# Task ID: 58

**Title:** Add RBAC for prompt link creation

**Status:** done

**Dependencies:** 56 ✓

**Priority:** medium

**Description:** Implement RBAC checks requiring edit permission on the target project to create prompt links, and auto-create service account permission on the source project.

**Details:**

1. Update prompt creation in `/src/mcpd/src/services/prompt.service.ts`:
   ```typescript
   async createPrompt(data: CreatePromptInput, userId: string): Promise<Prompt> {
     if (data.linkTarget) {
       // Verify user has edit permission on target project RBAC
       const hasPermission = await this.rbacService.checkPermission(
         userId, data.projectId, 'edit'
       );
       if (!hasPermission) {
         throw new ForbiddenError('Edit permission required to create prompt links');
       }
       
       // Parse link target
       const { project: sourceProject, server, uri } = this.parseLink(data.linkTarget);
       
       // Create service account permission on source project
       await this.rbacService.createServiceAccountPermission(
         data.projectId,  // target project
         sourceProject,   // source project
         server,
         uri,
         'read'
       );
     }
     
     return this.promptRepo.create(data);
   }
   ```

2. Clean up service account permission when link is deleted

3. Handle permission denied from source project

**Test Strategy:**

- Unit test: Link creation requires edit permission
- Unit test: Link creation without permission throws 403
- Unit test: Service account permission created on source project
- Unit test: Service account permission deleted when link deleted
- Unit test: Non-link prompts skip RBAC checks
- Integration test: End-to-end link creation with RBAC