@oneentry/mcp-platform-server 0.1.12 → 0.1.14

package/data/permissions.json

@@ -2,6 +2,8 @@
   "version": 1,
   "source": "generated from a platform checkout by build/sync-permissions.ts",
   "byOpId": {
+    "JournalController_list": "journal.get",
+    "JournalController_clear": "journal.delete",
     "WorkflowsController_getFlows": "workflows.get",
     "WorkflowsController_saveFlows": "workflows.update",
     "WorkflowsController_getNodes": "workflows.get",
@@ -9,23 +11,37 @@
     "WorkflowsController_getNodeCredentials": "workflows.get",
     "WorkflowsController_getSwaggerDocs": "workflows.get",
     "WorkflowsController_executeToNode": "workflows.update",
+    "AdminsController_findAll": "admins.get",
+    "AdminsController_create": "admins.create",
+    "AdminsController_update": "admins.update",
+    "AdminsController_updatePermissions": "admins.updatePermissions",
+    "AdminsController_remove": "admins.delete",
+    "AdminsController_findOne": "admins.get",
+    "AdminsController_updateModulePosition": "admins.changePositions",
     "AdminAnalyticsController_getFunnel": "analytics.read",
     "AdminAnalyticsController_getSearchNoResults": "analytics.read",
     "AdminAnalyticsController_getSearchTop": "analytics.read",
     "AdminAnalyticsController_getTopNotBuying": "analytics.read",
     "AdminAnalyticsController_getSegmentsDistribution": "analytics.read",
     "AdminAnalyticsController_getBlockPerformance": "analytics.read",
+    "AdminAttributesSetsController_findOne": "settings.attributesSets.get",
+    "AdminAttributesSetsController_findAll": "settings.attributesSets.get",
     "AdminAttributesSetsController_create": "settings.attributesSets.create",
     "AdminAttributesSetsController_update": "settings.attributesSets.update",
     "AdminAttributesSetsController_updateSchema": "settings.attributes.changePositions",
     "AdminAttributesSetsController_remove": "settings.attributesSets.delete",
     "AdminAttributesSetsController_updateAttributeSetPosition": "settings.attributesSets.changePositions",
     "AdminAttributesSetsController_setAdminVisibility": "settings.attributesSets.switching",
+    "AdminAttributesSetsController_getAllAttributesFromAllAttributeSets": "settings.attributesSets.get",
     "AdminAttributesSetsController_getCopyValuesStatus": "settings.attributesSets.update",
     "AdminAttributesSetsController_getLocalizeInfoSchema": "settings.attributesSets.update",
     "AdminAttributesSetsController_getUsage": "settings.attributesSets.delete",
     "AdminAttributesSetsController_logCopyEntity": "settings.attributesSets.update",
     "AdminAttributesSetsController_copyValues": "settings.attributesSets.update",
+    "AdminAttributesSetsController_getAllAttributesFromAttributeSet": "settings.attributesSets.get",
+    "AdminAttributesSetsController_getAttributeFromAttributeSet": "settings.attributesSets.get",
+    "DeveloperAttributesSetsController_findOne": "settings.attributesSets.get",
+    "AuthController_logoutAllUsers": "admins.totalLogout",
     "AdminBlocksController_previewBlock": "blocks.preview",
     "AdminBlocksController_getSimilarDiagnostics": "blocks.preview",
     "AdminBlocksController_create": "blocks.create",
@@ -56,6 +72,8 @@
     "AdminExportController_exporAllOrders": "orders.export",
     "AdminExportController_exportPaymentsByAccount": "payments.export",
     "AdminExportController_exporAllPayments": "payments.export",
+    "AdminFileUploadController_uploadFiles": "files.create",
+    "AdminFileUploadController_deleteFile": "files.delete",
     "AdminFiltersController_create": "filter.create",
     "AdminFiltersController_update": "filter.update",
     "AdminFiltersController_remove": "filter.delete",
@@ -72,9 +90,11 @@
     "AdminFiltersController_updateCustomItem": "filter.update",
     "AdminFiltersController_removeCustomItem": "filter.items.remove",
     "AdminFiltersController_updateCustomItemPosition": "filter.items.changePositions",
+    "AdminFormDataController_findByFormMarker": "forms.data.read",
     "AdminFormDataController_updateStatus": "forms.data.update",
     "AdminFormDataController_remove": "forms.data.delete",
     "AdminFormDataController_removeSelected": "forms.data.delete",
+    "AdminFormDataController_countSent": "forms.data.read",
     "AdminFormsController_create": "forms.create",
     "AdminFormsController_update": "forms.update",
     "AdminFormsController_remove": "forms.delete",
@@ -93,6 +113,8 @@
     "AdminContentApiErrorsController_getById": "journal.viewContentApiErrors",
     "AdminContentApiErrorsController_clearAll": "journal.viewContentApiErrors",
     "AdminContentApiStatsController_getStats": "journal.viewContentApiStats",
+    "AdminJournalTrafficController_getTraffic": "journal.get",
+    "AdminJournalTrafficController_clear": "journal.delete",
     "AdminLocalesController_create": "settings.locales.create",
     "AdminLocalesController_setActive": "settings.locales.switching",
     "AdminLocalesController_update": "settings.locales.update",
@@ -101,9 +123,13 @@
     "AdminMarkersController_create": "markers.create",
     "AdminMarkersController_update": "markers.update",
     "AdminMarkersController_remove": "markers.delete",
+    "AdminMenusController_findAll": "menu.get",
+    "AdminMenusController_findAllByMenuId": "menu.get",
+    "AdminMenusController_findOne": "menu.get",
     "AdminMenusController_create": "menu.create",
     "AdminMenusController_update": "menu.update",
     "AdminMenusController_updatePosition": "menu.items.changePositions",
+    "AdminMenusController_remove": "menu.delete",
     "AdminMenusController_createCustomItem": "menu.items.add",
     "AdminMenusController_updateCustomItem": "menu.update",
     "AdminMenusController_removeCustomItem": "menu.items.remove",
@@ -136,8 +162,16 @@
     "PageErrorsController_remove": "pages.errorStatus.delete",
     "PageErrorsController_setErrorPage": "pages.settings.update",
     "AdminPagesController_create": "pages.create",
+    "AdminPagesController_getTableData": "pages.get",
+    "AdminPagesController_getTableData2": "pages.get",
+    "AdminPagesController_findOne": "pages.get",
+    "AdminPagesController_findAllRoot": "pages.get",
+    "AdminPagesController_findAllCatalogPages": "pages.get",
+    "AdminPagesController_findChildrenById": "pages.get",
     "AdminPagesController_updateConfig": "catalog.products.outputSettings",
     "AdminPagesController_copy": "pages.copy",
+    "AdminPagesController_findBlocksById": "pages.get",
+    "AdminPagesController_findNestedBlocksById": "pages.get",
     "AdminPagesController_updatePosition": "pages.update",
     "AdminPagesController_moveMany": "pages.move",
     "AdminPagesController_update": "pages.update",
@@ -148,8 +182,12 @@
     "AdminPagesController_updatePageNestedBlockPosition": "pages.blocks.nested.changePositions",
     "AdminPagesController_updateProductPosition": "catalog.products.changePositions",
     "AdminPagesController_setVisibility": "pages.switching",
+    "AdminPagesController_findAllByName": "pages.get",
     "AdminPagesController_deleteMany": "pages.delete",
     "DeveloperPagesController_create": "pages.create",
+    "DeveloperPagesController_getTableData": "pages.get",
+    "DeveloperPagesController_getTableData2": "pages.get",
+    "DeveloperPagesController_findOne": "pages.get",
     "AdminPaymentsController_createStripeRedirectUrl": "payments.accounts.create",
     "AdminPaymentsController_deleteStripe": "payments.accounts.delete",
     "AdminPaymentsController_getStatusMap": "payments.settings.get",
@@ -188,6 +226,7 @@
     "ProductRelationTemplateController_deleteOne": "catalog.products.deleteRelationTemplate",
     "ProductRelationTemplateController_activateOne": "catalog.products.updateRelationTemplate",
     "ProductRelationTemplateController_create": "catalog.products.createRelationTemplate",
+    "AdminSettingsGeneralController_findOne": "settings.general.get",
     "AdminSettingsGeneralController_update": "settings.general.update",
     "AdminSlidesController_create": "slides.create",
     "AdminSlidesController_update": "slides.update",
@@ -231,14 +270,21 @@
     "AdminUserPermissionsController_create": "userPermissions.create",
     "AdminUserPermissionsController_update": "userPermissions.update",
     "AdminUserPermissionsController_remove": "userPermissions.delete",
+    "AdminUsersController_findAll": "users.get",
+    "AdminUsersController_queryActions": "users.get",
+    "AdminUsersController_findAllByIdentifier": "users.get",
     "AdminUsersController_update": "users.update",
     "AdminUsersController_remove": "users.delete",
+    "AdminUsersController_findOne": "users.get",
+    "AdminUsersController_findAllByConditions": "users.get",
+    "AdminUsersController_search": "users.get",
     "AdminUsersAuthProviderController_createProvider": "usersAuthProvider.create",
     "AdminUsersAuthProviderController_updateProvider": "usersAuthProvider.update",
     "AdminUsersAuthProviderController_remove": "usersAuthProvider.delete",
     "AdminUsersAuthProviderController_register": "users.create"
   },
   "permissions": [
+    "menu.get",
     "menu.create",
     "menu.update",
     "menu.delete",
@@ -257,6 +303,7 @@
     "settings.modules.delete",
     "settings.modules.changePositions",
     "settings.modules.upload",
+    "settings.attributesSets.get",
     "settings.attributesSets.create",
     "settings.attributesSets.update",
     "settings.attributesSets.delete",
@@ -284,6 +331,7 @@
     "settings.locales.delete",
     "settings.locales.switching",
     "settings.locales.changePositions",
+    "settings.general.get",
     "settings.general.update",
     "admins.create",
     "admins.update",
@@ -296,6 +344,7 @@
     "forms.create",
     "forms.update",
     "forms.delete",
+    "forms.data.read",
     "forms.data.delete",
     "forms.data.update",
     "blocks.create",
@@ -305,6 +354,7 @@
     "markers.create",
     "markers.update",
     "markers.delete",
+    "pages.get",
     "pages.create",
     "pages.update",
     "pages.updateBlockAndForms",
@@ -347,6 +397,7 @@
     "usersAuthProvider.create",
     "usersAuthProvider.update",
     "usersAuthProvider.delete",
+    "usersAuthProvider.users.register",
     "userGroups.get",
     "userGroups.create",
     "userGroups.update",
@@ -389,6 +440,7 @@
     "users.export",
     "orders.export",
     "payments.export",
+    "discounts.get",
     "discounts.create",
     "discounts.update",
     "discounts.delete",
@@ -406,7 +458,11 @@
     "slides.delete",
     "slides.switching",
     "slides.changePositions",
+    "journal.get",
     "journal.viewContentApiStats",
-    "journal.viewContentApiErrors"
+    "journal.viewContentApiErrors",
+    "journal.delete",
+    "files.create",
+    "files.delete"
   ]
 }

package/dist/tools/api-call.js

@@ -62,6 +62,16 @@ export const registerApiCall = (server, getSession) => {
             audit.record({ ...auditBase, outcome: 'denied' });
             return errorResult(levelDenial.reason, { opId, policy: config.allow, risk: operation.risk });
         }
+        let url;
+        try {
+            url = buildUrl(config.baseUrl, operation, args);
+        }
+        catch (error) {
+            if (error instanceof RequestBuildError) {
+                return errorResult(error.message, { opId, params: operation.params });
+            }
+            throw error;
+        }
         const identity = operation.permission ? await session.identity() : undefined;
         if (identity) {
             Object.assign(auditBase, { adminId: identity.id });
@@ -82,16 +92,6 @@ export const registerApiCall = (server, getSession) => {
             }
             return errorResult(decision.reason, { opId, policy: config.allow, risk: operation.risk });
         }
-        let url;
-        try {
-            url = buildUrl(config.baseUrl, operation, args);
-        }
-        catch (error) {
-            if (error instanceof RequestBuildError) {
-                return errorResult(error.message, { opId, params: operation.params });
-            }
-            throw error;
-        }
         if (decision.kind === 'needsConfirm') {
             const token = session.confirms.issue(opId, args);
             const target = await session.describeTarget(operation, args);

package/knowledge/operating-rules.md

@@ -87,7 +87,7 @@ Mutations on the instance's own configuration — admins, modules, backups, sett
 
 ## Permissions are checked before the request is sent
 
-Each operation declares the permission it needs, and this server refuses locally when the admin does not hold it — nothing is sent. **Ask for the grant** and stop: no retry and no sibling operation gets past it.
+Most operations declare the permission they need, and this server refuses locally when the admin lacks it. Some declare none, and there the `403` comes from the instance. **Ask for the grant**; retrying cannot work.
 
 → `mcp/docs/api/admins-and-permissions`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneentry/mcp-platform-server",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "MCP server that lets an AI agent operate the OneEntry Admin API, grounded in the project's own rules",
   "license": "MIT",
   "type": "module",