feat(security): upstream MCP request authentication and table access #14

Merged

james.maes merged 1 commits from feature/kof22-mcp-canonical into main 2026-11-05 12:47:04 +00:00

Conversation 0 Commits 1 Files Changed 11

+838 -7

james.maes commented 2026-11-05 11:35:18 +00:00

Owner

Copy link

Copy source

Move KOF22's MCP HTTP authentication and session-aware table visibility changes into the owning main line. Requests use the authenticated principal, and table discovery/schema responses respect the current session's permissions.

Migrate the build to the published QQQ 4.1.0-RC.21 BOM while preserving the current upstream release caller. This incorporates the necessary build migration from #12 without its stale CI deletion. Existing PRs remain open until this integration is merged.

Validation: production and test sources compiled against published QQQ JARs (test-compile BUILD SUCCESS; no tests executed locally). Canonical repository CI is the test gate. A published mainline artifact will replace the KOF22 embedded source.

Move KOF22's MCP HTTP authentication and session-aware table visibility changes into the owning main line. Requests use the authenticated principal, and table discovery/schema responses respect the current session's permissions. Migrate the build to the published QQQ 4.1.0-RC.21 BOM while preserving the current upstream release caller. This incorporates the necessary build migration from #12 without its stale CI deletion. Existing PRs remain open until this integration is merged. Validation: production and test sources compiled against published QQQ JARs (test-compile BUILD SUCCESS; no tests executed locally). Canonical repository CI is the test gate. A published mainline artifact will replace the KOF22 embedded source.

james.maes added 1 commit 2026-11-05 11:35:18 +00:00

feat(security): authenticate MCP HTTP requests and enforce table access ... ed57dd854a

Add a bearer-token authentication filter and an HTTP-principal session
provider so MCP requests run as the authenticated principal, and gate the
table list/schema tools and resources through a shared TableAccess check.
Add McpHttpSecurityTest and adapt the existing test utilities.

Build against the published QQQ 4.1 BOM (4.1.0-RC.21), add the servlet API
(provided) and the test-scope Javalin/RDBMS/Postgres/H2/Testcontainers
dependencies the security test needs, and run surefire under UTC.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

james.maes merged commit b04c73be47 into main 2026-11-05 12:47:04 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

security

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-middleware-mcp#14