drupal-mcp-connector 2.19.0 → 2.20.0

package/src/lib/patch-preflight.js

@@ -24,7 +24,9 @@
 
 import { entityLooksModerated, hasExplicitModerationState } from "./moderation-default.js";
 import { entityRevisionId } from "./write-revision.js";
+import { httpStatusOf } from "./error-status.js";
 import { writeDraft, readNodeDraftInventory, assertInventoryDraftLanguage } from "./sentinel-draft.js";
+import { PREFLIGHT_NONE, PREFLIGHT_CORE_GUARD, PREFLIGHT_SENTINEL_DRAFT } from "./dry-run-checks.js";
 
 /** Stable error code for a core working-copy / not-latest-revision block. */
 export const PATCH_BLOCKED_CODE = "PATCH_BLOCKED";
@@ -300,7 +302,7 @@ const ID_MISMATCH_RE = /does not match the ID in the payload/i;
  */
 export function isProbePassedWithoutSave(err) {
   const msg = String(err?.message || "");
-  return ID_MISMATCH_RE.test(msg) || /Drupal 422\b/.test(msg);
+  return ID_MISMATCH_RE.test(msg) || httpStatusOf(err) === 422;
 }
 
 /**
@@ -315,6 +317,12 @@ export function isProbePassedWithoutSave(err) {
  * When `resourceVersion` is `rel:working-copy`, the probe hits that same
  * URL so dryRun cannot succeed when the real write would 400 (#166).
  *
+ * The probe body carries no attributes, and core rejects the id before it
+ * evaluates field access or validation. A passing probe therefore proves the
+ * route's entity update access and the working-copy guard, and nothing about
+ * the fields the real write will submit (#336). The result says so
+ * (`payloadEvaluated: false`) rather than claiming the target is writable.
+ *
  * @param {object} args
  * @param {object} args.backend Backend with `rawQuery` + `resourcePath`.
  * @param {string} args.entityType
@@ -323,7 +331,7 @@ export function isProbePassedWithoutSave(err) {
  * @param {?object} [args.existing]
  * @param {object} [args.attributes]
  * @param {?string} [args.resourceVersion]
- * @returns {Promise<{probed: boolean, writable?: boolean|string, skipped?: string}>}
+ * @returns {Promise<{probed: boolean, revisionGuardPassed?: boolean, payloadEvaluated?: boolean, skipped?: string}>}
  * @throws {PatchBlockedError|WorkingCopyStaleError} When the guard rejects the probe.
  */
 export async function preflightPatchWritable({
@@ -368,7 +376,7 @@ export async function preflightPatchWritable({
       throw new PatchBlockedError(cause);
     }
     if (isProbePassedWithoutSave(err)) {
-      return { probed: true, writable: true };
+      return { probed: true, revisionGuardPassed: true, payloadEvaluated: false };
     }
     throw err;
   }
@@ -380,9 +388,14 @@ export async function preflightPatchWritable({
  * `langcode` always resolves Sentinel inventory and draft-preflights, even
  * when the entity is unmoderated (media translations).
  *
+ * The returned `preflight` names the server-side check that ran, so a dryRun
+ * preview can state what it covered (#336; see dry-run-checks.js):
+ * `sentinel_draft` evaluated the submitted fields, `core_patch_guard` carried
+ * no fields, `none` means Drupal evaluated nothing.
+ *
  * @param {object} backend
  * @param {{entityType: string, bundle: string, id: string, existing?: ?object, attributes?: object, relationships?: object, langcode?: string}} args
- * @returns {Promise<{resourceVersion: ?string, workingCopy: ?object, liveVid: ?number|string, workingVid: ?number|string}>}
+ * @returns {Promise<{resourceVersion: ?string, workingCopy: ?object, liveVid: ?number|string, workingVid: ?number|string, preflight: string}>}
  */
 export async function prepareGuardedPatch(backend, {
   entityType, bundle, id, existing, attributes, relationships, langcode,
@@ -391,6 +404,8 @@ export async function prepareGuardedPatch(backend, {
   const target = (needsPreflight || langcode)
     ? await resolveWorkingCopyPatchTarget(backend, { entityType, bundle, id, existing })
     : { resourceVersion: undefined, workingCopy: null, liveVid: null, workingVid: null };
+  // Set only after a check has run and passed; a refusal throws first.
+  target.preflight = PREFLIGHT_NONE;
   if (needsPreflight && !target.resourceVersion) {
     // Canonical path (no distinct working copy). The id-mismatch probe never
     // reaches Sentinel's save-time stale-default check; refuse here when the
@@ -427,6 +442,7 @@ export async function prepareGuardedPatch(backend, {
     } catch (err) {
       throw rewriteStaleCopyError(err);
     }
+    target.preflight = PREFLIGHT_SENTINEL_DRAFT;
     return target;
   }
   if (target.resourceVersion) {
@@ -438,13 +454,15 @@ export async function prepareGuardedPatch(backend, {
     } catch (err) {
       throw rewriteStaleCopyError(err);
     }
+    target.preflight = PREFLIGHT_SENTINEL_DRAFT;
     return target;
   }
   try {
-    await preflightPatchWritable({
+    const probe = await preflightPatchWritable({
       backend, entityType, bundle, id, existing, attributes,
       resourceVersion: target.resourceVersion,
     });
+    if (probe.probed === true) target.preflight = PREFLIGHT_CORE_GUARD;
   } catch (err) {
     throw rewriteStaleCopyError(err);
   }

package/src/lib/policy-enforcement.js

@@ -11,11 +11,11 @@
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { SEAL_PREFIX } from "./policy-promotion.js";
 
-export const POLICY_BUNDLE_VERSION = 1;
+const POLICY_BUNDLE_VERSION = 1;
 
-export const DEFAULT_BUNDLE_TTL = 86400 * 30;
+const DEFAULT_BUNDLE_TTL = 86400 * 30;
 
-export const EMERGENCY_DENY = "*";
+const EMERGENCY_DENY = "*";
 
 export const EMERGENCY_DIGEST = "emergency-deny";
 
@@ -43,7 +43,7 @@ function normalize(value) {
  * @param {object} claims
  * @returns {string}
  */
-export function canonicalJson(claims) {
+function canonicalJson(claims) {
   return JSON.stringify(normalize(claims));
 }
 

package/src/lib/principal.js

@@ -15,6 +15,7 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 import { getDefaultSiteName, getInboundGrants } from "./config.js";
 import { inferOperation } from "./operations.js";
+import { POLICY_DIGEST } from "./policy-promotion.js";
 import { resolveSecurityConfig, SecurityError } from "./security.js";
 
 const identityStore = new AsyncLocalStorage();
@@ -23,7 +24,6 @@ const identityStore = new AsyncLocalStorage();
 export const TARGET_HINT_KEYS = Object.freeze(["site", "environment", "tenant", "target"]);
 
 const ACTOR_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const POLICY_DIGEST = /^[0-9a-f]{64}$/i;
 
 function tableHasKeys(table) {
   return Object.keys(table).some((key) => {
@@ -129,7 +129,7 @@ function grantNameList(values) {
  * @param {object|null} actors
  * @returns {object|null}
  */
-export function normalizeActors(actors) {
+function normalizeActors(actors) {
   if (!actors || typeof actors !== "object" || Array.isArray(actors)) return null;
   const entries = [];
   for (const [rawKey, value] of Object.entries(actors)) {
@@ -201,7 +201,7 @@ export function resolveActor({ identity = null, actors = null } = {}) {
  * @param {object|null} policies
  * @returns {object|null}
  */
-export function normalizePolicies(policies) {
+function normalizePolicies(policies) {
   if (!policies || typeof policies !== "object" || Array.isArray(policies)) return null;
   const entries = [];
   for (const [rawKey, value] of Object.entries(policies)) {

package/src/lib/relay/edge.js

@@ -348,7 +348,7 @@ function callerApprovalHint(args = {}) {
  * @param {unknown} raw
  * @returns {string[]|{invalid: true, reason: string}}
  */
-export function normalizeApprovalRequiredTools(raw) {
+function normalizeApprovalRequiredTools(raw) {
   if (raw === null || raw === undefined) return [];
   if (Array.isArray(raw)) {
     return [...new Set(
@@ -415,7 +415,7 @@ export class EdgeStartupError extends Error {
  * @param {Record<string, string|string[]>} [headers]
  * @returns {Record<string, string>}
  */
-export function fanDownHeaders(headers = {}) {
+function fanDownHeaders(headers = {}) {
   const entries = [];
   for (const [name, value] of Object.entries(forwardHeaders(headers))) {
     const key = String(name).toLowerCase();

package/src/lib/reports-support.js

@@ -64,6 +64,35 @@ export function fieldValue(entity, candidates) {
   return undefined;
 }
 
+/**
+ * Read a field off a canonical entity and say whether its KEY was there.
+ *
+ * JSON:API keeps the key of an empty field (value `null`, `[]`, or
+ * `data: null`) and leaves out the key of a field the account may not view.
+ * So an absent key and an empty value are different facts, and callers that
+ * count "missing" values must keep them apart (#337).
+ *
+ * Looks in `fields`, then `relationships`. Promoted base attributes (`title`,
+ * `status`, `langcode`, `created`, `changed`, and `path` as `url`) are always
+ * carried by the canonical shape, so they always read as present: a denied
+ * base attribute cannot be told from an empty one after promotion.
+ *
+ * @param {object} entity Canonical entity.
+ * @param {string} field Field machine name.
+ * @returns {{present: boolean, value: *}} `present` is about the key, not the value.
+ */
+export function fieldPresence(entity, field) {
+  const name = field === "path" ? "url" : field;
+  if (BASE_KEYS.has(name)) {
+    return { present: true, value: new Map(Object.entries(entity ?? {})).get(name) };
+  }
+  const fields = new Map(Object.entries(entity?.fields ?? {}));
+  if (fields.has(name)) return { present: true, value: fields.get(name) };
+  const relationships = new Map(Object.entries(entity?.relationships ?? {}));
+  if (relationships.has(name)) return { present: true, value: relationships.get(name) };
+  return { present: false, value: undefined };
+}
+
 /**
  * Whole days elapsed between a date and now.
  * @param {?(string|number|Date)} dateValue A date parseable by `new Date()`.
@@ -73,3 +102,49 @@ export function daysSince(dateValue) {
   if (!dateValue) return null;
   return Math.floor((Date.now() - new Date(dateValue).getTime()) / MS_PER_DAY);
 }
+
+/**
+ * Whether a canonical field or relationship value carries no content.
+ *
+ * Handles scalars, `{value}` text objects, arrays, relationship refs
+ * (`{id}` / `[{id}, …]` / `null`), and keyed objects such as a link
+ * (`{uri, title}`). A keyed object with at least one key and none of the
+ * known value keys counts as populated.
+ *
+ * @param {*} value A value read off an entity's base props, `fields`, or `relationships`.
+ * @returns {boolean} True when the value is absent or carries no content.
+ */
+export function isEmptyFieldValue(value) {
+  if (value === undefined || value === null || value === "") return true;
+  if (Array.isArray(value)) return value.every((item) => isEmptyFieldValue(item));
+  if (typeof value === "object") {
+    if ("id" in value) return !value.id;
+    if ("value" in value) return value.value === undefined || value.value === null || value.value === "";
+    if ("target_id" in value) return value.target_id === undefined || value.target_id === null;
+    if ("uri" in value) return !value.uri;
+    return Object.keys(value).length === 0;
+  }
+  return false;
+}
+
+/**
+ * Note attached to a report's `notVisible` list: requested fields whose key is
+ * absent from every sampled entity, so the report could not score them (#341).
+ */
+export const FIELDS_NOT_VISIBLE_NOTE =
+  "These fields are absent from every sampled entity (the key is missing, not empty). " +
+  "Each may be denied to this account or not exist on this bundle, or the name may be wrong. " +
+  "Drupal leaves a field the account may not view out of the response with no marker, so this report cannot tell whether any value is missing. " +
+  "They were not scored.";
+
+/**
+ * Normalize a caller's `fields` argument to distinct, non-empty field names.
+ * Arguments are not schema-validated before they reach a handler, so a single
+ * string is read as one name and non-string entries are dropped.
+ * @param {*} fields The raw `fields` argument.
+ * @returns {string[]} Field names, or [] when the caller named none.
+ */
+export function requestedFieldNames(fields) {
+  const list = typeof fields === "string" ? [fields] : (Array.isArray(fields) ? fields : []);
+  return [...new Set(list.filter((f) => typeof f === "string" && f.trim()).map((f) => f.trim()))];
+}

package/src/lib/security.js

@@ -53,6 +53,19 @@ import { parse } from "graphql";
  *
  *  globalRedactedFields string[]         stripped from every response, every type
  *
+ *  protectedModules    string[]          module machine names ADDED to the default
+ *                                        protected list (DEFAULT_PROTECTED_MODULES).
+ *                                        drupal_drush_module_disable refuses them (#346).
+ *  allowProtectedModuleUninstall string[] explicit opt-out: names REMOVED from the
+ *                                        protected list. The only way to shrink it.
+ *                                        A malformed value in either key refuses
+ *                                        every uninstall rather than being ignored.
+ *  allowCoreExtensionChange boolean      false on every preset. true lets
+ *                                        drupal_config_set write core.extension and
+ *                                        lets drupal_drush_config_import run when
+ *                                        core.extension differs (#349). Anything but
+ *                                        true or false keeps both refused.
+ *
  *  declaredCeiling     string            narrow-only X-MCP-Declared-Ceiling
  *                                        (public|internal|restricted). Invalid
  *                                        values are dropped, never widened.
@@ -244,6 +257,98 @@ const PRESETS = {
  * @param {object} site Site config (reads site.security).
  * @returns {object} Effective security config used by the assert/redact helpers.
  */
+/**
+ * Modules drupal_drush_module_disable refuses to uninstall, on every preset
+ * (#346). Uninstalling one removes a control the connector relies on, and
+ * Drupal drops the module's hook_schema tables on uninstall, so an audit log or
+ * stored keys go with it. Operators extend the list with
+ * `security.protectedModules` and shrink it only with the explicit
+ * `security.allowProtectedModuleUninstall`.
+ */
+export const DEFAULT_PROTECTED_MODULES = Object.freeze([
+  // Governance and integrity.
+  "mcp_sentinel", "audit_chain", "field_guard", "file_gate",
+  // Secrets and authentication.
+  "key", "encrypt", "simple_oauth", "consumers",
+  // The API and governed tool surface the connector talks to.
+  "jsonapi", "serialization", "mcp_server", "mcp_server_tool_bridge", "tool",
+  // The editorial gate that decides publication.
+  "content_moderation", "workflows",
+]);
+
+/** Drupal module machine name. Same rule as validateMachineName(), kept local to avoid an import cycle. */
+const MODULE_NAME_RE = /^[a-z][a-z0-9_]{0,127}$/;
+
+/**
+ * Read one module-list key from raw site security config.
+ * @param {object} raw site.security.
+ * @param {string} key Config key.
+ * @param {string[]} problems Collects a message per malformed key.
+ * @returns {string[]} The valid names (empty when the key is absent or malformed).
+ */
+function readModuleList(raw, key, problems) {
+  const value = new Map(Object.entries(raw)).get(key);
+  if (value === undefined || value === null) return [];
+  if (!Array.isArray(value)) {
+    problems.push(`security.${key} must be an array of module machine names.`);
+    return [];
+  }
+  const valid = value.filter((name) => typeof name === "string" && MODULE_NAME_RE.test(name));
+  if (valid.length !== value.length) {
+    problems.push(
+      `security.${key} has ${value.length - valid.length} entr${value.length - valid.length === 1 ? "y that is" : "ies that are"} ` +
+      "not a module machine name (lowercase letters, digits and underscores)."
+    );
+    // A malformed opt-out never removes anything; a malformed extension still adds its valid names.
+    return key === "allowProtectedModuleUninstall" ? [] : valid;
+  }
+  return valid;
+}
+
+/**
+ * Resolve the effective protected-module list for a site.
+ * @param {object} raw site.security.
+ * @returns {{modules: string[], optOuts: string[], error: ?string}} `error` is
+ *   set when either key is malformed; callers must then refuse every uninstall.
+ */
+function resolveProtectedModules(raw) {
+  const problems = [];
+  const added = readModuleList(raw, "protectedModules", problems);
+  const optOuts = readModuleList(raw, "allowProtectedModuleUninstall", problems);
+  const removed = new Set(optOuts);
+  const modules = [...new Set([...DEFAULT_PROTECTED_MODULES, ...added])].filter((name) => !removed.has(name)).sort();
+  return { modules, optOuts: [...removed].sort(), error: problems.length ? problems.join(" ") : null };
+}
+
+/** The config object that lists installed modules and themes. */
+export const CORE_EXTENSION_CONFIG = "core.extension";
+
+/**
+ * Whether a config name addresses core.extension. Surrounding space and case
+ * are ignored: a source that trims the name would otherwise be reached by a
+ * padded one.
+ * @param {*} name Config object name.
+ * @returns {boolean}
+ */
+export function isCoreExtensionConfig(name) {
+  return typeof name === "string" && name.trim().toLowerCase() === CORE_EXTENSION_CONFIG;
+}
+
+/**
+ * Resolve the explicit opt-in for changing core.extension (#349).
+ * @param {object} raw site.security.
+ * @returns {{allowed: boolean, error: ?string}} `error` is set when the value
+ *   is neither true nor false; the change then stays refused.
+ */
+function resolveCoreExtensionOptIn(raw) {
+  const value = new Map(Object.entries(raw)).get("allowCoreExtensionChange");
+  if (value === undefined || value === null) return { allowed: false, error: null };
+  if (typeof value !== "boolean") {
+    return { allowed: false, error: "security.allowCoreExtensionChange must be true or false." };
+  }
+  return { allowed: value, error: null };
+}
+
 /** Default when `security.preset` is omitted — least privilege, not open mode (#140). */
 export const DEFAULT_SECURITY_PRESET = "production-strict";
 
@@ -254,6 +359,9 @@ export function resolveSecurityConfig(site) {
   const presetName = raw.preset ?? DEFAULT_SECURITY_PRESET;
   const preset = PRESETS[presetName] ?? PRESETS[DEFAULT_SECURITY_PRESET];
 
+  const protectedModules = resolveProtectedModules(raw);
+  const coreExtension = resolveCoreExtensionOptIn(raw);
+
   // Merge: explicit keys in site.security override the preset
   return {
     readOnly:              raw.readOnly              ?? preset.readOnly,
@@ -272,6 +380,13 @@ export function resolveSecurityConfig(site) {
     ],
     declaredCeiling:       raw.declaredCeiling ?? preset.declaredCeiling,
     readBudgets:           raw.readBudgets ?? preset.readBudgets ?? null,
+    // Not a preset value: the default list applies on every preset (#346).
+    protectedModules:        protectedModules.modules,
+    protectedModuleOptOuts:  protectedModules.optOuts,
+    protectedModulesError:   protectedModules.error,
+    // Not a preset value either: strict on every preset (#349).
+    allowCoreExtensionChange: coreExtension.allowed,
+    coreExtensionChangeError: coreExtension.error,
   };
 }
 
@@ -387,7 +502,7 @@ export function hasScope(site, scope) {
  * @param {object} site Resolved site config.
  * @returns {boolean}
  */
-export function isGovernedSetup(site) {
+function isGovernedSetup(site) {
   return site?.requireGovernance === true || Boolean(site?.oauth);
 }
 
@@ -430,6 +545,119 @@ export function assertDestructiveAllowed(secConfig, entityType, id) {
   }
 }
 
+/**
+ * Gate a module uninstall (drupal_drush_module_disable) against the site's
+ * protected-module list (#346). Fails closed: a security config that is
+ * malformed, or that never went through resolveSecurityConfig(), refuses every
+ * uninstall.
+ * @param {object} secConfig Resolved security config.
+ * @param {string} moduleName Module machine name, already validated.
+ * @returns {void}
+ * @throws {SecurityError} if the module is protected or the list cannot be trusted.
+ */
+export function assertModuleUninstallAllowed(secConfig, moduleName) {
+  if (secConfig?.protectedModulesError || !Array.isArray(secConfig?.protectedModules)) {
+    throw new SecurityError(
+      "Module uninstall is blocked because this site's protected-module config cannot be read. " +
+      `${secConfig?.protectedModulesError ?? "The protected-module list is missing."} ` +
+      "No module can be uninstalled through the connector until an operator fixes it."
+    );
+  }
+  if (secConfig.protectedModules.includes(moduleName)) {
+    throw new SecurityError(
+      `Module "${moduleName}" is protected and cannot be uninstalled through the connector. ` +
+      "Uninstalling it removes a control the connector relies on, and Drupal drops the module's tables on uninstall. " +
+      `To allow it, an operator must add "${moduleName}" to security.allowProtectedModuleUninstall for this site.`
+    );
+  }
+}
+
+/**
+ * Gate a change to core.extension (#349). The object lists installed modules
+ * and themes, so a write to it, or a config import that changes it, can
+ * uninstall a protected module without going through
+ * assertModuleUninstallAllowed(). Refused on every preset unless the operator
+ * set `security.allowCoreExtensionChange: true`. Fails closed: a malformed
+ * value, or a config that never went through resolveSecurityConfig(), refuses.
+ * @param {object} secConfig Resolved security config.
+ * @param {string} refusal What is being refused and why, as full sentences.
+ * @returns {void}
+ * @throws {SecurityError} unless the operator opted in.
+ */
+export function assertCoreExtensionChangeAllowed(secConfig, refusal) {
+  if (secConfig?.allowCoreExtensionChange === true && !secConfig.coreExtensionChangeError) return;
+  throw new SecurityError(
+    `${refusal} ` +
+    "To install or uninstall a module use drupal_drush_module_enable or drupal_drush_module_disable, " +
+    "which check the protected-module list. " +
+    (secConfig?.coreExtensionChangeError
+      ? `This site's opt-in cannot be read: ${secConfig.coreExtensionChangeError} It stays refused until an operator fixes it.`
+      : "To allow it, an operator must set security.allowCoreExtensionChange = true for this site.")
+  );
+}
+
+/**
+ * Check a drupal_config_set value for core.extension against the protected
+ * module list (#349). Runs only after assertCoreExtensionChangeAllowed().
+ *
+ * The value is a map of top-level keys, and the source also accepts a dotted
+ * key such as `module.devel`. A `module` key replaces the whole module map, so
+ * every protected module in `currentModules` must still be in it. A dotted key
+ * under `module.` that names a protected module is refused outright.
+ *
+ * @param {object} secConfig Resolved security config.
+ * @param {object} value The submitted map of config keys to values.
+ * @param {?string[]} currentModules Machine names installed now, or null when
+ *   the caller has not read them. Needed only when `value` has a `module` key.
+ * @returns {{needsCurrentModules: boolean}} `needsCurrentModules` is true when
+ *   the value replaces the module map and `currentModules` was not given; the
+ *   caller reads the list and calls again.
+ * @throws {SecurityError} if the write would remove or alter a protected
+ *   module, or the protected-module list cannot be trusted.
+ */
+export function assertCoreExtensionValueKeepsProtected(secConfig, value, currentModules = null) {
+  if (secConfig?.protectedModulesError || !Array.isArray(secConfig?.protectedModules)) {
+    throw new SecurityError(
+      "The write to core.extension is blocked because this site's protected-module config cannot be read. " +
+      `${secConfig?.protectedModulesError ?? "The protected-module list is missing."}`
+    );
+  }
+  const entries = value && typeof value === "object" && !Array.isArray(value) ? Object.entries(value) : [];
+  const protectedSet = new Set(secConfig.protectedModules);
+
+  const dotted = entries
+    .map(([key]) => /^module\.([^.]+)/.exec(key)?.[1])
+    .filter((name) => name !== undefined && protectedSet.has(name));
+  if (dotted.length) {
+    throw new SecurityError(
+      `The write to core.extension changes the entry of protected module${dotted.length === 1 ? "" : "s"} ` +
+      `${[...new Set(dotted)].sort().join(", ")}. Nothing was written. ` +
+      "To allow it, an operator must name the module in security.allowProtectedModuleUninstall for this site."
+    );
+  }
+
+  const moduleEntry = entries.find(([key]) => key === "module");
+  if (!moduleEntry) return { needsCurrentModules: false };
+  const next = moduleEntry[1];
+  if (!next || typeof next !== "object" || Array.isArray(next)) {
+    throw new SecurityError(
+      "The write to core.extension is refused: `module` must be a map of module machine names to weights. Nothing was written."
+    );
+  }
+  if (!Array.isArray(currentModules)) return { needsCurrentModules: true };
+
+  const kept = new Set(Object.keys(next));
+  const removed = currentModules.filter((name) => protectedSet.has(name) && !kept.has(name)).sort();
+  if (removed.length) {
+    throw new SecurityError(
+      `The write to core.extension would remove protected module${removed.length === 1 ? "" : "s"} ${removed.join(", ")}. ` +
+      "Nothing was written. " +
+      "To allow it, an operator must name the module in security.allowProtectedModuleUninstall for this site."
+    );
+  }
+  return { needsCurrentModules: false };
+}
+
 /**
  * Whether a set of write attributes carries a publish action.
  *
@@ -723,23 +951,6 @@ export function redactCanonicalEntity(entity, secConfig, entityType) {
   return { ...entity, fields: redactedFields, ...baseOverrides };
 }
 
-/**
- * Redact a full JSON:API response by redacting each item under `.data`.
- * @param {?object} response JSON:API response with a `data` object or array.
- * @param {object} secConfig Resolved security config.
- * @param {string} entityType Entity type for the response data.
- * @returns {?object} New response; original is not mutated.
- */
-export function redactResponse(response, secConfig, entityType) {
-  if (!response?.data) return response;
-  return {
-    ...response,
-    data: Array.isArray(response.data)
-      ? response.data.map((r) => redactResource(r, secConfig, entityType))
-      : redactResource(response.data, secConfig, entityType),
-  };
-}
-
 // ---------------------------------------------------------------------------
 // Security summary tool (exposed as drupal_security_info)
 // ---------------------------------------------------------------------------
@@ -768,5 +979,10 @@ export function getSecuritySummary(site) {
     entityRules:           cfg.entityRules,
     globalRedactedFields:  cfg.globalRedactedFields,
     declaredCeiling:       cfg.declaredCeiling ?? null,
+    protectedModules:      cfg.protectedModules,
+    protectedModuleOptOuts: cfg.protectedModuleOptOuts,
+    ...(cfg.protectedModulesError ? { protectedModulesError: cfg.protectedModulesError } : {}),
+    allowCoreExtensionChange: cfg.allowCoreExtensionChange,
+    ...(cfg.coreExtensionChangeError ? { coreExtensionChangeError: cfg.coreExtensionChangeError } : {}),
   };
 }

package/src/lib/sentinel-draft.js

@@ -9,6 +9,7 @@
  */
 
 import { entityRevisionId } from "./write-revision.js";
+import { httpStatusOf } from "./error-status.js";
 
 const LANGCODE_RE = /^[a-z][a-z0-9_-]{0,11}$/;
 const MISSING_DRAFT_ENDPOINT =
@@ -19,7 +20,6 @@ const MISSING_TRANSLATION_ENDPOINT =
   "Update MCP Sentinel; no canonical langcode PATCH was attempted.";
 const MISSING_DRAFT_RE = /does not provide Sentinel's governed draft endpoint/;
 const MISSING_TRANSLATION_RE = /does not provide Sentinel's governed draft-translation endpoint/;
-const DRUPAL_ABSENCE_RE = /Drupal (404|405)\b/;
 
 /**
  * Whether a backend can issue Sentinel's JSON:API draft/translation routes.
@@ -70,7 +70,8 @@ export function isMissingTranslationEndpoint(error) {
  * @returns {Error}
  */
 function missingEndpointError(error, message) {
-  if (DRUPAL_ABSENCE_RE.test(String(error?.message))) {
+  const status = httpStatusOf(error);
+  if (status === 404 || status === 405) {
     return new Error(message, { cause: error });
   }
   return error instanceof Error ? error : new Error(String(error));