Merge branch 'main' into sso-granular-rbac

Author: knolleary

forge/db/migrations/20260706-01-add-pat-scope-fields.js

@@ -0,0 +1,25 @@
+/**
+ * Add readOnly and adminOptIn columns to AccessTokens
+ */
+
+const { DataTypes } = require('sequelize')
+
+module.exports = {
+    /**
+     * upgrade database
+     * @param {QueryInterface} context Sequelize.QueryInterface
+     */
+    up: async (context, Sequelize) => {
+        await context.addColumn('AccessTokens', 'readOnly', {
+            type: DataTypes.BOOLEAN,
+            defaultValue: false,
+            allowNull: false
+        })
+        await context.addColumn('AccessTokens', 'adminOptIn', {
+            type: DataTypes.BOOLEAN,
+            defaultValue: false,
+            allowNull: false
+        })
+    },
+    down: async (context) => {}
+}

forge/db/migrations/20260706-02-add-access-token-team-scope.js

@@ -0,0 +1,61 @@
+/**
+ * Create AccessTokenTeamScopes join table for PAT team scoping
+ */
+
+const { DataTypes } = require('sequelize')
+
+module.exports = {
+    /**
+     * upgrade database
+     * @param {QueryInterface} context Sequelize.QueryInterface
+     */
+    up: async (context, Sequelize) => {
+        await context.createTable('AccessTokenTeamScopes', {
+            id: {
+                type: DataTypes.INTEGER,
+                primaryKey: true,
+                autoIncrement: true
+            },
+            AccessTokenId: {
+                type: DataTypes.INTEGER,
+                references: { model: 'AccessTokens', key: 'id' },
+                onDelete: 'CASCADE',
+                onUpdate: 'CASCADE',
+                allowNull: false
+            },
+            TeamId: {
+                type: DataTypes.INTEGER,
+                references: { model: 'Teams', key: 'id' },
+                onDelete: 'CASCADE',
+                onUpdate: 'CASCADE',
+                allowNull: false
+            },
+            UserId: {
+                type: DataTypes.INTEGER,
+                references: { model: 'Users', key: 'id' },
+                onDelete: 'CASCADE',
+                onUpdate: 'CASCADE',
+                allowNull: false
+            },
+            createdAt: {
+                type: DataTypes.DATE,
+                allowNull: false
+            },
+            updatedAt: {
+                type: DataTypes.DATE,
+                allowNull: false
+            }
+        })
+
+        await context.addIndex('AccessTokenTeamScopes', {
+            name: 'access_token_team_scope_unique',
+            fields: ['AccessTokenId', 'TeamId'],
+            unique: true
+        })
+        await context.addIndex('AccessTokenTeamScopes', {
+            name: 'access_token_team_scope_user_team',
+            fields: ['UserId', 'TeamId']
+        })
+    },
+    down: async (context) => {}
+}

forge/db/models/AccessToken.js

@@ -45,13 +45,16 @@ module.exports = {
                 }
             }
         },
-        name: { type: DataTypes.STRING }
+        name: { type: DataTypes.STRING },
+        readOnly: { type: DataTypes.BOOLEAN, defaultValue: false, allowNull: false },
+        adminOptIn: { type: DataTypes.BOOLEAN, defaultValue: false, allowNull: false }
     },
     associations: function (M) {
         this.belongsTo(M.Team, { foreignKey: 'ownerId', constraints: false })
         this.belongsTo(M.Project, { foreignKey: 'ownerId', constraints: false })
         this.belongsTo(M.Device, { foreignKey: 'ownerId', constraints: false })
         this.belongsTo(M.User, { foreignKey: 'ownerId', constraints: false })
+        this.hasMany(M.AccessTokenTeamScope)
     },
     finders: function (M) {
         return {
@@ -112,7 +115,14 @@ module.exports = {
                             name: { [Op.ne]: null }
                         },
                         order: [['id', 'ASC']],
-                        attributes: ['id', 'name', 'scope', 'expiresAt']
+                        attributes: ['id', 'name', 'scope', 'expiresAt', 'readOnly', 'adminOptIn'],
+                        include: [{
+                            model: M.AccessTokenTeamScope,
+                            include: [{
+                                model: M.Team,
+                                attributes: ['id', 'name']
+                            }]
+                        }]
                     })
                     return tokens
                 },

forge/db/models/AccessTokenTeamScope.js

@@ -0,0 +1,30 @@
+/**
+ * AccessTokenTeamScope join table
+ * Links scoped PATs to the teams they are allowed to access.
+ */
+const { DataTypes } = require('sequelize')
+
+module.exports = {
+    name: 'AccessTokenTeamScope',
+    schema: {
+        id: {
+            type: DataTypes.INTEGER,
+            primaryKey: true,
+            autoIncrement: true
+        }
+    },
+    meta: {
+        slug: false,
+        hashid: false,
+        links: false
+    },
+    indexes: [
+        { name: 'access_token_team_scope_unique', fields: ['AccessTokenId', 'TeamId'], unique: true },
+        { name: 'access_token_team_scope_user_team', fields: ['UserId', 'TeamId'] }
+    ],
+    associations: function (M) {
+        this.belongsTo(M.AccessToken)
+        this.belongsTo(M.Team)
+        this.belongsTo(M.User)
+    }
+}

forge/db/models/index.js

@@ -67,6 +67,7 @@ const modelTypes = [
     'ProjectTemplate',
     'ProjectSnapshot',
     'AccessToken',
+    'AccessTokenTeamScope',
     'AuthClient',
     'Device',
     'DeviceGroup',

forge/ee/routes/expert/index.js

@@ -16,14 +16,9 @@ const getDeviceComms = (app) => { return app.comms?.devices }
 
 /**
  * Maps a platform automation tool's wire definition into a catalog entry for the
- * Expert permissions UI (#421). Platform tools carry standard MCP annotations
- * (readOnlyHint / destructiveHint), which give the read/write/delete class. They
- * run on the platform, not in Node-RED, so they have no nr-assistant version window
- * (no minVersion/maxVersion — the UI treats their absence as always-available).
- * `group: 'platform'` routes them to the FlowFuse Platform Tools section (groupOf()
- * in the product-assistant store). The friendly label is the tool's own `title`; if a
- * tool ever lacks one, fall back to deriving it from the name (strip the platform_
- * prefix and title-case the rest).
+ * Expert permissions UI. The read/write/delete class comes from the MCP annotations
+ * (readOnlyHint / destructiveHint), and `group: 'platform'` routes it to the platform
+ * section. The label is the tool's own `title`, falling back to a name-derived label.
  */
 const curatePlatformTool = (def) => {
     const annotations = def.annotations || {}
@@ -586,16 +581,10 @@ module.exports = async function (app) {
     })
 
     /**
-     * Retrieve the curated tool catalog for the Expert's human-in-the-loop permissions UI
-     * (#421). Returns the merged catalog for both sections the UI shows:
-     * - flow-building tools, proxied from the agent service's /mcp/flow-tools endpoint
-     *   (friendly catalog entries only — raw MCP identifiers never leave the backend);
-     * - FlowFuse platform tools, curated here from the platform automation handler
-     *   (app.comms.platformAutomation) and tagged group:'platform'.
-     * A `hash` fingerprint of the flow-building catalog rides along so the browser refetches
-     * only when it changes. Team access + feature gating are enforced by the shared
-     * preHandler above; read/write classification on each entry is what the client uses to
-     * decide which tools a role may enable.
+     * Returns the merged tool catalog for the Expert permissions UI: flow-building tools
+     * proxied from the agent's /mcp/flow-tools endpoint, plus curated platform tools. A
+     * `hash` of the flow-building catalog rides along so the browser refetches only when
+     * it changes. Team access and feature gating are enforced by the shared preHandler.
      */
     app.get('/mcp/tools', {
         schema: {
@@ -656,11 +645,10 @@ module.exports = async function (app) {
 
             reply.send({ catalog, hash: response.data?.hash || null })
         } catch (error) {
-            // TODO: decide with the team whether this belongs on the branch. The tool catalog
-            // is a non-fatal enhancement (the client swallows failures and gates safely with
-            // defaults). Never forward an upstream auth failure as our own 401 — the SPA's
-            // axios interceptor treats any 401 as session-expiry and logs the user out, which
-            // an unrelated expert-service token rejection must not trigger.
+            // The tool catalog is a non-fatal enhancement (the client swallows failures and
+            // gates safely with defaults). Never forward an upstream auth failure as our own
+            // 401. The SPA's axios interceptor treats any 401 as session-expiry and logs the
+            // user out, which an unrelated expert-service token rejection must not trigger.
             const upstreamStatus = error.response?.status
             app.log.warn(`[expert/mcp/tools] upstream tool-catalog fetch failed: status=${upstreamStatus} msg=${error.message}`)
             if (upstreamStatus === 401 || upstreamStatus === 403) {

forge/forge.js

@@ -1,6 +1,7 @@
 const cookie = require('@fastify/cookie')
 const csrf = require('@fastify/csrf-protection')
 const helmet = require('@fastify/helmet')
+const { fastifyRequestContext } = require('@fastify/request-context')
 const Sentry = require('@sentry/node')
 const fastify = require('fastify')
 
@@ -212,6 +213,9 @@ module.exports = async (options = {}) => {
         })
         await server.register(csrf, { cookieOpts: { _signed: true, _httpOnly: true } })
 
+        // Request Context: per-request store
+        await server.register(fastifyRequestContext)
+
         let contentSecurityPolicy = false
         if (runtimeConfig.content_security_policy?.enabled) {
             if (!runtimeConfig.content_security_policy.directives) {