Gate MCP tool calls on human approval

crates/crank-community-mcp/src/app.rs

@@ -13,12 +13,13 @@ use axum::{
     routing::{get, post},
 };
 use crank_core::{
-    ApprovalRequestId, ApprovalRequestStatus, AuthProfile, CoordinationStateStore, InvocationLevel,
-    InvocationLog, InvocationLogId, InvocationSource, InvocationStatus, PlatformApiKeyScope,
-    SecretId,
+    ApprovalRequest, ApprovalRequestId, ApprovalRequestStatus, AuthProfile, CoordinationStateStore,
+    InvocationLevel, InvocationLog, InvocationLogId, InvocationSource, InvocationStatus,
+    PlatformApiKeyScope, SecretId,
 };
 use crank_registry::{
-    CreateInvocationLogRequest, DecideApprovalRequest, PostgresRegistry, PublishedAgentTool,
+    CreateApprovalRequest, CreateInvocationLogRequest, DecideApprovalRequest, PostgresRegistry,
+    PublishedAgentTool,
 };
 use crank_runtime::{
     RequestRateLimiter, ResolvedAuth, RuntimeError, RuntimeExecutionRequest, RuntimeExecutor,
@@ -736,6 +737,20 @@ async fn handle_base_tool_call(
     let tool = execution.tool;
     let arguments = execution.arguments;
     let operation = runtime_operation(&tool);
+    if let Some(response) = maybe_create_pending_approval(
+        &state,
+        session,
+        message,
+        response_mode,
+        &tool,
+        &arguments,
+        transport_request_id,
+    )
+    .await
+    {
+        return response;
+    }
+
     let mut runtime_request_context = RuntimeRequestContext::from_request_id(transport_request_id)
         .with_response_cache_scope(
             tool.workspace_id.as_str().to_owned(),
@@ -819,6 +834,112 @@ async fn handle_base_tool_call(
     }
 }
 
+async fn maybe_create_pending_approval(
+    state: &Arc<AppState>,
+    session: &SessionState,
+    message: &Value,
+    response_mode: ResponseMode,
+    tool: &PublishedAgentTool,
+    arguments: &Value,
+    transport_request_id: &str,
+) -> Option<Response> {
+    let policy = tool.operation.execution_config.approval_policy.as_ref()?;
+    if !policy.required {
+        return None;
+    }
+
+    let approval_id = ApprovalRequestId::new(format!("approval_{}", uuid::Uuid::now_v7().simple()));
+    let now = OffsetDateTime::now_utc();
+    let expires_at = now + time::Duration::seconds(i64::from(policy.ttl_seconds));
+    let approval_url = approval_url_for(tool, &approval_id);
+    let response_payload = json!({
+        "status": "approval_required",
+        "approval_id": approval_id.as_str(),
+        "approval_url": approval_url,
+        "approve": {
+            "method": "POST",
+            "url": format!("{approval_url}/approve"),
+            "body": { "approve": "yes" }
+        },
+        "deny": {
+            "method": "POST",
+            "url": format!("{approval_url}/deny"),
+            "body": { "approve": "no" }
+        },
+        "expires_at": expires_at,
+        "risk_level": policy.risk_level,
+        "confirmation_title": policy.confirmation_title,
+        "confirmation_body": policy.confirmation_body_template,
+        "payload_preview": if policy.show_payload_preview {
+            arguments.clone()
+        } else {
+            Value::Null
+        },
+    });
+    let approval = ApprovalRequest {
+        id: approval_id,
+        workspace_id: tool.workspace_id.clone(),
+        agent_id: tool.agent_id.clone(),
+        operation_id: tool.operation.id.clone(),
+        operation_version: tool.operation.version,
+        status: ApprovalRequestStatus::Pending,
+        risk_level: policy.risk_level,
+        confirmation_title: policy.confirmation_title.clone(),
+        confirmation_body: policy.confirmation_body_template.clone(),
+        request_payload: arguments.clone(),
+        response_payload: None,
+        created_at: now,
+        expires_at,
+        decided_at: None,
+        decided_by_key_id: None,
+        decision_note: None,
+    };
+
+    if let Err(error) = state
+        .registry
+        .create_approval_request(CreateApprovalRequest {
+            approval: &approval,
+        })
+        .await
+    {
+        return Some(internal_jsonrpc_error(message, error));
+    }
+
+    let _ = persist_invocation(
+        state,
+        tool,
+        InvocationRecord {
+            request_id: Some(transport_request_id),
+            tool_name: &tool.tool_name,
+            status: InvocationStatus::Ok,
+            level: InvocationLevel::Info,
+            message: "agent tool call is waiting for human approval",
+            status_code: None,
+            error_kind: None,
+            duration: Duration::from_millis(0),
+            request_preview: arguments.clone(),
+            response_preview: response_payload.clone(),
+        },
+    )
+    .await;
+
+    Some(success_tool_response(
+        message,
+        response_mode,
+        &session.protocol_version,
+        response_payload,
+    ))
+}
+
+fn approval_url_for(tool: &PublishedAgentTool, approval_id: &ApprovalRequestId) -> String {
+    format!(
+        "/v1/{}/{}/approvals/{}",
+        tool.workspace_slug,
+        tool.agent_slug,
+        approval_id.as_str()
+    )
+}
+
 async fn handle_initialize(
     state: Arc<AppState>,
     path: &AgentRoutePath,