@vfarcic/dot-ai 1.7.0 → 1.9.0

package/dist/interfaces/mcp.js

@@ -29,6 +29,7 @@ const rest_registry_1 = require("./rest-registry");
 const rest_api_1 = require("./rest-api");
 const oauth_1 = require("./oauth");
 const request_context_1 = require("./request-context");
+const rbac_1 = require("../core/rbac");
 const express_1 = __importDefault(require("express"));
 const router_js_1 = require("@modelcontextprotocol/sdk/server/auth/router.js");
 const error_response_1 = require("./error-response");
@@ -92,7 +93,9 @@ class MCPServer {
      */
     registerRestTool(name, description, inputSchema, handler, category, tags) {
         const restTracedHandler = async (args) => {
-            return await (0, tracing_1.withToolTracing)(name, args, handler, { mcpClient: { name: 'http', version: 'rest-api' } });
+            return await (0, tracing_1.withToolTracing)(name, args, handler, {
+                mcpClient: { name: 'http', version: 'rest-api' },
+            });
         };
         this.restRegistry.registerTool({
             name,
@@ -100,7 +103,7 @@ class MCPServer {
             inputSchema: inputSchema,
             handler: restTracedHandler,
             category,
-            tags
+            tags,
         });
     }
     /**
@@ -108,12 +111,32 @@ class MCPServer {
      */
     registerMcpTool(server, session, name, description, inputSchema, handler) {
         const mcpTracedHandler = async (args) => {
-            return await (0, tracing_1.withToolTracing)(name, args, handler, { mcpClient: session.clientInfo });
+            // RBAC enforcement (PRD #392) — invocation-time check as second layer of defense
+            const identity = (0, request_context_1.getCurrentIdentity)();
+            if (identity) {
+                const rbacResult = await (0, rbac_1.checkToolAccess)(identity, { toolName: name });
+                if (!rbacResult.allowed) {
+                    return {
+                        content: [
+                            {
+                                type: 'text',
+                                text: JSON.stringify({
+                                    error: 'FORBIDDEN',
+                                    message: `Access denied: tool '${name}' not authorized for user '${identity.email}'`,
+                                }),
+                            },
+                        ],
+                    };
+                }
+            }
+            return await (0, tracing_1.withToolTracing)(name, args, handler, {
+                mcpClient: session.clientInfo,
+            });
         };
         /* eslint-disable @typescript-eslint/no-explicit-any -- MCP SDK type compatibility */
         server.registerTool(name, {
             description,
-            inputSchema: inputSchema
+            inputSchema: inputSchema,
         }, mcpTracedHandler);
         /* eslint-enable @typescript-eslint/no-explicit-any */
     }
@@ -123,90 +146,123 @@ class MCPServer {
     getToolDefs() {
         return [
             {
-                name: recommend_1.RECOMMEND_TOOL_NAME, description: recommend_1.RECOMMEND_TOOL_DESCRIPTION,
+                name: recommend_1.RECOMMEND_TOOL_NAME,
+                description: recommend_1.RECOMMEND_TOOL_DESCRIPTION,
                 schema: recommend_1.RECOMMEND_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
-                    this.logger.info(`Processing ${recommend_1.RECOMMEND_TOOL_NAME} tool request`, { requestId });
+                    this.logger.info(`Processing ${recommend_1.RECOMMEND_TOOL_NAME} tool request`, {
+                        requestId,
+                    });
                     if (!this.pluginManager)
                         throw new Error('Plugin system not available. Recommend tool requires agentic-tools plugin.');
                     return await (0, recommend_1.handleRecommendTool)(args, this.dotAI, this.logger, requestId, this.pluginManager);
                 },
-                category: 'Deployment', tags: ['recommendation', 'kubernetes', 'deployment', 'workflow'],
+                category: 'Deployment',
+                tags: ['recommendation', 'kubernetes', 'deployment', 'workflow'],
             },
             {
-                name: version_1.VERSION_TOOL_NAME, description: version_1.VERSION_TOOL_DESCRIPTION,
+                name: version_1.VERSION_TOOL_NAME,
+                description: version_1.VERSION_TOOL_DESCRIPTION,
                 schema: version_1.VERSION_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
-                    this.logger.info(`Processing ${version_1.VERSION_TOOL_NAME} tool request`, { requestId });
+                    this.logger.info(`Processing ${version_1.VERSION_TOOL_NAME} tool request`, {
+                        requestId,
+                    });
                     return await (0, version_1.handleVersionTool)(args, this.logger, requestId);
                 },
-                category: 'System', tags: ['version', 'diagnostics', 'status'],
+                category: 'System',
+                tags: ['version', 'diagnostics', 'status'],
             },
             {
-                name: organizational_data_1.ORGANIZATIONAL_DATA_TOOL_NAME, description: organizational_data_1.ORGANIZATIONAL_DATA_TOOL_DESCRIPTION,
+                name: organizational_data_1.ORGANIZATIONAL_DATA_TOOL_NAME,
+                description: organizational_data_1.ORGANIZATIONAL_DATA_TOOL_DESCRIPTION,
                 schema: organizational_data_1.ORGANIZATIONAL_DATA_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
                     this.logger.info(`Processing ${organizational_data_1.ORGANIZATIONAL_DATA_TOOL_NAME} tool request`, { requestId });
                     return await (0, organizational_data_1.handleOrganizationalDataTool)(args, this.dotAI, this.logger, requestId);
                 },
-                category: 'Management', tags: ['patterns', 'policies', 'capabilities', 'data'],
+                category: 'Management',
+                tags: ['patterns', 'policies', 'capabilities', 'data'],
             },
             {
-                name: remediate_1.REMEDIATE_TOOL_NAME, description: remediate_1.REMEDIATE_TOOL_DESCRIPTION,
+                name: remediate_1.REMEDIATE_TOOL_NAME,
+                description: remediate_1.REMEDIATE_TOOL_DESCRIPTION,
                 schema: remediate_1.REMEDIATE_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
-                    this.logger.info(`Processing ${remediate_1.REMEDIATE_TOOL_NAME} tool request`, { requestId });
+                    this.logger.info(`Processing ${remediate_1.REMEDIATE_TOOL_NAME} tool request`, {
+                        requestId,
+                    });
                     if (!(0, plugin_registry_1.isPluginInitialized)())
                         throw new Error('Plugin system not available. Remediate tool requires agentic-tools plugin for kubectl operations.');
                     return await (0, remediate_1.handleRemediateTool)(args);
                 },
-                category: 'Troubleshooting', tags: ['remediation', 'troubleshooting', 'kubernetes', 'analysis'],
+                category: 'Troubleshooting',
+                tags: ['remediation', 'troubleshooting', 'kubernetes', 'analysis'],
             },
             {
-                name: operate_1.OPERATE_TOOL_NAME, description: operate_1.OPERATE_TOOL_DESCRIPTION,
+                name: operate_1.OPERATE_TOOL_NAME,
+                description: operate_1.OPERATE_TOOL_DESCRIPTION,
                 schema: operate_1.OPERATE_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
-                    this.logger.info(`Processing ${operate_1.OPERATE_TOOL_NAME} tool request`, { requestId });
+                    this.logger.info(`Processing ${operate_1.OPERATE_TOOL_NAME} tool request`, {
+                        requestId,
+                    });
                     if (!this.pluginManager)
                         throw new Error('Plugin system not available. Operate tool requires agentic-tools plugin for kubectl operations.');
                     return await (0, operate_1.handleOperateTool)(args, this.pluginManager);
                 },
-                category: 'Operations', tags: ['operate', 'operations', 'kubernetes', 'day2', 'update', 'scale'],
+                category: 'Operations',
+                tags: [
+                    'operate',
+                    'operations',
+                    'kubernetes',
+                    'day2',
+                    'update',
+                    'scale',
+                ],
             },
             {
-                name: project_setup_1.PROJECT_SETUP_TOOL_NAME, description: project_setup_1.PROJECT_SETUP_TOOL_DESCRIPTION,
+                name: project_setup_1.PROJECT_SETUP_TOOL_NAME,
+                description: project_setup_1.PROJECT_SETUP_TOOL_DESCRIPTION,
                 schema: project_setup_1.PROJECT_SETUP_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
                     this.logger.info(`Processing ${project_setup_1.PROJECT_SETUP_TOOL_NAME} tool request`, { requestId });
                     return await (0, project_setup_1.handleProjectSetupTool)(args, this.logger);
                 },
-                category: 'Project Setup', tags: ['governance', 'infrastructure', 'configuration', 'files'],
+                category: 'Project Setup',
+                tags: ['governance', 'infrastructure', 'configuration', 'files'],
             },
             {
-                name: query_1.QUERY_TOOL_NAME, description: query_1.QUERY_TOOL_DESCRIPTION,
+                name: query_1.QUERY_TOOL_NAME,
+                description: query_1.QUERY_TOOL_DESCRIPTION,
                 schema: query_1.QUERY_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
-                    this.logger.info(`Processing ${query_1.QUERY_TOOL_NAME} tool request`, { requestId });
+                    this.logger.info(`Processing ${query_1.QUERY_TOOL_NAME} tool request`, {
+                        requestId,
+                    });
                     return await (0, query_1.handleQueryTool)(args, this.pluginManager);
                 },
-                category: 'Intelligence', tags: ['query', 'search', 'discover', 'capabilities', 'cluster'],
+                category: 'Intelligence',
+                tags: ['query', 'search', 'discover', 'capabilities', 'cluster'],
             },
             {
-                name: manage_knowledge_1.MANAGE_KNOWLEDGE_TOOL_NAME, description: manage_knowledge_1.MANAGE_KNOWLEDGE_TOOL_DESCRIPTION,
+                name: manage_knowledge_1.MANAGE_KNOWLEDGE_TOOL_NAME,
+                description: manage_knowledge_1.MANAGE_KNOWLEDGE_TOOL_DESCRIPTION,
                 schema: manage_knowledge_1.MANAGE_KNOWLEDGE_TOOL_INPUT_SCHEMA,
                 handler: async (args) => {
                     const requestId = this.generateRequestId();
                     this.logger.info(`Processing ${manage_knowledge_1.MANAGE_KNOWLEDGE_TOOL_NAME} tool request`, { requestId });
                     return await (0, manage_knowledge_1.handleManageKnowledgeTool)(args, this.dotAI, this.logger, requestId);
                 },
-                category: 'Knowledge', tags: ['knowledge', 'documents', 'ingest', 'semantic', 'search'],
+                category: 'Knowledge',
+                tags: ['knowledge', 'documents', 'ingest', 'semantic', 'search'],
             },
         ];
     }
@@ -228,13 +284,16 @@ class MCPServer {
      * Each MCP client session gets its own server instance (SDK limitation:
      * Protocol only supports one transport per server).
      */
-    createSessionServer(session) {
+    async createSessionServer(session, authIdentity) {
         const server = new mcp_js_1.McpServer({ name: this.config.name, version: this.config.version }, { capabilities: { tools: {}, prompts: {} } });
         // Track client info per session
         server.server.oninitialized = () => {
             const clientVersion = server.server.getClientVersion();
             if (clientVersion) {
-                session.clientInfo = { name: clientVersion.name, version: clientVersion.version };
+                session.clientInfo = {
+                    name: clientVersion.name,
+                    version: clientVersion.version,
+                };
                 (0, telemetry_1.getTelemetry)().trackClientConnected(session.clientInfo);
                 this.logger.info('MCP client connected', {
                     client: clientVersion.name,
@@ -242,8 +301,10 @@ class MCPServer {
                 });
             }
         };
-        // Register all tools on this session server
-        for (const def of this.getToolDefs()) {
+        // Register tools on this session server, filtered by RBAC (PRD #392)
+        const allDefs = this.getToolDefs();
+        const defs = await (0, rbac_1.filterAuthorizedTools)(authIdentity, allDefs);
+        for (const def of defs) {
             this.registerMcpTool(server, session, def.name, def.description, def.schema, def.handler);
         }
         // Register prompts
@@ -263,14 +324,19 @@ class MCPServer {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any -- MCP SDK type compatibility
         server.server.setRequestHandler(types_js_1.GetPromptRequestSchema, async (request) => {
             const requestId = this.generateRequestId();
-            this.logger.info('Processing prompts/get request', { requestId, promptName: request.params?.name });
+            this.logger.info('Processing prompts/get request', {
+                requestId,
+                promptName: request.params?.name,
+            });
             return await (0, prompts_1.handlePromptsGetRequest)(request.params || { name: '' }, this.logger, requestId);
         });
     }
     configureHostProvider() {
         const aiProvider = this.dotAI.ai;
         this.logger.info('Using configured AI Provider', {
-            type: aiProvider.getProviderType ? aiProvider.getProviderType() : 'unknown'
+            type: aiProvider.getProviderType
+                ? aiProvider.getProviderType()
+                : 'unknown',
         });
     }
     /**
@@ -298,7 +364,11 @@ class MCPServer {
         this.initialized = true;
     }
     async startHttpTransport() {
-        const port = process.env.PORT ? parseInt(process.env.PORT) : (this.config.port !== undefined ? this.config.port : 3456);
+        const port = process.env.PORT
+            ? parseInt(process.env.PORT)
+            : this.config.port !== undefined
+                ? this.config.port
+                : 3456;
         const host = process.env.HOST || this.config.host || '0.0.0.0';
         this.logger.info('Using HTTP/SSE transport', { port, host });
         // Create OAuth provider and Express sub-app with SDK router
@@ -328,7 +398,7 @@ class MCPServer {
                     this.logger.debug('HTTP request received', {
                         method: req.method,
                         url: req.url,
-                        headers: req.headers
+                        headers: req.headers,
                     });
                     // Handle CORS for browser-based clients
                     res.setHeader('Access-Control-Allow-Origin', '*');
@@ -370,10 +440,14 @@ class MCPServer {
                     if (!isOpenApiEndpoint) {
                         const authResult = (0, oauth_1.checkBearerAuth)(req);
                         if (!authResult.authorized) {
-                            this.logger.warn('Authentication failed', { message: authResult.message });
+                            this.logger.warn('Authentication failed', {
+                                message: authResult.message,
+                            });
                             const issuerHref = this.issuerUrl.href.replace(/\/$/, '');
                             const resourceMetadataUrl = `${issuerHref}/.well-known/oauth-protected-resource`;
-                            (0, error_response_1.sendErrorResponse)(res, 401, 'UNAUTHORIZED', authResult.message || 'Authentication required', undefined, { 'WWW-Authenticate': `Bearer resource_metadata="${resourceMetadataUrl}"` });
+                            (0, error_response_1.sendErrorResponse)(res, 401, 'UNAUTHORIZED', authResult.message || 'Authentication required', undefined, {
+                                'WWW-Authenticate': `Bearer resource_metadata="${resourceMetadataUrl}"`,
+                            });
                             endSpan(401);
                             return;
                         }
@@ -388,7 +462,9 @@ class MCPServer {
                         }
                         // Check if this is a REST API request
                         if (this.restApiRouter.isApiRequest(req.url || '')) {
-                            this.logger.debug('Routing to REST API handler', { url: req.url });
+                            this.logger.debug('Routing to REST API handler', {
+                                url: req.url,
+                            });
                             // Mark span as REST API request
                             span.setAttribute('request.type', 'rest-api');
                             try {
@@ -410,7 +486,8 @@ class MCPServer {
                         span.updateName('MCP ' + (req.url || '/'));
                         try {
                             // Determine if this is an initialize request (needs new transport)
-                            const isInit = req.method === 'POST' && body != null &&
+                            const isInit = req.method === 'POST' &&
+                                body != null &&
                                 (Array.isArray(body)
                                     ? body.some(m => (0, types_js_1.isInitializeRequest)(m))
                                     : (0, types_js_1.isInitializeRequest)(body));
@@ -418,16 +495,20 @@ class MCPServer {
                                 // Create a new McpServer + transport pair for this client session.
                                 // Each session gets its own McpServer instance because the SDK's
                                 // Protocol class only supports one transport at a time.
-                                const session = { lastActivity: Date.now() };
+                                const session = {
+                                    lastActivity: Date.now(),
+                                };
                                 const transport = new streamableHttp_js_1.StreamableHTTPServerTransport({
                                     sessionIdGenerator: () => (0, node_crypto_1.randomUUID)(),
                                     enableJsonResponse: false,
                                     onsessioninitialized: (sid) => {
-                                        this.logger.info('Session initialized', { sessionId: sid });
+                                        this.logger.info('Session initialized', {
+                                            sessionId: sid,
+                                        });
                                         this.sessions.set(sid, session);
                                     },
                                 });
-                                const server = this.createSessionServer(session);
+                                const server = await this.createSessionServer(session, authIdentity);
                                 session.server = server;
                                 session.transport = transport;
                                 transport.onclose = () => {
@@ -443,7 +524,9 @@ class MCPServer {
                             else {
                                 // Route to existing session by Mcp-Session-Id header
                                 const sessionId = req.headers['mcp-session-id'];
-                                const session = sessionId ? this.sessions.get(sessionId) : undefined;
+                                const session = sessionId
+                                    ? this.sessions.get(sessionId)
+                                    : undefined;
                                 if (!session) {
                                     (0, error_response_1.sendErrorResponse)(res, 404, 'SESSION_NOT_FOUND', 'Session not found');
                                     endSpan(404);
@@ -485,7 +568,7 @@ class MCPServer {
     async parseRequestBody(req) {
         return new Promise((resolve, reject) => {
             let body = '';
-            req.on('data', chunk => body += chunk.toString());
+            req.on('data', chunk => (body += chunk.toString()));
             req.on('end', () => {
                 try {
                     resolve(body ? JSON.parse(body) : undefined);
@@ -513,12 +596,14 @@ class MCPServer {
             try {
                 await session.server.close();
             }
-            catch { /* ignore */ }
+            catch {
+                /* ignore */
+            }
             this.sessions.delete(sid);
         }
         // Stop HTTP server if running
         if (this.httpServer) {
-            await new Promise((resolve) => {
+            await new Promise(resolve => {
                 this.httpServer.close(() => {
                     this.logger.info('HTTP server stopped');
                     resolve();

package/dist/interfaces/rest-api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAoCtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AASvD;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAmGhB;;;OAGG;YACW,aAAa;IAqG3B;;OAEG;YACW,mBAAmB;IAgDjC;;OAEG;YACW,mBAAmB;IAuIjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IA6CtC;;OAEG;YACW,uBAAuB;IAmErC;;OAEG;YACW,yBAAyB;IAqDvC;;;;OAIG;YACW,eAAe;IAmW7B;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAmF9B;;OAEG;YACW,eAAe;IA+B7B;;OAEG;YACW,gBAAgB;IAwD9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}
+{"version":3,"file":"rest-api.d.ts","sourceRoot":"","sources":["../../src/interfaces/rest-api.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAE5D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAc,MAAM,uBAAuB,CAAC;AAEtE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAoCtC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAevD;;GAEG;AACH,oBAAY,UAAU;IACpB,EAAE,MAAM;IACR,WAAW,MAAM;IACjB,SAAS,MAAM;IACf,kBAAkB,MAAM;IACxB,qBAAqB,MAAM;IAC3B,WAAW,MAAM;IACjB,mBAAmB,MAAM;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,OAAO,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,eAAe;IAC5D,IAAI,CAAC,EAAE;QACL,KAAK,EAAE,QAAQ,EAAE,CAAC;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB,SAAS,GACT,OAAO,GACP,MAAM,GACN,OAAO,GACP,MAAM,GACN,WAAW,CAAC;AAEhB;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,gBAAgB,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,YAAY,GAAG,UAAU,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,iBAAiB,CAAC;IACxB,OAAO,EACH,MAAM,GACN;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAClC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;KAAE,GACvC,KAAK,CAAC;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC,GACF,wBAAwB,GACxB,4BAA4B,CAAC;CAClC;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,OAAO,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAmB;IACnC,OAAO,CAAC,aAAa,CAAoB;IACzC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,KAAK,CAAQ;IACrB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,aAAa,CAAC,CAAgB;gBAGpC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,aAAa,EAC7B,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAkCrC;;;;OAIG;IACG,aAAa,CACjB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,CAAC,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC;IAmGhB;;;OAGG;YACW,aAAa;IAqG3B;;OAEG;YACW,mBAAmB;IAuEjC;;OAEG;YACW,mBAAmB;IAuJjC;;OAEG;YACW,iBAAiB;IAqC/B;;OAEG;YACW,yBAAyB;IA2EvC;;;;OAIG;YACW,sBAAsB;IAyDpC;;;OAGG;YACW,qBAAqB;IAmKnC;;;;OAIG;YACW,mBAAmB;IAoLjC;;;OAGG;YACW,mBAAmB;IAmDjC;;;OAGG;YACW,iBAAiB;IAuL/B;;;OAGG;YACW,eAAe;IA0J7B;;;OAGG;YACW,aAAa;IAuK3B;;OAEG;YACW,wBAAwB;IA6CtC;;OAEG;YACW,uBAAuB;IAmErC;;OAEG;YACW,yBAAyB;IAqDvC;;;;OAIG;YACW,eAAe;IAmW7B;;;;OAIG;YACW,sBAAsB;IAuEpC;;;;OAIG;YACW,2BAA2B;IAyQzC;;;;OAIG;YACW,kBAAkB;IA6PhC;;OAEG;YACW,+BAA+B;IA8D7C;;OAEG;YACW,gBAAgB;IAwG9B;;OAEG;YACW,eAAe;IAkD7B;;OAEG;YACW,gBAAgB;IA6E9B;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;OAEG;YACW,gBAAgB;IAS9B;;OAEG;YACW,iBAAiB;IAyB/B;;OAEG;IACH,OAAO,CAAC,iBAAiB;IAIzB;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAMvC;;OAEG;IACH,SAAS,IAAI,aAAa;IAI1B;;;OAGG;IACH,gBAAgB,IAAI,iBAAiB;CAGtC"}

package/dist/interfaces/rest-api.js

@@ -57,6 +57,8 @@ const mermaid_tools_1 = require("../core/mermaid-tools");
 const plugin_registry_1 = require("../core/plugin-registry");
 const manage_knowledge_1 = require("../tools/manage-knowledge");
 const user_management_1 = require("./oauth/user-management");
+const request_context_1 = require("./request-context");
+const rbac_1 = require("../core/rbac");
 /**
  * HTTP status codes for REST responses
  */
@@ -222,7 +224,27 @@ class RestApiRouter {
             const category = searchParams.get('category') || undefined;
             const tag = searchParams.get('tag') || undefined;
             const search = searchParams.get('search') || undefined;
-            const tools = this.registry.getToolsFiltered({ category, tag, search });
+            let tools = this.registry.getToolsFiltered({ category, tag, search });
+            // RBAC-filtered tool discovery (PRD #392) — OAuth users only see authorized tools
+            const discoveryIdentity = (0, request_context_1.getCurrentIdentity)();
+            tools = await (0, rbac_1.filterAuthorizedTools)(discoveryIdentity, tools);
+            // Check user management access and include as virtual "users" tool (PRD #392)
+            const userAccessResult = await (0, rbac_1.checkToolAccess)(discoveryIdentity, {
+                toolName: 'manageUsers',
+                resource: 'users',
+            });
+            if (userAccessResult.allowed) {
+                tools = [
+                    ...tools,
+                    {
+                        name: 'users',
+                        description: 'Manage users (create, list, delete)',
+                        schema: { type: 'object', properties: {} },
+                        category: 'Administration',
+                        tags: ['users', 'administration', 'management'],
+                    },
+                ];
+            }
             const categories = this.registry.getCategories();
             const tags = this.registry.getTags();
             const response = {
@@ -261,6 +283,15 @@ class RestApiRouter {
                 await this.sendErrorResponse(res, requestId, HttpStatus.NOT_FOUND, 'TOOL_NOT_FOUND', `Tool '${toolName}' not found`);
                 return;
             }
+            // RBAC enforcement (PRD #392) — check tool-level authorization for OAuth users
+            const identity = (0, request_context_1.getCurrentIdentity)();
+            if (identity) {
+                const rbacResult = await (0, rbac_1.checkToolAccess)(identity, { toolName });
+                if (!rbacResult.allowed) {
+                    await this.sendErrorResponse(res, requestId, 403, 'FORBIDDEN', `Access denied: tool '${toolName}' not authorized for user '${identity.email}'`);
+                    return;
+                }
+            }
             // Validate request body
             if (!body || typeof body !== 'object') {
                 await this.sendErrorResponse(res, requestId, HttpStatus.BAD_REQUEST, 'INVALID_REQUEST', 'Request body must be a JSON object');
@@ -1795,6 +1826,18 @@ class RestApiRouter {
      */
     async handleCreateUser(_req, res, requestId, body) {
         try {
+            // RBAC enforcement (PRD #392) — user management requires dotai-admin role
+            const identity = (0, request_context_1.getCurrentIdentity)();
+            if (identity) {
+                const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
+                    toolName: 'users',
+                    resource: 'users',
+                });
+                if (!rbacResult.allowed) {
+                    await this.sendErrorResponse(res, requestId, 403, 'FORBIDDEN', 'User management requires dotai-admin role');
+                    return;
+                }
+            }
             if (!body ||
                 typeof body !== 'object' ||
                 !('email' in body) ||
@@ -1812,6 +1855,7 @@ class RestApiRouter {
                 return;
             }
             const result = await (0, user_management_1.createUser)(email, password);
+            (0, rbac_1.logUserManagementOperation)(identity, 'created', email);
             await this.sendJsonResponse(res, HttpStatus.OK, {
                 success: true,
                 data: result,
@@ -1839,6 +1883,18 @@ class RestApiRouter {
      */
     async handleListUsers(_req, res, requestId) {
         try {
+            // RBAC enforcement (PRD #392) — user management requires dotai-admin role
+            const identity = (0, request_context_1.getCurrentIdentity)();
+            if (identity) {
+                const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
+                    toolName: 'users',
+                    resource: 'users',
+                });
+                if (!rbacResult.allowed) {
+                    await this.sendErrorResponse(res, requestId, 403, 'FORBIDDEN', 'User management requires dotai-admin role');
+                    return;
+                }
+            }
             const users = await (0, user_management_1.listUsers)();
             await this.sendJsonResponse(res, HttpStatus.OK, {
                 success: true,
@@ -1861,6 +1917,18 @@ class RestApiRouter {
      */
     async handleDeleteUser(_req, res, requestId, email) {
         try {
+            // RBAC enforcement (PRD #392) — user management requires dotai-admin role
+            const identity = (0, request_context_1.getCurrentIdentity)();
+            if (identity) {
+                const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
+                    toolName: 'users',
+                    resource: 'users',
+                });
+                if (!rbacResult.allowed) {
+                    await this.sendErrorResponse(res, requestId, 403, 'FORBIDDEN', 'User management requires dotai-admin role');
+                    return;
+                }
+            }
             let decodedEmail;
             try {
                 decodedEmail = decodeURIComponent(email);
@@ -1870,6 +1938,7 @@ class RestApiRouter {
                 return;
             }
             const result = await (0, user_management_1.deleteUser)(decodedEmail);
+            (0, rbac_1.logUserManagementOperation)(identity, 'deleted', decodedEmail);
             await this.sendJsonResponse(res, HttpStatus.OK, {
                 success: true,
                 data: result,

package/dist/tools/generate-manifests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate-manifests.d.ts","sourceRoot":"","sources":["../../src/tools/generate-manifests.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,EAAE,KAAK,EAA0B,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAgBhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAsD5D,eAAO,MAAM,2BAA2B,sBAAsB,CAAC;AAC/D,eAAO,MAAM,kCAAkC,+IAC+F,CAAC;AAG/I,eAAO,MAAM,mCAAmC;;;CAa/C,CAAC;AAq8BF;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EACrD,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CA0WxD"}
+{"version":3,"file":"generate-manifests.d.ts","sourceRoot":"","sources":["../../src/tools/generate-manifests.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,OAAO,EAAE,KAAK,EAA0B,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAgBhD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AA8E5D,eAAO,MAAM,2BAA2B,sBAAsB,CAAC;AAC/D,eAAO,MAAM,kCAAkC,+IAC+F,CAAC;AAG/I,eAAO,MAAM,mCAAmC;;;CAa/C,CAAC;AAq8BF;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,EACrD,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CA0WxD"}

package/dist/tools/generate-manifests.js

@@ -57,7 +57,27 @@ const solution_cr_1 = require("../core/solution-cr");
 const packaging_1 = require("../core/packaging");
 const visualization_1 = require("../core/visualization");
 const plugin_registry_1 = require("../core/plugin-registry");
+const request_context_1 = require("../interfaces/request-context");
+const rbac_1 = require("../core/rbac");
 // PRD #359: All helm operations via unified plugin registry
+/**
+ * PRD #392 Milestone 2: Build agent instructions based on deploy permission.
+ * When the user has 'apply' permission, includes the deploy option.
+ * When they don't, explains that deploying requires 'apply' permission.
+ */
+async function buildDeployInstructions(outputPath, outputFormat) {
+    const writeInstr = `Write the files to "${outputPath}".`;
+    const formatInstr = outputFormat === 'helm' ? ' The output is a Helm chart.' : outputFormat === 'raw' ? '' : ' The output is a Kustomize overlay.';
+    const identity = (0, request_context_1.getCurrentIdentity)();
+    const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
+        toolName: 'recommend',
+        verb: 'apply',
+    });
+    if (rbacResult.allowed) {
+        return `${writeInstr}${formatInstr} If immediate deployment is desired, call the recommend tool with stage: "deployManifests".`;
+    }
+    return `${writeInstr}${formatInstr} Deploying manifests requires 'apply' permission on 'recommend', which is not granted for the current user. Save the files locally or push to Git to apply them through your own workflow.`;
+}
 /**
  * Ensure tmp directory exists
  */
@@ -915,7 +935,7 @@ async function handleGenerateManifestsTool(args, dotAI, logger, requestId, plugi
                             validationAttempts: attempt,
                             packagingAttempts: packagingResult.attempts,
                             timestamp: new Date().toISOString(),
-                            agentInstructions: `Write the files to "${outputPath}". The output is a ${outputFormat === 'helm' ? 'Helm chart' : 'Kustomize overlay'}. If immediate deployment is desired, call the recommend tool with stage: "deployManifests".`,
+                            agentInstructions: await buildDeployInstructions(outputPath, outputFormat),
                             ...(visualizationUrl ? { visualizationUrl } : {}),
                         };
                         // Build content blocks - JSON for REST API, agent instruction for MCP agents
@@ -957,7 +977,7 @@ async function handleGenerateManifestsTool(args, dotAI, logger, requestId, plugi
                         files: [{ relativePath: 'manifests.yaml', content: manifests }],
                         validationAttempts: attempt,
                         timestamp: new Date().toISOString(),
-                        agentInstructions: `Write the files to "${outputPath}". If immediate deployment is desired, call the recommend tool with stage: "deployManifests".`,
+                        agentInstructions: await buildDeployInstructions(outputPath, outputFormat),
                         ...(visualizationUrl ? { visualizationUrl } : {}),
                     };
                     // Build content blocks - JSON for REST API, agent instruction for MCP agents

package/dist/tools/manage-knowledge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manage-knowledge.d.ts","sourceRoot":"","sources":["../../src/tools/manage-knowledge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EAIL,yBAAyB,EAE1B,MAAM,yBAAyB,CAAC;AAQjC,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,iCAAiC,QAKgB,CAAC;AAG/D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;CAkC9C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiPD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4HrC;AA2ND;;GAEG;AACH,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAgBD;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,KAAK,GAAG,IAAI,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CA8B1B"}
+{"version":3,"file":"manage-knowledge.d.ts","sourceRoot":"","sources":["../../src/tools/manage-knowledge.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,OAAO,EAIL,yBAAyB,EAE1B,MAAM,yBAAyB,CAAC;AAUjC,eAAO,MAAM,0BAA0B,oBAAoB,CAAC;AAC5D,eAAO,MAAM,iCAAiC,QAKgB,CAAC;AAG/D,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;CAkC9C,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;IAC/C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAiPD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,yBAAyB,EAAE,CAAC;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA4HrC;AA2ND;;GAEG;AACH,UAAU,eAAe;IACvB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAgBD;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,oBAAoB,EAC1B,MAAM,EAAE,KAAK,GAAG,IAAI,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,eAAe,CAAC,CAiD1B"}

package/dist/tools/manage-knowledge.js

@@ -14,6 +14,8 @@ exports.handleManageKnowledgeTool = handleManageKnowledgeTool;
 const zod_1 = require("zod");
 const plugin_registry_1 = require("../core/plugin-registry");
 const embedding_service_1 = require("../core/embedding-service");
+const request_context_1 = require("../interfaces/request-context");
+const rbac_1 = require("../core/rbac");
 /**
  * Collection name for knowledge base chunks in Qdrant
  */
@@ -550,6 +552,24 @@ async function handleManageKnowledgeTool(args, _dotAI, logger, requestId) {
         requestId,
         operation: args.operation,
     });
+    // PRD #392 Milestone 8: Mutating operations require 'apply' verb
+    const MUTATING_KNOWLEDGE_OPS = new Set(['ingest', 'deleteByUri']);
+    if (MUTATING_KNOWLEDGE_OPS.has(args.operation)) {
+        const identity = (0, request_context_1.getCurrentIdentity)();
+        const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
+            toolName: 'manageKnowledge',
+            verb: 'apply',
+        });
+        if (!rbacResult.allowed) {
+            return wrapMcpResponse({
+                error: 'FORBIDDEN',
+                message: `Access denied: '${args.operation}' on knowledge base requires 'apply' permission on 'manageKnowledge'. Search is available with 'execute' permission.`,
+                tool: 'manageKnowledge',
+                operation: args.operation,
+                user: identity?.email,
+            });
+        }
+    }
     // Route to appropriate handler based on operation
     let response;
     switch (args.operation) {

package/dist/tools/operate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operate.d.ts","sourceRoot":"","sources":["../../src/tools/operate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,MAAM,EAEP,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIvD,OAAO,EACL,qBAAqB,EACrB,YAAY,EACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,wBAAwB,6TACuR,CAAC;AAG7T,eAAO,MAAM,yBAAyB;;;;;;CA+BrC,CAAC;AAGF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,eAAe,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE;QAChB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;QACL,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EACF,WAAW,GACX,mBAAmB,GACnB,WAAW,GACX,uBAAuB,GACvB,sBAAsB,GACtB,QAAQ,CAAC;IACb,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;CACtC;AAGD,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,wBAAwB,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,eAAe,CAAC;QACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,gBAAgB,EAAE;YAChB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;YAC7B,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;YACjC,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,eAAe,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAkF1B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAiBxE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAkB/D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAgB7E;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,YAAY,EAClB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,aAAa,CAAC,CAyDxB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,YAAY,EAClB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAoB7D"}
+{"version":3,"file":"operate.d.ts","sourceRoot":"","sources":["../../src/tools/operate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAIL,MAAM,EAEP,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAMvD,OAAO,EACL,qBAAqB,EACrB,YAAY,EACb,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,wBAAwB,6TACuR,CAAC;AAG7T,eAAO,MAAM,yBAAyB;;;;;;CA+BrC,CAAC;AAGF,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,kBAAmB,SAAQ,qBAAqB;IAC/D,QAAQ,EAAE,SAAS,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,eAAe,CAAC;IACzB,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE;QAChB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;QAC7B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE;QACL,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EACF,WAAW,GACX,mBAAmB,GACnB,WAAW,GACX,uBAAuB,GACvB,sBAAsB,GACtB,QAAQ,CAAC;IACb,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;CACtC;AAGD,MAAM,MAAM,cAAc,GAAG;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,kBAAkB,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,qBAAqB,EAAE,CAAC;IAClC,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,wBAAwB,CAAC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,eAAe,CAAC;QACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,gBAAgB,EAAE;YAChB,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;YAC7B,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,eAAe,EAAE,MAAM,EAAE,CAAC;QAC1B,KAAK,EAAE;YACL,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;YACjC,WAAW,EAAE,MAAM,CAAC;SACrB,CAAC;QACF,gBAAgB,EAAE,MAAM,CAAC;KAC1B,CAAC;IACF,SAAS,CAAC,EAAE;QACV,OAAO,EAAE,eAAe,EAAE,CAAC;QAC3B,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAQD;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAkF1B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAiBxE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAkB/D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAgB7E;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,YAAY,EAClB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC,aAAa,CAAC,CAyDxB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,YAAY,EAClB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAyD7D"}