mcpctl/.taskmaster/tasks/task_110.md

# Task ID: 110

**Title:** Implement RBAC for ProxyModels

**Status:** deferred

**Dependencies:** 87 ✗

**Priority:** low

**Description:** Add 'run' permission on proxymodels resource controlling which proxymodels users can activate on projects.

**Details:**

Update RBAC schema and enforcement:

1. Add to `src/db/prisma/schema.prisma`:
```prisma
// Extend existing RbacBinding or Permission model
enum RbacResource {
  // ... existing
  proxymodels
}

enum RbacPermission {
  // ... existing
  run     // permission to use a proxymodel
  cache   // permission to push to shared cache
}
```

2. Add enforcement in `src/mcplocal/src/router.ts`:
```typescript
async function resolveProxyModel(
  requestedModel: string,
  projectName: string,
  userId: string
): Promise<ProxyModelDefinition> {
  const models = await loadProxyModels();
  const model = models.get(requestedModel);
  
  if (!model) {
    console.warn(`Proxymodel '${requestedModel}' not found, using default`);
    return models.get('default')!;
  }
  
  // Check RBAC permission
  const hasPermission = await checkPermission(userId, 'run', 'proxymodels', requestedModel);
  if (!hasPermission) {
    console.warn(`User lacks 'run' permission for proxymodel '${requestedModel}', using default`);
    return models.get('default')!;
  }
  
  return model;
}
```

3. 'default' proxymodel requires no permission (always allowed).

**Test Strategy:**

Integration test: user with 'run' permission can use proxymodel, user without permission falls back to default, 'default' always works, permission check logs reason for fallback.