a869f77070
Merges feat/agent-project-membership (task 166/152). An agent can finally join many projects: membership routes, per-membership role and optional brain override, chat resolving context from the membership, and CLI attach-agent / detach-agent / get memberships. The legacy Agent.projectId fallback is kept for this release as the schema comment promises. Conflict resolved in main.ts: that branch added its RBAC case to mapUrlToPermission inline, while this branch had extracted the function to middleware/url-permission.ts so it could be tested. Kept the extraction and ported the case into it — joining a team is `edit:agents:<name>`, not `create:agents`, which is the authority to mint a whole agent. Also fixes something the extraction makes possible. security.test.ts contained a hand-copied reproduction of mapUrlToPermission, because main.ts self-invokes main() and nothing in it was importable. A security test asserting against a copy stops testing the system the moment the real one changes, and this copy had already drifted. It now imports the real function; all 18 assertions still pass, against the code that actually runs. Local: build clean, workspace 2550 passed, lint unchanged at 794 errors. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N4wNHWf7xSwnZCWpJcyv9p
56 lines
1.7 KiB
Markdown
56 lines
1.7 KiB
Markdown
# Task ID: 58
|
|
|
|
**Title:** Add RBAC for prompt link creation
|
|
|
|
**Status:** done
|
|
|
|
**Dependencies:** 56 ✓
|
|
|
|
**Priority:** medium
|
|
|
|
**Description:** Implement RBAC checks requiring edit permission on the target project to create prompt links, and auto-create service account permission on the source project.
|
|
|
|
**Details:**
|
|
|
|
1. Update prompt creation in `/src/mcpd/src/services/prompt.service.ts`:
|
|
```typescript
|
|
async createPrompt(data: CreatePromptInput, userId: string): Promise<Prompt> {
|
|
if (data.linkTarget) {
|
|
// Verify user has edit permission on target project RBAC
|
|
const hasPermission = await this.rbacService.checkPermission(
|
|
userId, data.projectId, 'edit'
|
|
);
|
|
if (!hasPermission) {
|
|
throw new ForbiddenError('Edit permission required to create prompt links');
|
|
}
|
|
|
|
// Parse link target
|
|
const { project: sourceProject, server, uri } = this.parseLink(data.linkTarget);
|
|
|
|
// Create service account permission on source project
|
|
await this.rbacService.createServiceAccountPermission(
|
|
data.projectId, // target project
|
|
sourceProject, // source project
|
|
server,
|
|
uri,
|
|
'read'
|
|
);
|
|
}
|
|
|
|
return this.promptRepo.create(data);
|
|
}
|
|
```
|
|
|
|
2. Clean up service account permission when link is deleted
|
|
|
|
3. Handle permission denied from source project
|
|
|
|
**Test Strategy:**
|
|
|
|
- Unit test: Link creation requires edit permission
|
|
- Unit test: Link creation without permission throws 403
|
|
- Unit test: Service account permission created on source project
|
|
- Unit test: Service account permission deleted when link deleted
|
|
- Unit test: Non-link prompts skip RBAC checks
|
|
- Integration test: End-to-end link creation with RBAC
|