codecortex 0.4.0__tar.gz → 0.5.0__tar.gz

{codecortex-0.4.0/src/codecortex.egg-info → codecortex-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.4.0
+Version: 0.5.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -189,6 +189,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -213,6 +214,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
 | `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
 | `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
@@ -286,9 +288,9 @@ Running codeintel as a shared service? It ships with what ops teams expect:
 | `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
 | `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
 
-Plus **bearer-token auth**, **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
 
-**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, a Prometheus scrape config, and a security checklist.
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
 
 ```bash
 docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \

{codecortex-0.4.0 → codecortex-0.5.0}/README.md

@@ -156,6 +156,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -180,6 +181,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
 | `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
 | `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
@@ -253,9 +255,9 @@ Running codeintel as a shared service? It ships with what ops teams expect:
 | `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
 | `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
 
-Plus **bearer-token auth**, **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
 
-**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, a Prometheus scrape config, and a security checklist.
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
 
 ```bash
 docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \

{codecortex-0.4.0 → codecortex-0.5.0/src/codecortex.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codecortex
-Version: 0.4.0
+Version: 0.5.0
 Summary: Local-first, MCP-native code-intelligence server — graph, LSP, and semantic search behind one safe code.query tool for coding agents.
 Author: Shammai Hamilton
 License-Expression: MIT
@@ -189,6 +189,7 @@ Full system docs live in [`docs/`](docs/) — start with the index:
 | `codeintel doctor [project_root] [--deep] [--json]` | Diagnose per-engine health + repo index status, with a fix for each gap |
 | `codeintel map [project_root]` | Generate the `CODE_INTEL.md` orientation file |
 | `codeintel reset [project_root] [--all] [--yes]` | Clear the semantic index (this repo, or `--all`) to recover from a corrupt/stale DB |
+| `codeintel gen-token` | Print a secure random bearer token (for `serve-http` / RBAC `auth.toml`) |
 
 Human-facing commands (`doctor`, `status`, `query`, `setup`, `reset`) honor `--no-color` / `NO_COLOR` and `--ascii`, and auto-degrade to plain text when piped.
 
@@ -213,6 +214,7 @@ Config is **validated on load** — an out-of-range number, a misspelled enum, o
 | Variable | Effect |
 |---|---|
 | `CODEINTEL_HTTP_TOKEN` | Bearer token required by `serve-http` (equivalent to `--token`) |
+| `CODEINTEL_AUTH_CONFIG` | Path to an RBAC token→role config (default `~/.codeintel/auth.toml`) — per-token roles + op scopes |
 | `CODEINTEL_LOG_LEVEL` | `DEBUG`\|`INFO`\|`WARNING`(default)\|`ERROR` for the server logger |
 | `CODEINTEL_LOG_FORMAT=json` | Structured (JSON-per-line) logs for ELK / Splunk / Datadog |
 | `CODEINTEL_HTTP_ACCESS_LOG=1` | One log line per HTTP request (method, path, status, latency) |
@@ -286,9 +288,9 @@ Running codeintel as a shared service? It ships with what ops teams expect:
 | `GET /readyz` | none | Readiness — `200` once the gateway is up (`readinessProbe`) |
 | `GET /metrics` | token | Prometheus exposition — request counts, latency, in-flight, build info |
 
-Plus **bearer-token auth**, **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
+Plus **bearer-token auth** — or **RBAC** (per-token roles + op scopes via `auth.toml`; a disallowed op returns `403`, and the role is server-authoritative so a client can't escalate) — **structured JSON logs** (`CODEINTEL_LOG_FORMAT=json`) with optional per-request access logs, **graceful `SIGTERM`** shutdown, a bounded connection pool, and a non-root **Dockerfile** with a healthcheck.
 
-**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, a Prometheus scrape config, and a security checklist.
+**Full guide → [docs/deploy.md](docs/deploy.md)**: systemd, Docker / Compose, Kubernetes (liveness + readiness probes, token from a Secret), reverse-proxy TLS, **RBAC + SSO-via-auth-proxy**, a Prometheus scrape config, and a security checklist.
 
 ```bash
 docker build -t codeintel . && docker run -p 127.0.0.1:8766:8766 \

{codecortex-0.4.0 → codecortex-0.5.0}/src/codecortex.egg-info/SOURCES.txt

@@ -9,6 +9,7 @@ src/codecortex.egg-info/requires.txt
 src/codecortex.egg-info/top_level.txt
 src/codeintel/__init__.py
 src/codeintel/__main__.py
+src/codeintel/auth.py
 src/codeintel/cache.py
 src/codeintel/config.py
 src/codeintel/doctor.py
@@ -52,6 +53,7 @@ tests/test_lsp_real.py
 tests/test_mapper.py
 tests/test_never_raise.py
 tests/test_onboarding.py
+tests/test_rbac.py
 tests/test_reindexer.py
 tests/test_reset.py
 tests/test_semantic_provider.py

codecortex-0.5.0/src/codeintel/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.0"

{codecortex-0.4.0 → codecortex-0.5.0}/src/codeintel/__main__.py

@@ -90,6 +90,8 @@ def main() -> None:
     reset_parser.add_argument("--yes", "-y", action="store_true", help="Skip the confirmation prompt")
     reset_parser.add_argument("--json", action="store_true", help="Emit the structured JSON report")
 
+    subparsers.add_parser("gen-token", help="Print a secure random bearer token (for serve-http / RBAC auth.toml)")
+
     args = parser.parse_args()
 
     from codeintel import term
@@ -355,6 +357,11 @@ def main() -> None:
 
         sys.exit(0 if any_ok else 1)
 
+    elif args.command == "gen-token":
+        import secrets
+        print(secrets.token_urlsafe(32))
+        sys.exit(0)
+
     else:
         parser.print_help()
         sys.exit(0)

codecortex-0.5.0/src/codeintel/auth.py

@@ -0,0 +1,120 @@
+"""Token→role authentication and RBAC for the HTTP transport.
+
+An optional auth config (``~/.codeintel/auth.toml`` or ``$CODEINTEL_AUTH_CONFIG``) maps bearer
+tokens to roles and roles to the operations they may run. The role is derived **server-side from
+the authenticated token** — a client can never escalate by claiming a role in the request body.
+
+Example ``auth.toml``::
+
+    [roles]
+    admin    = ["*"]                       # ["*"] (or omitted) = every op
+    reader   = ["search", "symbol", "overview", "callers", "callees", "impact", "chain", "context"]
+    searcher = ["search", "context"]
+
+    [tokens]                               # token = role  (store this file mode 0600)
+    "s3cret-admin-value"      = "admin"
+    "sha256:<hex-of-a-token>" = "reader"   # pre-hashed form, so plaintext need not be at rest
+
+SSO: put an OIDC auth proxy (e.g. oauth2-proxy) in front and have it present a per-role bearer
+token to codeintel — codeintel never speaks to the IdP itself (local-first, no per-query network).
+"""
+from __future__ import annotations
+
+import hashlib
+import logging
+import os
+import pathlib
+import tomllib  # stdlib on Python 3.11+ (the project's minimum)
+from typing import Dict, List, Optional
+
+from codeintel.policy import TieringPolicy
+
+logger = logging.getLogger("codeintel")
+
+_ALL = "*"
+_SHA_PREFIX = "sha256:"
+
+
+class TokenAuth:
+    """Resolves a bearer token to a role and builds the matching op policy. Tokens are held as
+    sha256 hashes; a presented token is hashed and looked up in O(1). Immutable; thread-safe."""
+
+    def __init__(self, token_hash_to_role: Dict[str, str], role_ops: Dict[str, List[str]]) -> None:
+        self._tokens = token_hash_to_role
+        self._role_ops = role_ops
+
+    @property
+    def enabled(self) -> bool:
+        return bool(self._tokens)
+
+    def role_for(self, presented_token: str) -> Optional[str]:
+        """The role for a presented token, or None if it isn't a known token."""
+        if not presented_token:
+            return None
+        h = hashlib.sha256(presented_token.encode("utf-8")).hexdigest()
+        return self._tokens.get(h)
+
+    def build_policy(self) -> TieringPolicy:
+        """A role with ops ``["*"]`` (or none) is unrestricted → omit it from the rules, since
+        TieringPolicy treats a role absent from its rules as full-access. Every other role maps to
+        its explicit op allowlist (an empty list = deny all ops, a fail-safe default)."""
+        rules: Dict[str, List[str]] = {}
+        for role, ops in self._role_ops.items():
+            if _ALL in ops:
+                continue  # unrestricted
+            rules[role] = list(ops)
+        return TieringPolicy(enabled=bool(rules), rules=rules)
+
+
+def _auth_config_path() -> Optional[pathlib.Path]:
+    env = os.environ.get("CODEINTEL_AUTH_CONFIG", "").strip()
+    if env:
+        p = pathlib.Path(env)
+        return p if p.is_file() else None
+    default = pathlib.Path.home() / ".codeintel" / "auth.toml"
+    return default if default.is_file() else None
+
+
+def load_auth() -> TokenAuth:
+    """Load the token→role config if present. Never raises — a missing or malformed file yields an
+    empty (disabled) TokenAuth, and the caller falls back to single-token / no-auth."""
+    path = _auth_config_path()
+    if path is None:
+        return TokenAuth({}, {})
+    try:
+        with path.open("rb") as fh:
+            data = tomllib.load(fh)
+    except Exception as exc:
+        logger.warning("auth: %s could not be parsed (%s) — RBAC is OFF", path, type(exc).__name__)
+        return TokenAuth({}, {})
+
+    raw_roles = data.get("roles") if isinstance(data.get("roles"), dict) else {}
+    role_ops: Dict[str, List[str]] = {}
+    for role, ops in raw_roles.items():
+        if isinstance(ops, list):
+            role_ops[str(role)] = [str(o) for o in ops]
+        else:
+            # Fail CLOSED: a non-list ops value (the missing-brackets typo `reader = "search"`) must
+            # never silently become full access — deny all ops for that role instead.
+            logger.warning("auth: role %r ops must be a list (got %r) — denying all ops for it", role, ops)
+            role_ops[str(role)] = []
+
+    raw_tokens = data.get("tokens") if isinstance(data.get("tokens"), dict) else {}
+    token_hash_to_role: Dict[str, str] = {}
+    for tok, role in raw_tokens.items():
+        role = str(role)
+        # A token mapped to an undefined role fails safe: define it as deny-all (empty op list).
+        if role not in role_ops:
+            role_ops[role] = []
+        tok = str(tok)
+        if tok[:len(_SHA_PREFIX)].lower() == _SHA_PREFIX:  # case-insensitive `sha256:` prefix
+            h = tok[len(_SHA_PREFIX):].strip().lower()
+        else:
+            h = hashlib.sha256(tok.encode("utf-8")).hexdigest()
+        if h:
+            token_hash_to_role[h] = role
+
+    if not token_hash_to_role:
+        logger.warning("auth: %s defines no usable [tokens] — RBAC is OFF (no token→role mapping)", path)
+
+    return TokenAuth(token_hash_to_role, role_ops)

{codecortex-0.4.0 → codecortex-0.5.0}/src/codeintel/gateway.py

@@ -132,6 +132,14 @@ class Gateway:
             log_swallowed(f"Gateway._dispatch_single[{engine_str}.{op_str}]", exc)
             return safe_null_result(op_str, target_str, engine=engine_str, reason="provider-error")
 
+    def allows(self, role: str, op: str) -> bool:
+        """Whether *role* may run *op* under the current policy (True when no policy is configured).
+        Lets non-query handlers (e.g. doctor) share the same RBAC gate as query()."""
+        try:
+            return self._policy is None or self._policy.is_allowed(role, op)
+        except Exception:
+            return True
+
     def query(
         self,
         op=None,
@@ -142,16 +150,25 @@ class Gateway:
         project_root=None,
     ) -> Result:
         try:
-            try:
-                self._reindexer.maybe_reindex(str(project_root or ""))
-            except Exception:
-                pass
-
             op_str = str(op or "")
             target_str = str(target or "")
             engine_str = str(engine or "").strip() or "auto"
             was_auto = engine_str == "auto"
 
+            # Policy check FIRST — a role denied for this op does NO work (no reindex, no dispatch,
+            # no cache lookup). Applies to the modern provider path; the legacy list path has none.
+            if (
+                self._legacy_providers is None
+                and self._policy is not None
+                and not self._policy.is_allowed(role, op_str)
+            ):
+                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
+
+            try:
+                self._reindexer.maybe_reindex(str(project_root or ""))
+            except Exception:
+                pass
+
             # Legacy list-based path (backward compat with pre-Phase-2 tests)
             if self._legacy_providers is not None:
                 for p in self._legacy_providers:
@@ -164,10 +181,6 @@ class Gateway:
                 reason = "engine-unavailable" if engine is not None else "no-result"
                 return safe_null_result(op_str, target_str, reason=reason)
 
-            # Policy check — before cache lookup
-            if self._policy is not None and not self._policy.is_allowed(role, op_str):
-                return safe_null_result(op_str, target_str, reason="op-not-allowed-for-role")
-
             # Unknown engine — reject immediately
             if engine_str not in _KNOWN_ENGINES:
                 return safe_null_result(op_str, target_str, reason="unknown-engine")

{codecortex-0.4.0 → codecortex-0.5.0}/src/codeintel/http_server.py

@@ -81,24 +81,30 @@ class _Handler(BaseHTTPRequestHandler):
         self.wfile.write(body)
         self._observe(status)
 
-    def _authorized(self) -> bool:
-        """When the server was started with a token, require ``Authorization: Bearer <token>``
-        (constant-time compare). No token configured → auth is disabled (the loopback default)."""
-        token = getattr(self.server, "auth_token", None)
-        if not token:
-            return True
+    def _bearer(self) -> str:
         header = self.headers.get("Authorization", "")
         prefix = "Bearer "
-        if not header.startswith(prefix):
-            return False
-        presented = header[len(prefix):].strip()
-        # Compare as UTF-8 bytes: hmac.compare_digest raises TypeError on a non-ASCII str, so a
-        # malformed header (e.g. `Bearer résumé`) would otherwise crash the handler thread. Encoding
-        # is always safe and keeps the comparison constant-time.
-        return hmac.compare_digest(presented.encode("utf-8"), token.encode("utf-8"))
+        return header[len(prefix):].strip() if header.startswith(prefix) else ""
+
+    def _resolve_role(self) -> tuple[bool, str]:
+        """Authenticate the request and return ``(authorized, role)``. The role is
+        **server-authoritative** — derived from the token, never from the request body. RBAC (a
+        token→role auth config) takes precedence; else a single shared token; else no auth (the
+        loopback default). Bytes-compare so a non-ASCII header can't crash ``hmac.compare_digest``."""
+        auth = getattr(self.server, "token_auth", None)
+        if auth is not None and auth.enabled:
+            role = auth.role_for(self._bearer())
+            return (role is not None, role or "")
+        token = getattr(self.server, "auth_token", None)
+        if not token:
+            return (True, "")  # auth disabled → full access, no role
+        presented = self._bearer()
+        ok = bool(presented) and hmac.compare_digest(presented.encode("utf-8"), token.encode("utf-8"))
+        return (ok, "")
 
     def do_POST(self) -> None:
-        if not self._authorized():
+        ok, role = self._resolve_role()
+        if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
         if self.path not in ("/code/query", "/code/doctor"):
@@ -122,11 +128,14 @@ class _Handler(BaseHTTPRequestHandler):
         if not isinstance(parsed, dict):
             self._send_json(400, {"error": "bad-request"})
             return
+        parsed["role"] = role  # server-authoritative — overrides any client-supplied role (no escalation)
         if self.path == "/code/doctor":
             result = code_doctor_handler(parsed)
         else:
             result = code_query_handler(parsed)
-        self._send_json(200, result)
+        # An RBAC denial (query OR doctor) comes back as a safe-null with this reason — 403 it.
+        status = 403 if result.get("reason") == "op-not-allowed-for-role" else 200
+        self._send_json(status, result)
 
     def do_GET(self) -> None:
         parsed = urlparse(self.path)
@@ -147,9 +156,10 @@ class _Handler(BaseHTTPRequestHandler):
                 self._send_json(503, {"status": "not-ready"})
             return
 
-        # Everything else is auth-gated when a token is configured (metrics can reveal usage
-        # patterns; status reveals engine/index state).
-        if not self._authorized():
+        # Everything else is auth-gated when auth is configured (metrics can reveal usage patterns;
+        # status reveals engine/index state). Any valid token/role may read these operational views.
+        ok, _ = self._resolve_role()
+        if not ok:
             self._send_json(401, {"error": "unauthorized"})
             return
 
@@ -175,7 +185,8 @@ class CodeIntelHTTPServer(ThreadingHTTPServer):
     # lock-guarded (query cache, reindexer, LSP sessions, graph project cache) and the semantic
     # engine is thread-confined with WAL, so concurrent requests are safe.
     daemon_threads = True
-    auth_token: str | None = None  # set by run() when a token is provided
+    auth_token: str | None = None  # set by run() when a single shared token is provided
+    token_auth = None              # set by run(): a TokenAuth for RBAC (token->role), if configured
 
     def __init__(self, *args, **kwargs) -> None:
         super().__init__(*args, **kwargs)
@@ -246,27 +257,36 @@ def run(
     token: str | None = None,
 ) -> None:
     configure_logging()
+    from codeintel.auth import load_auth
+    token_auth = load_auth()                          # RBAC (token→role), if an auth config exists
     server_token = (token or "").strip() or None
+    authenticated = bool(server_token) or token_auth.enabled
     if not _is_loopback(host):
         if not allow_remote:
             print(f"refusing to bind non-loopback host {host!r} without --allow-remote — this would "
                   f"expose a code-intel endpoint (your indexed repo) to the network", file=sys.stderr)
             raise SystemExit(2)
-        if not server_token and not _no_auth_override():
+        if not authenticated and not _no_auth_override():
             # Fail closed: never serve an UNAUTHENTICATED endpoint on the network by accident (a
-            # containerized `serve-http --host 0.0.0.0` with no token stops here unless overridden).
-            print(f"refusing to serve on {host}:{port} with NO authentication — set --token or "
-                  f"CODEINTEL_HTTP_TOKEN (recommended), or set CODEINTEL_ALLOW_NO_AUTH=1 to override "
-                  f"for a trusted network", file=sys.stderr)
+            # containerized `serve-http --host 0.0.0.0` with no auth stops here unless overridden).
+            print(f"refusing to serve on {host}:{port} with NO authentication — set --token / "
+                  f"CODEINTEL_HTTP_TOKEN, configure an RBAC auth.toml, or set CODEINTEL_ALLOW_NO_AUTH=1 "
+                  f"to override for a trusted network", file=sys.stderr)
             raise SystemExit(2)
 
     server = CodeIntelHTTPServer((host, port), _Handler)
     server.auth_token = server_token
-    if not _is_loopback(host) and not server_token:
+    server.token_auth = token_auth
+    if not _is_loopback(host) and not authenticated:
         print(f"WARNING: serving codeintel on {host}:{port} with NO authentication "
               f"(CODEINTEL_ALLOW_NO_AUTH set) — anyone who can reach this port can read your "
               f"indexed repo", file=sys.stderr)
-    auth_note = "  (bearer-token auth required)" if server_token else ""
+    if token_auth.enabled:
+        auth_note = "  (RBAC: token→role auth)"
+    elif server_token:
+        auth_note = "  (bearer-token auth required)"
+    else:
+        auth_note = ""
     print(f"Listening on http://{host}:{port}{auth_note}")
 
     def _graceful(signum, frame) -> None:

{codecortex-0.4.0 → codecortex-0.5.0}/src/codeintel/server.py

@@ -32,7 +32,15 @@ def _build_gateway() -> Gateway:
     except Exception:
         pass
     semantic = SemanticProvider()
-    policy = TieringPolicy(enabled=False)
+    # RBAC: when an auth config defines restricted roles, enforce role→op; otherwise the policy is
+    # disabled (full access). The per-request role is authenticated server-side by the HTTP layer;
+    # the local MCP agent passes role="" (unrestricted), so RBAC never affects the stdio transport.
+    try:
+        from codeintel.auth import load_auth
+        auth = load_auth()
+        policy = auth.build_policy() if auth.enabled else TieringPolicy(enabled=False)
+    except Exception:
+        policy = TieringPolicy(enabled=False)
     return Gateway(graph=graph, lsp=lsp, semantic=semantic, policy=policy, reindexer=_REINDEXER)
 
 
@@ -148,9 +156,18 @@ def code_doctor_handler(args: dict) -> dict:
 
         project_root = str(args.get("project_root", "") or "")
         deep = bool(args.get("deep", False))
+        role = str(args.get("role", "") or "")
         # Reuse the singleton gateway's providers so the report reflects the LIVE warmed LSP
         # session state an agent's real queries hit (and the graph project cache).
         gw = _get_gateway()
+        # RBAC: doctor is a privileged op (engine state + a deep LSP boot on an arbitrary path), so
+        # it's gated behind the "doctor" scope — a restricted role must list it (or use "*").
+        if not gw.allows(role, "doctor"):
+            return {
+                "ok": True, "project_root": project_root, "deep": deep,
+                "summary": {"ready": 0, "total": 3, "healthy": False},
+                "engines": {}, "reason": "op-not-allowed-for-role",
+            }
         return _doctor.run_doctor(
             project_root, deep=deep, graph=gw.graph, lsp=gw.lsp, semantic=gw.semantic
         )

codecortex-0.5.0/tests/test_rbac.py

@@ -0,0 +1,169 @@
+"""RBAC (0.5.0): token→role authentication + per-role op scopes, enforced server-side. The role
+is derived from the authenticated token, never from the request body — a client cannot escalate."""
+from __future__ import annotations
+
+import hashlib
+import http.client
+import json
+import threading
+
+import pytest
+
+from codeintel.auth import TokenAuth, load_auth
+from codeintel.http_server import CodeIntelHTTPServer, _Handler
+
+
+# --------------------------------------------------------------------------- auth config loading
+
+def test_load_auth_parses_roles_and_tokens(tmp_path, monkeypatch):
+    cfg = tmp_path / "auth.toml"
+    cfg.write_text('[roles]\nadmin = ["*"]\nreader = ["search", "context"]\n'
+                   '[tokens]\n"admin-tok" = "admin"\n"reader-tok" = "reader"\n')
+    monkeypatch.setenv("CODEINTEL_AUTH_CONFIG", str(cfg))
+    auth = load_auth()
+    assert auth.enabled
+    assert auth.role_for("admin-tok") == "admin"
+    assert auth.role_for("reader-tok") == "reader"
+    assert auth.role_for("unknown") is None
+
+
+def test_load_auth_missing_file_is_disabled(tmp_path, monkeypatch):
+    monkeypatch.setenv("CODEINTEL_AUTH_CONFIG", str(tmp_path / "nope.toml"))
+    assert not load_auth().enabled
+
+
+def test_load_auth_malformed_file_is_disabled_not_raised(tmp_path, monkeypatch):
+    (tmp_path / "auth.toml").write_text("this is not === valid toml")
+    monkeypatch.setenv("CODEINTEL_AUTH_CONFIG", str(tmp_path / "auth.toml"))
+    assert not load_auth().enabled
+
+
+def test_sha256_prefixed_token_matches_plaintext(tmp_path, monkeypatch):
+    h = hashlib.sha256(b"secret-value").hexdigest()
+    (tmp_path / "auth.toml").write_text(f'[roles]\nadmin = ["*"]\n[tokens]\n"sha256:{h}" = "admin"\n')
+    monkeypatch.setenv("CODEINTEL_AUTH_CONFIG", str(tmp_path / "auth.toml"))
+    assert load_auth().role_for("secret-value") == "admin"  # hashed at rest, matches plaintext
+
+
+def test_build_policy_restricts_and_omits_wildcard():
+    auth = TokenAuth({"h1": "admin", "h2": "reader"}, {"admin": ["*"], "reader": ["search"]})
+    pol = auth.build_policy()
+    assert pol.is_allowed("admin", "impact")       # ["*"] → unrestricted
+    assert pol.is_allowed("reader", "search")      # in the allowlist
+    assert not pol.is_allowed("reader", "impact")  # not in the allowlist
+
+
+# --------------------------------------------------------------------------- HTTP enforcement
+
+@pytest.fixture
+def rbac_server(tmp_path, monkeypatch):
+    (tmp_path / "auth.toml").write_text(
+        '[roles]\nadmin = ["*"]\nreader = ["search", "context"]\n'
+        '[tokens]\n"admintok" = "admin"\n"readertok" = "reader"\n'
+    )
+    monkeypatch.setenv("CODEINTEL_AUTH_CONFIG", str(tmp_path / "auth.toml"))
+    from codeintel import server as srv
+    srv._reset_gateway()  # rebuild the gateway so its policy reflects THIS auth config
+    s = CodeIntelHTTPServer(("127.0.0.1", 0), _Handler)
+    s.token_auth = load_auth()  # the same config the gateway policy is built from
+    threading.Thread(target=s.serve_forever, daemon=True).start()
+    yield s.server_address[1]
+    s.shutdown()
+    srv._reset_gateway()  # cleanup: the next test rebuilds without this policy
+
+
+def _query(port, body, token=None):
+    headers = {"Content-Type": "application/json"}
+    if token:
+        headers["Authorization"] = f"Bearer {token}"
+    c = http.client.HTTPConnection("127.0.0.1", port, timeout=5)
+    c.request("POST", "/code/query", json.dumps(body).encode(), headers)
+    r = c.getresponse()
+    out = json.loads(r.read())
+    c.close()
+    return r.status, out
+
+
+def test_rbac_no_token_is_401(rbac_server):
+    assert _query(rbac_server, {"op": "search", "target": "x"})[0] == 401
+
+
+def test_rbac_invalid_token_is_401(rbac_server):
+    assert _query(rbac_server, {"op": "search", "target": "x"}, token="bogus")[0] == 401
+
+
+def test_rbac_admin_passes_the_policy_for_a_restricted_op(rbac_server):
+    status, body = _query(rbac_server, {"op": "impact", "target": "x"}, token="admintok")
+    assert status == 200
+    assert body.get("reason") != "op-not-allowed-for-role"  # admin is allowed (engine may still be null)
+
+
+def test_rbac_reader_denied_disallowed_op_is_403(rbac_server):
+    status, body = _query(rbac_server, {"op": "impact", "target": "x"}, token="readertok")
+    assert status == 403
+    assert body["reason"] == "op-not-allowed-for-role"
+
+
+def test_rbac_reader_allowed_op_is_not_denied(rbac_server):
+    status, body = _query(rbac_server, {"op": "search", "target": "x"}, token="readertok")
+    assert status == 200
+    assert body.get("reason") != "op-not-allowed-for-role"
+
+
+def test_rbac_role_is_server_authoritative_no_body_escalation(rbac_server):
+    # A reader token claiming role="admin" in the body must STILL be treated as a reader.
+    status, body = _query(rbac_server, {"op": "impact", "target": "x", "role": "admin"}, token="readertok")
+    assert status == 403
+    assert body["reason"] == "op-not-allowed-for-role"
+
+
+def test_load_auth_non_list_ops_fails_closed(tmp_path, monkeypatch):
+    # `reader = "search"` (missing brackets) must DENY ALL, never silently grant full access.
+    (tmp_path / "auth.toml").write_text('[roles]\nadmin = ["*"]\nreader = "search"\n[tokens]\n"t" = "reader"\n')
+    monkeypatch.setenv("CODEINTEL_AUTH_CONFIG", str(tmp_path / "auth.toml"))
+    pol = load_auth().build_policy()
+    assert not pol.is_allowed("reader", "search")  # fail-closed, not the "*" fallback
+    assert not pol.is_allowed("reader", "impact")
+
+
+def _doctor(port, token):
+    c = http.client.HTTPConnection("127.0.0.1", port, timeout=5)
+    c.request("POST", "/code/doctor", b'{"project_root":"/tmp"}',
+              {"Content-Type": "application/json", "Authorization": f"Bearer {token}"})
+    r = c.getresponse()
+    body = json.loads(r.read())
+    c.close()
+    return r.status, body
+
+
+def test_rbac_reader_denied_doctor_is_403(rbac_server):
+    status, body = _doctor(rbac_server, "readertok")   # reader has no "doctor" scope
+    assert status == 403 and body["reason"] == "op-not-allowed-for-role"
+
+
+def test_rbac_admin_allowed_doctor(rbac_server):
+    status, body = _doctor(rbac_server, "admintok")     # admin is ["*"]
+    assert status == 200 and body.get("reason") != "op-not-allowed-for-role"
+
+
+def test_denied_op_does_no_reindex_work(monkeypatch):
+    from codeintel.gateway import Gateway
+    from codeintel.policy import TieringPolicy
+    from codeintel.reindexer import Reindexer
+    rx = Reindexer()
+    calls = {"n": 0}
+    monkeypatch.setattr(rx, "maybe_reindex", lambda root: calls.__setitem__("n", calls["n"] + 1))
+    gw = Gateway(graph=None, lsp=None, semantic=None,
+                 policy=TieringPolicy(enabled=True, rules={"reader": ["search"]}), reindexer=rx)
+    denied = gw.query(op="impact", target="x", role="reader", project_root="/tmp/x")
+    assert denied["reason"] == "op-not-allowed-for-role"
+    assert calls["n"] == 0                              # policy denial skips reindex entirely
+    gw.query(op="search", target="x", role="reader", project_root="/tmp/x")
+    assert calls["n"] == 1                              # an allowed op proceeds to reindex
+
+
+def test_rbac_healthz_still_unauthenticated(rbac_server):
+    c = http.client.HTTPConnection("127.0.0.1", rbac_server, timeout=5)
+    c.request("GET", "/healthz")
+    assert c.getresponse().status == 200  # probes never require a token, even under RBAC
+    c.close()

codecortex-0.4.0/src/codeintel/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.4.0"