feat(mcp): scope check helpers (CheckToolFromCtx + CheckProjectFromCtx)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-05-08 10:34:54 +08:00
parent 59e0138e7c
commit d6279c6ee1
2 changed files with 106 additions and 0 deletions
@@ -0,0 +1,33 @@
+package mcp
+
+import (
+	"context"
+
+	"github.com/google/uuid"
+
+	"github.com/yan1h/agent-coding-workflow/internal/infra/errs"
+)
+
+func CheckToolFromCtx(ctx context.Context, toolName string) error {
+	sess, ok := FromContext(ctx)
+	if !ok {
+		return errs.New(errs.CodeInternal, "mcp: AuthSession missing")
+	}
+	if !sess.Scope.AllowsTool(toolName) {
+		return errs.New(errs.CodeMcpTokenScopeViolation,
+			"tool '"+toolName+"' is not in token scope")
+	}
+	return nil
+}
+
+func CheckProjectFromCtx(ctx context.Context, projectID uuid.UUID) error {
+	sess, ok := FromContext(ctx)
+	if !ok {
+		return errs.New(errs.CodeInternal, "mcp: AuthSession missing")
+	}
+	if !sess.Scope.AllowsProject(projectID) {
+		return errs.New(errs.CodeMcpTokenScopeViolation,
+			"project is not in token scope")
+	}
+	return nil
+}