pjandro/OmniRoute
1
0
Fork 0
mirror of https://github.com/diegosouzapw/OmniRoute.git synced 2026-09-21 14:22:14 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(mcp): honor the mcp:connect carve-out in transport route guards (#11139)

Browse Source 
Validated on the combined batch board over tip 17897cc3: gates clean (changelog, file-size 159 frozen, complexity 2628<=2774, cognitive 1184<=1223, dead-code 409<=416, provider-consistency 267/350/0), typecheck:core clean, 83/83 PR suites + neighbors green (mcp-route-scope-carveout 15 tests with bug-injection proof, management-auth-hardening per-route call-shape pinning). The route layer now honors the #9159 mcp:connect carve-out exactly like the policy layer — audit/audit-stats deliberately stay manage-only, oma_ tokens still require admin. Thank you @HouMinXi!
This commit is contained in:
Bob.Hou
2026-08-23 01:18:06 -04:00
committed by GitHub
parent 0a7bd62401
commit dea5345397
7 changed files with 345 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/app/api/mcp/sse/route.ts
View File

@@ -30,7 +30,7 @@ async function guardEnabled(): Promise<NextResponse | null> {
}
export async function GET(request: NextRequest) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
const blocked = await guardEnabled();
if (blocked) return blocked;
@@ -38,7 +38,7 @@ export async function GET(request: NextRequest) {
}
export async function POST(request: NextRequest) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
const blocked = await guardEnabled();
if (blocked) return blocked;

2
src/app/api/mcp/status/route.ts
View File

@@ -14,7 +14,7 @@ import { getCachedSettings } from "@/lib/db/settings";
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
export async function GET(request: Request) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
try {
const [heartbeat, stats, lastCallPage, settings] = await Promise.all([

6
src/app/api/mcp/stream/route.ts
View File

@@ -33,7 +33,7 @@ async function guardEnabled(): Promise<NextResponse | null> {
}
export async function POST(request: NextRequest) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
const blocked = await guardEnabled();
if (blocked) return blocked;
@@ -41,7 +41,7 @@ export async function POST(request: NextRequest) {
}
export async function GET(request: NextRequest) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
const blocked = await guardEnabled();
if (blocked) return blocked;
@@ -49,7 +49,7 @@ export async function GET(request: NextRequest) {
}
export async function DELETE(request: NextRequest) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
const blocked = await guardEnabled();
if (blocked) return blocked;

2
src/app/api/mcp/tools/route.ts
View File

@@ -3,7 +3,7 @@ import { MCP_TOOLS, MCP_TOOL_MAP } from "@omniroute/open-sse/mcp-server/schemas/
import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
export async function GET(request: Request) {
const authError = await requireManagementAuth(request);
const authError = await requireManagementAuth(request, { acceptMcpConnectScope: true });
if (authError) return authError;
try {
return NextResponse.json({