backend-manager 5.7.5 → 5.7.6

package/CHANGELOG.md

@@ -14,6 +14,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - `Fixed` for any bug fixes.
 - `Security` in case of vulnerabilities.
 
+# [5.7.6] - 2026-06-18
+
+### Fixed
+- **MCP admin role promotion.** Users with `roles.admin=true` on their Firestore doc now see all 25 admin tools when connecting via OAuth. Previously only the `BACKEND_MANAGER_KEY` granted admin MCP access; user-role admins were limited to 3 tools.
+
 # [5.7.4] - 2026-06-18
 
 ### Added

package/TODO.md

@@ -9,6 +9,12 @@
     console.log('*** req.assistant', req.assistant);
     console.log('*** res.assistant', res.assistant);
 
+# OAUTH2 (INBOUND + OUTBOUND)
+UJM + BEM CHANGE
+* UJM /oauth2 = for conencting OTHER accounts to user account
+* UJM /token = for connecting user account to OTHER accounts
+  * we should rename this (requires backend change too)
+  * /authorize (most common says claude) or /connect
 
 # PAYMETNS
 https://github.com/invertase/stripe-firebase-extensions/tree/next/firestore-stripe-payments
@@ -28,9 +34,6 @@ Update deps!!!! theres lots
 * we culd have a test that TRIES EACH IMPORT ?? incase updating it fails due to ESM VULLSHIT?
 
 
-ADD HEALTHCHECK TO BEM!!!
-  ✗ https://api.clockii.com/backend-manager?command=healthcheck → fetch failed
-
 TODO
 PAYMENT
 https://hookdeck.com/webhooks/platforms/guide-to-paypal-webhooks-features-and-best-practices

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend-manager",
-  "version": "5.7.5",
+  "version": "5.7.6",
   "description": "Quick tools for developing Firebase functions",
   "main": "src/manager/index.js",
   "bin": {

package/src/mcp/handler.js

@@ -316,9 +316,35 @@ async function handleMcpProtocol(req, res, options) {
     return;
   }
 
-  // Classify the token
+  // Classify the token — fast check first, then DB lookup if needed
   const authInfo = resolveAuthInfo(token);
 
+  // If token is a user API key, check if the user has admin role in Firestore
+  if (authInfo.role === 'user') {
+    try {
+      const admin = Manager.libraries?.admin;
+
+      if (admin) {
+        const snapshot = await admin.firestore()
+          .collection('users')
+          .where('api.privateKey', '==', token)
+          .limit(1)
+          .get();
+
+        if (!snapshot.empty) {
+          const userData = snapshot.docs[0].data();
+
+          if (userData?.roles?.admin === true) {
+            authInfo.role = 'admin';
+            authInfo.authType = 'userAdmin';
+          }
+        }
+      }
+    } catch (e) {
+      // DB lookup failed — proceed with user role (safe fallback)
+    }
+  }
+
   // Load and merge consumer tools (consumer overrides win)
   const cwd = Manager.cwd || '';
   const consumerTools = getConsumerTools(cwd);

package/test/mcp/roles.js

@@ -76,6 +76,26 @@ module.exports = {
       },
     },
 
+    {
+      name: 'user with roles.admin sees all tools (DB role promotion)',
+      async run({ assert, accounts }) {
+        const adminUserKey = accounts.admin?.privateKey;
+        assert.ok(adminUserKey, 'Admin test account should have a privateKey');
+
+        const response = await mcpRequest('tools/list', {}, adminUserKey);
+
+        assert.ok(response?.result?.tools, 'Should return tools list');
+
+        const tools = response.result.tools;
+        assert.equal(tools.length, 25, `Admin-role user should see all 25 tools, got ${tools.length}`);
+
+        const names = tools.map((t) => t.name);
+        assert.ok(names.includes('firestore_read'), 'Should see admin tool firestore_read');
+        assert.ok(names.includes('get_user'), 'Should see user tool get_user');
+        assert.ok(names.includes('health_check'), 'Should see public tool health_check');
+      },
+    },
+
     {
       name: 'user sees only user + public tools',
       async run({ assert, accounts }) {