CalvinBackup/CyberStrikeAI
1
0
Fork 0
mirror of https://github.com/Ed1s0nZ/CyberStrikeAI.git synced 2026-09-15 22:25:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: add configurable tool call blocking and monitoring

Browse Source
This commit is contained in:
Ed1s0nZ
2026-09-08 09:44:32 +08:00
parent c70da22de7
commit 6ad9ea2d13
54 changed files with 4635 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/security/rbac_middleware.go
+6
View File
@@ -129,6 +129,10 @@ func permissionForRequest(method, fullPath string) string {
return "notification:read"
}
return "notification:write"
case path == "/tool-guard/test" && method == http.MethodPost:
return "config:read"
case path == "/tool-guard":
return crudPermission(method, "config")
case strings.HasPrefix(path, "/config"):
return crudPermission(method, "config")
case strings.HasPrefix(path, "/terminal"):
@@ -208,6 +212,8 @@ func resourceAllowed(c *gin.Context, db *database.DB) bool {
}
path := strings.TrimPrefix(c.FullPath(), "/api")
switch {
case path == "/tool-guard" && isMutationMethod(c.Request.Method):
return session.Scope == database.RBACScopeAll
case path == "/monitor/stats", path == "/monitor/calls-timeline":
// These APIs currently operate on process-global state. Until every MCP
// invocation and persisted execution record carries an immutable owner,