4 Commits

Include renames

Author	SHA1	Message	Date
jaredandClaude Opus 5.5	17be55bf8f	Add MCP write tools: create_ticket, add_comment, update_status, assign_ticket (#111, phase 5) ... Each tool is a thin adapter over the same code path the web UI uses (TicketCreationService, CommentService, ApiTicketController, AssignmentService), run as the signed-in user, so permissions, Workflow Designer rules, audit entries, notifications and stats-cache invalidation are identical to doing the same thing in the browser. - Registered in ToolCatalog and listed in its WRITE_TOOLS, so ToolScopeMiddleware requires tickets:write for them. - Annotated readOnlyHint=false / destructiveHint=false (nothing deletes). - Input the web form constrains with dropdowns (priority 1-5, visibility, status) is validated in the tools. Assignees are "me", a username or "unassigned". - A ticket the user can't see reads as "not found" (never "access denied"), consistent with get_ticket. - update_status turns requires_comment into an actionable error and invalidates the stats cache like api/update_ticket.php does. Verified locally through the real pipeline (only JWT validation stubbed) against MariaDB with seeded workflow transitions: 30/30 checks, including a read-only token getting 403 insufficient_scope on create_ticket with nothing written; create/comment/status/assign attributed and audit-logged as the user; @mentions; internal visibility needing groups and staying hidden from non-members; an invisible confidential ticket not found for comment/status; requires_comment enforced, and closing with a reason persisted in one transaction; transitions outside the workflow refused; the admin/creator/assignee rule for assigning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X	2026-09-24 19:13:41 -04:00
jaredandClaude Opus 5.5	65deedc295	Add MCP identity mapping and read tools (#111, phase 4) ... MCP requests now run as the signed-in Tinker Tickets user, under exactly the same rules as the web login, and expose the first two tools: search_tickets and get_ticket. Identity: - IdentityMiddleware maps the validated token to a user with the same checks as AuthMiddleware: the admin/employee group rule, now extracted into helpers/AccessPolicy.php so both entry points share one copy, then UserModel::syncUserFromAuthelia(), which creates/updates the row and derives is_admin from groups. - Claims are read from the validated token's server-side PSR-7 request attributes, not from JSON-RPC _meta. The SDK's OAuthRequestMetaMiddleware is deliberately not used: it array_merges into client-writable _meta, so only the keys the validator happens to set are overwritten and a client could inject others. Scopes (ToolScopeMiddleware), enforced before dispatch: - lifecycle messages need only a valid token; write tools (listed in ToolCatalog, the single registry) need tickets:write; everything else needs tickets:read, which tickets:write implies. - Denials are the spec's step-up challenge: 403 + WWW-Authenticate: Bearer error="insufficient_scope", scope=..., resource_metadata=... Tools (read-only, annotated readOnlyHint): - search_tickets: text/status/priority/category/assignee ("me", "unassigned", or a username), paginated, via TicketModel::getAllTickets with the user's visibility filter. Defaults to every non-Closed status. - get_ticket: details + comments, gated by canUserAccessTicket. A missing ticket and a non-visible one return the same "not found". Verified locally against a real MariaDB fixture (public, confidential, internal+group, and closed tickets across two users), driving the real pipeline (ToolCatalog, both middlewares, SDK transport) with only JWT validation stubbed: 20/20 checks pass, including visibility parity per user, confidential tickets hidden from non-owners, the group check rejecting a user without admin/employee, a missing preferred_username rejected, 403 insufficient_scope for a token without tickets:*, and write implying read. Also exercised the stateless 2026-07-28 era (no session, _meta + MCP-Protocol-Version/Mcp-Method/Mcp-Name headers), which returns the same visibility-filtered results. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X	2026-09-24 18:58:30 -04:00
jaredandClaude Opus 5.5	13660b4398	Fix duplicated Host header rejecting all MCP requests under PHP-FPM (#111) ... nyholm's ServerRequestCreator adds Host both from the URI it builds and from the request headers, so under PHP-FPM getHeaderLine('Host') returns "beta.t.lotusguild.org, beta.t.lotusguild.org". The SDK's DNS-rebinding check compares that joined string against the allowlist and refused every request with 403 "Invalid Host header", even for the correct hostname. It only passed locally because PHP's built-in server exposes headers differently. Collapse Host to the single value the client sent before the middleware runs. The rebinding check still sees the client's real Host, so foreign hosts and direct-by-IP access stay refused. Verified on the beta host by running the patched entrypoint against beta's real config and vendor/: the correct host gets the Protected Resource Metadata, and a foreign host still gets 403. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X	2026-09-24 18:46:52 -04:00
jaredandClaude Opus 5.5	5631731a28	Add OAuth-protected MCP endpoint scaffolding (#111, phase 2) ... First step of the remote MCP server: mcp/server.php serves /mcp over Streamable HTTP via the official MCP PHP SDK (mcp/sdk, pinned to exactly 0.8.1 since it breaks BC in nearly every minor release), with Authelia as the OAuth authorization server. No tools yet: this phase only stands up authentication, RFC 9728 Protected Resource Metadata, and routing. - Composer is introduced for the MCP endpoint ONLY: nothing else loads vendor/autoload.php, so a failed composer install at deploy time can only take /mcp down. vendor/ is gitignored and excluded from phpcs; composer.lock is resolved for PHP 8.2 so it installs on 8.2 and 8.4. - Tokens are validated against Authelia's JWKS (cached) for signature, issuer, audience == MCP_RESOURCE_URL (a beta token is rejected by prod and vice versa), and expiry. scopeClaim is 'scp' because Authelia puts scopes in an array claim of that name, not the standard 'scope'. - The request URI's scheme/host are pinned to MCP_RESOURCE_URL before the SDK sees it: TLS ends at the proxy, so PHP sees http and a client-controlled Host, and the SDK builds the 401 challenge's resource_metadata URL from that. preserveHost keeps the real Host header for the DNS-rebinding check, which only allows the canonical hostname (so direct-by-IP access is refused too). - Identity will come only from the token; this entrypoint never reads Remote-* headers or $_SESSION, since /mcp is exempt from forward-auth at the proxy and those headers are client-controlled there. Verified locally with PHP's built-in server: unauthenticated POST gets 401 + WWW-Authenticate with the https resource_metadata URL and scopes; metadata served at both /.well-known/oauth-protected-resource/mcp and the root form; malformed token -> 401 invalid_token; foreign Host and direct-IP Host -> 403; a forged Remote-User header without a token is still 401. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MGDKHiU5RJdo3dqQUDow3X	2026-09-24 18:40:11 -04:00