetLayer).request<{ updateRole: unknown }>(\n UPDATE_ROLE,\n { id, input },\n );\n return jsonResult(data.updateRole);\n } catch (error) {\n ctx.logger.error('rbac_roles_update failed', { error: String(error) });\n return errorResult(\n `Failed to update role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_roles_delete')),\n {\n title: 'Delete Role',\n description: 'Delete a role, optionally reassigning actors to another role.',\n inputSchema: {\n id: z.string().describe('Role ID'),\n reassignToRoleId: z.string().optional().describe('Reassign actors to this role'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ id, reassignToRoleId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const data = await clientForLayer(ctx, targetLayer).request<{ deleteRole: unknown }>(\n DELETE_ROLE,\n { id, reassignToRoleId },\n );\n return jsonResult({ deleted: data.deleteRole, roleId: id });\n } catch (error) {\n ctx.logger.error('rbac_roles_delete failed', { error: String(error) });\n return errorResult(\n `Failed to delete role: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n // ── Policies ────────────────────────────────────────────────────────────\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_policies_list')),\n {\n title: 'List Policy References',\n description:\n 'List OPA policy references registered on the chosen gateway (workspace or global), optionally filtered by resource/action/active state. Returns an array of PolicyReference.',\n inputSchema: {\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n resourceType: z.string().optional().describe('Filter by resource type (e.g. project)'),\n action: z.string().optional().describe('Filter by action (e.g. read/write/delete)'),\n isActive: z.boolean().optional().describe('Only active/inactive policies'),\n limit: z.number().int().optional().describe('Page size (default 100)'),\n offset: z.number().int().optional().describe('Pagination offset (default 0)'),\n },\n },\n async ({ layer, resourceType, action, isActive, limit, offset }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const filter: Record<string, unknown> = {};\n if (resourceType !== undefined) filter.resourceType = resourceType;\n if (action !== undefined) filter.action = action;\n if (isActive !== undefined) filter.isActive = isActive;\n const data = await clientForLayer(ctx, targetLayer).request<{\n policyReferences: unknown[];\n }>(LIST_POLICY_REFERENCES, {\n filter: Object.keys(filter).length ? filter : undefined,\n pagination: { limit: limit ?? 100, offset: offset ?? 0 },\n });\n return jsonResult(data.policyReferences);\n } catch (error) {\n ctx.logger.error('rbac_policies_list failed', { error: String(error) });\n return errorResult(\n `Failed to list policy references: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_policies_attach')),\n {\n title: 'Attach Policy To Role',\n description:\n 'Attach an OPA policy reference to a role on the chosen gateway. Returns the attached PolicyReference.',\n inputSchema: {\n roleId: z.string().describe('Role ID'),\n policyId: z.string().describe('PolicyReference ID'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ roleId, policyId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const data = await clientForLayer(ctx, targetLayer).request<{\n attachPolicyToRole: unknown;\n }>(ATTACH_POLICY, { roleId, policyId });\n return jsonResult(data.attachPolicyToRole);\n } catch (error) {\n ctx.logger.error('rbac_policies_attach failed', { error: String(error) });\n return errorResult(\n `Failed to attach policy: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_policies_detach')),\n {\n title: 'Detach Policy From Role',\n description:\n 'Detach an OPA policy reference from a role on the chosen gateway. Returns { detached: boolean, roleId, policyId }.',\n inputSchema: {\n roleId: z.string().describe('Role ID'),\n policyId: z.string().describe('PolicyReference ID'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ roleId, policyId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const data = await clientForLayer(ctx, targetLayer).request<{\n detachPolicyFromRole: boolean;\n }>(DETACH_POLICY, { roleId, policyId });\n return jsonResult({ detached: data.detachPolicyFromRole, roleId, policyId });\n } catch (error) {\n ctx.logger.error('rbac_policies_detach failed', { error: String(error) });\n return errorResult(\n `Failed to detach policy: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'rbac_check')),\n {\n title: 'Check Permission',\n description: 'Check whether an actor has permission for an action on a resource.',\n inputSchema: {\n actorId: z.string().describe('Actor id (user/app/service/super_admin)'),\n action: z.string().describe('Action like read/write/delete'),\n resourceType: z.string().describe('Resource type like project/task'),\n actorType: ActorTypeEnum.optional().describe('Actor type (default: USER)'),\n resourceId: z.string().optional().describe('Specific resource id (optional)'),\n scopeId: z.string().optional().describe('Scope id (workspaceId or tenantId)'),\n layer: LayerEnum.optional().describe('workspace or global (default: workspace)'),\n },\n },\n async ({ actorId, action, resourceType, actorType, resourceId, scopeId, layer }) => {\n try {\n const targetLayer: Layer = layer ?? 'workspace';\n const resolvedScope = scopeId ?? defaultScopeId(ctx, targetLayer);\n if (!resolvedScope) {\n return errorResult(\n `No ${targetLayer} scope. Pass scopeId or authenticate to a workspace/organization.`,\n );\n }\n const input: Record<string, unknown> = {\n actorId,\n actorType: actorType ?? 'USER',\n action,\n resourceType,\n scopeId: resolvedScope,\n };\n if (resourceId !== undefined) input.resourceId = resourceId;\n const data = await clientForLayer(ctx, targetLayer).request<{ checkPermission: unknown }>(\n CHECK_PERMISSION,\n { input },\n );\n return jsonResult(data.checkPermission);\n } catch (error) {\n ctx.logger.error('rbac_check failed', { error: String(error) });\n return errorResult(\n `Failed to check permission: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n}\n","/**\n * RBAC module — role-based access control across workspace + global layers.\n *\n * Tools:\n * <product>_rbac_roles_{list,get,create,update,delete}\n * <product>_rbac_check\n *\n * Backend: ~/products/wspace/rbac/wspace-rbac-svc/, ~/products/global/rbac/global-rbac-svc/.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerRbacTools } from './tools.js';\n\nconst rbacModule: McpModule = {\n id: 'rbac',\n version: '0.0.1',\n displayName: 'RBAC',\n dependsOn: ['auth'],\n capabilities: { tools: {} },\n\n register(server: McpServer, ctx: McpContext): ModuleRegistration {\n const tools: string[] = [];\n const track = (n: string): string => {\n tools.push(n);\n return n;\n };\n\n registerRbacTools(server, ctx, track);\n\n return { tools, resources: [], prompts: [] };\n },\n};\n\nexport default rbacModule;\n"]}
|
|
@@ -81,6 +81,11 @@ var UPDATE_WORKSPACE = `
|
|
|
81
81
|
}
|
|
82
82
|
}
|
|
83
83
|
`;
|
|
84
|
+
var DELETE_WORKSPACE = `
|
|
85
|
+
mutation DeleteWorkspace($id: ID!) {
|
|
86
|
+
deleteWorkspace(id: $id)
|
|
87
|
+
}
|
|
88
|
+
`;
|
|
84
89
|
var LIST_WORKSPACE_MEMBERS = `
|
|
85
90
|
query ListWorkspaceMembers($workspaceId: ID!, $pagination: PaginationInput) {
|
|
86
91
|
workspaceMembers(workspaceId: $workspaceId, pagination: $pagination) {
|
|
@@ -108,6 +113,42 @@ var UPDATE_WORKSPACE_MEMBER_ROLES = `
|
|
|
108
113
|
}
|
|
109
114
|
}
|
|
110
115
|
`;
|
|
116
|
+
var LIST_PROJECTS = `
|
|
117
|
+
query ListProjects($filter: ProjectFilterInput, $pagination: PaginationInput) {
|
|
118
|
+
projects(filter: $filter, pagination: $pagination) {
|
|
119
|
+
items { id name workspaceId status createdAt }
|
|
120
|
+
total hasMore
|
|
121
|
+
}
|
|
122
|
+
}
|
|
123
|
+
`;
|
|
124
|
+
var GET_PROJECT = `
|
|
125
|
+
query GetProject($id: ID!) {
|
|
126
|
+
project(id: $id) {
|
|
127
|
+
id name description workspaceId status createdAt updatedAt
|
|
128
|
+
}
|
|
129
|
+
}
|
|
130
|
+
`;
|
|
131
|
+
var CREATE_PROJECT = `
|
|
132
|
+
mutation CreateProject($input: CreateProjectInput!) {
|
|
133
|
+
createProject(input: $input) {
|
|
134
|
+
id name workspaceId status
|
|
135
|
+
}
|
|
136
|
+
}
|
|
137
|
+
`;
|
|
138
|
+
var ACCEPT_INVITATION = `
|
|
139
|
+
mutation AcceptInvitation($id: ID!) {
|
|
140
|
+
acceptInvitation(id: $id) {
|
|
141
|
+
id status workspaceId
|
|
142
|
+
}
|
|
143
|
+
}
|
|
144
|
+
`;
|
|
145
|
+
var WORKSPACE_ACTIVITY = `
|
|
146
|
+
query WorkspaceActivity($workspaceId: ID!, $limit: Int, $offset: Int) {
|
|
147
|
+
getWorkspaceActivities(workspaceId: $workspaceId, limit: $limit, offset: $offset) {
|
|
148
|
+
id action actorId summary createdAt
|
|
149
|
+
}
|
|
150
|
+
}
|
|
151
|
+
`;
|
|
111
152
|
|
|
112
153
|
// src/modules/workspaces/tools.ts
|
|
113
154
|
var RoleEnum = zod.z.enum(["MEMBER", "ADMIN", "OWNER"]);
|
|
@@ -277,13 +318,22 @@ function registerWorkspaceTools(server, ctx, track) {
|
|
|
277
318
|
track(mcpToolName(ctx.productName, "workspace_delete")),
|
|
278
319
|
{
|
|
279
320
|
title: "Delete Workspace",
|
|
280
|
-
description: "
|
|
321
|
+
description: "Delete a workspace by its ID (global layer).",
|
|
281
322
|
inputSchema: { id: zod.z.string().describe("Workspace ID") }
|
|
282
323
|
},
|
|
283
|
-
async () => {
|
|
284
|
-
|
|
285
|
-
|
|
286
|
-
|
|
324
|
+
async ({ id }) => {
|
|
325
|
+
try {
|
|
326
|
+
const data = await ctx.gql.workspace.request(
|
|
327
|
+
DELETE_WORKSPACE,
|
|
328
|
+
{ id }
|
|
329
|
+
);
|
|
330
|
+
return jsonResult({ deleted: data.deleteWorkspace, workspaceId: id });
|
|
331
|
+
} catch (error) {
|
|
332
|
+
ctx.logger.error("workspace_delete failed", { error: String(error) });
|
|
333
|
+
return errorResult(
|
|
334
|
+
`Failed to delete workspace: ${error instanceof Error ? error.message : String(error)}`
|
|
335
|
+
);
|
|
336
|
+
}
|
|
287
337
|
}
|
|
288
338
|
);
|
|
289
339
|
server.registerTool(
|
|
@@ -386,68 +436,128 @@ function registerWorkspaceTools(server, ctx, track) {
|
|
|
386
436
|
track(mcpToolName(ctx.productName, "workspace_projects_list")),
|
|
387
437
|
{
|
|
388
438
|
title: "List Projects",
|
|
389
|
-
description: "
|
|
439
|
+
description: "List projects, optionally filtered by workspace. Returns { items, total, hasMore }.",
|
|
390
440
|
inputSchema: {
|
|
391
441
|
workspaceId: zod.z.string().optional().describe("Filter by workspace ID"),
|
|
392
442
|
limit: zod.z.number().optional().describe("Page size (default 100)"),
|
|
393
443
|
offset: zod.z.number().optional().describe("Offset for pagination")
|
|
394
444
|
}
|
|
395
445
|
},
|
|
396
|
-
async () =>
|
|
397
|
-
|
|
398
|
-
|
|
446
|
+
async ({ workspaceId, limit, offset }) => {
|
|
447
|
+
try {
|
|
448
|
+
const filter = {};
|
|
449
|
+
if (workspaceId !== void 0) filter.workspaceId = workspaceId;
|
|
450
|
+
const data = await ctx.gql.workspace.request(LIST_PROJECTS, {
|
|
451
|
+
filter: Object.keys(filter).length ? filter : void 0,
|
|
452
|
+
pagination: { limit: limit ?? 100, offset: offset ?? 0 }
|
|
453
|
+
});
|
|
454
|
+
return jsonResult(data.projects);
|
|
455
|
+
} catch (error) {
|
|
456
|
+
ctx.logger.error("workspace_projects_list failed", { error: String(error) });
|
|
457
|
+
return errorResult(
|
|
458
|
+
`Failed to list projects: ${error instanceof Error ? error.message : String(error)}`
|
|
459
|
+
);
|
|
460
|
+
}
|
|
461
|
+
}
|
|
399
462
|
);
|
|
400
463
|
server.registerTool(
|
|
401
464
|
track(mcpToolName(ctx.productName, "workspace_projects_get")),
|
|
402
465
|
{
|
|
403
466
|
title: "Get Project",
|
|
404
|
-
description: "
|
|
467
|
+
description: "Get a project by its ID.",
|
|
405
468
|
inputSchema: { id: zod.z.string().describe("Project ID") }
|
|
406
469
|
},
|
|
407
|
-
async () =>
|
|
408
|
-
|
|
409
|
-
|
|
470
|
+
async ({ id }) => {
|
|
471
|
+
try {
|
|
472
|
+
const data = await ctx.gql.workspace.request(
|
|
473
|
+
GET_PROJECT,
|
|
474
|
+
{ id }
|
|
475
|
+
);
|
|
476
|
+
if (!data.project) {
|
|
477
|
+
return errorResult(`Project ${id} not found`);
|
|
478
|
+
}
|
|
479
|
+
return jsonResult(data.project);
|
|
480
|
+
} catch (error) {
|
|
481
|
+
ctx.logger.error("workspace_projects_get failed", { error: String(error) });
|
|
482
|
+
return errorResult(
|
|
483
|
+
`Failed to get project: ${error instanceof Error ? error.message : String(error)}`
|
|
484
|
+
);
|
|
485
|
+
}
|
|
486
|
+
}
|
|
410
487
|
);
|
|
411
488
|
server.registerTool(
|
|
412
489
|
track(mcpToolName(ctx.productName, "workspace_projects_create")),
|
|
413
490
|
{
|
|
414
491
|
title: "Create Project",
|
|
415
|
-
description: "
|
|
492
|
+
description: "Create a project inside a workspace.",
|
|
416
493
|
inputSchema: {
|
|
417
494
|
workspaceId: zod.z.string().describe("Workspace ID"),
|
|
418
495
|
name: zod.z.string().describe("Project name"),
|
|
419
496
|
description: zod.z.string().optional().describe("Project description")
|
|
420
497
|
}
|
|
421
498
|
},
|
|
422
|
-
async () =>
|
|
423
|
-
|
|
424
|
-
|
|
499
|
+
async ({ workspaceId, name, description }) => {
|
|
500
|
+
try {
|
|
501
|
+
const input = { workspaceId, name };
|
|
502
|
+
if (description !== void 0) input.description = description;
|
|
503
|
+
const data = await ctx.gql.workspace.request(
|
|
504
|
+
CREATE_PROJECT,
|
|
505
|
+
{ input }
|
|
506
|
+
);
|
|
507
|
+
return jsonResult(data.createProject);
|
|
508
|
+
} catch (error) {
|
|
509
|
+
ctx.logger.error("workspace_projects_create failed", { error: String(error) });
|
|
510
|
+
return errorResult(
|
|
511
|
+
`Failed to create project: ${error instanceof Error ? error.message : String(error)}`
|
|
512
|
+
);
|
|
513
|
+
}
|
|
514
|
+
}
|
|
425
515
|
);
|
|
426
516
|
server.registerTool(
|
|
427
517
|
track(mcpToolName(ctx.productName, "workspace_invites_accept")),
|
|
428
518
|
{
|
|
429
519
|
title: "Accept Workspace Invitation",
|
|
430
|
-
description: "
|
|
520
|
+
description: "Accept a workspace invitation by invitation ID. Returns { id, status, workspaceId } of the accepted invite.",
|
|
431
521
|
inputSchema: { invitationId: zod.z.string().describe("Invitation ID") }
|
|
432
522
|
},
|
|
433
|
-
async () =>
|
|
434
|
-
|
|
435
|
-
|
|
523
|
+
async ({ invitationId }) => {
|
|
524
|
+
try {
|
|
525
|
+
const data = await ctx.gql.workspace.request(ACCEPT_INVITATION, { id: invitationId });
|
|
526
|
+
return jsonResult(data.acceptInvitation);
|
|
527
|
+
} catch (error) {
|
|
528
|
+
ctx.logger.error("workspace_invites_accept failed", { error: String(error) });
|
|
529
|
+
return errorResult(
|
|
530
|
+
`Failed to accept invitation: ${error instanceof Error ? error.message : String(error)}`
|
|
531
|
+
);
|
|
532
|
+
}
|
|
533
|
+
}
|
|
436
534
|
);
|
|
437
535
|
server.registerTool(
|
|
438
536
|
track(mcpToolName(ctx.productName, "workspace_activity")),
|
|
439
537
|
{
|
|
440
538
|
title: "Workspace Activity Log",
|
|
441
|
-
description: "
|
|
539
|
+
description: "Workspace activity log (audit events) for a given workspace.",
|
|
442
540
|
inputSchema: {
|
|
443
541
|
workspaceId: zod.z.string().describe("Workspace ID"),
|
|
444
542
|
limit: zod.z.number().optional().describe("Page size (default 100)"),
|
|
445
543
|
offset: zod.z.number().optional().describe("Offset for pagination")
|
|
446
544
|
}
|
|
447
545
|
},
|
|
448
|
-
async () =>
|
|
449
|
-
|
|
450
|
-
|
|
546
|
+
async ({ workspaceId, limit, offset }) => {
|
|
547
|
+
try {
|
|
548
|
+
const data = await ctx.gql.workspace.request(WORKSPACE_ACTIVITY, {
|
|
549
|
+
workspaceId,
|
|
550
|
+
limit: limit ?? 100,
|
|
551
|
+
offset: offset ?? 0
|
|
552
|
+
});
|
|
553
|
+
return jsonResult(data.getWorkspaceActivities);
|
|
554
|
+
} catch (error) {
|
|
555
|
+
ctx.logger.error("workspace_activity failed", { error: String(error) });
|
|
556
|
+
return errorResult(
|
|
557
|
+
`Failed to fetch workspace activity: ${error instanceof Error ? error.message : String(error)}`
|
|
558
|
+
);
|
|
559
|
+
}
|
|
560
|
+
}
|
|
451
561
|
);
|
|
452
562
|
}
|
|
453
563
|
|