open-platform/mitosis

Fork 0

/goal /ultracode-workflows [RBAC-1] repo-permission authz in MCP (swap org-membership for the …/permission probe) #28

New issue

Closed

opened 2026-07-01 02:03:44 +00:00 by plat · 1 comment

plat commented

2026-07-01 02:03:44 +00:00

Owner

Track/Wave: RBAC-1 · Wave G1 · Size M
Repos: mcp
Depends on: none

Why

Today a read-only org member can delete_app/query_db any org app: authz is org-MEMBERSHIP not repo-PERMISSION. This closes the biggest hole and unblocks the rest of RBAC.

Scope

Replace the org-membership check in authorize() with a delegated GET /repos/{owner}/{repo}/collaborators/{user}/permission probe; read→read tools, write→write/manage tools.

Acceptance

A read collaborator can use read tools but not write/manage; a non-collaborator is rejected; a write collaborator gets manage tools — validated with two users of differing permission on one repo.

Notes

Seam B: isolated authorize() region of server.ts — tolerated concurrent with the overlay chain; land by rebase. Overlappable with Horizon 1.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `RBAC-1` · Wave **G1** · Size **M** **Repos:** `mcp` **Depends on:** none ## Why Today a read-only org member can delete_app/query_db any org app: authz is org-MEMBERSHIP not repo-PERMISSION. This closes the biggest hole and unblocks the rest of RBAC. ## Scope Replace the org-membership check in `authorize()` with a delegated `GET /repos/{owner}/{repo}/collaborators/{user}/permission` probe; read→read tools, write→write/manage tools. ## Acceptance A read collaborator can use read tools but not write/manage; a non-collaborator is rejected; a write collaborator gets manage tools — validated with two users of differing permission on one repo. ## Notes **Seam B: isolated `authorize()` region of server.ts — tolerated concurrent with the overlay chain; land by rebase. Overlappable with Horizon 1.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:44 +00:00

plat added the

horizon:governance

roadmap

goal

labels

2026-07-01 02:03:44 +00:00

plat added a new dependency

2026-07-01 02:04:44 +00:00

#29 /goal /ultracode-workflows [RBAC-2] forwardAuth platform-auth service + Traefik middleware (apps private by Forgejo permission, zero app auth code)

plat added a new dependency

2026-07-01 02:04:45 +00:00

#31 /goal /ultracode-workflows [RBAC-4] retire the god-PAT — per-user delegated agent identity + per-app scoped read-only kube token

plat added a new dependency

2026-07-01 02:04:45 +00:00

#33 /goal /ultracode-workflows [RBAC-7] DESIGN Forgejo-identity → per-app postgres role / RLS propagation

plat added a new dependency

2026-07-01 02:04:48 +00:00

#38 /goal /ultracode-workflows [POL-0] DESIGN the policy-authoring & governance-of-governance model (Kyverno)

plat referenced this issue

2026-07-01 02:05:20 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47

plat referenced this issue from a commit

2026-07-01 02:20:04 +00:00

RBAC-1: repo-permission authz in MCP (plat/mitosis#28)

plat referenced this issue from a commit

2026-07-01 03:21:31 +00:00

RBAC-1: repo-permission authz in MCP (plat/mitosis#28) (#5)

plat commented

2026-07-01 03:22:21 +00:00

Author

Owner

DONE — merged + live-validated. plat/mcp PR #5 merged to main (squash). The external contract was validated LIVE on a current-stack platform (valid8b, Forgejo 15/gitea-1.22): GET .../collaborators/{u}/permission returns owner/write/read/admin/none exactly as the probe expects, admin-only read confirmed (why it probes as PLAT_AUTH_HEADER, fail-closing non-2xx to none). The actual branch authorize() ran against live Forgejo: none→reject, read→read-allow/write-reject, write→both, owner→both. 60/60 unit tests. Propagation caveat: this is merged to mcp main only — reaching a germinated platform needs a new mcp release tag + seed refresh (see #14), and releasing an authz change to a live/client platform should be gated on owner sign-off. Unblocks RBAC-2/RBAC-4/RBAC-7/POL-0.

**DONE — merged + live-validated.** plat/mcp PR #5 merged to main (squash). The external contract was validated LIVE on a current-stack platform (valid8b, Forgejo 15/gitea-1.22): `GET .../collaborators/{u}/permission` returns owner/write/read/admin/none exactly as the probe expects, admin-only read confirmed (why it probes as PLAT_AUTH_HEADER, fail-closing non-2xx to none). The actual branch `authorize()` ran against live Forgejo: none→reject, read→read-allow/write-reject, write→both, owner→both. 60/60 unit tests. **Propagation caveat:** this is merged to mcp *main* only — reaching a germinated platform needs a new mcp release tag + seed refresh (see #14), and releasing an authz change to a live/client platform should be gated on owner sign-off. Unblocks RBAC-2/RBAC-4/RBAC-7/POL-0.

plat closed this issue

2026-07-01 03:22:22 +00:00

plat referenced this issue

2026-07-02 02:21:34 +00:00

[ROADMAP] First Client Deploy → Governance — tracker #47