@forumone/throughline-core 0.8.1 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @forumone/throughline-core
 
+## 0.8.2
+
+### Patch Changes
+
+- 262768a: The five publishing MCP tools now refuse an unauthenticated call and run their
+  reads and writes as the caller.
+
+  `publish`, `unpublish`, `rollback`, `schedulePublish` and `getPublishStatus`
+  built their actor without `enforceAccessAs`, which is the only thing that makes
+  the service pass `{ user, overrideAccess: false }` to Payload. So every one of
+  them ran at the Local API default of `overrideAccess: true` — publish,
+  unpublish, roll back or schedule any document in any collection with no
+  authorization check. `rollback` called `restoreVersion` with no user and no
+  override flag at all.
+
+  `tools/actor.ts` refuses when there is no identity and hands the caller to the
+  service as the principal to enforce against. Deliberately not a role gate: the
+  admin HTTP path already requires a user, sets `enforceAccessAs`, and lets the
+  collection's own `update` rule decide. The MCP path now participates in that
+  rather than carrying a second policy.
+
+  **Behavioural change for consumers.** A tool call arriving with no `ctx.user`
+  now returns `{ error: 'Must be authenticated…' }` instead of performing the
+  operation. In practice that is every `Bearer`-authenticated MCP call, because
+  `@payloadcms/plugin-mcp` does not assign `req.user` — which is why the audit,
+  integrations and approvals servers already denied and these five did not.
+
+  `@forumone/throughline-core`'s README claimed `requiredScope` is enforced —
+  hidden from `tools/list` and refused unless granted. It was, by an `auth.ts`
+  that "one MCP transport, not seven" (#80) removed along with the six
+  per-server endpoints. The declarations survived; the enforcement did not. The
+  README now says so, and says what gates a tool instead.
+
 ## 0.8.1
 
 ### Patch Changes

package/README.md

@@ -104,9 +104,34 @@ const publishTool: McpToolDefinition = {
 }
 ```
 
-A tool that declares no `requiredScope` is callable by any authenticated key, which is the right default for a read. A tool that declares one is **hidden from `tools/list`** and refused on a direct call unless the key names that scope — hidden as well as refused, because an agent shown a tool it will be turned away from will try it, fail, and report the tool as broken when what is narrow is the key.
-
-A key carrying no scopes at all passes nothing scoped. Absent is read as none, not as everything.
+> **Nothing enforces this today.** The paragraphs below describe how
+> `requiredScope` behaved when each server mounted its own `/api/<server>/mcp`
+> endpoint behind a hand-written JSON-RPC handler. That handler — and the
+> `auth.ts` that held callers to their scopes — were removed by "one MCP
+> transport, not seven" (#80), which consolidated every server onto Payload's
+> `/api/mcp`. The scope declarations survived the refactor; the enforcement did
+> not, and this section was not updated to say so. Audit 04 F-02.
+>
+> **What gates a tool now** is the per-key checkbox `@payloadcms/plugin-mcp`
+> generates, one per tool name. Two consequences worth knowing before relying
+> on either: all 27 of them **default to `true`**
+> (`createApiKeysCollection.js:4-15`), and a checkbox list cannot express
+> "writes off until granted, reads on" the way a scope can.
+>
+> The declarations are kept because they are the tool → scope mapping a
+> scope-aware default would be built from — see the note on `requiredScope` in
+> `@forumone/throughline-plugin-contract`, which states the same thing at the
+> type. Reinstating enforcement means putting it on the surviving transport.
+
+Historically, and as the intended design: a tool that declares no
+`requiredScope` is callable by any authenticated key, which is the right
+default for a read. A tool that declares one was **hidden from `tools/list`**
+and refused on a direct call unless the key named that scope — hidden as well
+as refused, because an agent shown a tool it will be turned away from will try
+it, fail, and report the tool as broken when what is narrow is the key.
+
+A key carrying no scopes at all passed nothing scoped. Absent was read as none,
+not as everything.
 
 The consequential tools in this suite and the scopes they require:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forumone/throughline-core",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "Core plumbing for Throughline: audit log, MCP authentication and handler, event taxonomy + Inngest client factory, logger, shared utilities.",
   "type": "module",
   "main": "./dist/index.js",
@@ -66,7 +66,7 @@
     "inngest": "^4.2.0",
     "payload": "^3.83.0",
     "typescript": "^5.6.0",
-    "vitest": "^2.1.0",
+    "vitest": "^4.1.10",
     "@forumone/throughline-eslint-config": "0.0.0",
     "@forumone/throughline-tsconfig": "0.0.0"
   },