@noodleseed/one 0.86.1 → 0.88.0

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.js

@@ -0,0 +1,64 @@
+import { evaluateToolAuthorization, TOOL_AUTHORIZATION_DENIED, toolAuthorizationRuleClass, toolAuthorizationRuleFingerprint, } from '@noodle-borg/protocol';
+import { protectedResourceMetadataUrl, } from './identity-authorization.js';
+import { rpcMethod, rpcTargetName, safeRpcId } from './request-capture.js';
+export function preflightToolAuthorization(parsed, target, caller) {
+    const items = Array.isArray(parsed) ? parsed : [parsed];
+    const observations = [];
+    let denial;
+    for (const item of items) {
+        const method = rpcMethod(item);
+        if (method !== 'tools/call')
+            continue;
+        const toolName = rpcTargetName(item, method);
+        if (toolName === undefined)
+            continue;
+        const tool = target.artifact.tools.find((candidate) => candidate.name === toolName);
+        if (tool === undefined)
+            continue;
+        const decision = evaluateToolAuthorization(tool.authorization, caller);
+        observations.push({
+            toolName,
+            decision: decision.allow ? 'allow' : 'deny',
+            reason: decision.allow ? 'allowed' : decision.reason,
+            ruleClass: toolAuthorizationRuleClass(tool.authorization),
+            ruleFingerprint: toolAuthorizationRuleFingerprint(tool.authorization),
+        });
+        if (!decision.allow && denial === undefined) {
+            denial = {
+                requestId: safeRpcId(item).requestId ?? null,
+                decision,
+            };
+        }
+    }
+    return {
+        observations,
+        ...(denial === undefined ? {} : { denial }),
+    };
+}
+export function sendToolAuthorizationDenial(req, res, auth, denial) {
+    const metadata = protectedResourceMetadataUrl(req, auth);
+    if (denial.decision.reason === 'authentication_required') {
+        res.setHeader('WWW-Authenticate', `Bearer realm="noodle", resource_metadata="${metadata}"`);
+        sendError(res, 401, denial.requestId, 'unauthorized', denial.decision.reason);
+        return;
+    }
+    if (denial.decision.reason === 'insufficient_scope') {
+        res.setHeader('WWW-Authenticate', `Bearer error="insufficient_scope", scope="${denial.decision.requiredScopes.join(' ')}", resource_metadata="${metadata}"`);
+        sendError(res, 403, denial.requestId, 'insufficient scope', denial.decision.reason);
+        return;
+    }
+    sendError(res, 403, denial.requestId, 'forbidden', denial.decision.reason);
+}
+function sendError(res, status, requestId, message, reason) {
+    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify({
+        jsonrpc: '2.0',
+        id: requestId,
+        error: {
+            code: TOOL_AUTHORIZATION_DENIED,
+            message,
+            data: { reason },
+        },
+    }));
+}
+//# sourceMappingURL=tool-authorization.js.map

package/node_modules/@noodle-borg/transport-http/dist/tool-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-authorization.js","sourceRoot":"","sources":["../src/tool-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EAGzB,yBAAyB,EAGzB,0BAA0B,EAC1B,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAEL,4BAA4B,GAC7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAe3E,MAAM,UAAU,0BAA0B,CACxC,MAAe,EACf,MAAsB,EACtB,MAAwC;IAKxC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,YAAY,GAAmC,EAAE,CAAC;IACxD,IAAI,MAA2C,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,MAAM,KAAK,YAAY;YAAE,SAAS;QACtC,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACpF,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,IAAI,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QACvE,YAAY,CAAC,IAAI,CAAC;YAChB,QAAQ;YACR,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YAC3C,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM;YACpD,SAAS,EAAE,0BAA0B,CAAC,IAAI,CAAC,aAAa,CAAC;YACzD,eAAe,EAAE,gCAAgC,CAAC,IAAI,CAAC,aAAa,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,GAAG;gBACP,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI;gBAC5C,QAAQ;aACT,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,YAAY;QACZ,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,GAAoB,EACpB,GAAmB,EACnB,IAAkC,EAClC,MAA+B;IAE/B,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,yBAAyB,EAAE,CAAC;QACzD,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,6CAA6C,QAAQ,GAAG,CAAC,CAAC;QAC5F,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpD,GAAG,CAAC,SAAS,CACX,kBAAkB,EAClB,6CAA6C,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAC9E,GAAG,CACJ,yBAAyB,QAAQ,GAAG,CACtC,CAAC;QACF,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,oBAAoB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IACD,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAChB,GAAmB,EACnB,MAAiB,EACjB,SAAiC,EACjC,OAAe,EACf,MAAqE;IAErE,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE,CAAC,CAAC;IAC7E,GAAG,CAAC,GAAG,CACL,IAAI,CAAC,SAAS,CAAC;QACb,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,SAAS;QACb,KAAK,EAAE;YACL,IAAI,EAAE,yBAAyB;YAC/B,OAAO;YACP,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB;KACF,CAAC,CACH,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noodleseed/one",
-  "version": "0.86.1",
+  "version": "0.88.0",
   "private": false,
   "description": "Noodle CLI by Noodle Seed — author, run, and deploy declarative MCP servers. Embedding the assistant in your own web app is @noodleseed/assistant.",
   "license": "Apache-2.0",