rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add tools and update authenticztion and RBAC

Browse Source 
Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2025-11-21 10:22:01 +01:00
parent deb656d95e
commit dfd924abeb
16 changed files with 15634 additions and 39441 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
pkg/server/api/mcp/v1/middleware.go
View File

@@ -16,12 +16,11 @@ package mcp_v1
import (
"net/http"
"strings"
"go.gearno.de/kit/log"
"go.probo.inc/probo/pkg/auth"
"go.probo.inc/probo/pkg/authz"
"go.probo.inc/probo/pkg/gid"
serverauth "go.probo.inc/probo/pkg/server/auth"
)
// WithMCPAuth wraps an HTTP handler with MCP authentication middleware
@@ -44,71 +43,27 @@ func WithMCPAuth(
log.String("path", r.URL.Path),
)
// Extract API key from Authorization header
authHeader := r.Header.Get("Authorization")
if authHeader == "" {
logger.WarnCtx(ctx, "MCP auth: missing Authorization header",
// Authenticate using API key from shared function
authCtx := serverauth.AuthenticateWithAPIKey(ctx, r, authSvc, authzSvc)
if authCtx == nil {
logger.WarnCtx(ctx, "MCP auth: authentication required",
log.String("correlation_id", correlationID),
)
http.Error(w, "authentication required", http.StatusUnauthorized)
return
}
// Expect "Bearer <token>" format
parts := strings.SplitN(authHeader, " ", 2)
if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
logger.WarnCtx(ctx, "MCP auth: invalid Authorization header format",
log.String("correlation_id", correlationID),
)
http.Error(w, "invalid authorization header", http.StatusUnauthorized)
return
}
user := serverauth.UserFromContext(authCtx)
userAPIKey := serverauth.UserAPIKeyFromContext(authCtx)
tenantAccess := serverauth.UserTenantAccessFromContext(authCtx)
apiKeyToken := parts[1]
// Validate the API key
user, userAPIKey, err := authSvc.ValidateUserAPIKey(ctx, apiKeyToken)
if err != nil {
logger.WarnCtx(ctx, "MCP auth: invalid API key",
log.Error(err),
log.String("correlation_id", correlationID),
)
http.Error(w, "invalid api key", http.StatusUnauthorized)
return
}
// Get organizations for this API key through the service layer
organizations, err := authzSvc.GetAllOrganizationsForUserAPIKeyId(ctx, userAPIKey.ID)
if err != nil {
logger.ErrorCtx(ctx, "MCP auth: failed to load API key organizations",
log.Error(err),
log.String("correlation_id", correlationID),
)
http.Error(w, "internal server error", http.StatusInternalServerError)
return
}
// Extract tenant IDs from organizations
tenantIDs := make([]gid.TenantID, 0, len(organizations))
for _, org := range organizations {
tenantIDs = append(tenantIDs, org.ID.TenantID())
}
// Create MCP context with user and accessible tenants
mcpCtx := &MCPContext{
UserID: user.ID,
TenantIDs: tenantIDs,
}
ctx = ContextWithMCPContext(ctx, mcpCtx)
logger.InfoCtx(ctx, "MCP authentication successful",
logger.InfoCtx(authCtx, "MCP authentication successful",
log.String("correlation_id", correlationID),
log.String("user_id", user.ID.String()),
log.String("api_key_id", userAPIKey.ID.String()),
log.Int("accessible_tenants", len(tenantIDs)),
log.Int("accessible_tenants", len(tenantAccess.TenantIDs)),
)
next.ServeHTTP(w, r.WithContext(ctx))
next.ServeHTTP(w, r.WithContext(authCtx))
})
}