rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rewrite identity and access management

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-12-03 19:23:15 +01:00
parent 4ed3f5a067
commit 74fc3b8cd1
201 changed files with 32895 additions and 23649 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
pkg/server/api/mcp/mcputils/recovery.go
View File

@@ -22,7 +22,7 @@ import (
"github.com/modelcontextprotocol/go-sdk/mcp"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/iam"
)
func RecoveryMiddleware(logger *log.Logger) func(mcp.MethodHandler) mcp.MethodHandler {
@@ -47,14 +47,14 @@ func convertPanicToError(ctx context.Context, logger *log.Logger, panicValue any
return fmt.Errorf("internal server error")
}
var tenantAccessErr *authz.TenantAccessError
var tenantAccessErr *iam.TenantAccessError
if errTyped, ok := panicValue.(error); ok && errors.As(errTyped, &tenantAccessErr) {
return fmt.Errorf("not authorized: %s", tenantAccessErr.Message)
}
var permissionDeniedErr *authz.PermissionDeniedError
var permissionDeniedErr *iam.ErrInsufficientPermissions
if errTyped, ok := panicValue.(error); ok && errors.As(errTyped, &permissionDeniedErr) {
return fmt.Errorf("permission denied: %s", permissionDeniedErr.Message)
return fmt.Errorf("permission denied: %s", permissionDeniedErr.Error())
}
if err, ok := panicValue.(error); ok {

37
pkg/server/api/mcp/v1/middleware.go
View File

@@ -17,18 +17,15 @@ package mcp_v1
import (
"net/http"
"errors"
"go.gearno.de/kit/httpserver"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
serverauth "go.probo.inc/probo/pkg/server/auth"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
)
// WithMCPAuth wraps an HTTP handler with MCP authentication middleware
// It authenticates using API keys from the Authorization header
func WithMCPAuth(
func RequireAPIKeyHandler(
logger *log.Logger,
authSvc *auth.Service,
authzSvc *authz.Service,
next http.Handler,
) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -43,27 +40,19 @@ func WithMCPAuth(
log.String("path", r.URL.Path),
)
// Authenticate using API key from shared function
authCtx := serverauth.AuthenticateWithAPIKey(ctx, r, authSvc, authzSvc)
if authCtx == nil {
logger.WarnCtx(ctx, "MCP auth: authentication required",
log.String("correlation_id", correlationID),
)
http.Error(w, "authentication required", http.StatusUnauthorized)
apiKey := connect_v1.APIKeyFromContext(ctx)
identity := connect_v1.UserFromContext(ctx)
if identity == nil {
httpserver.RenderError(w, http.StatusUnauthorized, errors.New("authentication required"))
return
}
user := serverauth.UserFromContext(authCtx)
userAPIKey := serverauth.UserAPIKeyFromContext(authCtx)
tenantAccess := serverauth.UserTenantAccessFromContext(authCtx)
logger.InfoCtx(authCtx, "MCP authentication successful",
logger.InfoCtx(ctx, "MCP authentication successful",
log.String("correlation_id", correlationID),
log.String("user_id", user.ID.String()),
log.String("api_key_id", userAPIKey.ID.String()),
log.Int("accessible_tenants", len(tenantAccess.TenantIDs)),
log.String("identity_id", identity.ID.String()),
log.String("api_key_id", apiKey.ID.String()),
)
next.ServeHTTP(w, r.WithContext(authCtx))
next.ServeHTTP(w, r.WithContext(ctx))
})
}

33
pkg/server/api/mcp/v1/resolver.go
View File

@@ -6,39 +6,32 @@ import (
"context"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/probo"
serverauth "go.probo.inc/probo/pkg/server/auth"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
)
type Resolver struct {
proboSvc *probo.Service
authSvc *auth.Service
authzSvc *authz.Service
iamSvc *iam.Service
logger *log.Logger
}
func (r *Resolver) MustBeAuthorized(ctx context.Context, entityID gid.GID, action authz.Action) {
user := serverauth.UserFromContext(ctx)
apiKey := serverauth.UserAPIKeyFromContext(ctx)
func (r *Resolver) MustBeAuthorized(ctx context.Context, entityID gid.GID, action iam.Action) {
user := connect_v1.UserFromContext(ctx)
apiKey := connect_v1.APIKeyFromContext(ctx)
if user == nil {
panic(&authz.TenantAccessError{Message: "authentication required"})
panic(&iam.TenantAccessError{Message: "authentication required"})
}
authzSvc := r.AuthzService(ctx, entityID.TenantID())
err := authzSvc.Authorize(ctx, user, apiKey, entityID, action)
var credentialID *gid.GID
if apiKey != nil {
credentialID = &apiKey.ID
}
err := r.iamSvc.AccessManagementService.Authorize(ctx, user.ID, credentialID, entityID, action)
if err != nil {
panic(err)
}
}
func (r *Resolver) AuthzService(ctx context.Context, tenantID gid.TenantID) *authz.TenantAuthzService {
return GetTenantAuthzService(ctx, r.authzSvc, tenantID)
}
func GetTenantAuthzService(ctx context.Context, authzSvc *authz.Service, tenantID gid.TenantID) *authz.TenantAuthzService {
serverauth.RequireTenantAccess(ctx, tenantID)
return authzSvc.WithTenant(tenantID)
}

169
pkg/server/api/mcp/v1/schema.resolvers.go
View File

@@ -9,24 +9,21 @@ import (
"fmt"
"github.com/modelcontextprotocol/go-sdk/mcp"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/coredata"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/mail"
"go.probo.inc/probo/pkg/page"
"go.probo.inc/probo/pkg/probo"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
"go.probo.inc/probo/pkg/server/api/mcp/v1/types"
serverauth "go.probo.inc/probo/pkg/server/auth"
)
// ListOrganizationsTool handles the listOrganizations tool
// List all organizations the user has access to
func (r *Resolver) ListOrganizationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListOrganizationsInput) (*mcp.CallToolResult, types.ListOrganizationsOutput, error) {
user := serverauth.UserFromContext(ctx)
if user == nil {
return nil, types.ListOrganizationsOutput{}, fmt.Errorf("authentication required")
}
user := connect_v1.UserFromContext(ctx)
organizations, err := r.authzSvc.GetAllUserOrganizations(ctx, user.ID)
organizations, err := r.iamSvc.AccountService.ListOrganizations(ctx, user.ID)
if err != nil {
return nil, types.ListOrganizationsOutput{}, fmt.Errorf("failed to list organizations: %w", err)
}
@@ -45,7 +42,7 @@ func (r *Resolver) ListOrganizationsTool(ctx context.Context, req *mcp.CallToolR
// ListVendorsTool handles the listVendors tool
// List all vendors for the organization
func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListVendorsInput) (*mcp.CallToolResult, types.ListVendorsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListVendors)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListVendors)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -78,7 +75,7 @@ func (r *Resolver) ListVendorsTool(ctx context.Context, req *mcp.CallToolRequest
// AddVendorTool handles the addVendor tool
// Add a new vendor to the organization
func (r *Resolver) AddVendorTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddVendorInput) (*mcp.CallToolResult, types.AddVendorOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateAsset)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateAsset)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -122,7 +119,7 @@ func (r *Resolver) UpdateVendorTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) ListPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListPeopleInput) (*mcp.CallToolResult, types.ListPeopleOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListPeople)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListPeople)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -153,7 +150,7 @@ func (r *Resolver) ListPeopleTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) GetPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetPeopleInput) (*mcp.CallToolResult, types.GetPeopleOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -168,7 +165,7 @@ func (r *Resolver) GetPeopleTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) AddPeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddPeopleInput) (*mcp.CallToolResult, types.AddPeopleOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreatePeople)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreatePeople)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -200,7 +197,7 @@ func (r *Resolver) AddPeopleTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) UpdatePeopleTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdatePeopleInput) (*mcp.CallToolResult, types.UpdatePeopleOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdatePeople)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdatePeople)
svc := r.ProboService(ctx, input.ID)
@@ -227,7 +224,7 @@ func (r *Resolver) UpdatePeopleTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListRisksInput) (*mcp.CallToolResult, types.ListRisksOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListRisks)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListRisks)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -258,7 +255,7 @@ func (r *Resolver) ListRisksTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetRiskInput) (*mcp.CallToolResult, types.GetRiskOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -273,7 +270,7 @@ func (r *Resolver) GetRiskTool(ctx context.Context, req *mcp.CallToolRequest, in
}
func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddRiskInput) (*mcp.CallToolResult, types.AddRiskOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateRisk)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateRisk)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -301,7 +298,7 @@ func (r *Resolver) AddRiskTool(ctx context.Context, req *mcp.CallToolRequest, in
}
func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateRiskInput) (*mcp.CallToolResult, types.UpdateRiskOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateRisk)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateRisk)
svc := r.ProboService(ctx, input.ID)
@@ -330,7 +327,7 @@ func (r *Resolver) UpdateRiskTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListMeasuresInput) (*mcp.CallToolResult, types.ListMeasuresOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListMeasures)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListMeasures)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -361,7 +358,7 @@ func (r *Resolver) ListMeasuresTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetMeasureInput) (*mcp.CallToolResult, types.GetMeasureOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -376,7 +373,7 @@ func (r *Resolver) GetMeasureTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddMeasureInput) (*mcp.CallToolResult, types.AddMeasureOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateMeasure)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateMeasure)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -399,7 +396,7 @@ func (r *Resolver) AddMeasureTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateMeasureInput) (*mcp.CallToolResult, types.UpdateMeasureOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateMeasure)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateMeasure)
svc := r.ProboService(ctx, input.ID)
@@ -423,7 +420,7 @@ func (r *Resolver) UpdateMeasureTool(ctx context.Context, req *mcp.CallToolReque
}
func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListFrameworksInput) (*mcp.CallToolResult, types.ListFrameworksOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListFrameworks)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListFrameworks)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -449,7 +446,7 @@ func (r *Resolver) ListFrameworksTool(ctx context.Context, req *mcp.CallToolRequ
}
func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetFrameworkInput) (*mcp.CallToolResult, types.GetFrameworkOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -464,7 +461,7 @@ func (r *Resolver) GetFrameworkTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddFrameworkInput) (*mcp.CallToolResult, types.AddFrameworkOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateFramework)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateFramework)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -486,7 +483,7 @@ func (r *Resolver) AddFrameworkTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateFrameworkInput) (*mcp.CallToolResult, types.UpdateFrameworkOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateFramework)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateFramework)
svc := r.ProboService(ctx, input.ID)
@@ -508,7 +505,7 @@ func (r *Resolver) UpdateFrameworkTool(ctx context.Context, req *mcp.CallToolReq
}
func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAssetsInput) (*mcp.CallToolResult, types.ListAssetsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListAssets)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListAssets)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -539,7 +536,7 @@ func (r *Resolver) ListAssetsTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAssetInput) (*mcp.CallToolResult, types.GetAssetOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -554,7 +551,7 @@ func (r *Resolver) GetAssetTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAssetInput) (*mcp.CallToolResult, types.AddAssetOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateAsset)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateAsset)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -580,7 +577,7 @@ func (r *Resolver) AddAssetTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAssetInput) (*mcp.CallToolResult, types.UpdateAssetOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateAsset)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateAsset)
svc := r.ProboService(ctx, input.ID)
@@ -606,7 +603,7 @@ func (r *Resolver) UpdateAssetTool(ctx context.Context, req *mcp.CallToolRequest
}
func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDataInput) (*mcp.CallToolResult, types.ListDataOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListData)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListData)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -637,7 +634,7 @@ func (r *Resolver) ListDataTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDatumInput) (*mcp.CallToolResult, types.GetDatumOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -652,7 +649,7 @@ func (r *Resolver) GetDatumTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDatumInput) (*mcp.CallToolResult, types.AddDatumOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateDatum)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateDatum)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -676,7 +673,7 @@ func (r *Resolver) AddDatumTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDatumInput) (*mcp.CallToolResult, types.UpdateDatumOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateDatum)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateDatum)
svc := r.ProboService(ctx, input.ID)
@@ -700,7 +697,7 @@ func (r *Resolver) UpdateDatumTool(ctx context.Context, req *mcp.CallToolRequest
}
func (r *Resolver) ListNonconformitiesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListNonconformitiesInput) (*mcp.CallToolResult, types.ListNonconformitiesOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListNonconformities)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListNonconformities)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -731,7 +728,7 @@ func (r *Resolver) ListNonconformitiesTool(ctx context.Context, req *mcp.CallToo
}
func (r *Resolver) GetNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetNonconformityInput) (*mcp.CallToolResult, types.GetNonconformityOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -746,7 +743,7 @@ func (r *Resolver) GetNonconformityTool(ctx context.Context, req *mcp.CallToolRe
}
func (r *Resolver) AddNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddNonconformityInput) (*mcp.CallToolResult, types.AddNonconformityOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateNonconformity)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateNonconformity)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -776,7 +773,7 @@ func (r *Resolver) AddNonconformityTool(ctx context.Context, req *mcp.CallToolRe
}
func (r *Resolver) UpdateNonconformityTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateNonconformityInput) (*mcp.CallToolResult, types.UpdateNonconformityOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateNonconformity)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateNonconformity)
svc := r.ProboService(ctx, input.ID)
@@ -806,7 +803,7 @@ func (r *Resolver) UpdateNonconformityTool(ctx context.Context, req *mcp.CallToo
}
func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListObligationsInput) (*mcp.CallToolResult, types.ListObligationsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListObligations)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListObligations)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -837,7 +834,7 @@ func (r *Resolver) ListObligationsTool(ctx context.Context, req *mcp.CallToolReq
}
func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetObligationInput) (*mcp.CallToolResult, types.GetObligationOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -852,7 +849,7 @@ func (r *Resolver) GetObligationTool(ctx context.Context, req *mcp.CallToolReque
}
func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddObligationInput) (*mcp.CallToolResult, types.AddObligationOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateObligation)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateObligation)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -882,7 +879,7 @@ func (r *Resolver) AddObligationTool(ctx context.Context, req *mcp.CallToolReque
}
func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateObligationInput) (*mcp.CallToolResult, types.UpdateObligationOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateObligation)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateObligation)
svc := r.ProboService(ctx, input.ID)
@@ -912,7 +909,7 @@ func (r *Resolver) UpdateObligationTool(ctx context.Context, req *mcp.CallToolRe
}
func (r *Resolver) ListContinualImprovementsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListContinualImprovementsInput) (*mcp.CallToolResult, types.ListContinualImprovementsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListContinualImprovements)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListContinualImprovements)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -943,7 +940,7 @@ func (r *Resolver) ListContinualImprovementsTool(ctx context.Context, req *mcp.C
}
func (r *Resolver) GetContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetContinualImprovementInput) (*mcp.CallToolResult, types.GetContinualImprovementOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -958,7 +955,7 @@ func (r *Resolver) GetContinualImprovementTool(ctx context.Context, req *mcp.Cal
}
func (r *Resolver) AddContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddContinualImprovementInput) (*mcp.CallToolResult, types.AddContinualImprovementOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateContinualImprovement)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateContinualImprovement)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -985,7 +982,7 @@ func (r *Resolver) AddContinualImprovementTool(ctx context.Context, req *mcp.Cal
}
func (r *Resolver) UpdateContinualImprovementTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateContinualImprovementInput) (*mcp.CallToolResult, types.UpdateContinualImprovementOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateContinualImprovement)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateContinualImprovement)
svc := r.ProboService(ctx, input.ID)
@@ -1012,7 +1009,7 @@ func (r *Resolver) UpdateContinualImprovementTool(ctx context.Context, req *mcp.
}
func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListAuditsInput) (*mcp.CallToolResult, types.ListAuditsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListAudits)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListAudits)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -1038,7 +1035,7 @@ func (r *Resolver) ListAuditsTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetAuditInput) (*mcp.CallToolResult, types.GetAuditOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -1053,7 +1050,7 @@ func (r *Resolver) GetAuditTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddAuditInput) (*mcp.CallToolResult, types.AddAuditOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateAudit)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateAudit)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -1078,7 +1075,7 @@ func (r *Resolver) AddAuditTool(ctx context.Context, req *mcp.CallToolRequest, i
}
func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateAuditInput) (*mcp.CallToolResult, types.UpdateAuditOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateAudit)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateAudit)
svc := r.ProboService(ctx, input.ID)
@@ -1103,7 +1100,7 @@ func (r *Resolver) UpdateAuditTool(ctx context.Context, req *mcp.CallToolRequest
}
func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListControlsInput) (*mcp.CallToolResult, types.ListControlsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListControls)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListControls)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -1134,7 +1131,7 @@ func (r *Resolver) ListControlsTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetControlInput) (*mcp.CallToolResult, types.GetControlOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -1149,7 +1146,7 @@ func (r *Resolver) GetControlTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddControlInput) (*mcp.CallToolResult, types.AddControlOutput, error) {
r.MustBeAuthorized(ctx, input.FrameworkID, authz.ActionCreateControl)
r.MustBeAuthorized(ctx, input.FrameworkID, iam.ActionCreateControl)
svc := r.ProboService(ctx, input.FrameworkID)
@@ -1174,7 +1171,7 @@ func (r *Resolver) AddControlTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateControlInput) (*mcp.CallToolResult, types.UpdateControlOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateControl)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateControl)
svc := r.ProboService(ctx, input.ID)
@@ -1199,7 +1196,7 @@ func (r *Resolver) UpdateControlTool(ctx context.Context, req *mcp.CallToolReque
}
func (r *Resolver) LinkControlMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlMeasureInput) (*mcp.CallToolResult, types.LinkControlMeasureOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlMeasureMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlMeasureMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1212,7 +1209,7 @@ func (r *Resolver) LinkControlMeasureTool(ctx context.Context, req *mcp.CallTool
}
func (r *Resolver) UnlinkControlMeasureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlMeasureInput) (*mcp.CallToolResult, types.UnlinkControlMeasureOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlMeasureMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlMeasureMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1225,7 +1222,7 @@ func (r *Resolver) UnlinkControlMeasureTool(ctx context.Context, req *mcp.CallTo
}
func (r *Resolver) LinkControlDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlDocumentInput) (*mcp.CallToolResult, types.LinkControlDocumentOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlDocumentMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlDocumentMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1238,7 +1235,7 @@ func (r *Resolver) LinkControlDocumentTool(ctx context.Context, req *mcp.CallToo
}
func (r *Resolver) UnlinkControlDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlDocumentInput) (*mcp.CallToolResult, types.UnlinkControlDocumentOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlDocumentMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlDocumentMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1251,7 +1248,7 @@ func (r *Resolver) UnlinkControlDocumentTool(ctx context.Context, req *mcp.CallT
}
func (r *Resolver) LinkControlAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlAuditInput) (*mcp.CallToolResult, types.LinkControlAuditOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlAuditMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlAuditMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1264,7 +1261,7 @@ func (r *Resolver) LinkControlAuditTool(ctx context.Context, req *mcp.CallToolRe
}
func (r *Resolver) UnlinkControlAuditTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlAuditInput) (*mcp.CallToolResult, types.UnlinkControlAuditOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlAuditMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlAuditMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1277,7 +1274,7 @@ func (r *Resolver) UnlinkControlAuditTool(ctx context.Context, req *mcp.CallTool
}
func (r *Resolver) LinkControlSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.LinkControlSnapshotInput) (*mcp.CallToolResult, types.LinkControlSnapshotOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionCreateControlSnapshotMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionCreateControlSnapshotMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1290,7 +1287,7 @@ func (r *Resolver) LinkControlSnapshotTool(ctx context.Context, req *mcp.CallToo
}
func (r *Resolver) UnlinkControlSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnlinkControlSnapshotInput) (*mcp.CallToolResult, types.UnlinkControlSnapshotOutput, error) {
r.MustBeAuthorized(ctx, input.ControlID, authz.ActionDeleteControlSnapshotMapping)
r.MustBeAuthorized(ctx, input.ControlID, iam.ActionDeleteControlSnapshotMapping)
svc := r.ProboService(ctx, input.ControlID)
@@ -1303,7 +1300,7 @@ func (r *Resolver) UnlinkControlSnapshotTool(ctx context.Context, req *mcp.CallT
}
func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListTasksInput) (*mcp.CallToolResult, types.ListTasksOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListTasks)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListTasks)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -1329,7 +1326,7 @@ func (r *Resolver) ListTasksTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetTaskInput) (*mcp.CallToolResult, types.GetTaskOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -1343,7 +1340,7 @@ func (r *Resolver) GetTaskTool(ctx context.Context, req *mcp.CallToolRequest, in
}
func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddTaskInput) (*mcp.CallToolResult, types.AddTaskOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateTask)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateTask)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -1368,7 +1365,7 @@ func (r *Resolver) AddTaskTool(ctx context.Context, req *mcp.CallToolRequest, in
}
func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateTaskInput) (*mcp.CallToolResult, types.UpdateTaskOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateTask)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateTask)
svc := r.ProboService(ctx, input.ID)
@@ -1394,7 +1391,7 @@ func (r *Resolver) UpdateTaskTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AssignTaskInput) (*mcp.CallToolResult, types.AssignTaskOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionAssignTask)
r.MustBeAuthorized(ctx, input.ID, iam.ActionAssignTask)
svc := r.ProboService(ctx, input.ID)
@@ -1409,7 +1406,7 @@ func (r *Resolver) AssignTaskTool(ctx context.Context, req *mcp.CallToolRequest,
}
func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UnassignTaskInput) (*mcp.CallToolResult, types.UnassignTaskOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUnassignTask)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUnassignTask)
svc := r.ProboService(ctx, input.ID)
@@ -1423,7 +1420,7 @@ func (r *Resolver) UnassignTaskTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListSnapshotsInput) (*mcp.CallToolResult, types.ListSnapshotsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListSnapshots)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListSnapshots)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -1449,7 +1446,7 @@ func (r *Resolver) ListSnapshotsTool(ctx context.Context, req *mcp.CallToolReque
}
func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetSnapshotInput) (*mcp.CallToolResult, types.GetSnapshotOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -1463,7 +1460,7 @@ func (r *Resolver) GetSnapshotTool(ctx context.Context, req *mcp.CallToolRequest
}
func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolRequest, input *types.TakeSnapshotInput) (*mcp.CallToolResult, types.TakeSnapshotOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateSnapshot)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateSnapshot)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -1485,7 +1482,7 @@ func (r *Resolver) TakeSnapshotTool(ctx context.Context, req *mcp.CallToolReques
}
func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentsInput) (*mcp.CallToolResult, types.ListDocumentsOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionListDocuments)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionListDocuments)
prb := r.ProboService(ctx, input.OrganizationID)
@@ -1521,7 +1518,7 @@ func (r *Resolver) ListDocumentsTool(ctx context.Context, req *mcp.CallToolReque
}
func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentInput) (*mcp.CallToolResult, types.GetDocumentOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -1536,7 +1533,7 @@ func (r *Resolver) GetDocumentTool(ctx context.Context, req *mcp.CallToolRequest
}
func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.AddDocumentInput) (*mcp.CallToolResult, types.AddDocumentOutput, error) {
r.MustBeAuthorized(ctx, input.OrganizationID, authz.ActionCreateDocument)
r.MustBeAuthorized(ctx, input.OrganizationID, iam.ActionCreateDocument)
svc := r.ProboService(ctx, input.OrganizationID)
@@ -1565,7 +1562,7 @@ func (r *Resolver) AddDocumentTool(ctx context.Context, req *mcp.CallToolRequest
}
func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentInput) (*mcp.CallToolResult, types.UpdateDocumentOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionUpdateDocument)
r.MustBeAuthorized(ctx, input.ID, iam.ActionUpdateDocument)
svc := r.ProboService(ctx, input.ID)
@@ -1590,7 +1587,7 @@ func (r *Resolver) UpdateDocumentTool(ctx context.Context, req *mcp.CallToolRequ
}
func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionsInput) (*mcp.CallToolResult, types.ListDocumentVersionsOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionDocumentVersion)
r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionDocumentVersion)
pageOrderBy := page.OrderBy[coredata.DocumentVersionOrderField]{
Field: coredata.DocumentVersionOrderFieldCreatedAt,
@@ -1615,7 +1612,7 @@ func (r *Resolver) ListDocumentVersionsTool(ctx context.Context, req *mcp.CallTo
}
func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionInput) (*mcp.CallToolResult, types.GetDocumentVersionOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
svc := r.ProboService(ctx, input.ID)
@@ -1630,7 +1627,7 @@ func (r *Resolver) GetDocumentVersionTool(ctx context.Context, req *mcp.CallTool
}
func (r *Resolver) CreateDraftDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CreateDraftDocumentVersionInput) (*mcp.CallToolResult, types.CreateDraftDocumentVersionOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionCreateDraftDocumentVersion)
r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionCreateDraftDocumentVersion)
svc := r.ProboService(ctx, input.DocumentID)
@@ -1645,7 +1642,7 @@ func (r *Resolver) CreateDraftDocumentVersionTool(ctx context.Context, req *mcp.
}
func (r *Resolver) UpdateDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.UpdateDocumentVersionInput) (*mcp.CallToolResult, types.UpdateDocumentVersionOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionUpdateDocumentVersion)
r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionUpdateDocumentVersion)
svc := r.ProboService(ctx, input.DocumentVersionID)
@@ -1666,11 +1663,11 @@ func (r *Resolver) UpdateDocumentVersionTool(ctx context.Context, req *mcp.CallT
}
func (r *Resolver) PublishDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.PublishDocumentVersionInput) (*mcp.CallToolResult, types.PublishDocumentVersionOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionPublishDocumentVersion)
r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionPublishDocumentVersion)
svc := r.ProboService(ctx, input.DocumentID)
user := serverauth.UserFromContext(ctx)
user := connect_v1.UserFromContext(ctx)
document, documentVersion, err := svc.Documents.PublishVersion(ctx, input.DocumentID, user.ID, input.Changelog)
if err != nil {
@@ -1684,7 +1681,7 @@ func (r *Resolver) PublishDocumentVersionTool(ctx context.Context, req *mcp.Call
}
func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ListDocumentVersionSignaturesInput) (*mcp.CallToolResult, types.ListDocumentVersionSignaturesOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionDocumentVersion)
r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionDocumentVersion)
prb := r.ProboService(ctx, input.DocumentVersionID)
@@ -1717,7 +1714,7 @@ func (r *Resolver) ListDocumentVersionSignaturesTool(ctx context.Context, req *m
}
func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.GetDocumentVersionSignatureInput) (*mcp.CallToolResult, types.GetDocumentVersionSignatureOutput, error) {
r.MustBeAuthorized(ctx, input.ID, authz.ActionGet)
r.MustBeAuthorized(ctx, input.ID, iam.ActionGet)
prb := r.ProboService(ctx, input.ID)
@@ -1732,7 +1729,7 @@ func (r *Resolver) GetDocumentVersionSignatureTool(ctx context.Context, req *mcp
}
func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req *mcp.CallToolRequest, input *types.RequestDocumentVersionSignatureInput) (*mcp.CallToolResult, types.RequestDocumentVersionSignatureOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionRequestSignature)
r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionRequestSignature)
svc := r.ProboService(ctx, input.DocumentVersionID)
@@ -1753,7 +1750,7 @@ func (r *Resolver) RequestDocumentVersionSignatureTool(ctx context.Context, req
}
func (r *Resolver) DeleteDraftDocumentVersionTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDraftDocumentVersionInput) (*mcp.CallToolResult, types.DeleteDraftDocumentVersionOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentVersionID, authz.ActionDeleteDraftDocumentVersion)
r.MustBeAuthorized(ctx, input.DocumentVersionID, iam.ActionDeleteDraftDocumentVersion)
svc := r.ProboService(ctx, input.DocumentVersionID)
@@ -1768,7 +1765,7 @@ func (r *Resolver) DeleteDraftDocumentVersionTool(ctx context.Context, req *mcp.
}
func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDocumentInput) (*mcp.CallToolResult, types.DeleteDocumentOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentID, authz.ActionDeleteDocument)
r.MustBeAuthorized(ctx, input.DocumentID, iam.ActionDeleteDocument)
svc := r.ProboService(ctx, input.DocumentID)
@@ -1783,7 +1780,7 @@ func (r *Resolver) DeleteDocumentTool(ctx context.Context, req *mcp.CallToolRequ
}
func (r *Resolver) CancelSignatureRequestTool(ctx context.Context, req *mcp.CallToolRequest, input *types.CancelSignatureRequestInput) (*mcp.CallToolResult, types.CancelSignatureRequestOutput, error) {
r.MustBeAuthorized(ctx, input.DocumentVersionSignatureID, authz.ActionCancelSignatureRequest)
r.MustBeAuthorized(ctx, input.DocumentVersionSignatureID, iam.ActionCancelSignatureRequest)
svc := r.ProboService(ctx, input.DocumentVersionSignatureID)

35
pkg/server/api/mcp/v1/types.go
View File

@@ -1,35 +0,0 @@
// Copyright (c) 2025 Probo Inc <hello@getprobo.com>.
//
// Permission to use, copy, modify, and/or distribute this software for any
// purpose with or without fee is hereby granted, provided that the above
// copyright notice and this permission notice appear in all copies.
//
// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
// PERFORMANCE OF THIS SOFTWARE.
package mcp_v1
import (
"time"
)
type (
Config struct {
Version string
RequestTimeout time.Duration
MaxRequestSize int64
}
)
func DefaultConfig() Config {
return Config{
Version: "1.0.0",
RequestTimeout: 30 * time.Second,
MaxRequestSize: 10 * 1024 * 1024, // 10MB
}
}

21
pkg/server/api/mcp/v1/v1_handler.go
View File

@@ -8,33 +8,27 @@ import (
"github.com/modelcontextprotocol/go-sdk/mcp"
"go.gearno.de/kit/log"
mcpgenmcp "go.probo.inc/mcpgen/mcp"
"go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/gid"
"go.probo.inc/probo/pkg/iam"
"go.probo.inc/probo/pkg/probo"
connect_v1 "go.probo.inc/probo/pkg/server/api/connect/v1"
"go.probo.inc/probo/pkg/server/api/mcp/mcputils"
"go.probo.inc/probo/pkg/server/api/mcp/v1/server"
serverauth "go.probo.inc/probo/pkg/server/auth"
)
func (r *Resolver) ProboService(ctx context.Context, objectID gid.GID) *probo.TenantService {
serverauth.RequireTenantAccess(ctx, objectID.TenantID())
return r.proboSvc.WithTenant(objectID.TenantID())
}
func NewMux(logger *log.Logger, proboSvc *probo.Service, authSvc *auth.Service, authzSvc *authz.Service, cfg Config) *chi.Mux {
func NewMux(logger *log.Logger, proboSvc *probo.Service, iamSvc *iam.Service) *chi.Mux {
logger = logger.Named("mcp.v1")
logger.Info("initializing MCP server",
log.String("version", cfg.Version),
log.String("request_timeout", cfg.RequestTimeout.String()),
)
logger.Info("initializing MCP server")
// server.AddReceivingMiddleware(mcputils.LoggingMiddleware(logger))
resolver := &Resolver{
proboSvc: proboSvc,
authSvc: authSvc,
authzSvc: authzSvc,
iamSvc: iamSvc,
logger: logger,
}
@@ -57,10 +51,9 @@ func NewMux(logger *log.Logger, proboSvc *probo.Service, authSvc *auth.Service,
},
)
authHandler := WithMCPAuth(logger, authSvc, authzSvc, handler)
r := chi.NewMux()
r.Handle("/", authHandler)
r.Use(connect_v1.NewAPIKeyMiddleware(iamSvc))
r.Handle("/", RequireAPIKeyHandler(logger, handler))
logger.Info("MCP server initialized successfully")