mcp_authorization.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#include <entropic/mcp/mcp_authorization.h>
#include <entropic/types/logging.h>
 
#include <nlohmann/json.hpp>
 
static auto logger = entropic::log::get("mcp.authorization");
 
namespace entropic {
 
void MCPAuthorizationManager::register_identity(
    const std::string& identity_name) {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    key_sets_.try_emplace(identity_name);
    logger->info("Registered identity: {}", identity_name);
}
 
bool MCPAuthorizationManager::is_enforced(
    const std::string& identity_name) const {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    return key_sets_.count(identity_name) > 0;
}
 
entropic_error_t MCPAuthorizationManager::grant(
    const std::string& identity_name,
    const std::string& pattern,
    MCPAccessLevel level) {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    auto it = key_sets_.find(identity_name);
    if (it == key_sets_.end()) {
        return ENTROPIC_ERROR_IDENTITY_NOT_FOUND;
    }
    it->second.grant(pattern, level);
    return ENTROPIC_OK;
}
 
entropic_error_t MCPAuthorizationManager::revoke(
    const std::string& identity_name,
    const std::string& pattern) {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    auto it = key_sets_.find(identity_name);
    if (it == key_sets_.end()) {
        return ENTROPIC_ERROR_IDENTITY_NOT_FOUND;
    }
    it->second.revoke(pattern);
    return ENTROPIC_OK;
}
 
bool MCPAuthorizationManager::check_access(
    const std::string& identity_name,
    const std::string& tool_name,
    MCPAccessLevel required_level) const {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    auto it = key_sets_.find(identity_name);
    if (it == key_sets_.end()) {
        logger->info("Auth ALLOW: {} on {} (no enforcement)",
                     identity_name, tool_name);
        return true;
    }
    bool allowed = it->second.has_access(tool_name, required_level);
    logger->info("Auth {}: {} on {} (required={})",
                 allowed ? "ALLOW" : "DENY",
                 identity_name, tool_name,
                 static_cast<int>(required_level));
    return allowed;
}
 
entropic_error_t MCPAuthorizationManager::grant_from(
    const std::string& granter_name,
    const std::string& grantee_name,
    const std::string& pattern,
    MCPAccessLevel level) {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    auto granter = key_sets_.find(granter_name);
    auto grantee = key_sets_.find(grantee_name);
    if (granter == key_sets_.end() ||
        grantee == key_sets_.end()) {
        return ENTROPIC_ERROR_IDENTITY_NOT_FOUND;
    }
    if (!granter->second.has_access(pattern, level)) {
        logger->warn("{} lacks {}:{} — cannot grant to {}",
                     granter_name, pattern,
                     mcp_access_level_name(level), grantee_name);
        return ENTROPIC_ERROR_PERMISSION_DENIED;
    }
    grantee->second.grant(pattern, level);
    logger->info("{} granted {}:{} to {}", granter_name, pattern,
                 mcp_access_level_name(level), grantee_name);
    return ENTROPIC_OK;
}
 
std::vector<MCPKey> MCPAuthorizationManager::list_keys(
    const std::string& identity_name) const {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    auto it = key_sets_.find(identity_name);
    if (it == key_sets_.end()) {
        return {};
    }
    return it->second.list();
}
 
std::string MCPAuthorizationManager::serialize_all() const {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    nlohmann::json obj = nlohmann::json::object();
    for (const auto& [name, key_set] : key_sets_) {
        auto keys_json = key_set.serialize();
        obj[name] = nlohmann::json::parse(keys_json);
    }
    return obj.dump();
}
 
bool MCPAuthorizationManager::deserialize_all(
    const std::string& json) {
    nlohmann::json obj;
    try {
        obj = nlohmann::json::parse(json);
    } catch (const nlohmann::json::exception& e) {
        logger->warn("Deserialize failed: {}", e.what());
        return false;
    }
    if (!obj.is_object()) {
        logger->warn("Deserialize: expected JSON object");
        return false;
    }
    std::lock_guard<std::mutex> lock(auth_mutex_);
    key_sets_.clear();
    for (const auto& [name, keys_arr] : obj.items()) {
        auto [it, _] = key_sets_.try_emplace(name);
        it->second.deserialize(keys_arr.dump());
    }
    return true;
}
 
void MCPAuthorizationManager::unregister_identity(
    const std::string& identity_name) {
    std::lock_guard<std::mutex> lock(auth_mutex_);
    key_sets_.erase(identity_name);
    logger->info("Unregistered identity: {}", identity_name);
}
 
} // namespace entropic