drupal-mcp-connector 2.6.0 → 2.7.0

package/src/tools/config.js

@@ -12,6 +12,7 @@
  */
 
 import { getSiteConfig } from "../lib/config.js";
+import { describeTarget, getRequestIdentity } from "../lib/principal.js";
 import {
   resolveSecurityConfig,
   getSecuritySummary,
@@ -117,8 +118,13 @@ async function whoami({ site: siteName }) {
   // When no OAuth scopes are configured, hasScope() is a no-op (preset-only).
   const canWrite  = !sec.readOnly && hasScope(site, "mcp_write");
   const canConfig = hasScope(site, "mcp_config");
+  const identity = getRequestIdentity();
   return {
     site: site._name,
+    target: describeTarget(site, siteName ? "hint" : "default"),
+    principal: identity
+      ? { sub: identity.sub, clientId: identity.clientId, scopes: [...(identity.scopes ?? [])] }
+      : null,
     tier: inferTier(site, sec),
     preset: summary.preset,
     scopes: site.oauth?.scopes ?? [],

package/src/tools/site.js

@@ -9,6 +9,7 @@
 import { getSiteConfig, listSiteNames } from "../lib/config.js";
 import { governanceStatus } from "../lib/governance.js";
 import { resolveBackend } from "../lib/backends/index.js";
+import { getRequestIdentity, resolveGrantedSiteNames, visibleSiteTargets } from "../lib/principal.js";
 
 // ---------------------------------------------------------------------------
 // Implementations
@@ -43,11 +44,21 @@ async function listContentTypes({ site: siteName }) {
 }
 
 /**
- * List all named sites from config.json. No backend call and no credentials.
- * @returns {Promise<{sites: string[]}>}
+ * List named sites this principal may address. No backend call and no credentials.
+ * `sites` stays a name list for compatibility; `targets` is the authoritative
+ * resolved-target record.
+ * @returns {Promise<{sites: string[], targets: Array<object>}>}
  */
 async function listConfiguredSites() {
-  return { sites: listSiteNames() };
+  const names = listSiteNames();
+  const resolvable = names.flatMap((name) => {
+    try {
+      return [getSiteConfig(name)];
+    } catch {
+      return [];
+    }
+  });
+  return visibleSiteTargets(getRequestIdentity(), resolvable, names);
 }
 
 /**
@@ -58,9 +69,41 @@ async function listConfiguredSites() {
  * @param {object} args - { site? } (a named site narrows the report).
  * @returns {Promise<{sites: object[]}>} required/ok/reason per site.
  */
+/**
+ * Classify a getSiteConfig failure so the diagnostic reason matches the cause.
+ * @param {string} message
+ * @returns {string}
+ */
+export function classifySiteResolutionFailure(message) {
+  if (message.includes("Unknown site:")) return "unknown_site";
+  if (message.includes("baseUrl is not HTTPS")) return "insecure_base_url";
+  if (message.includes("is not set in the environment")) return "credential_unresolved";
+  return "site_unresolved";
+}
+
 async function getGovernanceStatus({ site: siteName } = {}) {
-  const names = siteName ? [siteName] : listSiteNames();
-  return { sites: await governanceStatus(names.map((n) => getSiteConfig(n))) };
+  const identity = getRequestIdentity();
+  const configured = listSiteNames();
+  const allowed = identity ? resolveGrantedSiteNames(identity, configured) : configured;
+  const names = siteName ? [siteName] : allowed;
+  const resolved = [];
+  const unresolved = [];
+  for (const name of names) {
+    try {
+      resolved.push(getSiteConfig(name));
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : "site could not be resolved";
+      unresolved.push({
+        site: name,
+        required: null,
+        ok: false,
+        reason: classifySiteResolutionFailure(detail),
+        detail,
+        checkedAt: null,
+      });
+    }
+  }
+  return { sites: [...unresolved, ...(await governanceStatus(resolved))] };
 }
 
 // ---------------------------------------------------------------------------
@@ -94,7 +137,7 @@ export const definitions = [
   },
   {
     name: "drupal_list_sites",
-    description: "List all named Drupal sites configured in config.json. Useful for multi-site setups.",
+    description: "List the Drupal sites this principal may address. Each target includes the authoritative site name and base URL.",
     inputSchema: {
       type: "object",
       properties: {},
@@ -102,6 +145,8 @@ export const definitions = [
   },
 ];
 
+export { getGovernanceStatus };
+
 export const handlers = {
   drupal_site_info:          getSiteInfo,
   drupal_list_content_types: listContentTypes,