stacklok / toolhive / 26912592654

66%

Build Type

push

github

Committed by web-flow

Commit Message

Thread VirtualMCPServer name into Cedar authz middleware (#5448)

Cedar authorization policies compiled by the operator reference the
actual VirtualMCPServer name as the resource entity (e.g. MCP::"my-vmcp").
The factory hard-coded the string "vmcp" when calling
authz.CreateMiddlewareFromConfig, so the resource entity never matched
and Cedar's default-deny fired on every request — 403 for all principals
regardless of policy.

Fix by adding a serverName parameter to NewIncomingAuthMiddleware and
newCedarAuthzMiddleware, and passing vmcpCfg.Name at the serve.go call
site. Adds a regression test that scopes a Cedar permit policy to a
specific resource name and asserts it is honoured.

Fixes #5428

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Coverage Stats

4 of 7 new or added lines in 2 files covered. (57.14%)

2 existing lines in 1 file now uncovered.

66398 of 100835 relevant lines covered (65.85%)

63.51 hits per line