@sendinel/mcp-server 1.0.223 → 1.0.224

package/build/lib/action-approvals.js

@@ -11,7 +11,7 @@ import { logTesterRequestAudit } from './tester-request-audit.js';
 import { approvalStore } from './tester-requests-store.js';
 import { createHash } from 'node:crypto';
 import { approvalSetupSummary, buildApprovalPreview, isHumanApprovalChannel, triggerChangeSummary, decodeHtmlEntities, stripHtmlComments } from '@sendinel/domain';
-import { requestContext } from '../db.js';
+import { adminDb, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { captureApprovalSnapshot, withoutApprovalSnapshot, withoutApprovalDisplay } from './approval-snapshot.js';
 import { fireWebhookEvent } from './webhook-events.js';
@@ -705,7 +705,31 @@ export function withApproval(action, handler, options = {}) {
         let decidedBy;
         let decisionChannel;
         let consumedAt;
-        if (decision.tier !== 'autonomous') {
+        if (decision.tier === 'autonomous') {
+            try {
+                await assertResourcesBelongToActiveProject(action, params);
+            }
+            catch (error) {
+                if (!(error instanceof ResourceProjectRefusal))
+                    throw error;
+                const actor = requestContext();
+                try {
+                    const { error: auditError } = await adminDb().schema('email').from('audit_log').insert({
+                        project_id: getProjectId(), actor_type: actor?.actorType ?? 'mcp', actor_id: actor?.actorId ?? null,
+                        action: 'approval.resource_project_refused', resource_type: 'approval', channel: channelContext.channel,
+                        details: { action, tool: action, owner_project_id: error.ownerProjectId },
+                    });
+                    if (auditError)
+                        throw auditError;
+                }
+                catch {
+                    // An unavailable audit store must never turn a refusal into execution.
+                    console.warn('[mcp] Could not audit resource project refusal; request remains refused.');
+                }
+                return plainRefusalResult(error.message);
+            }
+        }
+        else {
             if (!approval_id) {
                 const display = options.display ? await options.display(params) : undefined;
                 try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.223",
+  "version": "1.0.224",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",