apunkt/omnigraph
1
0
Fork 0
mirror of https://github.com/ModernRelay/omnigraph.git synced 2026-07-15 03:22:11 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Scope the stored-query 404-hiding claim to non-invoke_query callers

Browse source 
Review found the deny==404 catalog-hiding was overstated as a contract: it
holds only at the outer invoke_query gate. A caller that HOLDS invoke_query
but lacks read/change gets the inner gate's 403 for an existing query vs 404
for an unknown one — so existence is visible to grant-holders by design (the
intended double-gate). The handler docstring, OpenAPI 404 description, and
server.md all claimed the 404 was airtight against any denied actor.

Correct the wording in all three (no behavior change) and add the missing
symmetric test (invoke_query but no read -> 403 for an existing query, 404
for unknown) so the actual contract is pinned. Also document that in
default-deny mode (tokens, no policy) every invocation 404s until an
invoke_query rule is configured.

Nits: the from_specs collision comment said "first declared wins" but it is
lexicographically-first by name (BTreeMap); the effective_tool_name docstring
overclaimed the CLI display routes through it (it resolves the rule on its
own output DTO).
This commit is contained in:
Ragnor Comerford 2026-05-30 23:33:27 +02:00
parent 566e9b7651
commit f4c38bb75a
No known key found for this signature in database
5 changed files with 58 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

16
crates/omnigraph-server/src/queries.rs
View file

@ -52,10 +52,10 @@ impl StoredQuery {
}
/// The MCP tool name this query is catalogued under: the explicit
/// `tool_name` override, else the query `name`. This is the catalog
/// key — enforced unique across exposed queries at load — and the one
/// definition every consumer (uniqueness check, catalog projection,
/// CLI display) reads, so the resolution can't drift between them.
/// `tool_name` override, else the query `name`. The catalog key —
/// enforced unique across exposed queries at load. Server-side
/// consumers (the uniqueness check, the future catalog projection) read
/// this; the CLI `queries list` resolves the same rule on its own DTO.
pub fn effective_tool_name(&self) -> &str {
self.tool_name.as_deref().unwrap_or(&self.name)
}
@ -141,9 +141,11 @@ impl QueryRegistry {
// Exposed queries are catalogued under their effective tool name;
// two claiming one name is an MCP-namespace collision. Refuse it at
// load (collected, not fail-fast), naming the loser and the winner.
// Iterating the `BTreeMap` keeps "first declared wins" and the error
// order deterministic. Scoped to a block so these borrows of
// `by_name` end before it is moved into `Self`.
// Iterating the `BTreeMap` makes the winner deterministic (the
// lexicographically-first query name; config is a map, so YAML
// declaration order isn't preserved anyway) and the error order
// stable. Scoped to a block so these borrows of `by_name` end
// before it is moved into `Self`.
{
let mut claimed: BTreeMap<&str, &str> = BTreeMap::new();
for query in by_name.values().filter(|q| q.expose) {