golem15/summercms
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(pier): end only the revoked token's or client's MCP sessions and log the client address (B-WR-04, B-IN-04)

Browse Source 
- pact.MCPSubjectChanged and pier.Event gain TokenID and ClientID; a
  narrowed revoked event closes only matching sessions and stateless servers
- cabana fires the admin token revoke with the token row id
- towel.WithClientIP/ClientIP; pier puts the address (surf applies
  http.trusted_proxies) on the resolve context and ResolveBackendToken logs it
This commit is contained in:
Jakub Zych
2026-10-23 16:21:37 +02:00
parent 0ec00f7f69
commit 24cf6cd931
16 changed files with 158 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
modules/pact/README.md
View File

@@ -163,7 +163,7 @@ func (p *Plugin) Schedule() []pact.ScheduledCommand {
| `pact.MCPTokenVerifier` | Published by the OAuth server plugin: verifies an access token at the MCP endpoint into a `pact.MCPGrant` (user, client, token, scopes, expiry) and names its resource. A refused token is `pact.ErrMCPTokenInvalid`. |
| `pact.MCPPersonalTokenResolver` | Published by the one plugin whose personal tokens may open an MCP session (one resolver per application): resolves a raw token into a `pact.MCPSubject` whose `TokenID` identifies the token row (it keys the session binding; a subject without one is refused); false when the prefix is not its own, which the endpoint answers as unauthorized. |
| `pact.MCPLinkedBackendResolver` | Published by the plugin that owns the frontend-to-backend account link: the `pact.LinkedBackendUser` (id, login, display name) of a frontend user, false when unlinked. |
| `pact.MCPSubjectChanged` | Event fired on the festival bus when a subject's permissions, link, grants or existence change (`Kind` is `pact.MCPSubjectPermissions`, `pact.MCPSubjectLink`, `pact.MCPSubjectRevoked` or `pact.MCPSubjectDeleted`), so the MCP endpoint re-lists tools or ends sessions. |
| `pact.MCPSubjectChanged` | Event fired on the festival bus when a subject's permissions, link, grants or existence change (`Kind` is `pact.MCPSubjectPermissions`, `pact.MCPSubjectLink`, `pact.MCPSubjectRevoked` or `pact.MCPSubjectDeleted`), so the MCP endpoint re-lists tools or ends sessions. `TokenID` and `ClientID` narrow a revoked event: a token id ends only the sessions that personal token opened (subject with that `TokenID` and no `ClientID`), a client id only that OAuth client's sessions, neither every session of the subject; other kinds ignore them. |
| `pact.FrontendPermission` | One frontend permission code a plugin declares: `Code`, `Label`, `Tab` and `Comment`, offered in the user plugin's permission editors next to the seeded codes. |
| `pact.HasFrontendPermissions` | Declares frontend permission codes, the frontend counterpart of `pact.HasPermissions`. |
| `pact.ReorderAfterSave` | Optional controller hook `ReorderAfterSave(ctx, partition)`: runs after a reorder save wrote the new order, inside the same transaction (`cabana.TxFromContext` works); an error rolls the reorder back. |

15
modules/pact/mcp.go
View File

@@ -272,10 +272,19 @@ type LinkedBackendUser struct {
// deactivated (MCPSubjectDeleted). The MCP module re-lists the subject's
// tools or ends its sessions; every call re-checks anyway, so a missed event
// only leaves a stale list for longer.
//
// TokenID and ClientID narrow an MCPSubjectRevoked event. A non-zero TokenID
// ends only the sessions whose subject under Guard is UserID with that
// TokenID and no ClientID: the sessions one personal token opened. A
// non-empty ClientID ends only the sessions whose subject under Guard is
// UserID with that ClientID: one OAuth client's grant. With neither, every
// session of the subject ends. Other kinds ignore both fields.
type MCPSubjectChanged struct {
Guard string
UserID uint
Kind string
Guard string
UserID uint
Kind string
TokenID uint
ClientID string
}
// Kinds of MCPSubjectChanged.