AutopilotMonitor

mirror of https://github.com/okieselbach/AutopilotMonitor.git synced 2026-10-24 20:53:06 +00:00

Files

T

Oliver Kieselbach 4b8b2a5a6d fix(mcp): AllMembers grants tenant members only, not every authenticated token; per-user overrides stay visible

McpAccessPolicy.AllMembers returned Allowed for any valid JWT, so a Progress
Portal end-user without a role could open an MCP session. The AllMembers path
now requires an effective role (Admin / Operator / Viewer) in the token's
tenant, resolved by the new TenantMemberRoleResolver that the policy
middleware shares (table first, Entra app-role claim when the tenant opted
in). Explicit grants (platform role, delegated scope, enabled McpUsers row)
and the Disabled-row kill-switch keep working in a policy-independent order;
auth/mcp and auth/me hand the token's app roles through.

The MCP Users settings section shows the user list under AllMembers too, as
the per-user override list (individual usage plan, disable = block).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-02 10:03:10 +02:00

AuthFunction.cs

fix(mcp): AllMembers grants tenant members only, not every authenticated token; per-user overrides stay visible

2026-09-02 10:03:10 +02:00

AzureMonitorAlertWebhookFunction.cs

fix(backend): alert-webhook 500 on non-seekable body - bounded read replaces Length check

2026-07-27 18:52:59 +02:00

HealthCheckFunction.cs

Typed API contract: every success response is a wire DTO, generated end-to-end into TypeScript (#136 )

2026-08-31 02:30:39 +02:00

McpUserFunction.cs

fix(mcp): AllMembers grants tenant members only, not every authenticated token; per-user overrides stay visible