fix(mcp): API key authentication for MCP — transport, validation, and RBAC - #7

Open

hbrooks wants to merge 31 commits into

masterfrom

demo/pr-39604

Commits on May 27, 2026

fix(mcp): create ApiKey permissions on init and support API keys with JWT auth
aminghadersohi
committed
fec56c7
fix(mcp): wire composite verifier and add ApiKey permission sync
aminghadersohi
committed
3c4e77b
fix(mcp): add type annotations to test fixtures and parameters
aminghadersohi
committed
6c767ef
fix(mcp): remove prefixes from log to satisfy CodeQL
aminghadersohi
committed
aa069c9
fix(mcp): validate API keys via FastMCP AccessToken and lock down ApiKey perms
aminghadersohi
committed
c16eaa4
refactor(mcp): hoist API key auth imports to module top
aminghadersohi
committed
bd73f9e
fix(security): drop redundant explicit ApiKey perm creation
aminghadersohi
committed
9c011d5
refactor(mcp): hoist JWT verifier imports to module top
aminghadersohi
committed
fc426dd
Potential fix for pull request finding

aminghadersohi
and
Copilot
committed
37b9468
fix(mcp): fix stale patch target in auth tests and update stale docstring
aminghadersohi
committed
07129f4
refactor(mcp): extract duplicated app context + sm setup into helper
aminghadersohi
committed
c1afc07
fix(mcp): harden auth — PermissionError propagation, passthrough client_id guard, fail-closed on missing token

aminghadersohi
and
claude
committed
690b714
refactor(mcp): delegate load_user_with_relationships to SecurityManager.find_user_with_relationships

aminghadersohi
and
claude
committed
3c80c2f
fix(mcp): fix stale patch target in auth tests and update stale docstring

aminghadersohi
and
claude
committed
30c4c20
fix(mcp): validate api_key_prefixes in CompositeTokenVerifier — filter empty/non-string entries

aminghadersohi
and
claude
committed
cda5a05
fix(mcp): fix stale patch target in auth tests and update stale docstring

aminghadersohi
and
claude
committed
bd44c24
fix(mcp): normalize FAB_API_KEY_PREFIXES from config before passing to CompositeTokenVerifier

aminghadersohi
and
claude
committed
e64b1ac
fix(mcp): address CodeQL security warnings and add ApiKey RBAC regression test
aminghadersohi
committed
4a99848
fix(mcp): remove sensitive values from log calls to satisfy CodeQL
aminghadersohi
committed
2a45cd9
fix(mcp): use class-bound attribute in joinedload for group roles
aminghadersohi
committed
9a1d2a4
fix(mcp): address dpgaspar review — imports, types, exception scope
aminghadersohi
committed
1ee3ead
fix(mcp): remove sensitive values from log calls to satisfy CodeQL
aminghadersohi
committed
46963f3
fix(mcp): update security_manager patch target in RBAC tests

aminghadersohi
and
claude
committed
7d3a3e7
fix(mcp): address Codex review — error class, fail-open, DRY permission logic

aminghadersohi
and
claude
committed
08cb50d
fix(mcp): update security_manager patch target in tool-search tests

aminghadersohi
and
claude
committed
53adbb7
fix(mcp): broaden _log_user_resolution_failure type hint
aminghadersohi
committed
bc310d0
fix(mcp): fix MCPPermissionDeniedError handler order and visibility test patch targets

aminghadersohi
and
claude
committed
a5d0205
fix(mcp): remove exc_info=True from tool-visibility debug log to prevent traceback-based credential leak

aminghadersohi
and
claude
committed
5765111
fix(mcp): use consistent filter() style for email lookup in find_user_with_relationships

aminghadersohi
and
claude
committed
dceb37d
fix(mcp): replace MCPJWTVerifier with JWTVerifier after browser-hello revert
aminghadersohi
committed
91c5042

Commits on May 28, 2026

fix(security): make ApiKey admin-only view menu conditional on FAB_API_KEY_ENABLED
aminghadersohi
committed
11dce41

Navigation Menu

fix(mcp): API key authentication for MCP — transport, validation, and RBAC - #7

fix(mcp): API key authentication for MCP — transport, validation, and RBAC#7
hbrooks wants to merge 31 commits into
masterfrom
demo/pr-39604

Commits on May 27, 2026

fix(mcp): create ApiKey permissions on init and support API keys with JWT auth

fix(mcp): wire composite verifier and add ApiKey permission sync

fix(mcp): add type annotations to test fixtures and parameters

fix(mcp): remove prefixes from log to satisfy CodeQL

fix(mcp): validate API keys via FastMCP AccessToken and lock down ApiKey perms

refactor(mcp): hoist API key auth imports to module top

fix(security): drop redundant explicit ApiKey perm creation

refactor(mcp): hoist JWT verifier imports to module top

Potential fix for pull request finding

fix(mcp): fix stale patch target in auth tests and update stale docstring

refactor(mcp): extract duplicated app context + sm setup into helper

fix(mcp): harden auth — PermissionError propagation, passthrough client_id guard, fail-closed on missing token

refactor(mcp): delegate load_user_with_relationships to SecurityManager.find_user_with_relationships

fix(mcp): fix stale patch target in auth tests and update stale docstring

fix(mcp): validate api_key_prefixes in CompositeTokenVerifier — filter empty/non-string entries

fix(mcp): fix stale patch target in auth tests and update stale docstring

fix(mcp): normalize FAB_API_KEY_PREFIXES from config before passing to CompositeTokenVerifier

fix(mcp): address CodeQL security warnings and add ApiKey RBAC regression test

fix(mcp): remove sensitive values from log calls to satisfy CodeQL

fix(mcp): use class-bound attribute in joinedload for group roles

fix(mcp): address dpgaspar review — imports, types, exception scope

fix(mcp): remove sensitive values from log calls to satisfy CodeQL

fix(mcp): update security_manager patch target in RBAC tests

fix(mcp): address Codex review — error class, fail-open, DRY permission logic

fix(mcp): update security_manager patch target in tool-search tests

fix(mcp): broaden _log_user_resolution_failure type hint

fix(mcp): fix MCPPermissionDeniedError handler order and visibility test patch targets

fix(mcp): remove exc_info=True from tool-visibility debug log to prevent traceback-based credential leak

fix(mcp): use consistent filter() style for email lookup in find_user_with_relationships

fix(mcp): replace MCPJWTVerifier with JWTVerifier after browser-hello revert

Commits on May 28, 2026

fix(security): make ApiKey admin-only view menu conditional on FAB_API_KEY_ENABLED