soajs.controller 4.3.22 → 4.3.24

package/ARCHITECTURE.md

@@ -158,7 +158,8 @@ The gateway processes requests through a sequential middleware pipeline:
 | [Custom Registry Configuration](docs/configuration-custom-registry.md) | Environment-specific gateway settings |
 | [Tenant Access Resolver Guide](docs/tenant-access-resolver.md) | Step by step: give a group of users access to a tenant through an API of your app |
 | [Services Config](docs/configuration-services-config.md) | Tenant key-specific configuration |
-| [Gateway Routes](docs/gateway-routes.md) | Built-in gateway routes (/soajs/acl, /soajs/proxy) |
+| [Gateway Routes](docs/gateway-routes.md) | Built-in gateway routes (/soajs/acl, /soajs/mcp, /soajs/proxy) |
+| [MCP Endpoint](docs/mcp.md) | The caller's APIs as MCP tools for AI agents |
 | [Maintenance Routes](docs/maintenance-routes.md) | Health check and admin endpoints |
 
 ---

package/docs/configuration-custom-registry.md

@@ -32,6 +32,9 @@ registry.custom
 │       │   └── [main product]      # Its sub products
 │       ├── oauth
 │       │   └── deviceIdCheck       # Turn the deviceId check off
+│       ├── mcp                     # MCP endpoint /soajs/mcp for AI agents
+│       │   ├── enabled             # true turns it on
+│       │   └── ttl, timeout, maxTools
 │       └── gotoService
 │           ├── monitor             # Request monitoring config
 │           └── renewReqMonitorOff  # Disable timeout renewal
@@ -760,6 +763,33 @@ Anything but a well formed access answer is no access, and the urac driver decid
 
 ---
 
+## 16. MCP Endpoint
+
+`registry.custom.gateway.value.mcp` turns on `POST /soajs/mcp`: AI agents see the APIs their
+caller may use as tools, and a tool call is processed as the API call it stands for.
+
+```json
+{
+  "mcp": {
+    "enabled": true,
+    "ttl": 300000,
+    "timeout": 10000,
+    "maxTools": 300
+  }
+}
+```
+
+| Field | Default | Description |
+|-------|---------|-------------|
+| `enabled` | — | `true` turns the endpoint on; otherwise it answers 404/190 |
+| `ttl` | `300000` | How long the tools of a service are cached, ms |
+| `timeout` | `10000` | Fetching tools and calling a tool, ms |
+| `maxTools` | `300` | At most this many tools in a list |
+
+See [MCP Endpoint](mcp.md).
+
+---
+
 ## Complete Configuration Example
 
 ```javascript

package/docs/gateway-routes.md

@@ -17,6 +17,12 @@ The SOAJS Controller provides special built-in routes that are handled directly
     │   ├── Requires: External key (header), OAuth token (query)                  │
     │   └── Returns: ACL, packages, user info, tenant info                        │
     │                                                                             │
+    │   /soajs/mcp                                                                │
+    │   ├── Method: POST                                                          │
+    │   ├── Purpose: MCP endpoint, the caller's APIs as tools for AI agents       │
+    │   ├── Requires: External key, OAuth token, mcp.enabled in custom registry   │
+    │   └── Returns: JSON-RPC answers (initialize, tools/list, tools/call)        │
+    │                                                                             │
     │   /soajs/proxy                                                              │
     │   ├── Method: Any                                                           │
     │   ├── Purpose: Proxy requests to external URLs or cross-environment         │
@@ -246,7 +252,19 @@ curl -X POST "http://api.example.com/soajs/proxy?proxyRoute=%2Fservice%2Fapi&__e
 
 ---
 
-## 3. Deprecated: `/proxy/redirect`
+## 3. MCP Route (`/soajs/mcp`)
+
+**Endpoint:** `POST /soajs/mcp`
+
+**Purpose:** AI agents connect with the Model Context Protocol and see the APIs their caller may
+use as tools; a tool call is processed as the API call it stands for. Same key, OAuth and user
+checks as `/soajs/acl`; off unless `mcp.enabled` is set in the gateway custom registry.
+
+See [MCP Endpoint](mcp.md).
+
+---
+
+## 4. Deprecated: `/proxy/redirect`
 
 **Status:** DEPRECATED
 

package/docs/mcp.md

@@ -0,0 +1,140 @@
+# MCP Endpoint (`/soajs/mcp`)
+
+AI agents connect to the gateway with the Model Context Protocol (MCP) and see the APIs their
+caller may use as tools. A tool call is processed as the API call it stands for, so it gets every
+check an API call gets.
+
+## How It Works
+
+```
+Agent (MCP client)
+   │  POST /soajs/mcp   key + token
+   ▼
+Gateway
+   ├─ key, OAuth and user checks (as for /soajs/acl)
+   ├─ tools/list  → the caller's ACL (/soajs/acl logic)
+   │                + GET /mcp/tools of each allowed service, cached per service and version
+   └─ tools/call  → the API call, sent to the gateway's own port with the caller's credentials:
+                    key, OAuth, tenant access resolver, ACL, throttling, idempotency, cache, service
+```
+
+### Where the tools come from
+
+Every service answers `GET /mcp/tools` on its maintenance port (the port awareness checks the
+heartbeat on: `maintenance`, `inherit` or a custom port):
+
+| Service | Answer |
+|---------|--------|
+| Built on `soajs` (4.1.24+) | `data.tools`: built from its `config.js` schema |
+| Built with an SDK (`soajs.nodejs` 2.0.4+, `soajs.python` 1.0.1+, `soajs.golang` v1.0.5+) | `data.swagger`: its Swagger 2.0 / OpenAPI 3 document, an object or YAML text, converted with `soajs.core.libs` `mcp.fromSwagger` |
+| Older, or no answer | no tools |
+
+Tools are cached per service and version for `ttl`; a service that did not answer is asked again
+after 30 seconds.
+
+### Which tools a caller sees
+
+The ACL the gateway computes for `/soajs/acl`: the user's ACL and packages, else the tenant
+application's, else the package's. For each service, the latest allowed version; a restricted
+service shows only the APIs its ACL lists, per method. To give agents a different list from your
+apps, give the agent its own application, key and package in the tenant.
+
+A tool call is checked again by the gateway like any API call, so a tool shown by mistake is still
+refused.
+
+## Configuration
+
+Off unless enabled, in the `gateway` custom registry (`registry.custom.gateway.value.mcp`):
+
+```json
+{
+  "mcp": {
+    "enabled": true,
+    "ttl": 300000,
+    "timeout": 10000,
+    "maxTools": 300
+  }
+}
+```
+
+| Field | Default | Description |
+|-------|---------|-------------|
+| `enabled` | — | `true` turns the endpoint on; anything else answers 404/190 |
+| `ttl` | `300000` | How long the tools of a service are cached, ms |
+| `timeout` | `10000` | Fetching tools and calling a tool, ms |
+| `maxTools` | `300` | At most this many tools in a list |
+
+## Protocol
+
+MCP over HTTP: JSON-RPC 2.0, `POST /soajs/mcp`, one JSON answer per request, no session and no
+streaming. `GET` answers 405.
+
+| Method | Answer |
+|--------|--------|
+| `initialize` | `protocolVersion` (the client's when supported: `2025-06-18`, `2025-03-26`, `2024-11-05`, else `2025-06-18`), `capabilities.tools`, `serverInfo` |
+| `notifications/*` (no `id`) | HTTP 202, no body |
+| `ping` | `{}` |
+| `tools/list` | `{tools}` |
+| `tools/call` | `{content, structuredContent, isError}` |
+
+### Tools
+
+| Field | Value |
+|-------|-------|
+| `name` | `<service>_<operationId>`, or `<service>_<method>_<path>`; `[A-Za-z0-9_-]`, 64 characters at most, unique |
+| `title` | The API label |
+| `description` | The label and `[service: METHOD /path]` |
+| `inputSchema` | JSON Schema of the inputs: path, query and body fields in one object |
+| `annotations` | `readOnlyHint` for GET, `destructiveHint` for DELETE |
+
+### Tool calls
+
+The arguments are split back into the path, the query string and the body, and the call goes to
+`http://127.0.0.1:<gateway port>/<service>/v<version><path>` with the caller's `key`,
+`authorization` / `access_token`, `device-id`, `user-agent`, `accept-language` and
+`idempotency-key` headers and `x-forwarded-for`.
+
+- **Success:** `content` has the response `data` as JSON text, `structuredContent` the same when it
+  is an object.
+- **Error** (HTTP 4xx/5xx or `result: false`): `isError: true`, `content` has the `errors`.
+
+### Errors
+
+| Case | Answer |
+|------|--------|
+| MCP not enabled | HTTP 404, SOAJS error 190 |
+| No `key` header | SOAJS error 132 |
+| No signed-in user | as `/soajs/acl` |
+| Not POST | HTTP 405, JSON-RPC -32600 |
+| Body not JSON | HTTP 400, JSON-RPC -32700 |
+| Batch, invalid request | HTTP 400, JSON-RPC -32600 |
+| Body over 1 MB | HTTP 413 |
+| Unknown method | JSON-RPC -32601 |
+| Unknown tool, no tool name | JSON-RPC -32602 |
+
+## Client Setup
+
+```json
+{
+  "mcpServers": {
+    "soajs": {
+      "url": "https://api.example.com/soajs/mcp",
+      "headers": {
+        "key": "<tenant external key>",
+        "Authorization": "Bearer <access token>"
+      }
+    }
+  }
+}
+```
+
+The key can also be sent in the query string (`/soajs/mcp?key=...`) for clients that only take a
+URL.
+
+## Files
+
+| File | Role |
+|------|------|
+| `mw/soajsRoutes/mcp/index.js` | The route: JSON-RPC handling |
+| `mw/soajsRoutes/mcp/tools.js` | Tools: fetch, cache, ACL filter, naming, the call |
+| `mw/soajsRoutes/lib/acl.js` | The ACL computation shared with `/soajs/acl` |

package/mw/gotoService/index.js

@@ -9,6 +9,7 @@
  */
 
 const gtw_keyACL = require("./../soajsRoutes/keyACL/index.js");
+const gtw_mcp = require("./../soajsRoutes/mcp/index.js");
 
 /**
  *
@@ -26,6 +27,13 @@ module.exports = (configuration) => {
 		"core": core
 	});
 
+	let soajs_mcp = gtw_mcp({
+		"provision": provision,
+		"serviceName": configuration.serviceName,
+		"serviceVersion": configuration.serviceVersion,
+		"core": core
+	});
+
 	let extractBuildParameters = require("./lib/extractBuildParameters.js");
 
 	let simpleRTS = require("./simpleRTS.js")(configuration);
@@ -43,8 +51,11 @@ module.exports = (configuration) => {
 
 		//check if route is soajs/acl then you also need to bypass the exctract Build Param BL
 		let url_keyACL = (serviceInfo[1] === 'soajs' && serviceInfo[2] === 'acl');
+		let url_mcp = (serviceInfo[1] === 'soajs' && serviceInfo[2] === 'mcp');
 		if (url_keyACL) {
 			return soajs_keyACL(req, res, next);
+		} else if (url_mcp) {
+			return soajs_mcp(req, res, next);
 		} else {
 			//check if proxy/redirect
 			//create proxy info object before calling extractbuildparams

package/mw/mt/index.js

@@ -42,7 +42,9 @@ module.exports = (configuration) => {
 		} else if (urlInfo[1] === 'soajs' && urlInfo[2] === 'proxy') {
 			proxy = true;
 		}
-		let url_keyACL = (urlInfo[1] === 'soajs' && urlInfo[2] === 'acl');
+		//NOTE: /soajs/acl and /soajs/mcp are apis of the gateway: key, oauth and urac checks only, the
+		//		route itself works with the caller's ACL
+		let url_keyACL = (urlInfo[1] === 'soajs' && (urlInfo[2] === 'acl' || urlInfo[2] === 'mcp'));
 
 		let serviceParam = {};
 		if (!proxy) {

package/mw/mt/utils.js

@@ -15,7 +15,7 @@ const coreLibs = require("soajs.core.libs");
 
 const async = require("async");
 const Netmask = require('netmask').Netmask;
-const useragent = require('useragent');
+const UAParser = require('ua-parser-js');
 const merge = require('merge');
 
 const UracDriver = require("./urac.js");
@@ -49,6 +49,91 @@ function getCachedNetmask(addr) {
 	return netmaskCache.get(addr);
 }
 
+// Device rules were written against the useragent package names; map ua-parser-js names back to them
+const UA_MAX_LENGTH = 512;
+const UA_OS_FAMILIES = {"Mac OS": "Mac OS X", "Chromium OS": "Chrome OS"};
+const UA_ANDROID_FAMILIES = {"Firefox": "Firefox Mobile", "Opera": "Opera Mobile", "Chrome WebView": "Chrome Mobile WebView"};
+const UA_IOS_FAMILIES = {"Chrome": "Chrome Mobile iOS", "Firefox": "Firefox iOS", "WebKit": "Mobile Safari UI/WKWebView"};
+const UA_FAMILIES = {"Yandex": "Yandex Browser"};
+
+// Own keys only: the family comes from the caller and must not resolve to Object.prototype members
+function mapName(map, name) {
+	return Object.prototype.hasOwnProperty.call(map, name) ? map[name] : name;
+}
+
+function splitVersion(version) {
+	let parts = (version || "").split(".");
+	return {
+		"major": parts[0] || "0",
+		"minor": parts[1] || "0",
+		"patch": parts[2] || "0"
+	};
+}
+
+/**
+ * Parses a User-Agent into {family, major, minor, patch, os: {family, major, minor, patch}}
+ *
+ * @param {String} ua
+ * @returns {Object}
+ */
+function parseUserAgent(ua) {
+	ua = String(ua).substring(0, UA_MAX_LENGTH);
+	let result = new UAParser(ua).getResult();
+	let family = result.browser.name;
+	let version = result.browser.version;
+	let osFamily = result.os.name;
+	let osVersion = result.os.version;
+	let match;
+
+	if (!family) {
+		// ua-parser-js guesses iOS from Darwin/CFNetwork without a version
+		if (osFamily === "iOS" && !osVersion) {
+			osFamily = null;
+		}
+		// non browser clients: curl/8.4.0, MyApp/142 CFNetwork/...
+		match = /^Mozilla\//.test(ua) ? null : /^([^\/\s]+)\/([\d.]+)/.exec(ua);
+		family = match ? match[1] : "Other";
+		version = match ? match[2] : null;
+	}
+	if (family === "Edge") {
+		if (/ Edg(A)?\//.test(ua)) {
+			match = /Chrome\/([\d.]+)/.exec(ua);
+			family = "Chrome";
+			version = match ? match[1] : null;
+		} else if (/ EdgiOS\//.test(ua)) {
+			match = /Version\/([\d.]+)/.exec(ua);
+			family = "Mobile Safari";
+			version = match ? match[1] : null;
+		}
+	}
+	if (osFamily === "Android") {
+		// useragent reported every Android version as 0.0.0, keep that so os version rules do not change
+		osVersion = null;
+		if (family === "Chrome" && / Mobile /.test(ua)) {
+			family = "Chrome Mobile";
+		} else {
+			family = mapName(UA_ANDROID_FAMILIES, family);
+		}
+	} else if (osFamily === "iOS") {
+		if (family === "WebKit") {
+			version = osVersion;
+		}
+		family = mapName(UA_IOS_FAMILIES, family);
+	}
+	family = mapName(UA_FAMILIES, family);
+
+	let uaObj = splitVersion(version);
+	uaObj.family = String(family);
+	if (osFamily === "Windows") {
+		// Windows versions are names: 10, 8.1, XP, Vista
+		uaObj.os = {"family": osFamily, "major": osVersion || "0", "minor": "0", "patch": "0"};
+	} else {
+		uaObj.os = splitVersion(osVersion);
+		uaObj.os.family = osFamily ? String(mapName(UA_OS_FAMILIES, osFamily)) : "Other";
+	}
+	return uaObj;
+}
+
 let sensitiveEnvCodes = ["dashboard"];
 if (process.env.SOAJS_SENSITIVE_ENVS) {
 	let temp_sensitiveEnvCodes = null;
@@ -381,7 +466,7 @@ let utils = {
 		};
 
 		let checkAccess = (deviceAccessArr, ua) => {
-			let uaObj = useragent.lookup(ua);
+			let uaObj = parseUserAgent(ua);
 			//if (uaObj && uaObj.family && uaObj.os && uaObj.os.family) {
 			if (uaObj && uaObj.family) {
 				return (deviceAccessArr.some(function (da) {

package/mw/soajsRoutes/keyACL/index.js

@@ -8,71 +8,13 @@
  * found in the LICENSE file at the root of this repository
  */
 
-const coreLibs = require("soajs.core.libs");
+const aclLib = require("../lib/acl.js");
 
 module.exports = (configuration) => {
 	let core = configuration.core;
 
 	let return_SOAJS_keyACL = (req) => {
-		let ACL = null;
-		let ALLOWED_PACKAGES = null;
-		if (req.soajs.uracDriver) {
-			ACL = req.soajs.uracDriver.getAcl();
-			ALLOWED_PACKAGES = req.soajs.uracDriver.getAllowedPackages();
-			req.soajs.log.debug("soajsRoute keyACL: uracDriver detected.", ALLOWED_PACKAGES);
-		}
-		if (!ALLOWED_PACKAGES && req.soajs.controller.serviceParams.keyObj.application.package) {
-			ALLOWED_PACKAGES = [req.soajs.controller.serviceParams.keyObj.application.package];
-			req.soajs.log.debug("soajsRoute keyACL: Found PACKAGE ACL at Tenant Application level, overriding default PACKAGE ACL configuration.", ALLOWED_PACKAGES);
-		}
-		if (!ACL && req.soajs.controller.serviceParams.keyObj.application.acl) {
-			ACL = req.soajs.controller.serviceParams.keyObj.application.acl;
-			req.soajs.log.debug("soajsRoute keyACL: Found ACL at Tenant Application level, overriding default ACL configuration.");
-		}
-		if (!ACL && req.soajs.controller.serviceParams.packObj.acl) {
-			req.soajs.log.debug("soajsRoute keyACL: Found Default ACL at Package level, setting default ACL configuration.");
-			ACL = coreLibs.utils.cloneObj(req.soajs.controller.serviceParams.packObj.acl);
-		}
-		let finalACL = null;
-		if (ACL) {
-			finalACL = {};
-			for (let s in ACL) {
-				if (ACL.hasOwnProperty(s)) {
-					for (let v in ACL[s]) {
-						if (ACL[s].hasOwnProperty(v)) {
-							let sv = ACL[s][v];
-							if (finalACL[s] && finalACL[s].version) {
-								let version = coreLibs.version.getLatest(finalACL[s].version, v);
-								if (version !== v) {
-									continue;
-								}
-							}
-							finalACL[s] = {
-								"version": v
-							};
-							if (sv.apisPermission && sv.apisPermission === "restricted") {
-								for (let m in sv) {
-									if (sv.hasOwnProperty(m)) {
-										if (m !== "access" && m !== "apisPermission") {
-											if (sv[m].apis) {
-												for (let a in sv[m].apis) {
-													if (sv[m].apis.hasOwnProperty(a)) {
-														if (!finalACL[s][m]) {
-															finalACL[s][m] = [];
-														}
-														finalACL[s][m].push(a);
-													}
-												}
-											}
-										}
-									}
-								}
-							}
-						}
-					}
-				}
-			}
-		}
+		let computed = aclLib.computeACL(req);
 
 		let urac = null;
 		if (req.soajs.uracDriver) {
@@ -98,9 +40,9 @@ module.exports = (configuration) => {
 		}
 
 		let response = {
-			"acl": ACL,
-			"finalACL": finalACL,
-			"packages": ALLOWED_PACKAGES,
+			"acl": computed.acl,
+			"finalACL": computed.finalACL,
+			"packages": computed.packages,
 			"urac": urac,
 			"tenant": tenant
 		};
@@ -114,30 +56,12 @@ module.exports = (configuration) => {
 			return req.soajs.controllerResponse(core.error.getError(132));
 		}
 
-		//mimic a service named controller with route /key/permission/get
-		let serviceName = configuration.serviceName;
-		req.soajs.controller.serviceParams.registry = req.soajs.registry.services[serviceName];
-		req.soajs.controller.serviceParams.name = serviceName;
-		req.soajs.controller.serviceParams.url = "/soajs/acl";
-		req.soajs.controller.serviceParams.path = "/soajs/acl";
-		req.soajs.controller.serviceParams.version = configuration.serviceVersion;
-		req.soajs.controller.serviceParams.extKeyRequired = true;
-		req.soajs.controller.serviceParams.registry.versions = {
-			[configuration.serviceVersion]: {
-				"extKeyRequired": true,
-				"oauth": true,
-				"urac": true,
-				"urac_ACL": true,
-				"provision_ACL": true,
-				"apis": [
-					{
-						"l": "Get ACL",
-						"v": "/soajs/acl",
-						"m": "get"
-					}
-				]
-			}
-		};
+		//mimic an api of the gateway, so mt runs the key, oauth and urac checks
+		aclLib.mimicGatewayApi(req, configuration, {
+			"l": "Get ACL",
+			"v": "/soajs/acl",
+			"m": "get"
+		});
 
 		//assign the correct method to gotoservice in controller
 		req.soajs.controller.gotoservice = return_SOAJS_keyACL;

package/mw/soajsRoutes/lib/acl.js

@@ -0,0 +1,130 @@
+'use strict';
+
+/**
+ * @license
+ * Copyright SOAJS All Rights Reserved.
+ *
+ * Use of this source code is governed by an Apache license that can be
+ * found in the LICENSE file at the root of this repository
+ */
+
+const coreLibs = require("soajs.core.libs");
+
+/**
+ * What the caller may use, the way the gateway decides it: the user's ACL and packages, else the
+ * tenant application's, else the package's. Shared by /soajs/acl and /soajs/mcp.
+ *
+ * finalACL is, per service, the latest allowed version and, for a restricted service, the allowed
+ * apis per method: {"urac": {"version": "3", "get": ["/user"]}}. A service that is not restricted
+ * has only its version: all its apis are allowed.
+ *
+ * @param req
+ * @returns {{acl: object|null, finalACL: object|null, packages: Array|null}}
+ */
+function computeACL(req) {
+	let ACL = null;
+	let ALLOWED_PACKAGES = null;
+	if (req.soajs.uracDriver) {
+		ACL = req.soajs.uracDriver.getAcl();
+		ALLOWED_PACKAGES = req.soajs.uracDriver.getAllowedPackages();
+		req.soajs.log.debug("soajsRoute ACL: uracDriver detected.", ALLOWED_PACKAGES);
+	}
+	if (!ALLOWED_PACKAGES && req.soajs.controller.serviceParams.keyObj.application.package) {
+		ALLOWED_PACKAGES = [req.soajs.controller.serviceParams.keyObj.application.package];
+		req.soajs.log.debug("soajsRoute ACL: Found PACKAGE ACL at Tenant Application level, overriding default PACKAGE ACL configuration.", ALLOWED_PACKAGES);
+	}
+	if (!ACL && req.soajs.controller.serviceParams.keyObj.application.acl) {
+		ACL = req.soajs.controller.serviceParams.keyObj.application.acl;
+		req.soajs.log.debug("soajsRoute ACL: Found ACL at Tenant Application level, overriding default ACL configuration.");
+	}
+	if (!ACL && req.soajs.controller.serviceParams.packObj.acl) {
+		req.soajs.log.debug("soajsRoute ACL: Found Default ACL at Package level, setting default ACL configuration.");
+		ACL = coreLibs.utils.cloneObj(req.soajs.controller.serviceParams.packObj.acl);
+	}
+	let finalACL = null;
+	if (ACL) {
+		finalACL = {};
+		for (let s in ACL) {
+			if (ACL.hasOwnProperty(s)) {
+				for (let v in ACL[s]) {
+					if (ACL[s].hasOwnProperty(v)) {
+						let sv = ACL[s][v];
+						if (finalACL[s] && finalACL[s].version) {
+							let version = coreLibs.version.getLatest(finalACL[s].version, v);
+							if (version !== v) {
+								continue;
+							}
+						}
+						finalACL[s] = {
+							"version": v
+						};
+						if (sv.apisPermission && sv.apisPermission === "restricted") {
+							for (let m in sv) {
+								if (sv.hasOwnProperty(m)) {
+									if (m !== "access" && m !== "apisPermission") {
+										// {apis: {...}} or, grouped, [{group, apis: {...}}]
+										let groups = Array.isArray(sv[m]) ? sv[m] : [sv[m]];
+										for (let g = 0; g < groups.length; g++) {
+											let group = groups[g];
+											if (group && group.apis) {
+												for (let a in group.apis) {
+													if (group.apis.hasOwnProperty(a)) {
+														if (!finalACL[s][m]) {
+															finalACL[s][m] = [];
+														}
+														if (finalACL[s][m].indexOf(a) === -1) {
+															finalACL[s][m].push(a);
+														}
+													}
+												}
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	return {
+		"acl": ACL,
+		"finalACL": finalACL,
+		"packages": ALLOWED_PACKAGES
+	};
+}
+
+/**
+ * Makes the request look like a call to an api of the gateway itself, so mt runs the key, oauth
+ * and urac checks for it. The registry entry is a copy: the shared registry is not changed.
+ *
+ * @param req
+ * @param configuration {serviceName, serviceVersion}
+ * @param api {l, v, m}
+ */
+function mimicGatewayApi(req, configuration, api) {
+	let serviceName = configuration.serviceName;
+	let registry = Object.assign({}, req.soajs.registry.services[serviceName]);
+	registry.versions = {
+		[configuration.serviceVersion]: {
+			"extKeyRequired": true,
+			"oauth": true,
+			"urac": true,
+			"urac_ACL": true,
+			"provision_ACL": true,
+			"apis": [api]
+		}
+	};
+	req.soajs.controller.serviceParams.registry = registry;
+	req.soajs.controller.serviceParams.name = serviceName;
+	req.soajs.controller.serviceParams.url = api.v;
+	req.soajs.controller.serviceParams.path = api.v;
+	req.soajs.controller.serviceParams.version = configuration.serviceVersion;
+	req.soajs.controller.serviceParams.extKeyRequired = true;
+}
+
+module.exports = {
+	computeACL,
+	mimicGatewayApi
+};