secufusion-mcp 1.0.5 → 1.0.6

package/README.md

@@ -228,6 +228,7 @@ This writes to `.rejected-patterns.json`:
 | **SPEC** | `.current-task-spec.md` is missing or has unchecked `- [ ]` boxes |
 | **LINTING** | AST linters (ESLint, Checkstyle) fail in any discovered microservice. Fix natively, do not suppress! (Falls back to regex if no linters exist) |
 | **SECURITY** | Hardcoded IPs or `uat.*` / `prod.*` / `staging.*` URLs in source or config files |
+| **TENANT ISOLATION** | `*Repository.java` files contain query methods or `@Query` annotations that do NOT include `tenant` filtering |
 | **FLYWAY** | `@Entity`-annotated Java files exist but no `V*__.sql` Flyway migrations found |
 
 **Example — Run checks before PR:**
@@ -517,7 +518,7 @@ Timestamp: 2026-08-26T16:00:00.000Z
 ## PR Summary
 - Work Item: #2847
 - Spec: All acceptance criteria verified ✅
-- Guardrails: tenantId scoping, no debug logs, no hardcoded URLs, Flyway covered ✅
+- Guardrails: tenant isolation secured, no debug logs, no hardcoded URLs, Flyway covered ✅
 - Ready to raise PR 🚀
 
 🚫 Rejected Patterns Reminder (1 on record)
@@ -585,7 +586,7 @@ You are an elite Senior Developer and Architect working on the SecuFusion worksp
 
 ## Phase 1 — Planning (TRIGGER: user assigns a task or work item)
 - Do NOT write code immediately. First, call `manage_feature_spec`.
-- Determine which microservices are likely affected. Pass a `reference_file_path` to observe exact coding patterns.
+- Determine which microservices are likely affected. Pass a `reference_file_path` from each to observe exact coding patterns.
 - Pass the user's requirements into `task_description` to generate the workspace-level `.current-task-spec.md` blueprint.
 - Wait for the spec to be generated before writing any code.
 
@@ -600,11 +601,11 @@ You are an elite Senior Developer and Architect working on the SecuFusion worksp
 - Always check `.rejected-patterns.json` implicitly before suggesting architectural choices to ensure you never repeat past mistakes.
 
 ## Phase 4 — PR Handoff (TRIGGER: user says "prepare PR", "finish up", or "run checks")
-- Call `run_pre_pr_checks` with the Azure DevOps `work_item_id`. The tool will automatically discover all modified microservices in the workspace and run their native linters.
-- If the tool throws an error for a specific repository (e.g., missing Flyway SQL migration, or a linter failing due to console logs/bad formatting), YOU MUST navigate to that specific microservice, FIX THE ERROR in the codebase, and run the tool again until the entire workspace passes. Do not suppress linter warnings.
+- Call `run_pre_pr_checks` with the Azure DevOps `work_item_id`. The tool will automatically discover all modified microservices in the workspace and run native linters, database script checks, and strict tenant-isolation scanners.
+- If the tool throws an error for a specific repository (e.g., missing Flyway SQL migration, missing `tenantId` in a query, or a linter failing), YOU MUST navigate to that specific microservice, FIX THE ERROR in the codebase natively, and run the tool again until the entire workspace passes. Do not suppress warnings.
 
 ## Guardrails (enforce always, no exceptions)
-- All DB queries and event payloads MUST be scoped with `tenantId` unless the spec explicitly notes it as a global/system operation.
+- TENANT SAFETY IS AUTOMATED: The PR Gatekeeper actively scans all `*Repository.java` files. If you write a database query (derived method or `@Query`) that does not explicitly filter by `tenantId` or contain the word `tenant`, the PR will be blocked. Write secure, tenant-isolated queries on your first attempt.
 - Do not ignore linter errors. AST-level tools (ESLint, Checkstyle/Maven) are the source of truth for hygiene. Fix them natively.
 - Never hardcode UAT/Prod IPs or URLs. Use environment variables or configuration properties.
 - If you modify a JPA `@Entity` in any backend repo, you MUST create the corresponding Flyway `.sql` migration script before running PR checks.

package/index.js

@@ -8,7 +8,7 @@
  *   - run_pre_pr_checks    : gate PRs via AST-level linters (ESLint / Maven Checkstyle) + structural checks
  *
  * Guardrails enforced:
- *   1. All DB queries and event payloads must carry tenantId.
+ *   1. TENANT SAFETY AUTOMATED: Active scanning of *Repository.java for tenantId scoping.
  *   2. Code hygiene (console.log, unused vars, formatting) enforced via ESLint / Checkstyle — not regex.
  *   3. No hardcoded UAT/Prod IPs or environment URLs.
  *   4. Every modified JPA @Entity must have a matching Flyway SQL migration.
@@ -246,6 +246,31 @@ function findProjectRoots(dir, depth = 0) {
     }
     return [...new Set(roots)];
 }
+// ── Automated Tenant Isolation Scanner ────────────────────────────────────────
+function checkTenantIsolation(rootDir) {
+    const violations = [];
+    const files = walkDir(rootDir, [".java"]).filter(f => f.endsWith("Repository.java"));
+    const queryMethodRegex = /\b(?:find|get|read|query|search|stream|count|exists|delete|remove)(?:All)?By[A-Z0-9]/;
+    const atQueryRegex = /@Query\s*\(/;
+    for (const file of files) {
+        const content = readFileSafe(file);
+        if (!content)
+            continue;
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if (queryMethodRegex.test(line) || atQueryRegex.test(line)) {
+                // Look at current line and the next to handle simple wrapping
+                const combinedContext = line + (lines[i + 1] || "");
+                if (!/tenant/i.test(combinedContext)) {
+                    violations.push(`Missing tenant isolation in ${path.relative(rootDir, file)}:${i + 1} — query lacks 'tenantId':\n` +
+                        `      ${line.trim()}`);
+                }
+            }
+        }
+    }
+    return violations;
+}
 function checkFlywayMigrations(rootDir) {
     const warnings = [];
     const javaFiles = walkDir(rootDir, [".java"]);
@@ -464,9 +489,9 @@ server.tool("log_rejected_pattern", "Record a coding pattern that was rejected b
 });
 // ─── Tool 3: run_pre_pr_checks ───────────────────────────────────────────────
 server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks across the workspace. " +
-    "Automatically discovers modified microservices and runs their native linters (ESLint, Maven Checkstyle). " +
-    "Also validates: spec checkboxes, hardcoded IPs/URLs, and Flyway migration coverage for JPA entities. " +
-    "Linter errors must be fixed natively — do not suppress warnings to pass the gate. " +
+    "Automatically discovers modified microservices and runs native linters, database script checks, and strict tenant-isolation scanners. " +
+    "Validates: spec checkboxes, hardcoded IPs/URLs, tenantId in Repositories, and Flyway migration coverage for JPA entities. " +
+    "Linter/isolation errors must be fixed natively — do not suppress warnings to pass the gate. " +
     "MUST pass with zero errors before a PR is raised.", {
     work_item_id: z
         .string()
@@ -479,6 +504,7 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks acr
         .array(z.enum([
         "spec_boxes",
         "console_logs",
+        "tenant_isolation",
         "hardcoded_urls",
         "flyway_migrations",
     ]))
@@ -556,7 +582,21 @@ server.tool("run_pre_pr_checks", "Run all SecuFusion pre-PR guardrail checks acr
     else {
         warnings.push("⚠️  [LINTING] Linter check SKIPPED (manually bypassed).");
     }
-    // ── 3. Hardcoded URL check (regex — no AST equivalent needed here) ───────
+    // ── 3. Tenant Isolation Scanner ──────────────────────────────────────────
+    if (!skip_checks.includes("tenant_isolation")) {
+        const tenantViolations = checkTenantIsolation(scanRoot);
+        if (tenantViolations.length > 0) {
+            errors.push(`❌ [SECURITY] Tenant Isolation Failed: Found ${tenantViolations.length} query method(s) in *Repository.java without tenant scoping:\n` +
+                tenantViolations.map((v) => `   • ${v}`).join("\n"));
+        }
+        else {
+            passed.push("✅ [SECURITY] Tenant isolation active: All database queries correctly scoped with tenantId.");
+        }
+    }
+    else {
+        warnings.push("⚠️  [SECURITY] Tenant isolation check SKIPPED (manually bypassed).");
+    }
+    // ── 4. Hardcoded URL check (regex) ───────────────────────────────────────
     if (!skip_checks.includes("hardcoded_urls")) {
         const urlViolations = checkHardcodedUrls(scanRoot);
         if (urlViolations.length > 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "secufusion-mcp",
-  "version": "1.0.5",
+  "version": "1.0.6",
   "type": "module",
   "description": "SecuFusion MCP server - developer workflow tooling with guardrails",
   "main": "index.js",