mcp: enforce operation security levels

2026-05-03 19:26:38 +00:00
parent 076cead491
commit 34d345158f
3 changed files with 205 additions and 52 deletions
@@ -1588,6 +1588,147 @@ mod tests {
        assert_eq!(response.status(), reqwest::StatusCode::FORBIDDEN);
    }

+    #[tokio::test]
+    async fn rejects_elevated_operation_with_static_agent_key() {
+        let registry = test_registry().await;
+        let upstream_base_url = spawn_upstream_server().await;
+        let mut operation = test_operation(&upstream_base_url, "crm_elevated_static");
+        operation.security_level = crank_core::OperationSecurityLevel::Elevated;
+
+        registry
+            .create_operation(&test_workspace_id(), &operation, Some("alice"))
+            .await
+            .unwrap();
+        registry
+            .publish_operation(PublishRequest {
+                workspace_id: &test_workspace_id(),
+                operation_id: &operation.id,
+                version: 1,
+                published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
+                published_by: Some("alice"),
+            })
+            .await
+            .unwrap();
+        publish_agent_for_operation(&registry, &operation, "sales-elevated-static").await;
+        let api_key = create_platform_api_key(
+            &registry,
+            "sales-elevated-static",
+            "mcp-elevated-static",
+            &[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
+        )
+        .await;
+
+        let base_url = spawn_mcp_server(build_test_app(
+            registry,
+            Duration::from_millis(0),
+            Some("https://crank.example.com".to_owned()),
+        ))
+        .await;
+        let client = reqwest::Client::new();
+        let mcp_url = agent_mcp_url(&base_url, "sales-elevated-static");
+        let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
+        let call_result = post_jsonrpc(
+            &client,
+            &mcp_url,
+            &api_key,
+            Some(&initialized_session),
+            json!({
+                "jsonrpc": "2.0",
+                "id": 2,
+                "method": "tools/call",
+                "params": {
+                    "name": "crm_elevated_static",
+                    "arguments": {
+                        "email": "alice@example.com"
+                    }
+                }
+            }),
+        )
+        .await;
+
+        assert_eq!(call_result["result"]["isError"], json!(true));
+        assert_eq!(
+            call_result["result"]["structuredContent"]["error"]["code"],
+            "machine_access_insufficient"
+        );
+        assert_eq!(
+            call_result["result"]["structuredContent"]["error"]["context"]["machine_access_mode"],
+            "static_agent_key"
+        );
+        assert_eq!(
+            call_result["result"]["structuredContent"]["error"]["context"]["required_security_level"],
+            "elevated"
+        );
+    }
+
+    #[tokio::test]
+    async fn allows_elevated_operation_with_verified_short_lived_token() {
+        let registry = test_registry().await;
+        let upstream_base_url = spawn_upstream_server().await;
+        let mut operation = test_operation(&upstream_base_url, "crm_elevated_token");
+        operation.security_level = crank_core::OperationSecurityLevel::Elevated;
+
+        registry
+            .create_operation(&test_workspace_id(), &operation, Some("alice"))
+            .await
+            .unwrap();
+        registry
+            .publish_operation(PublishRequest {
+                workspace_id: &test_workspace_id(),
+                operation_id: &operation.id,
+                version: 1,
+                published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
+                published_by: Some("alice"),
+            })
+            .await
+            .unwrap();
+        publish_agent_for_operation(&registry, &operation, "sales-elevated-token").await;
+
+        let verifier = Arc::new(StubMachineCredentialVerifier {
+            token: "issued_token_elevated".to_owned(),
+            credential: VerifiedMachineCredential {
+                machine_access_mode: crank_core::MachineAccessMode::ShortLivedToken,
+                max_security_level: crank_core::OperationSecurityLevel::Elevated,
+                scopes: vec![PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
+            },
+        });
+
+        let base_url = spawn_mcp_server(build_test_app_with_store(
+            registry,
+            Duration::from_millis(0),
+            Some("https://crank.example.com".to_owned()),
+            RequestRateLimitConfig::new(10_000, 10_000).unwrap(),
+            std::sync::Arc::new(InMemorySessionStore::default()),
+            verifier,
+        ))
+        .await;
+        let client = reqwest::Client::new();
+        let mcp_url = agent_mcp_url(&base_url, "sales-elevated-token");
+        let initialized_session =
+            initialize_session(&client, &mcp_url, "issued_token_elevated").await;
+        let call_result = post_jsonrpc(
+            &client,
+            &mcp_url,
+            "issued_token_elevated",
+            Some(&initialized_session),
+            json!({
+                "jsonrpc": "2.0",
+                "id": 2,
+                "method": "tools/call",
+                "params": {
+                    "name": "crm_elevated_token",
+                    "arguments": {
+                        "email": "alice@example.com"
+                    }
+                }
+            }),
+        )
+        .await;
+
+        assert_eq!(call_result["result"]["isError"], json!(false));
+        assert_eq!(call_result["result"]["structuredContent"]["id"], "lead_123");
+    }
+
    #[tokio::test]
    async fn exposes_and_runs_session_tool_family_via_mcp() {
        let registry = test_registry().await;