lambda-erp 0.8.28__tar.gz → 0.8.29__tar.gz

{lambda_erp-0.8.28 → lambda_erp-0.8.29}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lambda-erp
-Version: 0.8.28
+Version: 0.8.29
 Summary: Core ERP logic - accounting, sales, purchasing, inventory
 Author: TORUS INVESTMENTS AG
 License-Expression: Apache-2.0

{lambda_erp-0.8.28 → lambda_erp-0.8.29}/api/chat.py

@@ -27,6 +27,7 @@ from fastapi import APIRouter, Depends as _Depends, HTTPException, WebSocket, We
 from openai import OpenAI
 
 from api import services
+from api.tool_permissions import tool_allowed, tool_permission_error
 from api.demo_limits import (
     demo_call_reserve_usd,
     demo_max_completion_tokens,
@@ -1438,10 +1439,12 @@ def build_tools(user_info: dict | None = None):
         role = user_info.get("role")
         action_tools = [
             tool for tool in action_tools
-            if services.registered_action_allowed(tool["function"]["name"], role)
+            if tool_allowed(tool["function"]["name"], role)
         ]
-        if role not in {"manager", "admin"}:
-            hidden_tools.add("import_bank_statement_attachments")
+        hidden_tools = {
+            tool["function"]["name"] for tool in TOOLS
+            if not tool_allowed(tool["function"]["name"], role)
+        }
     if not extra_docs and not extra_masters and not action_tools and not hidden_tools:
         return TOOLS
     tools = copy.deepcopy(TOOLS)
@@ -3556,7 +3559,8 @@ async def run_thinking_loop(
             # If GPT is delegating report code-gen to the Anthropic specialist,
             # surface the handoff in the UI.
             will_delegate_to_code_specialist = (
-                fn_name in ("create_custom_analytics_report", "update_custom_analytics_report")
+                tool_allowed(fn_name, user_role)
+                and fn_name in ("create_custom_analytics_report", "update_custom_analytics_report")
                 and not fn_args.get("transform_js")
                 and not fn_args.get("data_requests")
             )
@@ -3569,7 +3573,12 @@ async def run_thinking_loop(
                 })
 
             handler = tool_handlers.get(fn_name)
-            if not handler:
+            # The model's tool list and prompt are not authorization controls.
+            # Check the caller at execution even for invented or replayed calls.
+            if not tool_allowed(fn_name, user_role):
+                result = tool_permission_error(fn_name, user_role)
+                success = False
+            elif not handler:
                 result = {"error": f"Unknown tool: {fn_name}"}
                 success = False
             else:

{lambda_erp-0.8.28 → lambda_erp-0.8.29}/api/routers/mcp.py

@@ -25,6 +25,7 @@ from api.auth import get_current_user
 from api import services
 from api import chat as chat_mod
 from api.chat import TOOL_HANDLERS, build_tools
+from api.tool_permissions import tool_allowed
 
 router = APIRouter(tags=["mcp"])
 
@@ -42,37 +43,10 @@ _EXCLUDE = {
     "plan_company_setup",
     "apply_company_setup",
 }
-# Mirror the REST permission model: reads are viewer+, writes are manager+,
-# delete_master is admin-only (the handler also re-checks).
-_WRITE = {
-    "create_document", "update_document", "batch_update_documents",
-    "submit_document", "cancel_document",
-    "discard_document", "convert_document", "create_master", "update_master",
-    "reconcile_bank_transaction", "undo_bank_reconciliation",
-}
-_ADMIN = {"delete_master"}
-_MANAGER_ONLY = {
-    "list_bank_reconciliation_queue", "suggest_bank_reconciliation",
-    "reconcile_bank_transaction", "undo_bank_reconciliation",
-}
-
-
-def _can_write(role) -> bool:
-    return role in ("manager", "admin", "public_manager")
 
 
 def _allowed(name: str, role) -> bool:
-    if name in _EXCLUDE:
-        return False
-    if name in services.REGISTERED_ACTIONS:
-        return services.registered_action_allowed(name, role)
-    if name in _ADMIN:
-        return role == "admin"
-    if name in _MANAGER_ONLY:
-        return role in ("manager", "admin")
-    if name in _WRITE:
-        return _can_write(role)
-    return True
+    return name not in _EXCLUDE and tool_allowed(name, role)
 
 
 def _require_caller(request: Request) -> dict:
@@ -99,6 +73,9 @@ def _tools(role) -> list:
 
 
 def _call(name: str, args: dict, user: dict):
+    # Preserve MCP's unknown-tool error without dispatching an unclassified tool.
+    if name not in TOOL_HANDLERS and name != "delete_master" and name not in services.REGISTERED_ACTIONS:
+        raise KeyError(name)
     role = user.get("role")
     if not _allowed(name, role):
         return {"error": f"'{name}' is not available to a {role or 'viewer'} key."}

lambda_erp-0.8.29/api/tool_permissions.py

@@ -0,0 +1,52 @@
+"""Shared execution policy for ERP tools exposed through chat and MCP.
+
+Every built-in tool must be classified here. Unknown tools and unknown callers
+are denied; registered extension actions carry their own explicit policy.
+Session ownership and other resource checks still belong to their handlers.
+"""
+
+from api import services
+
+
+_READERS = frozenset({"viewer", "manager", "admin", "public_manager"})
+_DOCUMENT_WRITERS = frozenset({"manager", "admin", "public_manager"})
+_MANAGERS = frozenset({"manager", "admin"})
+_ADMINS = frozenset({"admin"})
+
+TOOL_ROLES = {
+    **dict.fromkeys((
+        "list_documents", "get_document_fields", "get_document",
+        "get_master_fields", "search_masters", "get_report", "get_current_time",
+        "retrieve_chat_history", "list_chat_attachments", "retrieve_chat_attachment",
+        "preview_bank_statement_attachments", "query_dataset",
+        # Personal report drafts follow the viewer-accessible reporting API.
+        # Their handlers enforce ownership; these do not post ERP transactions.
+        "create_custom_analytics_report", "get_custom_analytics_report",
+        "update_custom_analytics_report",
+    ), _READERS),
+    **dict.fromkeys((
+        "create_document", "update_document", "batch_update_documents",
+        "submit_document", "cancel_document", "discard_document", "convert_document",
+    ), _DOCUMENT_WRITERS),
+    **dict.fromkeys((
+        "create_master", "update_master", "revalue_currencies",
+        "import_bank_statement_attachments", "list_bank_reconciliation_queue",
+        "suggest_bank_reconciliation", "reconcile_bank_transaction",
+        "undo_bank_reconciliation",
+    ), _MANAGERS),
+    **dict.fromkeys((
+        "delete_master", "plan_company_setup", "apply_company_setup",
+    ), _ADMINS),
+}
+
+
+def tool_allowed(name: str, role: str | None) -> bool:
+    if role not in _READERS:
+        return False
+    if name in TOOL_ROLES:
+        return role in TOOL_ROLES[name]
+    return services.registered_action_allowed(name, role)
+
+
+def tool_permission_error(name: str, role: str | None) -> dict:
+    return {"error": f"Tool '{name}' is not available to role '{role or 'unauthenticated'}'."}

{lambda_erp-0.8.28 → lambda_erp-0.8.29}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lambda-erp"
-version = "0.8.28"
+version = "0.8.29"
 description = "Core ERP logic - accounting, sales, purchasing, inventory"
 readme = "README.md"
 license = "Apache-2.0"