secufusion-mcp 1.0.21 → 1.0.23

package/.secufusion-project-spec.json

@@ -4,7 +4,6 @@
     "generated_from": "codebase analysis",
     "workspace_root": "c:\\Users\\Yash\\Desktop\\secufi_full"
   },
-
   "project": {
     "name": "SecuFusion",
     "devops_org": "secufusion",
@@ -13,14 +12,21 @@
     "branch_naming_convention": "Mixed, not strictly enforced. Common patterns: feature/<kebab-description>, fix/<desc> or bugfix/<ticket-or-desc>, ticket-only (TASK-####, TASK-####-<desc>, BUG-####-<desc>), release-<major>.<minor>.<patch> (dash, not slash) for release branches. Trunk branches are 'main' and 'develop' in every repo, but which one is checked out as the working default varies per repo (sfn-events-api and sfn-web-ui default to develop; snf-browser-extn defaults to main). Many ad hoc/free-text branch names also exist.",
     "commit_message_pattern": "No single enforced convention. Recurring mixture: (1) Azure Repos auto-generated 'Merged PR <number>: <title>' on PR completion (dominant pattern in all 3 sampled repos), (2) ticket-prefixed 'TASK-<number>: <desc>' or 'TASK-<number>-<desc>' (common in sfn-events-api), (3) conventional-commit style 'feat(<scope>): ...' / 'fix(<scope>): ...' (used consistently within recent 'ai-ops' feature work in sfn-web-ui, not elsewhere), (4) plain imperative descriptive messages with no prefix at all. Work items referenced via https://dev.azure.com/secufusion/SFCloud-MSSP/_workitems/edit/<id>."
   },
-
   "microservices": {
     "sfn-auth-api": {
       "artifact_id": "sfn-auth-api",
       "port": "CONFLICT: 8081 (hardcoded literal in application.properties, confirmed by direct read) vs 8087 (AUTH_SERVICE_PORT in shared deployment env config supplied by user) — the repo's server.port is NOT wired to ${AUTH_SERVICE_PORT}, so 8087 appears unused by this service as currently checked out; flagged for manual verification",
       "eureka_name": "AUTH-SERVICE",
       "domain": "Legacy/parallel auth & tenant-config resolution (login, tenant-config lookup by host). Heavy functional overlap with sfn-iam-api's AuthController (see manual_review_flags) — possibly superseded/duplicate.",
-      "owns_tables": ["Address", "auth_provider_config", "groups", "roles", "scopes", "Tenant", "Users"],
+      "owns_tables": [
+        "Address",
+        "auth_provider_config",
+        "groups",
+        "roles",
+        "scopes",
+        "Tenant",
+        "Users"
+      ],
       "exposes_endpoints": [
         "GET /tenant-config/v1 -> AuthController.getTenantConfig() [host param, referer-validated]",
         "GET /tenant-config -> AuthController.getTenantConfig() [host param, unvalidated overload]",
@@ -37,7 +43,6 @@
       "spring_boot_version": "3.4.12",
       "java_version": "17"
     },
-
     "sfn-eureka-api": {
       "artifact_id": "sfn-eureka-api",
       "port": 8761,
@@ -56,13 +61,64 @@
       "spring_boot_version": "3.2.4",
       "java_version": "17"
     },
-
     "sfn-events-api": {
       "artifact_id": "sfn-events-api",
       "port": 8086,
       "eureka_name": "EVENTS-SERVICE",
       "domain": "Security event ingestion, incident management, device/extension inventory, AI-on-endpoints governance, notifications. Largest/most active service (22 controllers).",
-      "owns_tables": ["devices", "device_user", "device_credential", "events", "event_inbox", "extension_events", "extension_api_keys", "extension_approval_request", "extension_policy", "installed_extensions", "events_group", "incidents", "incident_activities", "incident_assignees", "incident_events", "incident_playbooks", "incident_playbook_steps", "playbook_templates", "escalation_rules", "machine", "groups", "notifications", "notification_preferences", "smtp_config", "policy_assignments", "tenant_api_mappings", "tenant_extension_client", "tenant_extension_first_seen", "ai_policy", "ai_device_scan", "ai_host_instance", "ai_mcp_server_instance", "ai_local_model", "ai_instruction_file", "ai_extensibility_item", "ai_versioned_record", "browserpolicy", "networkpolicy", "Users", "roles", "auth_provider_config", "Tenant", "api_flags", "downloadable_files", "extension_registry", "extension_version", "extension_risk_components", "permission_risk_classification", "api_key_configuration", "scopes", "tenant_types"],
+      "owns_tables": [
+        "devices",
+        "device_user",
+        "device_credential",
+        "events",
+        "event_inbox",
+        "extension_events",
+        "extension_api_keys",
+        "extension_approval_request",
+        "extension_policy",
+        "installed_extensions",
+        "events_group",
+        "incidents",
+        "incident_activities",
+        "incident_assignees",
+        "incident_events",
+        "incident_playbooks",
+        "incident_playbook_steps",
+        "playbook_templates",
+        "escalation_rules",
+        "machine",
+        "groups",
+        "notifications",
+        "notification_preferences",
+        "smtp_config",
+        "policy_assignments",
+        "tenant_api_mappings",
+        "tenant_extension_client",
+        "tenant_extension_first_seen",
+        "ai_policy",
+        "ai_device_scan",
+        "ai_host_instance",
+        "ai_mcp_server_instance",
+        "ai_local_model",
+        "ai_instruction_file",
+        "ai_extensibility_item",
+        "ai_versioned_record",
+        "browserpolicy",
+        "networkpolicy",
+        "Users",
+        "roles",
+        "auth_provider_config",
+        "Tenant",
+        "api_flags",
+        "downloadable_files",
+        "extension_registry",
+        "extension_version",
+        "extension_risk_components",
+        "permission_risk_classification",
+        "api_key_configuration",
+        "scopes",
+        "tenant_types"
+      ],
       "exposes_endpoints": [
         "GET /api/events/reports/ai-usage/summary -> AiUsageReportController.summary()",
         "GET /api/events/reports/ai-usage/by-platform -> AiUsageReportController.byPlatform()",
@@ -246,8 +302,16 @@
         "GET /api/events/ai/tool-bundle -> AiToolBundleController.bundle()"
       ],
       "calls_services": [],
-      "kafka_produces": ["quickstart-events", "device-deleted", "extension-approval-decided"],
-      "kafka_consumes": ["device-registration", "quickstart-events", "extension-policy-changed"],
+      "kafka_produces": [
+        "quickstart-events",
+        "device-deleted",
+        "extension-approval-decided"
+      ],
+      "kafka_consumes": [
+        "device-registration",
+        "quickstart-events",
+        "extension-policy-changed"
+      ],
       "keycloak_realm": "not_found (no static realm; per-tenant issuer resolved dynamically from DB via DbJwtAuthenticationManagerResolver)",
       "keycloak_client_id": "not_found (tenant.client-id/tenant.client-secret env-driven properties exist)",
       "flyway_next_version": "V38 (highest found: V37__endpoint_ai_inventory.sql; sequential V1-V37, no gaps). NOTE: no Flyway Maven dependency in pom.xml despite this migrations directory existing — flagged inconsistency.",
@@ -256,7 +320,6 @@
       "spring_boot_version": "3.4.12",
       "java_version": "17"
     },
-
     "sfn-gateway-api": {
       "artifact_id": "api-gateway (project name: sfn-gateway-api)",
       "port": 8083,
@@ -274,7 +337,12 @@
         "ROUTE /openapi/events -> EVENTS_SERVICE_URI (SetPath /v3/api-docs)",
         "ROUTE /openapi/policy -> POLICY_SERVICE_URI (SetPath /v3/api-docs)"
       ],
-      "calls_services": ["IAM-SERVICE", "TENANT-SERVICE", "EVENTS-SERVICE", "POLICY-SERVICE"],
+      "calls_services": [
+        "IAM-SERVICE",
+        "TENANT-SERVICE",
+        "EVENTS-SERVICE",
+        "POLICY-SERVICE"
+      ],
       "kafka_produces": [],
       "kafka_consumes": [],
       "keycloak_realm": "not_found",
@@ -285,13 +353,54 @@
       "spring_boot_version": "3.2.4",
       "java_version": "17"
     },
-
     "sfn-iam-api": {
       "artifact_id": "IAM (project name: sfn-iam-api)",
       "port": 8084,
       "eureka_name": "IAM-SERVICE",
       "domain": "Identity & access management: users, groups, roles, scopes, features/packages/subscriptions, SSO configuration, Azure AD group sync, login/device audit. Richest tenant-isolation implementation (TenantAccessInterceptor + ParentChainAuthorizer). Heavy table/endpoint overlap with sfn-auth-api (see manual_review_flags).",
-      "owns_tables": ["access_level", "addon_pricing", "Address", "api_flags", "audit_log", "auth_provider_config", "billing_cycle", "browserpolicy", "cities", "country", "device_user", "events", "events_group", "events_group_history", "extension_policy", "features", "feature_group", "feature_types", "groups", "industry", "login_audit_event", "networkpolicy", "package", "package_feature_mapping", "package_pricing", "package_type", "policy_assignments", "region", "retention_period", "roles", "scopes", "sso_configurations", "sso_provider_url_config", "states", "Tenant", "tenant_addon_feature", "tenant_api_mappings", "tenant_subscription", "tenant_types", "Users", "user_device_login"],
+      "owns_tables": [
+        "access_level",
+        "addon_pricing",
+        "Address",
+        "api_flags",
+        "audit_log",
+        "auth_provider_config",
+        "billing_cycle",
+        "browserpolicy",
+        "cities",
+        "country",
+        "device_user",
+        "events",
+        "events_group",
+        "events_group_history",
+        "extension_policy",
+        "features",
+        "feature_group",
+        "feature_types",
+        "groups",
+        "industry",
+        "login_audit_event",
+        "networkpolicy",
+        "package",
+        "package_feature_mapping",
+        "package_pricing",
+        "package_type",
+        "policy_assignments",
+        "region",
+        "retention_period",
+        "roles",
+        "scopes",
+        "sso_configurations",
+        "sso_provider_url_config",
+        "states",
+        "Tenant",
+        "tenant_addon_feature",
+        "tenant_api_mappings",
+        "tenant_subscription",
+        "tenant_types",
+        "Users",
+        "user_device_login"
+      ],
       "exposes_endpoints": [
         "GET /access-levels -> AccessLevelController.getAll()",
         "GET /access-levels/active -> AccessLevelController.getActive()",
@@ -476,8 +585,12 @@
         "POST /users/tenants/{tenantId}/users/{userId}/resend-verification -> UserController.resendVerification()"
       ],
       "calls_services": [],
-      "kafka_produces": ["device-registration"],
-      "kafka_consumes": ["device-deleted"],
+      "kafka_produces": [
+        "device-registration"
+      ],
+      "kafka_consumes": [
+        "device-deleted"
+      ],
       "keycloak_realm": "not_found (no static realm; per-tenant DB-driven JwtDecoder resolution via DbJwtAuthenticationManagerResolver; admin-client realm=${KC_ADMIN_REALM})",
       "keycloak_client_id": "not_found (env-driven ${KC_ADMIN_CLIENT_ID}); Keycloak Admin REST client + Microsoft Graph SDK used for Azure AD group sync",
       "flyway_next_version": "V56 (highest found: V55__seed_ai_policy_scopes.sql; non-contiguous range, V41-V47 and V52 missing). NOTE: no Flyway Maven dependency declared despite this migrations directory — flagged inconsistency.",
@@ -486,13 +599,54 @@
       "spring_boot_version": "3.4.12",
       "java_version": "17"
     },
-
     "sfn-policy-api": {
       "artifact_id": "sfn-policy-api",
       "port": 8089,
       "eureka_name": "POLICY-SERVICE",
       "domain": "Browser/network/extension/AI policy CRUD and effective-policy resolution for the browser extension; rules-engine bundle publishing. Heavy table/endpoint/Kafka-topic overlap with sfn-tenants-api (see manual_review_flags) — near-duplicate policy domain.",
-      "owns_tables": ["Address", "api_flags", "audit_log", "auth_provider_config", "billing_cycle", "devices", "events", "browserpolicy", "compliancerules", "device_user", "dlp", "events_groups", "events_groups_device_user_map", "extension_api_keys", "extension_detail", "extension_policy", "groups", "homepage", "idp_provider_default_hostname", "landingpage", "managed_extensions", "networkconfiguration", "networkpolicy", "package_pricing", "package_type", "policy_assignments", "roles", "rules_engine_bundle", "scopes", "shortcut", "smtp_config", "subscription_history", "package", "Tenant", "tenant_api_mappings", "tenant_subscription", "tenant_types", "urlfilter", "Users", "watermarking", "webhook_configs"],
+      "owns_tables": [
+        "Address",
+        "api_flags",
+        "audit_log",
+        "auth_provider_config",
+        "billing_cycle",
+        "devices",
+        "events",
+        "browserpolicy",
+        "compliancerules",
+        "device_user",
+        "dlp",
+        "events_groups",
+        "events_groups_device_user_map",
+        "extension_api_keys",
+        "extension_detail",
+        "extension_policy",
+        "groups",
+        "homepage",
+        "idp_provider_default_hostname",
+        "landingpage",
+        "managed_extensions",
+        "networkconfiguration",
+        "networkpolicy",
+        "package_pricing",
+        "package_type",
+        "policy_assignments",
+        "roles",
+        "rules_engine_bundle",
+        "scopes",
+        "shortcut",
+        "smtp_config",
+        "subscription_history",
+        "package",
+        "Tenant",
+        "tenant_api_mappings",
+        "tenant_subscription",
+        "tenant_types",
+        "urlfilter",
+        "Users",
+        "watermarking",
+        "webhook_configs"
+      ],
       "exposes_endpoints": [
         "POST /browser-policy -> BrowserPolicyController.createPolicy()",
         "GET /browser-policy/{id} -> BrowserPolicyController.getPolicy()",
@@ -543,8 +697,13 @@
         "GET /.well-known/sfbrowser-bootstrap-jwks -> SfBrowserBootstrapJwksController.jwks() [public]"
       ],
       "calls_services": [],
-      "kafka_produces": ["policy-events", "extension-policy-changed"],
-      "kafka_consumes": ["extension-approval-decided"],
+      "kafka_produces": [
+        "policy-events",
+        "extension-policy-changed"
+      ],
+      "kafka_consumes": [
+        "extension-approval-decided"
+      ],
       "keycloak_realm": "not_found (no static realm; per-tenant DB-driven JwtDecoder resolution)",
       "keycloak_client_id": "not_found (env-driven ${KC_ADMIN_CLIENT_ID}); sfbrowser.bootstrap.expected-azp=sfbrowser-bootstrap for the SfBrowser network-config bootstrap flow",
       "flyway_next_version": "not_found (no db/migration directory and no Flyway dependency in this repo — shares the Postgres schema managed/migrated elsewhere, likely sfn-tenants-api)",
@@ -553,13 +712,57 @@
       "spring_boot_version": "3.4.12",
       "java_version": "17"
     },
-
     "sfn-tenants-api": {
       "artifact_id": "sfn-tenants-api",
       "port": "CONFLICT: 9001 (local dev default found in local/.env.local.example within the repo) vs 8085 (TENANT_SERVICE_PORT in shared deployment env config supplied by user) — likely a per-developer local override vs. the shared dev-environment value; flagged for manual verification",
       "eureka_name": "TENANT-SERVICE",
       "domain": "Owns the canonical Tenant entity and lifecycle/onboarding (incl. per-tenant Keycloak realm provisioning), sessions/auth, dashboards, webhooks, SMTP config, subscriptions, plus a second copy of the browser/network/extension/AI policy domain (see manual_review_flags for overlap with sfn-policy-api).",
-      "owns_tables": ["Tenant", "Users", "auth_provider_config", "ai_policy", "audit_log", "events", "device_user", "devices", "browserpolicy", "events_group", "groups", "extension_api_keys", "login_audit_event", "extension_policy", "notifications", "landingpage", "notification_preferences", "networkpolicy", "policy_assignments", "roles", "rules_engine_bundle", "smtp_config", "tenant_api_mappings", "tenant_subscription", "subscription_history", "webhook_configs", "webhook_delivery_logs", "Address", "api_flags", "billing_cycle", "country", "cities", "states", "region", "compliancerules", "extension_detail", "managed_extensions", "package_pricing", "package_type", "package", "scopes", "TenantTypes", "idp_provider_default_hostname", "events_groups_device_user_map"],
+      "owns_tables": [
+        "Tenant",
+        "Users",
+        "auth_provider_config",
+        "ai_policy",
+        "audit_log",
+        "events",
+        "device_user",
+        "devices",
+        "browserpolicy",
+        "events_group",
+        "groups",
+        "extension_api_keys",
+        "login_audit_event",
+        "extension_policy",
+        "notifications",
+        "landingpage",
+        "notification_preferences",
+        "networkpolicy",
+        "policy_assignments",
+        "roles",
+        "rules_engine_bundle",
+        "smtp_config",
+        "tenant_api_mappings",
+        "tenant_subscription",
+        "subscription_history",
+        "webhook_configs",
+        "webhook_delivery_logs",
+        "Address",
+        "api_flags",
+        "billing_cycle",
+        "country",
+        "cities",
+        "states",
+        "region",
+        "compliancerules",
+        "extension_detail",
+        "managed_extensions",
+        "package_pricing",
+        "package_type",
+        "package",
+        "scopes",
+        "TenantTypes",
+        "idp_provider_default_hostname",
+        "events_groups_device_user_map"
+      ],
       "exposes_endpoints": [
         "POST /api/tenants -> TenantController.createTenant()",
         "GET /api/tenants/{id}/provisioning-status -> TenantController.getProvisioningStatus()",
@@ -664,8 +867,13 @@
         "PUT /api/tenants/notifications/preferences -> NotificationController.updatePreferences()"
       ],
       "calls_services": [],
-      "kafka_produces": ["policy-events", "extension-policy-changed"],
-      "kafka_consumes": ["extension-approval-decided"],
+      "kafka_produces": [
+        "policy-events",
+        "extension-policy-changed"
+      ],
+      "kafka_consumes": [
+        "extension-approval-decided"
+      ],
       "keycloak_realm": "not_found (no static realm; owns the realm-provisioning logic itself — creates a new Keycloak realm per tenant onboarding, stored in Tenant.realmName)",
       "keycloak_client_id": "not_found (env-driven ${KC_ADMIN_CLIENT_ID}); sfbrowser.bootstrap.master-realm-issuer for SfBrowser bootstrap service-account flow",
       "flyway_next_version": "V64 (highest found: V63__tenant_principal_gate.sql; full V1-V35 then gap, V41-V63 present, V36-V40 missing). NOTE: no Flyway Maven dependency declared despite this migrations directory — flagged inconsistency (consistent with the same pattern in sfn-iam-api and sfn-events-api).",
@@ -675,7 +883,6 @@
       "java_version": "17"
     }
   },
-
   "infrastructure": {
     "source_note": "Ports/hosts/credentials in this section were confirmed via a shared deployment .env supplied directly by the user in-conversation (not discovered by the repo file scan itself). Repo-scan-only findings from earlier phases are preserved alongside as cross-checks where they differ.",
     "eureka": {
@@ -686,7 +893,10 @@
       "prefer_ip_address": true,
       "instance_ip_address": "127.0.0.1"
     },
-    "gateway": { "port": 8083, "service_name": "API-GATEWAY-SERVICE" },
+    "gateway": {
+      "port": 8083,
+      "service_name": "API-GATEWAY-SERVICE"
+    },
     "keycloak": {
       "admin_server_url": "https://auth.motivitylabs.net",
       "admin_realm": "master",
@@ -732,7 +942,11 @@
       "password": "Cgg8Q~QubDEAPlIqDn8s2azy126H0~oQ-IH-CbWb",
       "from_address": "donotreply@motivitylabs.net"
     },
-    "mailhog": { "smtp_port": 0, "ui_port": 0, "note": "not used by this platform — see infrastructure.smtp instead" },
+    "mailhog": {
+      "smtp_port": 0,
+      "ui_port": 0,
+      "note": "not used by this platform — see infrastructure.smtp instead"
+    },
     "docker_network": "not_found (no docker-compose.yml exists anywhere in the workspace; services run individually against externally-hosted shared infra — remote Postgres, remote Kafka broker, hosted Keycloak, Azure Communication Services SMTP)",
     "context_paths": {
       "server_root": "/",
@@ -748,7 +962,6 @@
       "note": "Defined in the shared deployment env config (PRODUCT_SERVICE_NAME/PRODUCT_SERVICE_PORT/PRODUCT_SERVICE_URI) but NO corresponding repository exists anywhere in this 18-repo workspace, and no route to it was found in sfn-gateway-api's application.properties. See manual_review_flags."
     }
   },
-
   "frontend": {
     "repo": "sfn-web-ui",
     "dev_port": 5173,
@@ -759,7 +972,6 @@
     "auth_token_attachment": "axios request interceptor: tries dynamicKeycloakService.getToken() (silent refresh) first, falls back to Redux auth.token, sets Authorization: Bearer <token>. Matching response interceptor handles 401 via Keycloak refresh or POST /api/tenants/auth/token/refresh, with a failed-request queue to avoid parallel refresh storms.",
     "tenant_id_in_requests": "Hybrid: normally tenantId is embedded as a URL path segment (derived from Redux auth.user.tenantId) per service's own routing convention. For MSSP 'acting tenant' impersonation, the same axios interceptor adds an X-Acting-Tenant header (for tenant-agnostic-path APIs) AND rewrites /api/tenants/... URL path segments to swap in the acting tenant's UUID (implemented in src/services/tenantImpersonation.js)."
   },
-
   "chrome_extension": {
     "repo": "snf-browser-extn",
     "manifest_version": 3,
@@ -767,7 +979,6 @@
     "env_switch_mechanism": "chrome.storage.managed (populated via Windows registry/GPO/MDM per storage.managed_schema pointing at schema.json), read into chrome.storage.local. appEnv value ('DEV'|'UAT'|'TR'|'PROD'|'LOCAL') looked up against a hardcoded ENV_DOMAINS map in background.js (DEV->motivitylabs.net, UAT->agenticworkspace.ai, TR->motivitylabs.ai, PROD->secufusion.com; LOCAL routes to http://localhost:9000), combined with a per-tenant tenantHost managed-storage value to build the API base URL.",
     "registry_key_path": "not_found in this repo's extension JS (background.js comments confirm registry reads for Safe Browsing detection, e.g. HKLM\\SOFTWARE\\Policies\\Google\\Chrome\\SafeBrowsingProtectionLevel, are handled by the separate native Windows agent (Go), not the extension; the actual registry key that seeds chrome.storage.managed is written by the MSI installer's Product.wxs, which is outside this repo's scanned scope)"
   },
-
   "auth_flow": {
     "type": "OAuth2/OIDC via Keycloak, multi-tenant (one Keycloak realm provisioned per tenant by sfn-tenants-api at onboarding)",
     "token_type": "JWT (Bearer)",
@@ -798,7 +1009,6 @@
       "mismatch_validation": true
     }
   },
-
   "coding_patterns": {
     "transactional_placement": "Method level only (never class level). @Transactional(readOnly = true) on read methods, plain @Transactional on write methods. Bulk-operation methods catch Exception per-item internally to accumulate a partial-failure result rather than aborting the whole batch.",
     "exception_handling": "Custom unchecked exceptions (e.g. ResourceNotFoundException, ResourceConflictException) thrown from services, translated centrally by a @ControllerAdvice GlobalExceptionHandler into a flat JSON error body. Controllers additionally often wrap logic in try/catch to log with tenant/id context before rethrowing, which is somewhat redundant with the global handler.",
@@ -811,9 +1021,9 @@
     "test_naming_convention": "Not fully uniform. Predominantly camelCase descriptive sentence-style method names (e.g. refreshReplacesStaleSecretOnExistingRowAndPrimesCache); some newer test classes instead use snake_case sentence names with @Nested + @DisplayName groupings (e.g. blacklisted_extension_is_blocked_regardless_of_risk). Class-name suffixes are meaningful and consistent: *Test (unit), *IntegrationTest (Testcontainers-backed), *BaselineTest / *RegressionTest / *GuardrailTest (behavior-pinning regression tests), *ContractTest (Kafka payload contracts), *MigrationTest (Flyway migration verification).",
     "assertion_library": "AssertJ (assertThat(...)) is the house standard; plain JUnit assertEquals/assertTrue not used in the sampled files.",
     "query_style": "Mixed within the same repository interfaces: derived query methods (Spring Data naming, incl. nested-property navigation like findByXAndTenant_TenantID), plus @Query using both JPQL and native SQL (native used especially for optional-filter idioms and GROUP BY/aggregate stats queries).",
-    "tenant_filter_pattern": "No single universal mechanism. Combination of: (1) explicit tenantId predicate inside @Query/derived repository methods for most tenant-owned entities, (2) a centralized fail-closed HandlerInterceptor (TenantAccessInterceptor, most fully built out in sfn-iam-api and sfn-tenants-api) that validates any tenantId path-variable/query-param against the JWT-resolved acting tenant before the controller runs, (3) explicit service/controller-level TenantAccessGuard.requireCallerCanAccess(...) checks for endpoints addressed by a non-tenant id (e.g. a bare userId), and (4) a small number of repositories/entities are deliberately global/unscoped reference data (countries, package catalogs, scopes, etc.) — see manual_review_flags for entities where this determination could not be fully verified from code alone."
+    "tenant_filter_pattern": "No single universal mechanism. Combination of: (1) explicit tenantId predicate inside @Query/derived repository methods for most tenant-owned entities, (2) a centralized fail-closed HandlerInterceptor (TenantAccessInterceptor, most fully built out in sfn-iam-api and sfn-tenants-api) that validates any tenantId path-variable/query-param against the JWT-resolved acting tenant before the controller runs, (3) explicit service/controller-level TenantAccessGuard.requireCallerCanAccess(...) checks for endpoints addressed by a non-tenant id (e.g. a bare userId), and (4) a small number of repositories/entities are deliberately global/unscoped reference data (countries, package catalogs, scopes, etc.) — see manual_review_flags for entities where this determination could not be fully verified from code alone.",
+    "timestamp_handling": "Architecture Rule: The backend ONLY produces UTC timestamp strings. All time formatting and local timezone conversion MUST be handled by the frontend. The backend never returns pre-formatted display strings like timeDisplay or dateDisplay."
   },
-
   "golden_rules": {
     "tenant_isolation": "Multi-layered, not enforced by a single mechanism: JWT issuer resolves caller tenant via per-tenant DB-stored Keycloak config (DbJwtAuthenticationManagerResolver, duplicated across 5 services) -> TenantContextHolder holds the acting tenant for the request -> optional MSSP 'acting tenant' impersonation override via X-Acting-Tenant header or /api/tenants/{tenantId}/... path prefix, gated by ParentChainAuthorizer.isCallerAncestorOrSelf + PrivacyLevelEnforcer.canImpersonate -> TenantAccessInterceptor/TenantAccessGuard perform a fail-closed check of any tenantId path-var/query-param against the acting tenant (most complete in sfn-iam-api and sfn-tenants-api) -> individual repository query methods additionally filter by tenantId for tenant-owned entities. No .rejected-patterns.json file exists anywhere in the workspace to source a canonical, explicitly-authored rule set from — this description is reconstructed from code, not an authored policy document.",
     "rejected_patterns": [],
@@ -824,14 +1034,12 @@
     ],
     "explicitly_banned": []
   },
-
   "current_state": {
     "active_branch": "Multi-repo — no single active branch. sfn-events-api and sfn-web-ui were checked out on 'develop' at analysis time; snf-browser-extn was checked out on 'main'.",
     "pending_acs": [],
     "completed_acs": [],
     "next_step": "not_found (no .secufusion-state.json exists anywhere in the workspace)"
   },
-
   "manual_review_flags": [
     "sfn-auth-api and sfn-iam-api both define an AuthController with near-identical endpoints (GET /tenant-config/v1, GET /tenant-config, POST /login) and both own JPA entities for the same tables (Address, auth_provider_config, groups, roles, scopes, Tenant, Users). It is not determinable from code alone which service is canonical/current and which is legacy or superseded — recommend asking the team directly.",
     "sfn-tenants-api and sfn-policy-api both implement a near-identical browser/network/extension/AI-policy domain (BrowserPolicyController, ExtensionPolicyController, NetworkPolicyController, LandingPageController, RulesEnginePolicyController, PolicyMappingController, NetworkConfigController, SfBrowserBootstrapJwksController — same class names, same entity/table names, same Kafka topics produced (policy-events, extension-policy-changed) and consumed (extension-approval-decided)). sfn-tenants-api exposes these under /api/tenants/policy/... and additionally owns Tenant lifecycle/onboarding; sfn-policy-api exposes the same functionality under its own /api/policy/... (or similar, context-path is env-driven and not confirmed literally) with no Tenant-ownership responsibilities and only a single smoke test. This strongly suggests one of these two either supersedes the other or was split out and the old copy was never removed — recommend asking the team which is authoritative before adding new policy functionality to either.",
@@ -847,4 +1055,4 @@
     "The shared deployment env config also defines AUTH_SERVICE_URI=lb://AUTH-SERVICE, but sfn-gateway-api's own application.properties routes list (read directly from the repo) has no /api/auth/** route — only IAM/TENANT/EVENTS/POLICY are routed. Combined with the sfn-auth-api/sfn-iam-api duplicate-AuthController flag above, this is additional evidence that sfn-auth-api may be legacy/unrouted in the current gateway config.",
     "Two literal port conflicts surfaced when cross-checking the shared deployment env config against values read directly from the repos: sfn-auth-api hardcodes server.port=8081 in application.properties (not wired to any env var) while the shared config defines AUTH_SERVICE_PORT=8087; and sfn-tenants-api's own local/.env.local.example defaults to port 9001 while the shared config defines TENANT_SERVICE_PORT=8085. Both are recorded as CONFLICT values in the affected microservice entries rather than silently picking one — recommend confirming which is actually live in each real environment."
   ]
-}
+}

package/index.js

@@ -1191,36 +1191,40 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     const BACKEND_SIGNALS = [
         "api", "endpoint", "service", "repository", "database", "db", "query",
         "migration", "flyway", "kafka", "consumer", "producer", "topic",
-        "keycloak", "jwt", "auth", "token", "realm", "microservice", "spring",
-        "java", "entity", "@entity", "dto", "controller", "feign", "scheduler",
-        "cron", "config", "yaml", "yml", "null pointer", "exception", "500",
-        "error", "npe", "backend", "server", "rest", "json response", "payload",
-        "header", "cors", "filter", "interceptor", "tenantid", "tenant",
-        "permission", "role", "sfn-iam", "sfn-events", "sfn-tenants",
-        "sfn-policy", "sfn-gateway", "sfn-notification", "sfn-audit", "device",
-        "machine", "event", "security alert", "policy rule", "audit log",
+        "backend", "server", "rest", "json response", "payload"
     ];
     const FRONTEND_SIGNALS = [
         "ui", "frontend", "react", "component", "page", "screen", "button",
-        "form", "input", "dropdown", "modal", "table", "chart", "graph",
-        "dashboard", "layout", "style", "css", "color", "icon", "tooltip",
-        "sidebar", "navbar", "menu", "sfn-web-ui", "web ui", "browser ui",
-        "display", "render", "show on screen", "visual", "animation",
-        "responsive", "redux", "zustand", "context", "hook", "tsx", "jsx",
-        "html",
+        "modal", "layout", "style", "css", "web ui", "browser ui", "render"
     ];
     const EXTENSION_SIGNALS = [
-        "chrome extension", "extension", "manifest", "content script",
-        "background script", "service worker", "popup", "options page",
-        "chrome storage", "registry", "managed policy", "browser extension",
-        "sfn-chrome",
+        "chrome extension", "extension", "content script", "background script",
+        "browser extension", "popup"
     ];
+    if (spec) {
+        if (spec.microservices) {
+            Object.keys(spec.microservices).forEach(k => BACKEND_SIGNALS.push(k.toLowerCase()));
+            Object.values(spec.microservices).forEach(svc => {
+                if (Array.isArray(svc.owns_tables)) {
+                    svc.owns_tables.forEach(t => BACKEND_SIGNALS.push(t.toLowerCase()));
+                }
+            });
+        }
+        if (spec.frontend && spec.frontend.repo)
+            FRONTEND_SIGNALS.push(spec.frontend.repo.toLowerCase());
+        if (spec.chrome_extension && spec.chrome_extension.repo)
+            EXTENSION_SIGNALS.push(spec.chrome_extension.repo.toLowerCase());
+    }
     const backendFound = BACKEND_SIGNALS.filter(s => corpus.includes(s));
     const frontendFound = FRONTEND_SIGNALS.filter(s => corpus.includes(s));
     const extensionFound = EXTENSION_SIGNALS.filter(s => corpus.includes(s));
-    const backendScore = backendFound.length;
-    const frontendScore = frontendFound.length;
-    const extensionScore = extensionFound.length;
+    // Refine signals based on explicit modifiers (the user's "analysis" expectation)
+    let backendScore = backendFound.length;
+    let frontendScore = frontendFound.length;
+    let extensionScore = extensionFound.length;
+    if (corpus.includes("pure ui") || corpus.includes("no backend changes") || corpus.includes("frontend only")) {
+        backendScore = 0;
+    }
     // Determine classification
     let classification;
     let confidence = "HIGH";
@@ -1258,7 +1262,18 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
     // CHECK 1: Title accuracy
     const verbs = ["delete", "create", "fetch", "update", "add", "remove", "fix", "implement"];
     const nouns = ["tenant", "admin", "device", "policy", "gateway", "notification", "audit", "role", "permission", "user", "group", "mapping", "api", "endpoint", "dashboard", "db", "database"];
-    const services = ["sfn-iam-api", "sfn-events-api", "sfn-tenants-api", "sfn-policy-api", "sfn-gateway-api", "sfn-web-ui"];
+    const services = [];
+    if (spec) {
+        if (spec.microservices)
+            Object.keys(spec.microservices).forEach(k => services.push(k.toLowerCase()));
+        if (spec.frontend && spec.frontend.repo)
+            services.push(spec.frontend.repo.toLowerCase());
+        if (spec.chrome_extension && spec.chrome_extension.repo)
+            services.push(spec.chrome_extension.repo.toLowerCase());
+    }
+    if (services.length === 0) {
+        services.push("sfn-iam-api", "sfn-events-api", "sfn-tenants-api", "sfn-policy-api", "sfn-gateway-api", "sfn-web-ui");
+    }
     const foundConcepts = [];
     [...verbs, ...nouns, ...services].forEach(word => {
         if (descLower.includes(word))
@@ -1376,8 +1391,15 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
             secufusionFlags.push(`This may re-introduce rejected pattern #${r.id}: ${r.pattern}`);
         }
     });
-    if (descLower.includes("sfn-iam-api") && descLower.includes("device-user-group mapping")) {
-        secufusionFlags.push("Rejected pattern #X: sfn-iam-api must not write device-user-group mappings. sfn-events-api is the sole authority.");
+    // Dynamically inject coding patterns from project spec
+    if (spec && spec.coding_patterns) {
+        Object.entries(spec.coding_patterns).forEach(([key, rule]) => {
+            const keyTokens = key.toLowerCase().split('_');
+            // if any token from the key is in the corpus, add the rule
+            if (keyTokens.some(token => corpus.includes(token))) {
+                secufusionFlags.push(`Architecture Rule (${key}): ${rule}`);
+            }
+        });
     }
     let validationVerdict = "CLEAN";
     if (!titleAccurate || !taskTypeCorrect || (task_type === "bug" && rootCauseAssumed)) {
@@ -1416,6 +1438,16 @@ server.tool("classify_task", "MANDATORY FIRST STEP for every task without except
         "column", "table", "migration", "flyway", "entity", "@entity",
         "schema", "alter", "add column", "drop column", "rename column",
     ];
+    if (spec && spec.microservices) {
+        Object.values(spec.microservices).forEach(svc => {
+            if (Array.isArray(svc.owns_tables)) {
+                svc.owns_tables.forEach(t => DB_CHANGE_SIGNALS.push(t.toLowerCase()));
+            }
+            if (Array.isArray(svc.kafka_consumes)) {
+                svc.kafka_consumes.forEach(topic => KAFKA_CHANGE_SIGNALS.push(topic.toLowerCase()));
+            }
+        });
+    }
     const endpointRisk = ENDPOINT_CHANGE_SIGNALS.some(s => corpus.includes(s));
     const kafkaRisk = KAFKA_CHANGE_SIGNALS.some(s => corpus.includes(s));
     const dbRisk = DB_CHANGE_SIGNALS.some(s => corpus.includes(s));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.21",
+  "version": "1.0.23",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",