stacklok / toolhive / 27221404552

push

github

Wire Cedar admission seam into vMCP core (#5459)

* Wire Cedar admission seam into vMCP core

Authorization runs only as HTTP middleware today (AuthzMiddleware +
AnnotationEnrichmentMiddleware), so a tool can pass tools/list yet be
refused on tools/call — the "list says yes / call says no" gap — because
the two checks live on different paths. Re-platform that single Cedar
decision into the core so List* (filter) and Call/Read/Get (deny)
enforce it from one source.

Implements issue #5438:
- Add the Admission seam (interface + Cedar-backed adapter) in
  pkg/vmcp/core/admission.go. The core moved to its own package in
  #5437; the adapter wraps pkg/authz, which would cycle with the root
  vmcp package, so the seam lives here rather than pkg/vmcp/admission.go.
- Build the authorizer from cfg.Authz via the same factory path the HTTP
  middleware uses (authorizers.GetFactory + CreateAuthorizer); no new
  policy language. A nil cfg.Authz yields an allow-all seam, matching the
  AuthzMiddleware != nil guard.
- Re-inject the explicit identity and core-sourced Tool.Annotations into
  the ctx the authorizer reads, replacing AnnotationEnrichmentMiddleware
  on the domain path.
- Keep optimizer meta-tools (find_tool/call_tool) exempt via
  cfg.PassThroughTools, mirroring the HTTP response filter.
- Add cfg.ServerName/cfg.PassThroughTools to feed the seam.

server.New is untouched: the live path still enforces via middleware in
Phase 1, so double-enforcement only ever occurs in tests that exercise
the core directly. #5441 removes the HTTP middleware.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Address code review feedback

Fixed issues from code review:
- HIGH: newAdmission now rejects an empty ServerName when Authz is set,
  mirroring the live factory's fail-loud check (incoming.go:120) so a
  misconfigured composition root fails at New instead of silently
  changing Cedar resource-scoped policy semantics.
- HIGH: corrected the AllowT... (continued)

172 of 189 new or added lines in 4 files covered. (91.01%)

67162 of 101363 relevant lines covered (66.26%)

63.87 hits per line