@hed-hog/core 0.0.399 → 0.0.401

package/dist/mcp/guards/mcp-permission.guard.js

@@ -10,48 +10,68 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.McpPermissionGuard = void 0;
-const api_prisma_1 = require("@hed-hog/api-prisma");
 const common_1 = require("@nestjs/common");
+const mcp_permission_service_1 = require("../mcp-permission.service");
+/**
+ * A trava de verdade do `tools/call`.
+ *
+ * O `tools/list` também filtra pelas mesmas permissões, mas aquilo é
+ * apresentação: nada impede um cliente de chamar uma tool que ele nunca viu na
+ * lista. Por isso os dois consultam o mesmo `McpPermissionService` e este guard
+ * continua existindo.
+ *
+ * O corpo pode ser UM objeto JSON-RPC ou um ARRAY deles — o transporte do SDK
+ * aceita batch (`if (Array.isArray(rawMessage))`) e despacha cada mensagem para o
+ * mesmo handler. Ler só `body.method` deixava passar qualquer chamada envolvida em
+ * colchetes: `body.method` fica `undefined`, o guard liberava, e o handler de
+ * `CallToolRequestSchema` executa sem olhar papel nenhum. Toda mensagem do lote
+ * precisa ser inspecionada.
+ */
 let McpPermissionGuard = class McpPermissionGuard {
-    constructor(prisma) {
-        this.prisma = prisma;
+    constructor(permissions) {
+        this.permissions = permissions;
     }
     async canActivate(context) {
-        var _a, _b;
         const request = context.switchToHttp().getRequest();
         // Only POST requests carry tool invocations
         if (request.method !== 'POST')
             return true;
-        const body = request.body;
-        const toolName = (body === null || body === void 0 ? void 0 : body.method) === 'tools/call' ? (_a = body === null || body === void 0 ? void 0 : body.params) === null || _a === void 0 ? void 0 : _a.name : undefined;
+        const toolNames = this.extractToolNames(request.body);
         // tools/list, initialize, ping, etc. — no per-tool permission check needed
-        if (!toolName)
+        if (toolNames.length === 0)
             return true;
-        const userId = (_b = request === null || request === void 0 ? void 0 : request.auth) === null || _b === void 0 ? void 0 : _b.sub;
-        const count = await this.prisma.route.count({
-            where: {
-                type: 'MCP',
-                tool_name: toolName,
-                role_route: {
-                    some: {
-                        role: {
-                            role_user: {
-                                some: { user_id: userId },
-                            },
-                        },
-                    },
-                },
-            },
-        });
-        if (count === 0) {
-            throw new common_1.ForbiddenException(`Access denied to MCP tool '${toolName}'`);
+        const auth = request === null || request === void 0 ? void 0 : request.auth;
+        const userId = auth === null || auth === void 0 ? void 0 : auth.sub;
+        // Token de cliente OAuth externo carrega `aud`; o interno, nao. O teto de
+        // permissao so vale para o primeiro.
+        const viaConnector = (auth === null || auth === void 0 ? void 0 : auth.aud) !== undefined;
+        // Uma consulta só: o service resolve o conjunto inteiro de uma vez e o cache
+        // atende as demais mensagens do lote.
+        const allowed = await this.permissions.getAllowedToolNames(userId, viaConnector);
+        for (const toolName of toolNames) {
+            if (!allowed.has(toolName)) {
+                throw new common_1.ForbiddenException(`Access denied to MCP tool '${toolName}'`);
+            }
         }
         return true;
     }
+    /**
+     * Nomes de tool de toda mensagem `tools/call` do corpo, seja ele um objeto ou
+     * um lote. Mensagem malformada é ignorada aqui de propósito — quem a rejeita é
+     * o parser do SDK, e inventar um nome a partir dela só produziria um 403 com
+     * mensagem enganosa.
+     */
+    extractToolNames(body) {
+        const messages = Array.isArray(body) ? body : [body];
+        return messages
+            .filter((m) => (m === null || m === void 0 ? void 0 : m.method) === 'tools/call')
+            .map((m) => { var _a; return (_a = m === null || m === void 0 ? void 0 : m.params) === null || _a === void 0 ? void 0 : _a.name; })
+            .filter((name) => typeof name === 'string' && name.length > 0);
+    }
 };
 exports.McpPermissionGuard = McpPermissionGuard;
 exports.McpPermissionGuard = McpPermissionGuard = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [api_prisma_1.PrismaService])
+    __metadata("design:paramtypes", [mcp_permission_service_1.McpPermissionService])
 ], McpPermissionGuard);
 //# sourceMappingURL=mcp-permission.guard.js.map

package/dist/mcp/guards/mcp-permission.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-permission.guard.js","sourceRoot":"","sources":["../../../src/mcp/guards/mcp-permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAKwB;AAIjB,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,WAAW,CAAC,OAAyB;;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAE7D,4CAA4C;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAW,CAAC;QACjC,MAAM,QAAQ,GACZ,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,MAAK,YAAY,CAAC,CAAC,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,0CAAE,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEjE,2EAA2E;QAC3E,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAC,OAAe,aAAf,OAAO,uBAAP,OAAO,CAAU,IAAI,0CAAE,GAAG,CAAC;QAE3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;YAC1C,KAAK,EAAE;gBACL,IAAI,EAAE,KAAY;gBAClB,SAAS,EAAE,QAAQ;gBACnB,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,SAAS,EAAE;gCACT,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;6BAC1B;yBACF;qBACF;iBACF;aACF;SACF,CAAC,CAAC;QAEH,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;YAChB,MAAM,IAAI,2BAAkB,CAAC,8BAA8B,QAAQ,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAxCY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAE0B,0BAAa;GADvC,kBAAkB,CAwC9B"}
+{"version":3,"file":"mcp-permission.guard.js","sourceRoot":"","sources":["../../../src/mcp/guards/mcp-permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAKwB;AAExB,sEAAiE;AAEjE;;;;;;;;;;;;;;GAcG;AAEI,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,WAAiC;QAAjC,gBAAW,GAAX,WAAW,CAAsB;IAAG,CAAC;IAElE,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAE7D,4CAA4C;QAC5C,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEtD,2EAA2E;QAC3E,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAExC,MAAM,IAAI,GAAI,OAAe,aAAf,OAAO,uBAAP,OAAO,CAAU,IAAI,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,CAAC;QACzB,0EAA0E;QAC1E,qCAAqC;QACrC,MAAM,YAAY,GAAG,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,MAAK,SAAS,CAAC;QAE7C,6EAA6E;QAC7E,sCAAsC;QACtC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACxD,MAAM,EACN,YAAY,CACb,CAAC;QAEF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,2BAAkB,CAAC,8BAA8B,QAAQ,GAAG,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,gBAAgB,CAAC,IAAa;QACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAErD,OAAO,QAAQ;aACZ,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,MAAK,YAAY,CAAC;aAC9C,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,WAAC,OAAA,MAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,MAAM,0CAAE,IAAI,CAAA,EAAA,CAAC;aAChC,MAAM,CAAC,CAAC,IAAa,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC5F,CAAC;CACF,CAAA;AAlDY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAE+B,6CAAoB;GADnD,kBAAkB,CAkD9B"}

package/dist/mcp/mcp-audit.service.d.ts

@@ -2,6 +2,8 @@ import { PrismaService } from '@hed-hog/api-prisma';
 import { AccessLogService } from '../access-log/access-log.service';
 interface AuditRecord {
     userId: number;
+    /** Client OAuth externo, ou null para o caminho interno. */
+    clientId?: string | null;
     toolName: string;
     input: Record<string, any>;
     success: boolean;
@@ -13,6 +15,21 @@ export declare class McpAuditService {
     private readonly accessLogService;
     private readonly logger;
     constructor(prisma: PrismaService, accessLogService: AccessLogService);
+    /**
+     * Campos que carregam o conteúdo de um arquivo. Serializá-los custa memória à toa e o
+     * que sobraria no log são mil caracteres de base64, que não dizem nada sobre a chamada.
+     */
+    private static readonly REDACTED_FIELDS;
+    /**
+     * Troca o conteúdo de arquivo por uma marca antes de serializar.
+     *
+     * Sem isto, `JSON.stringify` de uma chamada com `fileBase64` monta uma string de
+     * dezenas de MB só para o `slice(0, 1000)` logo abaixo jogar fora quase tudo — e o
+     * pedaço que fica é base64, não a informação que a auditoria quer. Com a troca, o log
+     * passa a mostrar os demais argumentos (o id do título, a modalidade escolhida), que é
+     * o que permite reconstruir o que foi feito.
+     */
+    private redact;
     record(data: AuditRecord): Promise<void>;
 }
 export {};

package/dist/mcp/mcp-audit.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-audit.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGxC,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,gBAAgB;IAG/C,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAuB/C"}
+{"version":3,"file":"mcp-audit.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBACa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IALnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGxC,MAAM,EAAE,aAAa,EAErB,gBAAgB,EAAE,gBAAgB;IAGrD;;;OAGG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAiC;IAExE;;;;;;;;OAQG;IACH,OAAO,CAAC,MAAM;IAgBR,MAAM,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CA0B/C"}

package/dist/mcp/mcp-audit.service.js

@@ -23,17 +23,41 @@ let McpAuditService = McpAuditService_1 = class McpAuditService {
         this.accessLogService = accessLogService;
         this.logger = new common_1.Logger(McpAuditService_1.name);
     }
+    /**
+     * Troca o conteúdo de arquivo por uma marca antes de serializar.
+     *
+     * Sem isto, `JSON.stringify` de uma chamada com `fileBase64` monta uma string de
+     * dezenas de MB só para o `slice(0, 1000)` logo abaixo jogar fora quase tudo — e o
+     * pedaço que fica é base64, não a informação que a auditoria quer. Com a troca, o log
+     * passa a mostrar os demais argumentos (o id do título, a modalidade escolhida), que é
+     * o que permite reconstruir o que foi feito.
+     */
+    redact(input) {
+        if (!input || typeof input !== 'object') {
+            return input;
+        }
+        const copy = Object.assign({}, input);
+        for (const field of McpAuditService_1.REDACTED_FIELDS) {
+            if (typeof copy[field] === 'string') {
+                copy[field] = `<redacted: ${copy[field].length} chars>`;
+            }
+        }
+        return copy;
+    }
     async record(data) {
-        var _a;
-        const sanitized = JSON.stringify(data.input).slice(0, 1000);
+        var _a, _b;
+        const sanitized = JSON.stringify(this.redact(data.input)).slice(0, 1000);
         try {
             await this.prisma.mcp_tool_call_log.create({
                 data: {
                     user_id: data.userId || null,
+                    // Sem isto a auditoria nao distingue uma acao feita pelo Claude
+                    // Desktop de uma feita pelo Claude Code com chave fixa.
+                    client_id: (_a = data.clientId) !== null && _a !== void 0 ? _a : null,
                     tool_name: data.toolName,
                     input: sanitized,
                     success: data.success,
-                    error: (_a = data.error) !== null && _a !== void 0 ? _a : null,
+                    error: (_b = data.error) !== null && _b !== void 0 ? _b : null,
                     duration_ms: data.durationMs,
                 },
             });
@@ -49,6 +73,11 @@ let McpAuditService = McpAuditService_1 = class McpAuditService {
     }
 };
 exports.McpAuditService = McpAuditService;
+/**
+ * Campos que carregam o conteúdo de um arquivo. Serializá-los custa memória à toa e o
+ * que sobraria no log são mil caracteres de base64, que não dizem nada sobre a chamada.
+ */
+McpAuditService.REDACTED_FIELDS = ['fileBase64', 'chunkBase64'];
 exports.McpAuditService = McpAuditService = McpAuditService_1 = __decorate([
     (0, common_1.Injectable)(),
     __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => access_log_service_1.AccessLogService))),

package/dist/mcp/mcp-audit.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-audit.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAAwE;AACxE,yEAAoE;AAY7D,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YACmB,MAAqB,EAEtC,gBAAmD;QAFlC,WAAM,GAAN,MAAM,CAAe;QAErB,qBAAgB,GAAhB,gBAAgB,CAAkB;QALpC,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAMxD,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,IAAiB;;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACzC,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;oBAC5B,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,IAAI;oBACzB,WAAW,EAAE,IAAI,CAAC,UAAU;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAhCY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qCAAgB,CAAC,CAAC,CAAA;qCADlB,0BAAa;QAEH,qCAAgB;GAN1C,eAAe,CAgC3B"}
+{"version":3,"file":"mcp-audit.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAAwE;AACxE,yEAAoE;AAc7D,IAAM,eAAe,uBAArB,MAAM,eAAe;IAG1B,YACmB,MAAqB,EAEtC,gBAAmD;QAFlC,WAAM,GAAN,MAAM,CAAe;QAErB,qBAAgB,GAAhB,gBAAgB,CAAkB;QALpC,WAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAMxD,CAAC;IAQJ;;;;;;;;OAQG;IACK,MAAM,CAAC,KAA0B;QACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,IAAI,qBAA6B,KAAK,CAAE,CAAC;QAE/C,KAAK,MAAM,KAAK,IAAI,iBAAe,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC,KAAK,CAAC,GAAG,cAAc,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAiB;;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC;gBACzC,IAAI,EAAE;oBACJ,OAAO,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;oBAC5B,gEAAgE;oBAChE,wDAAwD;oBACxD,SAAS,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,IAAI;oBAChC,SAAS,EAAE,IAAI,CAAC,QAAQ;oBACxB,KAAK,EAAE,SAAS;oBAChB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,IAAI;oBACzB,WAAW,EAAE,IAAI,CAAC,UAAU;iBAC7B;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,SAAS;SACrB,CAAC,CAAC;IACL,CAAC;;AAjEU,0CAAe;AAS1B;;;GAGG;AACqB,+BAAe,GAAG,CAAC,YAAY,EAAE,aAAa,CAAC,AAAhC,CAAiC;0BAb7D,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,qCAAgB,CAAC,CAAC,CAAA;qCADlB,0BAAa;QAEH,qCAAgB;GAN1C,eAAe,CAkE3B"}

package/dist/mcp/mcp-permission.service.d.ts

@@ -0,0 +1,64 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import { SettingService } from '../setting/setting.service';
+/**
+ * Quais tools MCP um usuário pode ver e chamar.
+ *
+ * Existe como service — e não inline no guard — porque a mesma resposta é usada
+ * em dois lugares que precisam concordar: o `tools/list`, que decide o que o
+ * cliente enxerga, e o `tools/call`, que decide o que ele executa. Duplicar a
+ * consulta é o caminho conhecido para os dois divergirem: tool que aparece na
+ * lista e devolve 403, ou — pior — tool que some da lista mas continua
+ * chamável.
+ *
+ * A fonte da verdade é a tabela `route` com `type = 'MCP'`, populada pelos
+ * arquivos `route.yaml` das libraries. Tool que existe em código mas não tem
+ * rota semeada não é concedida a ninguém.
+ */
+export declare class McpPermissionService {
+    private readonly prisma;
+    private readonly setting;
+    /**
+     * Curto de propósito: o preço de errar é uma mudança de papel demorar até
+     * meio minuto para valer, e o ganho é não repetir a consulta a cada uma das
+     * centenas de tools de um `tools/list`. O cache é por processo, e a API roda
+     * com várias réplicas — o limite real de propagação é sempre o TTL, nunca a
+     * réplica que respondeu.
+     */
+    private static readonly CACHE_TTL_MS;
+    /** Teto de usuários em cache antes de podar o que já expirou. */
+    private static readonly CACHE_MAX_ENTRIES;
+    /**
+     * Usado quando a setting nao pode ser lida. Escrita no nucleo de seguranca:
+     * usuarios, papeis, rotas, telas, settings e revogacao de sessao. Ler esses
+     * dominios continua liberado — o que se nega e alterar.
+     */
+    private static readonly DEFAULT_DENIED_TOOLS;
+    private readonly cache;
+    constructor(prisma: PrismaService, setting: SettingService);
+    /**
+     * `viaConnector` marca a chamada como vinda de um cliente OAuth externo.
+     *
+     * Um token de conector herda os papeis INTEIROS de quem autorizou — para um
+     * admin, todas as tools do sistema ao alcance de um prompt. Como o conteudo
+     * que o agente le pode vir de fora (um documento, um chamado, um e-mail), o
+     * papel sozinho nao e uma fronteira suficiente: e preciso um teto que valha
+     * mesmo para quem pode tudo.
+     *
+     * A negativa NAO se aplica ao caminho interno (chave `hedhog_mcp_`, JWT de
+     * login, mcp-chat): ali quem chama e o proprio operador, com a tela na frente.
+     */
+    getAllowedToolNames(userId: number, viaConnector?: boolean): Promise<Set<string>>;
+    canCall(userId: number, toolName: string, viaConnector?: boolean): Promise<boolean>;
+    /**
+     * A lista vem de setting, e nao de constante, porque a fronteira do que um
+     * agente externo pode fazer muda com o uso — e mudar isso nao deve exigir
+     * deploy. O `getSettingValues` ja e cacheado por versao, entao ler aqui e
+     * barato.
+     *
+     * Falha de leitura NAO abre a porta: sem conseguir a lista, o servico assume
+     * o padrao embutido. Uma setting apagada por engano nao pode virar permissao.
+     */
+    private getDeniedTools;
+    private remember;
+}
+//# sourceMappingURL=mcp-permission.service.d.ts.map

package/dist/mcp/mcp-permission.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-permission.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAO5D;;;;;;;;;;;;;GAaG;AACH,qBACa,oBAAoB;IAqC7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAtC1B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAU;IAE9C,iEAAiE;IACjE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAO;IAEhD;;;;OAIG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAc1C;IAEF,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;gBAGpC,MAAM,EAAE,aAAa,EAErB,OAAO,EAAE,cAAc;IAG1C;;;;;;;;;;;OAWG;IACG,mBAAmB,CACvB,MAAM,EAAE,MAAM,EACd,YAAY,UAAQ,GACnB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAkDjB,OAAO,CACX,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,UAAQ,GACnB,OAAO,CAAC,OAAO,CAAC;IAKnB;;;;;;;;OAQG;YACW,cAAc;IAgB5B,OAAO,CAAC,QAAQ;CAkBjB"}

package/dist/mcp/mcp-permission.service.js

@@ -0,0 +1,178 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var McpPermissionService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.McpPermissionService = void 0;
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const setting_service_1 = require("../setting/setting.service");
+/** Setting com as tools que nenhum cliente OAuth externo pode chamar. */
+const DENIED_TOOLS_SETTING = 'mcp-connector-denied-tools';
+/**
+ * Quais tools MCP um usuário pode ver e chamar.
+ *
+ * Existe como service — e não inline no guard — porque a mesma resposta é usada
+ * em dois lugares que precisam concordar: o `tools/list`, que decide o que o
+ * cliente enxerga, e o `tools/call`, que decide o que ele executa. Duplicar a
+ * consulta é o caminho conhecido para os dois divergirem: tool que aparece na
+ * lista e devolve 403, ou — pior — tool que some da lista mas continua
+ * chamável.
+ *
+ * A fonte da verdade é a tabela `route` com `type = 'MCP'`, populada pelos
+ * arquivos `route.yaml` das libraries. Tool que existe em código mas não tem
+ * rota semeada não é concedida a ninguém.
+ */
+let McpPermissionService = McpPermissionService_1 = class McpPermissionService {
+    constructor(prisma, setting) {
+        this.prisma = prisma;
+        this.setting = setting;
+        this.cache = new Map();
+    }
+    /**
+     * `viaConnector` marca a chamada como vinda de um cliente OAuth externo.
+     *
+     * Um token de conector herda os papeis INTEIROS de quem autorizou — para um
+     * admin, todas as tools do sistema ao alcance de um prompt. Como o conteudo
+     * que o agente le pode vir de fora (um documento, um chamado, um e-mail), o
+     * papel sozinho nao e uma fronteira suficiente: e preciso um teto que valha
+     * mesmo para quem pode tudo.
+     *
+     * A negativa NAO se aplica ao caminho interno (chave `hedhog_mcp_`, JWT de
+     * login, mcp-chat): ali quem chama e o proprio operador, com a tela na frente.
+     */
+    async getAllowedToolNames(userId, viaConnector = false) {
+        // Sem usuário não há concessão. A guarda não é teórica: `user_id: undefined`
+        // faz o Prisma *descartar* o filtro, e `role_user: { some: {} }` casaria com
+        // qualquer rota ligada a qualquer papel — liberando tudo em vez de nada.
+        if (!userId)
+            return new Set();
+        // A chave inclui a origem: o mesmo usuario tem conjuntos diferentes pelo
+        // conector e pelo caminho interno, e uma chave so por id serviria o conjunto
+        // errado para quem usa os dois.
+        const cacheKey = viaConnector ? `c:${userId}` : `i:${userId}`;
+        const cached = this.cache.get(cacheKey);
+        if (cached && cached.expiresAt > Date.now()) {
+            return cached.names;
+        }
+        const rows = await this.prisma.route.findMany({
+            where: {
+                type: 'MCP',
+                tool_name: { not: null },
+                role_route: {
+                    some: {
+                        role: {
+                            role_user: {
+                                some: { user_id: userId },
+                            },
+                        },
+                    },
+                },
+            },
+            select: { tool_name: true },
+        });
+        const names = new Set(rows
+            .map((row) => row.tool_name)
+            .filter((name) => Boolean(name)));
+        if (viaConnector) {
+            for (const denied of await this.getDeniedTools()) {
+                names.delete(denied);
+            }
+        }
+        this.remember(cacheKey, names);
+        return names;
+    }
+    async canCall(userId, toolName, viaConnector = false) {
+        const allowed = await this.getAllowedToolNames(userId, viaConnector);
+        return allowed.has(toolName);
+    }
+    /**
+     * A lista vem de setting, e nao de constante, porque a fronteira do que um
+     * agente externo pode fazer muda com o uso — e mudar isso nao deve exigir
+     * deploy. O `getSettingValues` ja e cacheado por versao, entao ler aqui e
+     * barato.
+     *
+     * Falha de leitura NAO abre a porta: sem conseguir a lista, o servico assume
+     * o padrao embutido. Uma setting apagada por engano nao pode virar permissao.
+     */
+    async getDeniedTools() {
+        try {
+            const values = await this.setting.getSettingValues([DENIED_TOOLS_SETTING]);
+            const raw = values[DENIED_TOOLS_SETTING];
+            const parsed = typeof raw === 'string' ? JSON.parse(raw) : raw;
+            if (Array.isArray(parsed) && parsed.length > 0) {
+                return parsed.map((t) => String(t));
+            }
+        }
+        catch (_a) {
+            // cai no padrao abaixo
+        }
+        return McpPermissionService_1.DEFAULT_DENIED_TOOLS;
+    }
+    remember(cacheKey, names) {
+        if (this.cache.size >= McpPermissionService_1.CACHE_MAX_ENTRIES) {
+            const now = Date.now();
+            for (const [key, entry] of this.cache) {
+                if (entry.expiresAt <= now)
+                    this.cache.delete(key);
+            }
+            // Todas ainda válidas: o cache inteiro sai. Esvaziar custa uma consulta
+            // por usuário ativo; deixar crescer sem teto custa memória para sempre.
+            if (this.cache.size >= McpPermissionService_1.CACHE_MAX_ENTRIES) {
+                this.cache.clear();
+            }
+        }
+        this.cache.set(cacheKey, {
+            expiresAt: Date.now() + McpPermissionService_1.CACHE_TTL_MS,
+            names,
+        });
+    }
+};
+exports.McpPermissionService = McpPermissionService;
+/**
+ * Curto de propósito: o preço de errar é uma mudança de papel demorar até
+ * meio minuto para valer, e o ganho é não repetir a consulta a cada uma das
+ * centenas de tools de um `tools/list`. O cache é por processo, e a API roda
+ * com várias réplicas — o limite real de propagação é sempre o TTL, nunca a
+ * réplica que respondeu.
+ */
+McpPermissionService.CACHE_TTL_MS = 30000;
+/** Teto de usuários em cache antes de podar o que já expirou. */
+McpPermissionService.CACHE_MAX_ENTRIES = 500;
+/**
+ * Usado quando a setting nao pode ser lida. Escrita no nucleo de seguranca:
+ * usuarios, papeis, rotas, telas, settings e revogacao de sessao. Ler esses
+ * dominios continua liberado — o que se nega e alterar.
+ */
+McpPermissionService.DEFAULT_DENIED_TOOLS = [
+    'core.roles.create', 'core.roles.delete', 'core.roles.menus.update',
+    'core.roles.routes.update', 'core.roles.screens.update', 'core.roles.update',
+    'core.roles.users.update',
+    'core.routes.create', 'core.routes.delete', 'core.routes.roles.update',
+    'core.routes.screens.update', 'core.routes.update',
+    'core.screens.create', 'core.screens.delete', 'core.screens.roles.update',
+    'core.screens.routes.update', 'core.screens.update',
+    'core.sessions.revoke', 'core.sessions.revoke-all', 'core.sessions.revoke-all-other',
+    'core.settings.delete', 'core.settings.set', 'core.settings.set-many',
+    'core.settings.update-from-slug',
+    'core.users.assign-role', 'core.users.create', 'core.users.delete',
+    'core.users.remove-role', 'core.users.reset-password', 'core.users.update',
+    'core.users.verify-identifier',
+];
+exports.McpPermissionService = McpPermissionService = McpPermissionService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => setting_service_1.SettingService))),
+    __metadata("design:paramtypes", [api_prisma_1.PrismaService,
+        setting_service_1.SettingService])
+], McpPermissionService);
+//# sourceMappingURL=mcp-permission.service.js.map

package/dist/mcp/mcp-permission.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-permission.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-permission.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAAgE;AAChE,gEAA4D;AAI5D,yEAAyE;AACzE,MAAM,oBAAoB,GAAG,4BAA4B,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AAEI,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAoC/B,YACmB,MAAqB,EAEtC,OAAwC;QAFvB,WAAM,GAAN,MAAM,CAAe;QAErB,YAAO,GAAP,OAAO,CAAgB;QALzB,UAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAMpD,CAAC;IAEJ;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,mBAAmB,CACvB,MAAc,EACd,YAAY,GAAG,KAAK;QAEpB,6EAA6E;QAC7E,6EAA6E;QAC7E,yEAAyE;QACzE,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAE9B,yEAAyE;QACzE,6EAA6E;QAC7E,gCAAgC;QAChC,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAE9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YAC5C,KAAK,EAAE;gBACL,IAAI,EAAE,KAAY;gBAClB,SAAS,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACxB,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE;4BACJ,SAAS,EAAE;gCACT,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;6BAC1B;yBACF;qBACF;iBACF;aACF;YACD,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;SAC5B,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,IAAI;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;aAC3B,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CACnD,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;gBACjD,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE/B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,OAAO,CACX,MAAc,EACd,QAAgB,EAChB,YAAY,GAAG,KAAK;QAEpB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACrE,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;YAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;YAE/D,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC/C,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,WAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QAED,OAAO,sBAAoB,CAAC,oBAAoB,CAAC;IACnD,CAAC;IAEO,QAAQ,CAAC,QAAgB,EAAE,KAAkB;QACnD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAoB,CAAC,iBAAiB,EAAE,CAAC;YAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG;oBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,wEAAwE;YACxE,wEAAwE;YACxE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,sBAAoB,CAAC,iBAAiB,EAAE,CAAC;gBAC9D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAoB,CAAC,YAAY;YACzD,KAAK;SACN,CAAC,CAAC;IACL,CAAC;;AA9JU,oDAAoB;AAC/B;;;;;;GAMG;AACqB,iCAAY,GAAG,KAAM,AAAT,CAAU;AAE9C,iEAAiE;AACzC,sCAAiB,GAAG,GAAG,AAAN,CAAO;AAEhD;;;;GAIG;AACqB,yCAAoB,GAAG;IAC7C,mBAAmB,EAAE,mBAAmB,EAAE,yBAAyB;IACnE,0BAA0B,EAAE,2BAA2B,EAAE,mBAAmB;IAC5E,yBAAyB;IACzB,oBAAoB,EAAE,oBAAoB,EAAE,0BAA0B;IACtE,4BAA4B,EAAE,oBAAoB;IAClD,qBAAqB,EAAE,qBAAqB,EAAE,2BAA2B;IACzE,4BAA4B,EAAE,qBAAqB;IACnD,sBAAsB,EAAE,0BAA0B,EAAE,gCAAgC;IACpF,sBAAsB,EAAE,mBAAmB,EAAE,wBAAwB;IACrE,gCAAgC;IAChC,wBAAwB,EAAE,mBAAmB,EAAE,mBAAmB;IAClE,wBAAwB,EAAE,2BAA2B,EAAE,mBAAmB;IAC1E,8BAA8B;CAC/B,AAd2C,CAc1C;+BAhCS,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAuCR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADhB,0BAAa;QAEZ,gCAAc;GAvC/B,oBAAoB,CA+JhC"}

package/dist/mcp/mcp-server.service.d.ts

@@ -1,11 +1,13 @@
 import { Request, Response } from 'express';
 import { McpAuditService } from './mcp-audit.service';
+import { McpPermissionService } from './mcp-permission.service';
 import { McpRegistryService } from './mcp-registry.service';
 import { McpContext } from './types/mcp-context.type';
 export declare class McpServerService {
     private readonly registry;
     private readonly audit;
-    constructor(registry: McpRegistryService, audit: McpAuditService);
+    private readonly permissions;
+    constructor(registry: McpRegistryService, audit: McpAuditService, permissions: McpPermissionService);
     handleRequest(req: Request, res: Response, context: McpContext): Promise<void>;
     private buildServer;
 }

package/dist/mcp/mcp-server.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,qBACa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBADL,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,eAAe;IAGnC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IASpF,OAAO,CAAC,WAAW;CA0DpB"}
+{"version":3,"file":"mcp-server.service.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,qBACa,gBAAgB;IAEzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFX,QAAQ,EAAE,kBAAkB,EAC5B,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,oBAAoB;IAG9C,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAepF,OAAO,CAAC,WAAW;CA0EpB"}

package/dist/mcp/mcp-server.service.js

@@ -15,35 +15,53 @@ const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/server/streamable
 const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
 const common_1 = require("@nestjs/common");
 const mcp_audit_service_1 = require("./mcp-audit.service");
+const mcp_permission_service_1 = require("./mcp-permission.service");
 const mcp_registry_service_1 = require("./mcp-registry.service");
 let McpServerService = class McpServerService {
-    constructor(registry, audit) {
+    constructor(registry, audit, permissions) {
         this.registry = registry;
         this.audit = audit;
+        this.permissions = permissions;
     }
     async handleRequest(req, res, context) {
         const server = this.buildServer(context);
         const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
             sessionIdGenerator: undefined,
+            // Sem sessão o transporte só atende POST, e aí o SSE não compra nada: não
+            // há stream para retomar nem notificação do servidor para empurrar. O que
+            // ele custa é real — um `tools/list` de centenas de KB atravessa o ingress
+            // como um único evento, sujeito ao buffering do nginx. JSON puro entrega a
+            // mesma resposta sem esse caminho.
+            enableJsonResponse: true,
         });
         await server.connect(transport);
         await transport.handleRequest(req, res, req.body);
     }
     buildServer(context) {
         const server = new index_js_1.Server({ name: 'hedhog-mcp', version: '1.0.0' }, { capabilities: { tools: {} } });
-        server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => ({
-            tools: this.registry.getAll().map((e) => {
-                var _a;
-                return ({
-                    name: e.definition.name,
-                    description: e.definition.description,
-                    inputSchema: (_a = e.definition.inputSchema) !== null && _a !== void 0 ? _a : {
-                        type: 'object',
-                        properties: {},
-                    },
-                });
-            }),
-        }));
+        // A lista sai filtrada pelas mesmas permissões que o McpPermissionGuard
+        // aplica no tools/call. Sem isso o cliente recebe as centenas de tools do
+        // registry inteiro e descobre o que pode usar tomando 403 — além de gastar
+        // o contexto da conversa com ferramentas que nunca vão funcionar.
+        server.setRequestHandler(types_js_1.ListToolsRequestSchema, async () => {
+            const allowed = await this.permissions.getAllowedToolNames(context.userId, context.clientId !== null);
+            return {
+                tools: this.registry
+                    .getAll()
+                    .filter((e) => allowed.has(e.definition.name))
+                    .map((e) => {
+                    var _a;
+                    return ({
+                        name: e.definition.name,
+                        description: e.definition.description,
+                        inputSchema: (_a = e.definition.inputSchema) !== null && _a !== void 0 ? _a : {
+                            type: 'object',
+                            properties: {},
+                        },
+                    });
+                }),
+            };
+        });
         server.setRequestHandler(types_js_1.CallToolRequestSchema, async (request) => {
             var _a;
             const toolName = request.params.name;
@@ -60,6 +78,7 @@ let McpServerService = class McpServerService {
                 const result = await entry.handler(args, Object.assign(Object.assign({}, context), { toolName }));
                 await this.audit.record({
                     userId: context.userId,
+                    clientId: context.clientId,
                     toolName,
                     input: args,
                     success: true,
@@ -70,6 +89,7 @@ let McpServerService = class McpServerService {
             catch (e) {
                 await this.audit.record({
                     userId: context.userId,
+                    clientId: context.clientId,
                     toolName,
                     input: args,
                     success: false,
@@ -89,6 +109,7 @@ exports.McpServerService = McpServerService;
 exports.McpServerService = McpServerService = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [mcp_registry_service_1.McpRegistryService,
-        mcp_audit_service_1.McpAuditService])
+        mcp_audit_service_1.McpAuditService,
+        mcp_permission_service_1.McpPermissionService])
 ], McpServerService);
 //# sourceMappingURL=mcp-server.service.js.map

package/dist/mcp/mcp-server.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-server.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wEAAmE;AACnE,0FAAmG;AACnG,iEAG4C;AAC5C,2CAA4C;AAE5C,2DAAsD;AACtD,iEAA4D;AAIrD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACmB,QAA4B,EAC5B,KAAsB;QADtB,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,UAAK,GAAL,KAAK,CAAiB;IACtC,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,OAAmB;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;SAC9B,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,WAAW,CAAC,OAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC;YAC5D,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;;gBAAC,OAAA,CAAC;oBACxC,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;oBACvB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW;oBACrC,WAAW,EAAE,MAAA,CAAC,CAAC,UAAU,CAAC,WAAW,mCAAI;wBACvC,IAAI,EAAE,QAAQ;wBACd,UAAU,EAAE,EAAE;qBACf;iBACF,CAAC,CAAA;aAAA,CAAC;SACJ,CAAC,CAAC,CAAC;QAEJ,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,MAAA,OAAO,CAAC,MAAM,CAAC,SAAS,mCAAI,EAAE,CAAwB,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,QAAQ,aAAa,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,kCAAO,OAAO,KAAE,QAAQ,IAAG,CAAC;gBACnE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,OAAO;oBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAzEY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGkB,yCAAkB;QACrB,mCAAe;GAH9B,gBAAgB,CAyE5B"}
+{"version":3,"file":"mcp-server.service.js","sourceRoot":"","sources":["../../src/mcp/mcp-server.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,wEAAmE;AACnE,0FAAmG;AACnG,iEAG4C;AAC5C,2CAA4C;AAE5C,2DAAsD;AACtD,qEAAgE;AAChE,iEAA4D;AAIrD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YACmB,QAA4B,EAC5B,KAAsB,EACtB,WAAiC;QAFjC,aAAQ,GAAR,QAAQ,CAAoB;QAC5B,UAAK,GAAL,KAAK,CAAiB;QACtB,gBAAW,GAAX,WAAW,CAAsB;IACjD,CAAC;IAEJ,KAAK,CAAC,aAAa,CAAC,GAAY,EAAE,GAAa,EAAE,OAAmB;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,iDAA6B,CAAC;YAClD,kBAAkB,EAAE,SAAS;YAC7B,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,mCAAmC;YACnC,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACpD,CAAC;IAEO,WAAW,CAAC,OAAmB;QACrC,MAAM,MAAM,GAAG,IAAI,iBAAM,CACvB,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,EACxC,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAChC,CAAC;QAEF,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,CAAC,iBAAiB,CAAC,iCAAsB,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACxD,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,QAAQ,KAAK,IAAI,CAC1B,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,QAAQ;qBACjB,MAAM,EAAE;qBACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;qBAC7C,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;;oBAAC,OAAA,CAAC;wBACX,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI;wBACvB,WAAW,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW;wBACrC,WAAW,EAAE,MAAA,CAAC,CAAC,UAAU,CAAC,WAAW,mCAAI;4BACvC,IAAI,EAAE,QAAQ;4BACd,UAAU,EAAE,EAAE;yBACf;qBACF,CAAC,CAAA;iBAAA,CAAC;aACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,iBAAiB,CAAC,gCAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;;YAChE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,MAAA,OAAO,CAAC,MAAM,CAAC,SAAS,mCAAI,EAAE,CAAwB,CAAC;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAE1C,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,QAAQ,aAAa,EAAE,CAAC;iBAClE,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,kCAAO,OAAO,KAAE,QAAQ,IAAG,CAAC;gBACnE,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACvE,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,QAAQ;oBACR,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,CAAC,CAAC,OAAO;oBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;gBACH,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;iBAC7C,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAhGY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAGkB,yCAAkB;QACrB,mCAAe;QACT,6CAAoB;GAJzC,gBAAgB,CAgG5B"}

package/dist/mcp/mcp.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAI5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,qBAIa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc;IAIpC,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAqBvE"}
+{"version":3,"file":"mcp.controller.d.ts","sourceRoot":"","sources":["../../src/mcp/mcp.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAK5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,qBAOa,aAAa;IAEtB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,SAAS,EAAE,gBAAgB,EAC3B,OAAO,EAAE,cAAc;IAIpC,MAAM,CAAQ,GAAG,EAAE,OAAO,EAAS,GAAG,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC;CAwBvE"}