mirror of
https://github.com/pomerium/pomerium.git
synced 2025-07-10 13:28:36 +02:00
mcp: add mcp method and tool logging to authorize (#5668)
## Summary Adds support for extending authorization log with Model Context Protocol details. i.e. ```json { "level": "info", "server-name": "all", "service": "authorize", "mcp-method": "tools/call", "mcp-tool": "describe_table", "mcp-tool-parameters": { "table_name": "Categories" }, "allow": true, "allow-why-true": ["email-ok", "mcp-tool-ok"], "deny": false, "deny-why-false": [], "time": "2025-06-24T17:40:41-04:00", "message": "authorize check" } ``` ## Related issues Fixes https://linear.app/pomerium/issue/ENG-2393/mcp-authorize-each-incoming-request-to-an-mcp-route ## User Explanation <!-- How would you explain this change to the user? If this change doesn't create any user-facing changes, you can leave this blank. If filled out, add the `docs` label --> ## Checklist - [x] reference any related issues - [x] updated unit tests - [x] add appropriate label (`enhancement`, `bug`, `breaking`, `dependencies`, `ci`) - [x] ready for review
This commit is contained in:
parent
eacf19cd64
commit
9363457849
14 changed files with 271 additions and 82 deletions
|
@ -22,6 +22,9 @@ const (
|
|||
AuthorizeLogFieldImpersonateSessionID AuthorizeLogField = "impersonate-session-id"
|
||||
AuthorizeLogFieldImpersonateUserID AuthorizeLogField = "impersonate-user-id"
|
||||
AuthorizeLogFieldIP AuthorizeLogField = "ip"
|
||||
AuthorizeLogFieldMCPMethod AuthorizeLogField = "mcp-method"
|
||||
AuthorizeLogFieldMCPTool AuthorizeLogField = "mcp-tool"
|
||||
AuthorizeLogFieldMCPToolParameters AuthorizeLogField = "mcp-tool-parameters"
|
||||
AuthorizeLogFieldMethod AuthorizeLogField = "method"
|
||||
AuthorizeLogFieldPath AuthorizeLogField = "path"
|
||||
AuthorizeLogFieldQuery AuthorizeLogField = "query"
|
||||
|
@ -72,6 +75,9 @@ var authorizeLogFieldLookup = map[AuthorizeLogField]struct{}{
|
|||
AuthorizeLogFieldImpersonateSessionID: {},
|
||||
AuthorizeLogFieldImpersonateUserID: {},
|
||||
AuthorizeLogFieldIP: {},
|
||||
AuthorizeLogFieldMCPMethod: {},
|
||||
AuthorizeLogFieldMCPTool: {},
|
||||
AuthorizeLogFieldMCPToolParameters: {},
|
||||
AuthorizeLogFieldMethod: {},
|
||||
AuthorizeLogFieldPath: {},
|
||||
AuthorizeLogFieldQuery: {},
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue