@frontmcp/plugin-approval 1.8.1 → 1.8.3

package/esm/index.mjs

@@ -22,11 +22,210 @@ import {
   DynamicPlugin as DynamicPlugin2,
   FRONTMCP_CONTEXT,
   Plugin as Plugin2,
-  ProviderScope as ProviderScope4
+  ProviderScope as ProviderScope4,
+  ScopeEntry
 } from "@frontmcp/sdk";
 
+// plugins/plugin-approval/src/approval/errors.ts
+var ApprovalError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ApprovalError";
+  }
+};
+var ApprovalRequiredError = class extends ApprovalError {
+  constructor(details) {
+    super(details.message);
+    this.details = details;
+    this.name = "ApprovalRequiredError";
+  }
+  details;
+  /**
+   * Convert to a JSON-RPC compatible error structure.
+   */
+  toJsonRpcError() {
+    return {
+      code: -32600,
+      // Invalid Request
+      message: this.details.message,
+      data: {
+        type: "approval_required",
+        toolId: this.details.toolId,
+        state: this.details.state,
+        options: this.details.approvalOptions
+      }
+    };
+  }
+};
+var ApprovalOperationError = class extends ApprovalError {
+  constructor(operation, reason) {
+    super(`Approval ${operation} failed: ${reason}`);
+    this.operation = operation;
+    this.reason = reason;
+    this.name = "ApprovalOperationError";
+  }
+  operation;
+  reason;
+  /**
+   * Convert to a JSON-RPC compatible error structure.
+   */
+  toJsonRpcError() {
+    return {
+      code: -32603,
+      // Internal Error
+      message: "Approval operation failed",
+      data: {
+        type: "approval_operation_error",
+        operation: this.operation
+      }
+    };
+  }
+};
+var ApprovalScopeNotAllowedError = class extends ApprovalError {
+  constructor(requestedScope, allowedScopes) {
+    super(
+      `Approval scope '${requestedScope}' is not allowed for this tool. Allowed scopes: ${allowedScopes.join(", ")}`
+    );
+    this.requestedScope = requestedScope;
+    this.allowedScopes = allowedScopes;
+    this.name = "ApprovalScopeNotAllowedError";
+  }
+  requestedScope;
+  allowedScopes;
+  /**
+   * Convert to a JSON-RPC compatible error structure.
+   */
+  toJsonRpcError() {
+    return {
+      code: -32602,
+      // Invalid Params
+      message: this.message,
+      data: {
+        type: "approval_scope_not_allowed",
+        requestedScope: this.requestedScope,
+        allowedScopes: this.allowedScopes
+      }
+    };
+  }
+};
+var ApprovalExpiredError = class extends ApprovalError {
+  constructor(toolId, expiredAt) {
+    super(`Approval for tool '${toolId}' expired at ${new Date(expiredAt).toISOString()}`);
+    this.toolId = toolId;
+    this.expiredAt = expiredAt;
+    this.name = "ApprovalExpiredError";
+  }
+  toolId;
+  expiredAt;
+  /**
+   * Convert to a JSON-RPC compatible error structure.
+   */
+  toJsonRpcError() {
+    return {
+      code: -32600,
+      // Invalid Request
+      message: this.message,
+      data: {
+        type: "approval_expired",
+        toolId: this.toolId,
+        expiredAt: this.expiredAt
+      }
+    };
+  }
+};
+var ChallengeValidationError = class extends ApprovalError {
+  constructor(reason = "invalid", message) {
+    super(message ?? `PKCE challenge validation failed: ${reason}`);
+    this.reason = reason;
+    this.name = "ChallengeValidationError";
+  }
+  reason;
+  /**
+   * Convert to a JSON-RPC compatible error structure.
+   */
+  toJsonRpcError() {
+    return {
+      code: -32600,
+      // Invalid Request
+      message: this.message,
+      data: {
+        type: "challenge_validation_error",
+        reason: this.reason
+      }
+    };
+  }
+};
+
+// plugins/plugin-approval/src/approval/types.ts
+var ApprovalScope = /* @__PURE__ */ ((ApprovalScope2) => {
+  ApprovalScope2["SESSION"] = "session";
+  ApprovalScope2["USER"] = "user";
+  ApprovalScope2["TIME_LIMITED"] = "time_limited";
+  ApprovalScope2["TOOL_SPECIFIC"] = "tool_specific";
+  ApprovalScope2["CONTEXT_SPECIFIC"] = "context_specific";
+  return ApprovalScope2;
+})(ApprovalScope || {});
+var ApprovalState = /* @__PURE__ */ ((ApprovalState2) => {
+  ApprovalState2["PENDING"] = "pending";
+  ApprovalState2["APPROVED"] = "approved";
+  ApprovalState2["DENIED"] = "denied";
+  ApprovalState2["EXPIRED"] = "expired";
+  return ApprovalState2;
+})(ApprovalState || {});
+
+// plugins/plugin-approval/src/approval/policy.ts
+function resolveApprovalRequirement(config) {
+  if (config === true) {
+    return { required: true, defaultScope: "session" /* SESSION */ };
+  }
+  if (config === false || config === void 0) {
+    return { required: false };
+  }
+  return {
+    ...config,
+    required: config.required ?? true,
+    defaultScope: config.defaultScope ?? "session" /* SESSION */
+  };
+}
+function effectiveExpiresAt(record, requirement) {
+  const capped = requirement.maxTtlMs !== void 0 ? record.grantedAt + requirement.maxTtlMs : void 0;
+  if (record.expiresAt === void 0) return capped;
+  return capped === void 0 ? record.expiresAt : Math.min(record.expiresAt, capped);
+}
+function isApprovalExpired(record, requirement, now) {
+  const expiresAt = effectiveExpiresAt(record, requirement);
+  return expiresAt !== void 0 && now > expiresAt;
+}
+function isApprovalUsable(record, requirement, now) {
+  if (record.state !== "approved" /* APPROVED */) return false;
+  if (requirement.allowedScopes?.length && !requirement.allowedScopes.includes(record.scope)) return false;
+  return !isApprovalExpired(record, requirement, now);
+}
+function assertValidTtl(ttlMs) {
+  if (ttlMs === void 0) return;
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+    throw new ApprovalOperationError("grant", `ttlMs must be a positive number of milliseconds, got ${ttlMs}`);
+  }
+}
+function checkGrantAgainstPolicy(toolId, scope, ttlMs, requirement) {
+  assertValidTtl(ttlMs);
+  if (!requirement) return ttlMs;
+  if (requirement.allowedScopes?.length && !requirement.allowedScopes.includes(scope)) {
+    throw new ApprovalScopeNotAllowedError(scope, requirement.allowedScopes);
+  }
+  const { maxTtlMs } = requirement;
+  if (maxTtlMs === void 0) return ttlMs;
+  if (ttlMs === void 0) return maxTtlMs;
+  if (ttlMs > maxTtlMs) {
+    throw new ApprovalOperationError(
+      "grant",
+      `ttlMs ${ttlMs} exceeds the maximum of ${maxTtlMs} ms that tool "${toolId}" allows`
+    );
+  }
+  return ttlMs;
+}
+
 // plugins/plugin-approval/src/approval.identity.ts
-import { STATELESS_SESSION_ID } from "@frontmcp/sdk";
 import { randomUUID } from "@frontmcp/utils";
 function nonEmptyString(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -34,8 +233,8 @@ function nonEmptyString(value) {
 function resolveApprovalIdentity(ctx) {
   const extra = ctx?.authInfo?.extra;
   const userId = nonEmptyString(extra?.["userId"]) ?? nonEmptyString(extra?.["sub"]) ?? nonEmptyString(ctx?.authInfo?.clientId);
-  const sessionId = nonEmptyString(ctx?.sessionId);
-  if (sessionId && sessionId !== STATELESS_SESSION_ID) {
+  const sessionId = nonEmptyString(ctx?.verifiedSessionId);
+  if (sessionId) {
     return { sessionId, userId };
   }
   return { sessionId: userId ? `stateless-user:${userId}` : `unidentified:${randomUUID()}`, userId };
@@ -55,23 +254,6 @@ var ChallengeServiceToken = /* @__PURE__ */ Symbol.for(
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
 import { DynamicPlugin, Plugin, ToolHook } from "@frontmcp/sdk";
 
-// plugins/plugin-approval/src/approval/types.ts
-var ApprovalScope = /* @__PURE__ */ ((ApprovalScope2) => {
-  ApprovalScope2["SESSION"] = "session";
-  ApprovalScope2["USER"] = "user";
-  ApprovalScope2["TIME_LIMITED"] = "time_limited";
-  ApprovalScope2["TOOL_SPECIFIC"] = "tool_specific";
-  ApprovalScope2["CONTEXT_SPECIFIC"] = "context_specific";
-  return ApprovalScope2;
-})(ApprovalScope || {});
-var ApprovalState = /* @__PURE__ */ ((ApprovalState2) => {
-  ApprovalState2["PENDING"] = "pending";
-  ApprovalState2["APPROVED"] = "approved";
-  ApprovalState2["DENIED"] = "denied";
-  ApprovalState2["EXPIRED"] = "expired";
-  return ApprovalState2;
-})(ApprovalState || {});
-
 // plugins/plugin-approval/src/approval/schemas.ts
 import { z } from "@frontmcp/lazy-zod";
 var approvalScopeSchema = z.nativeEnum(ApprovalScope);
@@ -288,136 +470,6 @@ function isApiGrantor(grantor) {
   return grantor.source === "api" || grantor.source === "oauth";
 }
 
-// plugins/plugin-approval/src/approval/errors.ts
-var ApprovalError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "ApprovalError";
-  }
-};
-var ApprovalRequiredError = class extends ApprovalError {
-  constructor(details) {
-    super(details.message);
-    this.details = details;
-    this.name = "ApprovalRequiredError";
-  }
-  details;
-  /**
-   * Convert to a JSON-RPC compatible error structure.
-   */
-  toJsonRpcError() {
-    return {
-      code: -32600,
-      // Invalid Request
-      message: this.details.message,
-      data: {
-        type: "approval_required",
-        toolId: this.details.toolId,
-        state: this.details.state,
-        options: this.details.approvalOptions
-      }
-    };
-  }
-};
-var ApprovalOperationError = class extends ApprovalError {
-  constructor(operation, reason) {
-    super(`Approval ${operation} failed: ${reason}`);
-    this.operation = operation;
-    this.reason = reason;
-    this.name = "ApprovalOperationError";
-  }
-  operation;
-  reason;
-  /**
-   * Convert to a JSON-RPC compatible error structure.
-   */
-  toJsonRpcError() {
-    return {
-      code: -32603,
-      // Internal Error
-      message: "Approval operation failed",
-      data: {
-        type: "approval_operation_error",
-        operation: this.operation
-      }
-    };
-  }
-};
-var ApprovalScopeNotAllowedError = class extends ApprovalError {
-  constructor(requestedScope, allowedScopes) {
-    super(
-      `Approval scope '${requestedScope}' is not allowed for this tool. Allowed scopes: ${allowedScopes.join(", ")}`
-    );
-    this.requestedScope = requestedScope;
-    this.allowedScopes = allowedScopes;
-    this.name = "ApprovalScopeNotAllowedError";
-  }
-  requestedScope;
-  allowedScopes;
-  /**
-   * Convert to a JSON-RPC compatible error structure.
-   */
-  toJsonRpcError() {
-    return {
-      code: -32602,
-      // Invalid Params
-      message: this.message,
-      data: {
-        type: "approval_scope_not_allowed",
-        requestedScope: this.requestedScope,
-        allowedScopes: this.allowedScopes
-      }
-    };
-  }
-};
-var ApprovalExpiredError = class extends ApprovalError {
-  constructor(toolId, expiredAt) {
-    super(`Approval for tool '${toolId}' expired at ${new Date(expiredAt).toISOString()}`);
-    this.toolId = toolId;
-    this.expiredAt = expiredAt;
-    this.name = "ApprovalExpiredError";
-  }
-  toolId;
-  expiredAt;
-  /**
-   * Convert to a JSON-RPC compatible error structure.
-   */
-  toJsonRpcError() {
-    return {
-      code: -32600,
-      // Invalid Request
-      message: this.message,
-      data: {
-        type: "approval_expired",
-        toolId: this.toolId,
-        expiredAt: this.expiredAt
-      }
-    };
-  }
-};
-var ChallengeValidationError = class extends ApprovalError {
-  constructor(reason = "invalid", message) {
-    super(message ?? `PKCE challenge validation failed: ${reason}`);
-    this.reason = reason;
-    this.name = "ChallengeValidationError";
-  }
-  reason;
-  /**
-   * Convert to a JSON-RPC compatible error structure.
-   */
-  toJsonRpcError() {
-    return {
-      code: -32600,
-      // Invalid Request
-      message: this.message,
-      data: {
-        type: "challenge_validation_error",
-        reason: this.reason
-      }
-    };
-  }
-};
-
 // plugins/plugin-approval/src/hooks/approval-check.hook.ts
 var passedApprovalStores = /* @__PURE__ */ new WeakMap();
 var ApprovalCheckPlugin = class extends DynamicPlugin {
@@ -425,7 +477,7 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
     const { tool, toolContext } = flowCtx.state;
     if (!tool || !toolContext) return;
     const metadata = tool.metadata;
-    const approvalConfig = this.resolveApprovalConfig(
+    const approvalConfig = resolveApprovalRequirement(
       metadata["approval"]
     );
     if (!approvalConfig.required) {
@@ -443,44 +495,43 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
   }
   async enforceApproval(flowCtx, tool, toolContext, approvalConfig, approvalStore) {
     const { sessionId, userId } = resolveApprovalIdentity(toolContext.tryGetContext?.());
-    const approval = await approvalStore.getApproval(tool.fullName, sessionId, userId);
-    if (approval?.state === "denied" /* DENIED */) {
+    const currentContext = this.getCurrentContext(flowCtx);
+    const records = await this.readApprovals(approvalStore, tool.fullName, sessionId, userId, currentContext);
+    if (records.some((record) => record.state === "denied" /* DENIED */)) {
       throw new ApprovalRequiredError({
         toolId: tool.fullName,
         state: "denied",
         message: `Tool "${tool.fullName}" execution denied.`
       });
     }
-    if (this.isPreApprovedContext(approvalConfig, this.getCurrentContext(flowCtx))) {
+    if (this.isPreApprovedContext(approvalConfig, currentContext)) {
       return;
     }
+    const approved = records.filter((record) => record.state === "approved" /* APPROVED */);
     if (approvalConfig.alwaysPrompt) {
-      await this.handleApprovalRequired(flowCtx, approvalConfig, approval);
+      await this.handleApprovalRequired(flowCtx, approvalConfig, approved[0]);
       return;
     }
-    if (approval?.state === "approved" /* APPROVED */) {
-      if (!this.isExpired(approval)) {
-        return;
-      }
+    const now = Date.now();
+    if (approved.some((record) => isApprovalUsable(record, approvalConfig, now))) {
+      return;
     }
-    await this.handleApprovalRequired(flowCtx, approvalConfig, approval);
+    await this.handleApprovalRequired(
+      flowCtx,
+      approvalConfig,
+      approved.find((record) => isApprovalExpired(record, approvalConfig, now)) ?? approved[0]
+    );
   }
-  resolveApprovalConfig(config) {
-    if (config === true) {
-      return { required: true, defaultScope: "session" /* SESSION */ };
-    }
-    if (config === false || config === void 0) {
-      return { required: false };
+  /**
+   * The caller's approvals and denials of the tool, from the context it runs in too. Stores
+   * without `getApprovals()` give the one record `getApproval()` picks.
+   */
+  async readApprovals(store, toolId, sessionId, userId, context) {
+    if (store.getApprovals) {
+      return store.getApprovals(toolId, sessionId, userId, context);
     }
-    return {
-      ...config,
-      required: config.required ?? true,
-      defaultScope: config.defaultScope ?? "session" /* SESSION */
-    };
-  }
-  isExpired(approval) {
-    if (!approval.expiresAt) return false;
-    return Date.now() > approval.expiresAt;
+    const record = await store.getApproval(toolId, sessionId, userId, context);
+    return record ? [record] : [];
   }
   /**
    * The context this call is running in, as established by the SESSION (GHSA-r848-p7wf-96rc).
@@ -510,7 +561,7 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
   async handleApprovalRequired(flowCtx, config, existingApproval) {
     const { tool } = flowCtx.state;
     const message = config.approvalMessage ?? `Tool "${tool?.fullName}" requires approval to execute. Allow?`;
-    const isExpiredApproval = existingApproval ? this.isExpired(existingApproval) : false;
+    const isExpiredApproval = existingApproval ? isApprovalExpired(existingApproval, config, Date.now()) : false;
     throw new ApprovalRequiredError({
       toolId: tool?.fullName ?? "unknown",
       state: isExpiredApproval ? "expired" : "pending",
@@ -526,26 +577,34 @@ var ApprovalCheckPlugin = class extends DynamicPlugin {
   }
 };
 __decorateClass([
-  ToolHook.Will("execute", { priority: 100 })
+  ToolHook.Will("execute", { priority: 100, appliesTo: "uncovered-apps" })
 ], ApprovalCheckPlugin.prototype, "checkApproval", 1);
 ApprovalCheckPlugin = __decorateClass([
   Plugin({
     name: "approval:check",
-    description: "Checks tool approval state before execution"
+    description: "Checks tool approval state before execution",
+    // A server where a tool or agent declares `approval` and this gate does not reach it refuses to start.
+    enforcesMetadata: ["approval"]
   })
 ], ApprovalCheckPlugin);
 
 // plugins/plugin-approval/src/services/approval.service.ts
 import { Provider, ProviderScope } from "@frontmcp/sdk";
 var ApprovalService = class {
-  constructor(store, sessionId, userId) {
+  constructor(store, sessionId, userId, requirementOf = () => void 0) {
     this.store = store;
     this.sessionId = sessionId;
     this.userId = userId;
+    this.requirementOf = requirementOf;
   }
   store;
   sessionId;
   userId;
+  requirementOf;
+  /** Checks a grant against the tool's `allowedScopes` and `maxTtlMs`; returns the ttl to store. */
+  checkGrant(toolId, scope, ttlMs) {
+    return checkGrantAgainstPolicy(toolId, scope, ttlMs, this.requirementOf(toolId));
+  }
   // ─────────────────────────────────────────────────────────────────────────────
   // Query Methods
   // ─────────────────────────────────────────────────────────────────────────────
@@ -553,7 +612,14 @@ var ApprovalService = class {
    * Check if a tool is approved for current session/user.
    */
   async isApproved(toolId, context) {
-    return this.store.isApproved(toolId, this.sessionId, this.userId, context);
+    const requirement = this.requirementOf(toolId);
+    if (!requirement || !this.store.getApprovals) {
+      return this.store.isApproved(toolId, this.sessionId, this.userId, context);
+    }
+    const records = await this.store.getApprovals(toolId, this.sessionId, this.userId, context);
+    if (records.some((record) => record.state === "denied" /* DENIED */)) return false;
+    const now = Date.now();
+    return records.some((record) => isApprovalUsable(record, requirement, now));
   }
   /**
    * Get approval record for a tool.
@@ -584,14 +650,15 @@ var ApprovalService = class {
     });
   }
   /**
-   * Query approvals with custom filters.
+   * Query the current caller's approvals (those of its session and those of its user) with custom
+   * filters. A `sessionId` or `userId` in the query narrows the result further; it never reaches
+   * another caller's records. Read the store directly for administrative queries.
    */
   async queryApprovals(query) {
-    return this.store.queryApprovals({
-      ...query,
-      sessionId: query.sessionId ?? this.sessionId,
-      userId: query.userId ?? this.userId
-    });
+    const records = await this.store.queryApprovals(query);
+    return records.filter(
+      (record) => record.sessionId === this.sessionId || this.userId !== void 0 && record.userId === this.userId
+    );
   }
   // ─────────────────────────────────────────────────────────────────────────────
   // Grant Methods
@@ -600,9 +667,11 @@ var ApprovalService = class {
    * Grant session-scoped approval for a tool.
    */
   async grantSessionApproval(toolId, options = {}) {
+    const ttlMs = this.checkGrant(toolId, "session" /* SESSION */);
     return this.store.grantApproval({
       toolId,
       scope: "session" /* SESSION */,
+      ttlMs,
       sessionId: this.sessionId,
       grantedBy: options.grantedBy ?? "policy",
       reason: options.reason,
@@ -616,9 +685,11 @@ var ApprovalService = class {
     if (!this.userId) {
       throw new Error("Cannot grant user approval without userId");
     }
+    const ttlMs = this.checkGrant(toolId, "user" /* USER */);
     return this.store.grantApproval({
       toolId,
       scope: "user" /* USER */,
+      ttlMs,
       userId: this.userId,
       grantedBy: options.grantedBy ?? "policy",
       reason: options.reason,
@@ -629,6 +700,7 @@ var ApprovalService = class {
    * Grant time-limited approval for a tool.
    */
   async grantTimeLimitedApproval(toolId, ttlMs, options = {}) {
+    this.checkGrant(toolId, "time_limited" /* TIME_LIMITED */, ttlMs);
     return this.store.grantApproval({
       toolId,
       scope: "time_limited" /* TIME_LIMITED */,
@@ -644,9 +716,11 @@ var ApprovalService = class {
    * Grant context-specific approval for a tool.
    */
   async grantContextApproval(toolId, context, options = {}) {
+    const ttlMs = this.checkGrant(toolId, "context_specific" /* CONTEXT_SPECIFIC */);
     return this.store.grantApproval({
       toolId,
       scope: "context_specific" /* CONTEXT_SPECIFIC */,
+      ttlMs,
       context,
       sessionId: this.sessionId,
       userId: this.userId,
@@ -659,7 +733,8 @@ var ApprovalService = class {
   // Revoke Methods
   // ─────────────────────────────────────────────────────────────────────────────
   /**
-   * Revoke approval for a tool.
+   * Revoke the caller's approvals of a tool: its session, user, time-limited and context
+   * approvals. Returns whether anything was revoked. Recorded denials are kept.
    */
   async revokeApproval(toolId, options = {}) {
     return this.store.revokeApproval({
@@ -684,8 +759,8 @@ ApprovalService = __decorateClass([
     scope: ProviderScope.CONTEXT
   })
 ], ApprovalService);
-function createApprovalService(store, sessionId, userId) {
-  return new ApprovalService(store, sessionId, userId);
+function createApprovalService(store, sessionId, userId, requirementOf) {
+  return new ApprovalService(store, sessionId, userId, requirementOf);
 }
 
 // plugins/plugin-approval/src/services/challenge.service.ts
@@ -857,6 +932,7 @@ import {
 function escapePattern(str) {
   return str.replace(/[*?[\]\\]/g, "\\$&");
 }
+var TIME_LIMITED_KEY_SEGMENT = `scope:${"time_limited" /* TIME_LIMITED */}`;
 var ApprovalStorageStore = class {
   storage;
   options;
@@ -906,6 +982,22 @@ var ApprovalStorageStore = class {
     if (context) parts.push(`ctx:${context.type}:${context.identifier}`);
     return parts.join(":");
   }
+  /**
+   * The key of a time-limited approval granted to a session alone or a user alone. Kept apart from
+   * that session's or user's own key, so a time-limited grant never replaces the session or user
+   * approval, or a denial recorded there. (With both a session and a user, `buildKey` is already distinct.)
+   */
+  timeLimitedKey(toolId, sessionId, userId) {
+    return `${this.buildKey(toolId, sessionId, userId)}:${TIME_LIMITED_KEY_SEGMENT}`;
+  }
+  /** The key a new record is stored under. */
+  recordKey(options) {
+    const { toolId, scope, sessionId, userId, context } = options;
+    if (scope === "time_limited" /* TIME_LIMITED */ && !context && !(sessionId && userId)) {
+      return this.timeLimitedKey(toolId, sessionId, userId);
+    }
+    return this.buildKey(toolId, sessionId, userId, context);
+  }
   parseRecord(value) {
     if (!value) return void 0;
     try {
@@ -923,28 +1015,55 @@ var ApprovalStorageStore = class {
     return approval.expiresAt !== void 0 && Date.now() > approval.expiresAt;
   }
   /**
-   * The session record, else the user record, except that a denial in either scope wins,
-   * so a session approval cannot mask a user-level denial.
+   * The keys a caller's approvals of a tool can be stored under: its session, its user, both
+   * (time-limited and context grants made through `ApprovalService`), the time-limited keys of its
+   * session and its user, and, for a call in a server-established context, that context (granted
+   * to the session and the user, or to the session before it had a user, the way a session approval
+   * stays in force once the caller's user is known). Records written by 1.8.2 sit under the same
+   * keys (a time-limited grant without a user under the session key), so they are still read.
    */
-  async getApproval(toolId, sessionId, userId) {
-    this.ensureInitialized();
-    const keys = [this.buildKey(toolId, sessionId)];
+  callerKeys(toolId, sessionId, userId, context) {
+    const keys = [this.buildKey(toolId, sessionId), this.timeLimitedKey(toolId, sessionId)];
     if (userId) {
-      keys.push(this.buildKey(toolId, void 0, userId));
+      keys.push(
+        this.buildKey(toolId, void 0, userId),
+        this.timeLimitedKey(toolId, void 0, userId),
+        this.buildKey(toolId, sessionId, userId)
+      );
     }
-    const activeRecords = [];
-    for (const key of keys) {
+    if (context) {
+      keys.push(this.buildKey(toolId, sessionId, void 0, context));
+      if (userId) keys.push(this.buildKey(toolId, sessionId, userId, context));
+    }
+    return [...new Set(keys)];
+  }
+  /**
+   * Every unexpired record that applies to this caller: session, user, time-limited and, when
+   * `context` is given, context-specific approvals and denials.
+   */
+  async getApprovals(toolId, sessionId, userId, context) {
+    this.ensureInitialized();
+    const records = [];
+    for (const key of this.callerKeys(toolId, sessionId, userId, context)) {
       const record = this.parseRecord(await this.storage.get(key));
-      if (record && !this.isExpired(record)) {
-        activeRecords.push(record);
+      if (record && record.toolId === toolId && !this.isExpired(record)) {
+        records.push(record);
       }
     }
-    return activeRecords.find((record) => record.state === "denied" /* DENIED */) ?? activeRecords[0];
+    return records;
+  }
+  /**
+   * The caller's record for a tool; a denial in any of its scopes wins, so an approval in one
+   * scope cannot mask a denial in another.
+   */
+  async getApproval(toolId, sessionId, userId, context) {
+    const records = await this.getApprovals(toolId, sessionId, userId, context);
+    return records.find((record) => record.state === "denied" /* DENIED */) ?? records[0];
   }
   async queryApprovals(query) {
     this.ensureInitialized();
     const results = [];
-    const pattern = query.toolId ? `${query.toolId}:*` : "*";
+    const pattern = query.toolId ? `${escapePattern(query.toolId)}:*` : "*";
     const keys = await this.storage.keys(pattern);
     const values = await this.storage.mget(keys);
     for (const value of values) {
@@ -972,8 +1091,12 @@ var ApprovalStorageStore = class {
   }
   async grantApproval(options) {
     this.ensureInitialized();
+    assertValidTtl(options.ttlMs);
+    if (options.scope === "time_limited" /* TIME_LIMITED */ && options.ttlMs === void 0) {
+      throw new ApprovalOperationError("grant", "a time-limited approval needs ttlMs");
+    }
     const now = Date.now();
-    const expiresAt = options.ttlMs ? now + options.ttlMs : void 0;
+    const expiresAt = options.ttlMs !== void 0 ? now + options.ttlMs : void 0;
     const grantedBy = normalizeGrantor(options.grantedBy);
     const record = {
       toolId: options.toolId,
@@ -989,52 +1112,59 @@ var ApprovalStorageStore = class {
       reason: options.reason,
       metadata: options.metadata
     };
-    const key = this.buildKey(options.toolId, options.sessionId, options.userId, options.context);
-    const ttlSeconds = options.ttlMs ? Math.ceil(options.ttlMs / 1e3) : void 0;
+    const key = this.recordKey(options);
+    const ttlSeconds = options.ttlMs !== void 0 ? Math.ceil(options.ttlMs / 1e3) : void 0;
     await this.storage.set(key, JSON.stringify(record), { ttlSeconds });
     return record;
   }
+  /**
+   * Deletes the approvals of a tool that belong to the given session or user: with a context, only
+   * that context's approval; otherwise every approval of the tool stored for that session or user
+   * (session, user, time-limited and context approvals alike). Recorded denials are kept.
+   */
   async revokeApproval(options) {
     this.ensureInitialized();
-    const key = this.buildKey(options.toolId, options.sessionId, options.userId, options.context);
-    const exists = await this.storage.exists(key);
-    if (exists) {
-      await this.storage.delete(key);
-      return true;
+    const { toolId, sessionId, userId, context } = options;
+    if (!sessionId && !userId && !context) {
+      return false;
     }
-    return false;
-  }
-  async isApproved(toolId, sessionId, userId, context) {
-    this.ensureInitialized();
-    if (context) {
-      const contextKey = this.buildKey(toolId, sessionId, userId, context);
-      const contextValue = await this.storage.get(contextKey);
-      const contextApproval = this.parseRecord(contextValue);
-      if (contextApproval && contextApproval.state === "approved" /* APPROVED */ && !this.isExpired(contextApproval)) {
-        return true;
+    const keys = await this.storage.keys(`${escapePattern(toolId)}:*`);
+    const values = await this.storage.mget(keys);
+    const keysToDelete = [];
+    for (let i = 0; i < keys.length; i++) {
+      const record = this.parseRecord(values[i]);
+      if (!record || record.toolId !== toolId || record.state === "denied" /* DENIED */) continue;
+      if (context) {
+        const sameSession = sessionId !== void 0 && record.sessionId === sessionId;
+        if (record.context?.type === context.type && record.context.identifier === context.identifier && (!sessionId || sameSession) && // A context approval granted to the session before it had a user applies to that user too.
+        (!userId || record.userId === userId || sameSession && record.userId === void 0)) {
+          keysToDelete.push(keys[i]);
+        }
+        continue;
       }
-    }
-    const sessionKey = this.buildKey(toolId, sessionId);
-    const sessionValue = await this.storage.get(sessionKey);
-    const sessionApproval = this.parseRecord(sessionValue);
-    if (sessionApproval && sessionApproval.state === "approved" /* APPROVED */ && !this.isExpired(sessionApproval)) {
-      return true;
-    }
-    if (userId) {
-      const userKey = this.buildKey(toolId, void 0, userId);
-      const userValue = await this.storage.get(userKey);
-      const userApproval = this.parseRecord(userValue);
-      if (userApproval && userApproval.state === "approved" /* APPROVED */ && !this.isExpired(userApproval)) {
-        return true;
+      if (sessionId && record.sessionId === sessionId || userId && record.userId === userId) {
+        keysToDelete.push(keys[i]);
       }
     }
-    return false;
+    if (keysToDelete.length === 0) {
+      return false;
+    }
+    await this.storage.mdelete(keysToDelete);
+    return true;
+  }
+  async isApproved(toolId, sessionId, userId, context) {
+    const approval = await this.getApproval(toolId, sessionId, userId, context);
+    return approval?.state === "approved" /* APPROVED */;
   }
   async clearSessionApprovals(sessionId) {
     this.ensureInitialized();
     const escapedSessionId = escapePattern(sessionId);
-    const pattern = `*:session:${escapedSessionId}*`;
-    const keys = await this.storage.keys(pattern);
+    const keys = [
+      .../* @__PURE__ */ new Set([
+        ...await this.storage.keys(`*:session:${escapedSessionId}`),
+        ...await this.storage.keys(`*:session:${escapedSessionId}:*`)
+      ])
+    ];
     if (keys.length === 0) {
       return 0;
     }
@@ -1178,10 +1308,16 @@ __publicField(ApprovalPlugin, "dynamicProviders", (options) => {
     name: "approval:service",
     provide: ApprovalServiceToken,
     scope: ProviderScope4.CONTEXT,
-    inject: () => [ApprovalStoreToken, FRONTMCP_CONTEXT],
-    useFactory: (store, ctx) => {
+    inject: () => [ApprovalStoreToken, FRONTMCP_CONTEXT, ScopeEntry],
+    useFactory: (store, ctx, scope) => {
       const { sessionId, userId } = resolveApprovalIdentity(ctx);
-      return createApprovalService(store, sessionId, userId);
+      const requirementOf = (toolId) => {
+        const tool = scope.tools.getTools(true).find((entry) => entry.fullName === toolId);
+        if (!tool) return void 0;
+        const approval = tool.metadata.approval;
+        return resolveApprovalRequirement(approval);
+      };
+      return createApprovalService(store, sessionId, userId, requirementOf);
     }
   });
   return providers;