@raytio/mcp-server 2.0.0 → 2.2.0

package/dist/authorization.d.ts

@@ -0,0 +1,29 @@
+import { RaytioApiClient } from './raytio/api-client.js';
+/**
+ * Result of resolving the effective tool domain set for the authenticated
+ * user. When `authorized` is `false`, the caller MUST expose no tools.
+ */
+export interface AuthorizationResult {
+    /** Comma-separated domain spec suitable for `resolveDomains()`, or `undefined` when no tools should be exposed. */
+    domainSpec: string | undefined;
+    /** Human-readable reason for the decision. Emitted to stderr for operator visibility. */
+    reason: string;
+    /** `true` when the caller should expose tools. `false` means fail closed — expose nothing. */
+    authorized: boolean;
+}
+type StderrLogger = Pick<Console, 'error'>;
+/**
+ * Resolve the tool domain surface for the authenticated user.
+ *
+ * Behaviour:
+ *  - Always queries the backend for the user's resolved roles. On any
+ *    failure, fails closed and exposes no tools.
+ *  - The static `RAYTIO_TOOL_DOMAINS` override may only *restrict* the
+ *    user's resolved domain set. It never grants access to domains the
+ *    user does not have.
+ *  - If the intersection is empty (or the user has no recognised roles),
+ *    fails closed.
+ */
+export declare function resolveToolDomains(apiClient: RaytioApiClient, envSpec: string | undefined, logger?: StderrLogger): Promise<AuthorizationResult>;
+export {};
+//# sourceMappingURL=authorization.d.ts.map

package/dist/authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.d.ts","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,mHAAmH;IACnH,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,yFAAyF;IACzF,MAAM,EAAE,MAAM,CAAC;IACf,8FAA8F;IAC9F,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,KAAK,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAgD3C;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,eAAe,EAC1B,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,MAAM,GAAE,YAAsB,GAC7B,OAAO,CAAC,mBAAmB,CAAC,CAyC9B"}

package/dist/authorization.js

@@ -0,0 +1,87 @@
+import { resolveUserDomains } from './tools/role-mapping.js';
+/**
+ * Domains that a static override may resolve to when the user only holds
+ * the full-access parent. This preserves the useful "further restrict a
+ * privileged user to read-only tools" case without ever letting a static
+ * override grant access the user does not already have.
+ */
+const READONLY_PARENTS = {
+    'ppm-readonly': 'ppm',
+    'wrm-readonly': 'wrm',
+    'sfa-readonly': 'sfa',
+};
+function parseSpec(spec) {
+    if (!spec)
+        return [];
+    return spec
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/**
+ * Intersect a static domain list with the user's resolved domain list.
+ * Static entries that ask for a read-only sub-domain of a full-access
+ * domain the user already holds are permitted (a further restriction).
+ * Anything else the user does not have is silently dropped — a static
+ * override is a restriction, never a grant.
+ */
+function restrictToUserDomains(staticDomains, userDomains) {
+    const userSet = new Set(userDomains);
+    const allowed = [];
+    for (const d of staticDomains) {
+        if (userSet.has(d)) {
+            allowed.push(d);
+            continue;
+        }
+        const parent = READONLY_PARENTS[d];
+        if (parent && userSet.has(parent)) {
+            allowed.push(d);
+        }
+    }
+    return allowed;
+}
+/**
+ * Resolve the tool domain surface for the authenticated user.
+ *
+ * Behaviour:
+ *  - Always queries the backend for the user's resolved roles. On any
+ *    failure, fails closed and exposes no tools.
+ *  - The static `RAYTIO_TOOL_DOMAINS` override may only *restrict* the
+ *    user's resolved domain set. It never grants access to domains the
+ *    user does not have.
+ *  - If the intersection is empty (or the user has no recognised roles),
+ *    fails closed.
+ */
+export async function resolveToolDomains(apiClient, envSpec, logger = console) {
+    const staticDomains = parseSpec(envSpec);
+    let dynamicSpec;
+    try {
+        dynamicSpec = await resolveUserDomains(apiClient);
+    }
+    catch (err) {
+        const reason = `role query failed: ${err?.message ?? err}`;
+        logger.error(`Raytio MCP: authorization resolution failed (${reason}) — exposing no tools (fail closed)`);
+        return { domainSpec: undefined, reason, authorized: false };
+    }
+    const userDomains = parseSpec(dynamicSpec);
+    if (userDomains.length === 0) {
+        const reason = 'user has no recognised roles';
+        logger.error(`Raytio MCP: ${reason} — exposing no tools (fail closed)`);
+        return { domainSpec: undefined, reason, authorized: false };
+    }
+    if (staticDomains.length === 0) {
+        const spec = userDomains.join(',');
+        logger.error(`Raytio MCP: resolved domains from user roles: ${spec}`);
+        return { domainSpec: spec, reason: 'resolved from user roles', authorized: true };
+    }
+    const allowed = restrictToUserDomains(staticDomains, userDomains);
+    if (allowed.length === 0) {
+        const reason = `static RAYTIO_TOOL_DOMAINS "${staticDomains.join(',')}" does not intersect user roles "${userDomains.join(',')}"`;
+        logger.error(`Raytio MCP: ${reason} — exposing no tools (fail closed)`);
+        return { domainSpec: undefined, reason, authorized: false };
+    }
+    const spec = allowed.join(',');
+    logger.error(`Raytio MCP: static RAYTIO_TOOL_DOMAINS restricted user roles (${userDomains.join(',')}) to ${spec}`);
+    return { domainSpec: spec, reason: 'restricted by static override', authorized: true };
+}
+//# sourceMappingURL=authorization.js.map

package/dist/authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization.js","sourceRoot":"","sources":["../src/authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAiB7D;;;;;GAKG;AACH,MAAM,gBAAgB,GAA2B;IAC/C,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;IACrB,cAAc,EAAE,KAAK;CACtB,CAAC;AAEF,SAAS,SAAS,CAAC,IAA+B;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,qBAAqB,CAC5B,aAAuB,EACvB,WAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAA0B,EAC1B,OAA2B,EAC3B,SAAuB,OAAO;IAE9B,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAEzC,IAAI,WAA+B,CAAC;IACpC,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,sBAAsB,GAAG,EAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC3D,MAAM,CAAC,KAAK,CACV,gDAAgD,MAAM,qCAAqC,CAC5F,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;IAE3C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,8BAA8B,CAAC;QAC9C,MAAM,CAAC,KAAK,CACV,eAAe,MAAM,oCAAoC,CAC1D,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,+BAA+B,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,oCAAoC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAClI,MAAM,CAAC,KAAK,CAAC,eAAe,MAAM,oCAAoC,CAAC,CAAC;QACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CACV,iEAAiE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CACrG,CAAC;IACF,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,+BAA+B,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACzF,CAAC"}