@oneentry/mcp-platform-server 0.1.13 → 0.1.14

package/data/permissions.json

@@ -4,7 +4,6 @@
   "byOpId": {
     "JournalController_list": "journal.get",
     "JournalController_clear": "journal.delete",
-    "JournalController_clear": "journal.delete",
     "WorkflowsController_getFlows": "workflows.get",
     "WorkflowsController_saveFlows": "workflows.update",
     "WorkflowsController_getNodes": "workflows.get",
@@ -12,6 +11,13 @@
     "WorkflowsController_getNodeCredentials": "workflows.get",
     "WorkflowsController_getSwaggerDocs": "workflows.get",
     "WorkflowsController_executeToNode": "workflows.update",
+    "AdminsController_findAll": "admins.get",
+    "AdminsController_create": "admins.create",
+    "AdminsController_update": "admins.update",
+    "AdminsController_updatePermissions": "admins.updatePermissions",
+    "AdminsController_remove": "admins.delete",
+    "AdminsController_findOne": "admins.get",
+    "AdminsController_updateModulePosition": "admins.changePositions",
     "AdminAnalyticsController_getFunnel": "analytics.read",
     "AdminAnalyticsController_getSearchNoResults": "analytics.read",
     "AdminAnalyticsController_getSearchTop": "analytics.read",
@@ -36,7 +42,6 @@
     "AdminAttributesSetsController_getAttributeFromAttributeSet": "settings.attributesSets.get",
     "DeveloperAttributesSetsController_findOne": "settings.attributesSets.get",
     "AuthController_logoutAllUsers": "admins.totalLogout",
-    "AuthController_logoutAllUsers": "admins.totalLogout",
     "AdminBlocksController_previewBlock": "blocks.preview",
     "AdminBlocksController_getSimilarDiagnostics": "blocks.preview",
     "AdminBlocksController_create": "blocks.create",
@@ -109,6 +114,7 @@
     "AdminContentApiErrorsController_clearAll": "journal.viewContentApiErrors",
     "AdminContentApiStatsController_getStats": "journal.viewContentApiStats",
     "AdminJournalTrafficController_getTraffic": "journal.get",
+    "AdminJournalTrafficController_clear": "journal.delete",
     "AdminLocalesController_create": "settings.locales.create",
     "AdminLocalesController_setActive": "settings.locales.switching",
     "AdminLocalesController_update": "settings.locales.update",
@@ -123,6 +129,7 @@
     "AdminMenusController_create": "menu.create",
     "AdminMenusController_update": "menu.update",
     "AdminMenusController_updatePosition": "menu.items.changePositions",
+    "AdminMenusController_remove": "menu.delete",
     "AdminMenusController_createCustomItem": "menu.items.add",
     "AdminMenusController_updateCustomItem": "menu.update",
     "AdminMenusController_removeCustomItem": "menu.items.remove",

package/dist/tools/api-call.js

@@ -62,6 +62,16 @@ export const registerApiCall = (server, getSession) => {
             audit.record({ ...auditBase, outcome: 'denied' });
             return errorResult(levelDenial.reason, { opId, policy: config.allow, risk: operation.risk });
         }
+        let url;
+        try {
+            url = buildUrl(config.baseUrl, operation, args);
+        }
+        catch (error) {
+            if (error instanceof RequestBuildError) {
+                return errorResult(error.message, { opId, params: operation.params });
+            }
+            throw error;
+        }
         const identity = operation.permission ? await session.identity() : undefined;
         if (identity) {
             Object.assign(auditBase, { adminId: identity.id });
@@ -82,16 +92,6 @@ export const registerApiCall = (server, getSession) => {
             }
             return errorResult(decision.reason, { opId, policy: config.allow, risk: operation.risk });
         }
-        let url;
-        try {
-            url = buildUrl(config.baseUrl, operation, args);
-        }
-        catch (error) {
-            if (error instanceof RequestBuildError) {
-                return errorResult(error.message, { opId, params: operation.params });
-            }
-            throw error;
-        }
         if (decision.kind === 'needsConfirm') {
             const token = session.confirms.issue(opId, args);
             const target = await session.describeTarget(operation, args);

package/knowledge/operating-rules.md

@@ -87,7 +87,7 @@ Mutations on the instance's own configuration — admins, modules, backups, sett
 
 ## Permissions are checked before the request is sent
 
-Each operation declares the permission it needs, and this server refuses locally when the admin does not hold it — nothing is sent. **Ask for the grant** and stop: no retry and no sibling operation gets past it.
+Most operations declare the permission they need, and this server refuses locally when the admin lacks it. Some declare none, and there the `403` comes from the instance. **Ask for the grant**; retrying cannot work.
 
 → `mcp/docs/api/admins-and-permissions`
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oneentry/mcp-platform-server",
-  "version": "0.1.13",
+  "version": "0.1.14",
   "description": "MCP server that lets an AI agent operate the OneEntry Admin API, grounded in the project's own rules",
   "license": "MIT",
   "type": "module",