56 lines
1.7 KiB
Markdown
56 lines
1.7 KiB
Markdown
|
# Task ID: 58
|
||
|
|
|
||
|
|
**Title:** Add RBAC for prompt link creation
|
||
|
|
|
||
|
|
**Status:** done
|
||
|
|
|
||
|
|
**Dependencies:** 56 ✓
|
||
|
|
|
||
|
|
**Priority:** medium
|
||
|
|
|
||
|
|
**Description:** Implement RBAC checks requiring edit permission on the target project to create prompt links, and auto-create service account permission on the source project.
|
||
|
|
|
||
|
|
**Details:**
|
||
|
|
|
||
|
|
1. Update prompt creation in `/src/mcpd/src/services/prompt.service.ts`:
|
||
|
|
```typescript
|
||
|
|
async createPrompt(data: CreatePromptInput, userId: string): Promise<Prompt> {
|
||
|
|
if (data.linkTarget) {
|
||
|
|
// Verify user has edit permission on target project RBAC
|
||
|
|
const hasPermission = await this.rbacService.checkPermission(
|
||
|
|
userId, data.projectId, 'edit'
|
||
|
|
);
|
||
|
|
if (!hasPermission) {
|
||
|
|
throw new ForbiddenError('Edit permission required to create prompt links');
|
||
|
|
}
|
||
|
|
|
||
|
|
// Parse link target
|
||
|
|
const { project: sourceProject, server, uri } = this.parseLink(data.linkTarget);
|
||
|
|
|
||
|
|
// Create service account permission on source project
|
||
|
|
await this.rbacService.createServiceAccountPermission(
|
||
|
|
data.projectId, // target project
|
||
|
|
sourceProject, // source project
|
||
|
|
server,
|
||
|
|
uri,
|
||
|
|
'read'
|
||
|
|
);
|
||
|
|
}
|
||
|
|
|
||
|
|
return this.promptRepo.create(data);
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
2. Clean up service account permission when link is deleted
|
||
|
|
|
||
|
|
3. Handle permission denied from source project
|
||
|
|
|
||
|
|
**Test Strategy:**
|
||
|
|
|
||
|
|
- Unit test: Link creation requires edit permission
|
||
|
|
- Unit test: Link creation without permission throws 403
|
||
|
|
- Unit test: Service account permission created on source project
|
||
|
|
- Unit test: Service account permission deleted when link deleted
|
||
|
|
- Unit test: Non-link prompts skip RBAC checks
|
||
|
|
- Integration test: End-to-end link creation with RBAC
|