stacklok / toolhive / 35605414532

71%

Build Type

push

github

Committed by web-flow

Commit Message

Merge commit from fork

* Authorize completion and subscription references

The direct proxy's authorization middleware classified completion/complete
and subscriptions/listen as protocol-level methods with an empty
feature/operation pair, which skips the authorizer entirely. Both methods
name a capability policy can already decide on: a completion request
references a concrete prompt or resource template, and a subscription
request lists resource URIs the backend registers for change notifications.
An identity denied a prompt or resource could therefore reach backend
completion candidates for it, or observe its existence and change timing,
through methods no policy was ever consulted about.

Neither classification could be expressed as a static feature/operation
pair: completion's feature depends on the reference type in the body, and a
subscription names many resources at once. Both are moved out of
MCPMethodToFeatureOperation into derivedAuthorizers, which derives the
checks from the request body and is consulted before the static map, so no
always-allowed entry can shadow them. A prompt reference requires the same
get decision prompts/get requires; a resource reference and every
subscribed URI require the same read decision resources/read requires.

Requests whose authorization target cannot be established are denied rather
than authorized under an empty identifier, and a subscription list is
admitted as a unit so the backend never registers a set that differs from
the one authorized. Derived checks pass no arguments: Cedar namespaces
arguments as arg_*, and the parser hands completion its entire params map,
so forwarding it would let a caller forge values for a policy condition the
real prompts/get could not satisfy.

Two behaviors change for existing deployments. A resource-template
reference is authorized as the template string, its own Cedar entity id, so
a policy naming only concrete URIs no longer permits template completions.
The legacy bar... (continued)

Coverage Stats

111 of 116 new or added lines in 2 files covered. (95.69%)

57 existing lines in 3 files now uncovered.

83920 of 118418 relevant lines covered (70.87%)

107.67 hits per line