Add files via upload

internal/app/app.go

@@ -8,6 +8,7 @@ import (
 	"fmt"
 	"net"
 	"net/http"
+	"net/url"
 	"os"
 	"path/filepath"
 	"strings"
@@ -16,6 +17,7 @@ import (
 
 	"cyberstrike-ai/internal/agent"
 	"cyberstrike-ai/internal/audit"
+	"cyberstrike-ai/internal/authctx"
 	"cyberstrike-ai/internal/c2"
 	"cyberstrike-ai/internal/config"
 	"cyberstrike-ai/internal/database"
@@ -123,6 +125,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 
 	// 创建MCP服务器（带数据库持久化）
 	mcpServer := mcp.NewServerWithStorage(log.Logger, db)
+	mcpServer.SetToolAuthorizer(mcpToolAuthorizer(db))
 	mcpServer.ConfigureHTTPToolCallTimeoutFromAgentMinutes(cfg.Agent.ToolTimeoutMinutes)
 
 	// 创建安全工具执行器
@@ -146,6 +149,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 
 	// 创建外部MCP管理器（使用与内部MCP服务器相同的存储）
 	externalMCPMgr := mcp.NewExternalMCPManagerWithStorage(log.Logger, db)
+	externalMCPMgr.SetToolAuthorizer(externalMCPToolAuthorizer())
 	if cfg.ExternalMCP.Servers != nil {
 		externalMCPMgr.LoadConfigs(&cfg.ExternalMCP)
 		// 启动所有启用的外部MCP客户端
@@ -372,7 +376,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 	vulnerabilityHandler.SetAudit(auditSvc)
 	webshellHandler := handler.NewWebShellHandler(log.Logger, db)
 	webshellHandler.SetAudit(auditSvc)
-	chatUploadsHandler := handler.NewChatUploadsHandler(log.Logger)
+	chatUploadsHandler := handler.NewChatUploadsHandler(log.Logger, db)
 	chatUploadsHandler.SetAudit(auditSvc)
 	registerWebshellTools(mcpServer, db, webshellHandler, log.Logger)
 	registerWebshellManagementTools(mcpServer, db, webshellHandler, log.Logger)
@@ -541,6 +545,7 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 		terminalHandler,
 		app.c2Handler,
 		auditHandler,
+		auditSvc,
 		rbacHandler,
 		mcpServer,
 		authManager,
@@ -554,17 +559,30 @@ func New(cfg *config.Config, log *logger.Logger, configPath string) (*App, error
 // mcpHandlerWithAuth 在鉴权通过后转发到 MCP 处理；若配置了 auth_header 则校验请求头，否则直接放行
 func (a *App) mcpHandlerWithAuth(w http.ResponseWriter, r *http.Request) {
 	cfg := a.config.MCP
-	if cfg.AuthHeader != "" {
-		actual := []byte(r.Header.Get(cfg.AuthHeader))
-		expected := []byte(cfg.AuthHeaderValue)
-		if subtle.ConstantTimeCompare(actual, expected) != 1 {
-			a.logger.Logger.Debug("MCP 鉴权失败：header 缺失或值不匹配", zap.String("header", cfg.AuthHeader))
-			w.Header().Set("Content-Type", "application/json")
-			w.WriteHeader(http.StatusUnauthorized)
-			w.Write([]byte(`{"error":"unauthorized"}`))
+	if authHeader := strings.TrimSpace(r.Header.Get("Authorization")); len(authHeader) > 7 && strings.EqualFold(authHeader[:7], "Bearer ") {
+		if session, ok := a.auth.ValidateToken(strings.TrimSpace(authHeader[7:])); ok && session.Permissions["mcp:execute"] {
+			principal := authctx.NewPrincipalWithScopes(session.UserID, session.Username, session.Scope, session.Permissions, session.PermissionScopes)
+			a.mcpServer.HandleHTTP(w, r.WithContext(authctx.WithPrincipal(r.Context(), principal)))
 			return
 		}
 	}
+	if !cfg.AllowGlobalAccess || strings.TrimSpace(cfg.AuthHeader) == "" || strings.TrimSpace(cfg.AuthHeaderValue) == "" {
+		http.Error(w, "use an authorized user bearer token; global MCP service access is disabled", http.StatusUnauthorized)
+		return
+	}
+	if subtle.ConstantTimeCompare([]byte(r.Header.Get(cfg.AuthHeader)), []byte(cfg.AuthHeaderValue)) != 1 {
+		a.logger.Logger.Debug("MCP 鉴权失败：header 缺失或值不匹配", zap.String("header", cfg.AuthHeader))
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusUnauthorized)
+		w.Write([]byte(`{"error":"unauthorized"}`))
+		return
+	}
+	permissions := make(map[string]bool, len(security.PermissionCatalog))
+	for permission := range security.PermissionCatalog {
+		permissions[permission] = true
+	}
+	principal := authctx.NewPrincipal("service:mcp", "mcp-service", database.RBACScopeAll, permissions)
+	r = r.WithContext(authctx.WithPrincipal(r.Context(), principal))
 	a.mcpServer.HandleHTTP(w, r)
 }
 
@@ -825,6 +843,7 @@ func setupRoutes(
 	terminalHandler *handler.TerminalHandler,
 	c2Handler *handler.C2Handler,
 	auditHandler *handler.AuditHandler,
+	auditSvc *audit.Service,
 	rbacHandler *handler.RBACHandler,
 	mcpServer *mcp.Server,
 	authManager *security.AuthManager,
@@ -835,8 +854,9 @@ func setupRoutes(
 
 	// 认证相关路由
 	authRoutes := api.Group("/auth")
+	loginRL := security.NewRateLimiter(10, 1*time.Minute)
 	{
-		authRoutes.POST("/login", authHandler.Login)
+		authRoutes.POST("/login", security.RateLimitMiddleware(loginRL), authHandler.Login)
 		authRoutes.POST("/logout", security.AuthMiddleware(authManager), authHandler.Logout)
 		authRoutes.POST("/change-password", security.AuthMiddleware(authManager), security.RequirePermission("auth:self"), authHandler.ChangePassword)
 		authRoutes.GET("/validate", security.AuthMiddleware(authManager), authHandler.Validate)
@@ -856,7 +876,15 @@ func setupRoutes(
 
 	protected := api.Group("")
 	protected.Use(security.AuthMiddleware(authManager))
-	protected.Use(security.RBACMiddleware(app.db))
+	protected.Use(security.RBACMiddlewareWithDenyHook(app.db, func(c *gin.Context, reason, permission string) {
+		if auditSvc != nil {
+			auditSvc.Record(c, audit.Entry{
+				Level: "warn", Category: "rbac", Action: "access_denied", Result: "failure",
+				Message: "RBAC 拒绝访问", ResourceType: "route", ResourceID: c.FullPath(),
+				Detail: map[string]interface{}{"reason": reason, "permission": permission, "method": c.Request.Method},
+			})
+		}
+	}))
 	{
 		protected.GET("/rbac/me", rbacHandler.Me)
 		protected.GET("/rbac/metadata", rbacHandler.Metadata)
@@ -1490,7 +1518,13 @@ func registerWebshellManagementTools(mcpServer *mcp.Server, db *database.DB, web
 		},
 	}
 	listHandler := func(ctx context.Context, args map[string]interface{}) (*mcp.ToolResult, error) {
-		connections, err := db.ListWebshellConnections()
+		connections := []database.WebShellConnection{}
+		var err error
+		if principal, ok := authctx.PrincipalFromContext(ctx); ok {
+			connections, err = db.ListWebshellConnectionsForAccess(principal.UserID, principal.ScopeFor("webshell:read"))
+		} else {
+			return &mcp.ToolResult{Content: []mcp.Content{{Type: "text", Text: "缺少认证身份"}}, IsError: true}, nil
+		}
 		if err != nil {
 			return &mcp.ToolResult{
 				Content: []mcp.Content{{Type: "text", Text: "获取连接列表失败: " + err.Error()}},
@@ -1605,6 +1639,10 @@ func registerWebshellManagementTools(mcpServer *mcp.Server, db *database.DB, web
 				IsError: true,
 			}, nil
 		}
+		if principal, ok := authctx.PrincipalFromContext(ctx); ok {
+			_ = db.SetResourceOwner("webshell", conn.ID, principal.UserID)
+			_ = db.AssignResourceToUser(principal.UserID, "webshell", conn.ID)
+		}
 
 		return &mcp.ToolResult{
 			Content: []mcp.Content{{
@@ -2000,8 +2038,17 @@ func initializeKnowledge(
 // corsMiddleware CORS中间件
 func corsMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		c.Writer.Header().Set("Access-Control-Allow-Origin", "*")
-		c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
+		origin := strings.TrimSpace(c.GetHeader("Origin"))
+		if origin != "" {
+			parsed, err := url.Parse(origin)
+			if err != nil || parsed.Host == "" || !strings.EqualFold(parsed.Host, c.Request.Host) {
+				c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "cross-origin request denied"})
+				return
+			}
+			c.Writer.Header().Set("Access-Control-Allow-Origin", origin)
+			c.Writer.Header().Set("Access-Control-Allow-Credentials", "true")
+			c.Writer.Header().Add("Vary", "Origin")
+		}
 		c.Writer.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Accept-Encoding, X-CSRF-Token, Authorization, accept, origin, Cache-Control, X-Requested-With")
 		c.Writer.Header().Set("Access-Control-Allow-Methods", "POST, OPTIONS, GET, PUT, DELETE")
 

internal/app/c2_tools.go

@@ -4,11 +4,13 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
 
 	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/authctx"
 	"cyberstrike-ai/internal/c2"
 	"cyberstrike-ai/internal/database"
 	"cyberstrike-ai/internal/mcp"
@@ -66,16 +68,16 @@ tcp_reverse 默认仅接受 CSB1 加密 Beacon（AES-GCM + ImplantToken）才登
 		InputSchema: map[string]interface{}{
 			"type": "object",
 			"properties": map[string]interface{}{
-				"action":      map[string]interface{}{"type": "string", "description": "操作: list/get/create/update/start/stop/delete", "enum": []string{"list", "get", "create", "update", "start", "stop", "delete"}},
-				"listener_id": map[string]interface{}{"type": "string", "description": "监听器 ID（get/update/start/stop/delete 需要）"},
-				"name":        map[string]interface{}{"type": "string", "description": "监听器名称（create/update）"},
-				"type":        map[string]interface{}{"type": "string", "description": "监听器类型（create）", "enum": []string{"tcp_reverse", "http_beacon", "https_beacon", "websocket"}},
+				"action":        map[string]interface{}{"type": "string", "description": "操作: list/get/create/update/start/stop/delete", "enum": []string{"list", "get", "create", "update", "start", "stop", "delete"}},
+				"listener_id":   map[string]interface{}{"type": "string", "description": "监听器 ID（get/update/start/stop/delete 需要）"},
+				"name":          map[string]interface{}{"type": "string", "description": "监听器名称（create/update）"},
+				"type":          map[string]interface{}{"type": "string", "description": "监听器类型（create）", "enum": []string{"tcp_reverse", "http_beacon", "https_beacon", "websocket"}},
 				"bind_host":     map[string]interface{}{"type": "string", "description": "绑定地址，默认 127.0.0.1；外网监听常用 0.0.0.0"},
 				"callback_host": map[string]interface{}{"type": "string", "description": "可选：植入端/Payload 回连主机名（公网 IP 或域名）。写入 config_json；生成 oneliner/beacon 时优先于 bind_host。update 时传入空字符串可清除"},
-				"bind_port":   map[string]interface{}{"type": "integer", "description": fmt.Sprintf("绑定端口（create 必填）。须 ≠ %d（当前本服务 Web/API 端口，配置 server.port）", webListenPort), "minimum": 1, "maximum": 65535},
-				"profile_id":  map[string]interface{}{"type": "string", "description": "Malleable Profile ID"},
-				"remark":      map[string]interface{}{"type": "string", "description": "备注"},
-				"config":      map[string]interface{}{"type": "object", "description": "高级配置（beacon 路径/TLS/OPSEC 等），create/update 可用。tcp_reverse 可选 allow_legacy_shell:true 允许未加密经典 shell（默认 false）"},
+				"bind_port":     map[string]interface{}{"type": "integer", "description": fmt.Sprintf("绑定端口（create 必填）。须 ≠ %d（当前本服务 Web/API 端口，配置 server.port）", webListenPort), "minimum": 1, "maximum": 65535},
+				"profile_id":    map[string]interface{}{"type": "string", "description": "Malleable Profile ID"},
+				"remark":        map[string]interface{}{"type": "string", "description": "备注"},
+				"config":        map[string]interface{}{"type": "object", "description": "高级配置（beacon 路径/TLS/OPSEC 等），create/update 可用。tcp_reverse 可选 allow_legacy_shell:true 允许未加密经典 shell（默认 false）"},
 			},
 			"required": []string{"action"},
 		},
@@ -85,7 +87,7 @@ tcp_reverse 默认仅接受 CSB1 加密 Beacon（AES-GCM + ImplantToken）才登
 
 		switch action {
 		case "list":
-			listeners, err := m.DB().ListC2Listeners()
+			listeners, err := m.DB().ListC2ListenersForAccess(c2ToolAccess(ctx))
 			if err != nil {
 				return makeC2Result(nil, err)
 			}
@@ -128,6 +130,10 @@ tcp_reverse 默认仅接受 CSB1 加密 Beacon（AES-GCM + ImplantToken）才登
 			if err != nil {
 				return makeC2Result(nil, err)
 			}
+			if principal, ok := authctx.PrincipalFromContext(ctx); ok {
+				_ = m.DB().SetResourceOwner("c2_listener", listener.ID, principal.UserID)
+				_ = m.DB().AssignResourceToUser(principal.UserID, "c2_listener", listener.ID)
+			}
 			implantToken := listener.ImplantToken
 			listener.EncryptionKey = ""
 			listener.ImplantToken = ""
@@ -264,7 +270,7 @@ func registerC2SessionTool(s *mcp.Server, m *c2.Manager, l *zap.Logger) {
 			if v, ok := params["suspicious"].(bool); ok && v {
 				filter.Suspicious = true
 			}
-			sessions, err := m.DB().ListC2Sessions(filter)
+			sessions, err := m.DB().ListC2SessionsForAccess(filter, c2ToolAccess(ctx))
 			return makeC2Result(map[string]interface{}{"sessions": sessions, "count": len(sessions)}, err)
 
 		case "get":
@@ -494,7 +500,7 @@ func registerC2TaskManageTool(s *mcp.Server, m *c2.Manager, l *zap.Logger) {
 			if limit := int(getFloat64(params, "limit")); limit > 0 {
 				filter.Limit = limit
 			}
-			tasks, err := m.DB().ListC2Tasks(filter)
+			tasks, err := m.DB().ListC2TasksForAccess(filter, c2ToolAccess(ctx))
 			return makeC2Result(map[string]interface{}{"tasks": tasks, "count": len(tasks)}, err)
 
 		case "cancel":
@@ -602,6 +608,9 @@ func registerC2PayloadTool(s *mcp.Server, m *c2.Manager, l *zap.Logger, webListe
 			if err != nil {
 				return makeC2Result(nil, err)
 			}
+			if principal, ok := authctx.PrincipalFromContext(ctx); ok {
+				_ = m.DB().RecordC2PayloadArtifact(filepath.Base(result.OutputPath), result.PayloadID, result.ListenerID, principal.UserID)
+			}
 			return makeC2Result(map[string]interface{}{
 				"payload_id": result.PayloadID, "download_path": result.DownloadPath,
 				"os": result.OS, "arch": result.Arch, "size_bytes": result.SizeBytes,
@@ -648,11 +657,19 @@ func registerC2EventTool(s *mcp.Server, m *c2.Manager, l *zap.Logger) {
 				filter.Since = &t
 			}
 		}
-		events, err := m.DB().ListC2Events(filter)
+		events, err := m.DB().ListC2EventsForAccess(filter, c2ToolAccess(ctx))
 		return makeC2Result(map[string]interface{}{"events": events, "count": len(events)}, err)
 	})
 }
 
+func c2ToolAccess(ctx context.Context) database.RBACListAccess {
+	principal, ok := authctx.PrincipalFromContext(ctx)
+	if !ok {
+		return database.RBACListAccess{Scope: database.RBACScopeAssigned}
+	}
+	return database.RBACListAccess{UserID: principal.UserID, Scope: principal.ScopeFor("c2:read")}
+}
+
 // ============================================================================
 // c2_profile — Malleable Profile 管理工具（新增）
 // ============================================================================

internal/app/cors_security_test.go

@@ -0,0 +1,34 @@
+package app
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+func TestCORSMiddlewareAllowsSameOriginAndRejectsForeignOrigin(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	router := gin.New()
+	router.Use(corsMiddleware())
+	router.GET("/test", func(c *gin.Context) { c.Status(http.StatusNoContent) })
+
+	same := httptest.NewRequest(http.MethodGet, "http://app.example/test", nil)
+	same.Host = "app.example"
+	same.Header.Set("Origin", "http://app.example")
+	sameW := httptest.NewRecorder()
+	router.ServeHTTP(sameW, same)
+	if sameW.Code != http.StatusNoContent || sameW.Header().Get("Access-Control-Allow-Origin") != "http://app.example" {
+		t.Fatalf("same-origin response = %d, allow-origin=%q", sameW.Code, sameW.Header().Get("Access-Control-Allow-Origin"))
+	}
+
+	foreign := httptest.NewRequest(http.MethodGet, "http://app.example/test", nil)
+	foreign.Host = "app.example"
+	foreign.Header.Set("Origin", "https://evil.example")
+	foreignW := httptest.NewRecorder()
+	router.ServeHTTP(foreignW, foreign)
+	if foreignW.Code != http.StatusForbidden {
+		t.Fatalf("foreign-origin response = %d, want %d", foreignW.Code, http.StatusForbidden)
+	}
+}

internal/app/mcp_authorization.go

@@ -0,0 +1,249 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/authctx"
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/mcp"
+	"cyberstrike-ai/internal/mcp/builtin"
+)
+
+func mcpToolAuthorizer(db *database.DB) func(context.Context, string, map[string]interface{}) error {
+	return func(ctx context.Context, toolName string, args map[string]interface{}) error {
+		principal, ok := authctx.PrincipalFromContext(ctx)
+		if !ok {
+			return fmt.Errorf("missing authenticated principal")
+		}
+		require := func(permission string) error {
+			if !principal.HasPermission(permission) {
+				return fmt.Errorf("missing permission %s", permission)
+			}
+			return nil
+		}
+		resource := func(permission, resourceType, argument string) error {
+			if err := require(permission); err != nil {
+				return err
+			}
+			id := mcpAuthorizationString(args, argument)
+			if id == "" || db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor(permission), resourceType, id) {
+				return fmt.Errorf("no access to %s %s", resourceType, id)
+			}
+			return nil
+		}
+
+		switch toolName {
+		case builtin.ToolWebshellExec, builtin.ToolWebshellFileWrite:
+			return resource("webshell:write", "webshell", "connection_id")
+		case builtin.ToolWebshellFileList, builtin.ToolWebshellFileRead:
+			return resource("webshell:read", "webshell", "connection_id")
+		case builtin.ToolManageWebshellList:
+			return require("webshell:read")
+		case builtin.ToolManageWebshellAdd:
+			return require("webshell:write")
+		case builtin.ToolManageWebshellUpdate, builtin.ToolManageWebshellTest:
+			return resource("webshell:write", "webshell", "connection_id")
+		case builtin.ToolManageWebshellDelete:
+			return resource("webshell:delete", "webshell", "connection_id")
+		case builtin.ToolRecordVulnerability:
+			if err := require("vulnerability:write"); err != nil {
+				return err
+			}
+			conversationID := mcpAuthorizationString(args, "conversation_id")
+			if conversationID == "" {
+				conversationID = mcpAuthorizationConversationID(ctx)
+			}
+			if conversationID == "" || db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor("vulnerability:write"), "conversation", conversationID) {
+				return fmt.Errorf("no access to conversation %s", conversationID)
+			}
+			return nil
+		case builtin.ToolListVulnerabilities:
+			if err := require("vulnerability:read"); err != nil {
+				return err
+			}
+			conversationID := mcpAuthorizationConversationID(ctx)
+			if conversationID == "" || db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor("vulnerability:read"), "conversation", conversationID) {
+				return fmt.Errorf("no access to conversation %s", conversationID)
+			}
+			return nil
+		case builtin.ToolGetVulnerability:
+			return resource("vulnerability:read", "vulnerability", "id")
+		case builtin.ToolUpsertProjectFact, builtin.ToolDeprecateProjectFact, builtin.ToolRestoreProjectFact:
+			return authorizeProjectTool(ctx, principal, db, "project:write")
+		case builtin.ToolGetProjectFact, builtin.ToolListProjectFacts, builtin.ToolSearchProjectFacts:
+			return authorizeProjectTool(ctx, principal, db, "project:read")
+		case builtin.ToolListKnowledgeRiskTypes, builtin.ToolSearchKnowledgeBase:
+			return require("knowledge:read")
+		case builtin.ToolAnalyzeImage:
+			return require("agent:execute")
+		case builtin.ToolBatchTaskList:
+			return require("tasks:read")
+		case builtin.ToolBatchTaskGet:
+			return resource("tasks:read", "batch_task", "queue_id")
+		case builtin.ToolBatchTaskCreate:
+			if err := require("tasks:write"); err != nil {
+				return err
+			}
+			if projectID := mcpAuthorizationString(args, "project_id"); projectID != "" && (db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor("tasks:write"), "project", projectID)) {
+				return fmt.Errorf("no access to project %s", projectID)
+			}
+			return nil
+		case builtin.ToolBatchTaskDelete, builtin.ToolBatchTaskRemove:
+			return resource("tasks:delete", "batch_task", "queue_id")
+		case builtin.ToolBatchTaskStart, builtin.ToolBatchTaskRerun, builtin.ToolBatchTaskPause,
+			builtin.ToolBatchTaskUpdateMetadata, builtin.ToolBatchTaskUpdateSchedule,
+			builtin.ToolBatchTaskScheduleEnabled, builtin.ToolBatchTaskAdd, builtin.ToolBatchTaskUpdate:
+			return resource("tasks:write", "batch_task", "queue_id")
+		case builtin.ToolC2Listener:
+			return authorizeC2Action(principal, db, args, "c2_listener", "listener_id")
+		case builtin.ToolC2Session, builtin.ToolC2Task, builtin.ToolC2File:
+			if toolName == builtin.ToolC2File && mcpAuthorizationString(args, "action") == "get_result" {
+				return authorizeC2Action(principal, db, args, "c2_task", "task_id")
+			}
+			return authorizeC2Action(principal, db, args, "c2_session", "session_id")
+		case builtin.ToolC2TaskManage:
+			return authorizeC2Action(principal, db, args, "c2_task", "task_id")
+		case builtin.ToolC2Payload:
+			return resource("c2:write", "c2_listener", "listener_id")
+		case builtin.ToolC2Event:
+			if id := mcpAuthorizationString(args, "session_id"); id != "" {
+				return resource("c2:read", "c2_session", "session_id")
+			}
+			if principal.ScopeFor("c2:read") != database.RBACScopeAll {
+				return fmt.Errorf("unfiltered C2 event list requires global scope")
+			}
+			return require("c2:read")
+		case builtin.ToolC2Profile:
+			// Profiles are process-global and do not yet have an owner. Writes are
+			// therefore reserved for global scope; reads require c2:read.
+			if mcpAuthorizationString(args, "action") == "list" || mcpAuthorizationString(args, "action") == "get" {
+				return require("c2:read")
+			}
+			permission := "c2:write"
+			if mcpAuthorizationString(args, "action") == "delete" {
+				permission = "c2:delete"
+			}
+			if principal.ScopeFor(permission) != database.RBACScopeAll {
+				return fmt.Errorf("C2 profile mutation requires global scope")
+			}
+			if mcpAuthorizationString(args, "action") == "delete" {
+				return require("c2:delete")
+			}
+			return require("c2:write")
+		default:
+			if builtin.IsBuiltinTool(toolName) {
+				return fmt.Errorf("no authorization policy registered for builtin tool %s", toolName)
+			}
+			if principal.HasPermission("agent:local-execute") {
+				return nil
+			}
+			return fmt.Errorf("missing agent:local-execute")
+		}
+	}
+}
+
+func externalMCPToolAuthorizer() func(context.Context, string, map[string]interface{}) error {
+	return func(ctx context.Context, toolName string, _ map[string]interface{}) error {
+		principal, ok := authctx.PrincipalFromContext(ctx)
+		if !ok {
+			return fmt.Errorf("missing authenticated principal")
+		}
+		if !principal.HasPermission("mcp:external:execute") {
+			return fmt.Errorf("missing permission mcp:external:execute")
+		}
+		if principal.ScopeFor("mcp:external:execute") != database.RBACScopeAll {
+			return fmt.Errorf("external MCP invocation requires global scope")
+		}
+		if strings.TrimSpace(toolName) == "" {
+			return fmt.Errorf("missing external tool name")
+		}
+		return nil
+	}
+}
+
+func authorizeC2Action(principal authctx.Principal, db *database.DB, args map[string]interface{}, resourceType, argument string) error {
+	action := mcpAuthorizationString(args, "action")
+	permission := "c2:write"
+	if action == "list" || action == "get" || action == "get_result" || action == "wait" {
+		permission = "c2:read"
+	} else if action == "delete" || action == "delete_batch" {
+		permission = "c2:delete"
+	}
+	if !principal.HasPermission(permission) {
+		return fmt.Errorf("missing permission %s", permission)
+	}
+	id := mcpAuthorizationString(args, argument)
+	if action == "delete_batch" {
+		ids := mcpAuthorizationStrings(args, argument+"s")
+		if len(ids) == 0 {
+			return fmt.Errorf("missing resource identifiers %ss", argument)
+		}
+		for _, candidate := range ids {
+			if db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor(permission), resourceType, candidate) {
+				return fmt.Errorf("no access to %s %s", resourceType, candidate)
+			}
+		}
+		return nil
+	}
+	if id == "" {
+		if action == "create" || action == "list" {
+			return nil
+		}
+		return fmt.Errorf("missing resource identifier %s", argument)
+	}
+	if db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor(permission), resourceType, id) {
+		return fmt.Errorf("no access to %s %s", resourceType, id)
+	}
+	return nil
+}
+
+func mcpAuthorizationStrings(args map[string]interface{}, key string) []string {
+	values := []string{}
+	switch raw := args[key].(type) {
+	case []string:
+		for _, value := range raw {
+			if value = strings.TrimSpace(value); value != "" {
+				values = append(values, value)
+			}
+		}
+	case []interface{}:
+		for _, item := range raw {
+			if value, ok := item.(string); ok {
+				if value = strings.TrimSpace(value); value != "" {
+					values = append(values, value)
+				}
+			}
+		}
+	}
+	return values
+}
+
+func authorizeProjectTool(ctx context.Context, principal authctx.Principal, db *database.DB, permission string) error {
+	if !principal.HasPermission(permission) {
+		return fmt.Errorf("missing permission %s", permission)
+	}
+	conversationID := mcpAuthorizationConversationID(ctx)
+	if conversationID == "" || db == nil || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor(permission), "conversation", conversationID) {
+		return fmt.Errorf("no access to conversation %s", conversationID)
+	}
+	projectID, err := db.GetConversationProjectID(conversationID)
+	if err != nil || strings.TrimSpace(projectID) == "" || !db.UserCanAccessResource(principal.UserID, principal.ScopeFor(permission), "project", projectID) {
+		return fmt.Errorf("no access to project %s", projectID)
+	}
+	return nil
+}
+
+func mcpAuthorizationConversationID(ctx context.Context) string {
+	if id := strings.TrimSpace(agent.ConversationIDFromContext(ctx)); id != "" {
+		return id
+	}
+	return strings.TrimSpace(mcp.MCPConversationIDFromContext(ctx))
+}
+
+func mcpAuthorizationString(args map[string]interface{}, key string) string {
+	value, _ := args[key].(string)
+	return strings.TrimSpace(value)
+}

internal/app/mcp_authorization_test.go

@@ -0,0 +1,97 @@
+package app
+
+import (
+	"context"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"cyberstrike-ai/internal/authctx"
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/mcp/builtin"
+	"cyberstrike-ai/internal/security"
+
+	"go.uber.org/zap"
+)
+
+func TestMCPToolAuthorizerEnforcesPermissionAndResource(t *testing.T) {
+	db, err := database.NewDB(filepath.Join(t.TempDir(), "mcp-authz.db"), zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	user, err := db.CreateRBACUser("mcp-user", "MCP User", "hash", true, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{"ws_allowed", "ws_hidden"} {
+		if err := db.CreateWebshellConnection(&database.WebShellConnection{ID: id, URL: "http://127.0.0.1/" + id, Type: "php", Method: "post", CmdParam: "cmd", CreatedAt: time.Now()}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := db.AssignResourceToUser(user.ID, "webshell", "ws_allowed"); err != nil {
+		t.Fatal(err)
+	}
+
+	principal := authctx.NewPrincipal(user.ID, user.Username, database.RBACScopeAssigned, map[string]bool{"mcp:write": true, "webshell:write": true})
+	ctx := authctx.WithPrincipal(context.Background(), principal)
+	authorize := mcpToolAuthorizer(db)
+	if err := authorize(ctx, builtin.ToolWebshellExec, map[string]interface{}{"connection_id": "ws_allowed"}); err != nil {
+		t.Fatalf("allowed resource denied: %v", err)
+	}
+	if err := authorize(ctx, builtin.ToolWebshellExec, map[string]interface{}{"connection_id": "ws_hidden"}); err == nil {
+		t.Fatal("foreign webshell resource was allowed")
+	}
+	if err := authorize(ctx, builtin.ToolManageWebshellDelete, map[string]interface{}{"connection_id": "ws_allowed"}); err == nil {
+		t.Fatal("delete without webshell:delete was allowed")
+	}
+}
+
+func TestEveryBuiltinMCPToolHasExplicitAuthorizationPolicy(t *testing.T) {
+	db, err := database.NewDB(filepath.Join(t.TempDir(), "mcp-policy-inventory.db"), zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+	permissions := map[string]bool{}
+	for permission := range security.PermissionCatalog {
+		permissions[permission] = true
+	}
+	ctx := authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("admin", "admin", database.RBACScopeAll, permissions))
+	authorize := mcpToolAuthorizer(db)
+	args := map[string]interface{}{
+		"action": "get", "connection_id": "x", "queue_id": "x", "listener_id": "x",
+		"session_id": "x", "task_id": "x", "id": "x", "conversation_id": "x",
+	}
+	for _, toolName := range builtin.GetAllBuiltinTools() {
+		err := authorize(ctx, toolName, args)
+		if err != nil && strings.Contains(err.Error(), "no authorization policy registered") {
+			t.Errorf("builtin tool %s has no explicit policy", toolName)
+		}
+	}
+}
+
+func TestExternalMCPRequiresDedicatedPermission(t *testing.T) {
+	authorize := externalMCPToolAuthorizer()
+	ctx := authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("u1", "user", database.RBACScopeAssigned, map[string]bool{"agent:execute": true}))
+	if err := authorize(ctx, "server::tool", nil); err == nil {
+		t.Fatal("agent:execute alone authorized an external MCP tool")
+	}
+	ctx = authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("u1", "user", database.RBACScopeAll, map[string]bool{"mcp:external:execute": true}))
+	if err := authorize(ctx, "server::tool", nil); err != nil {
+		t.Fatalf("dedicated external MCP permission rejected: %v", err)
+	}
+}
+
+func TestConfiguredCommandToolRequiresLocalExecutePermission(t *testing.T) {
+	authorize := mcpToolAuthorizer(nil)
+	agentOnly := authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("u1", "user", database.RBACScopeAssigned, map[string]bool{"agent:execute": true}))
+	if err := authorize(agentOnly, "nmap_scan", nil); err == nil {
+		t.Fatal("agent:execute alone authorized a configured command tool")
+	}
+	local := authctx.WithPrincipal(context.Background(), authctx.NewPrincipal("u1", "user", database.RBACScopeAssigned, map[string]bool{"agent:local-execute": true}))
+	if err := authorize(local, "nmap_scan", nil); err != nil {
+		t.Fatalf("agent:local-execute rejected: %v", err)
+	}
+}

internal/app/mcp_http_auth_test.go

@@ -0,0 +1,55 @@
+package app
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"cyberstrike-ai/internal/config"
+	"cyberstrike-ai/internal/database"
+	"cyberstrike-ai/internal/mcp"
+	"cyberstrike-ai/internal/security"
+
+	"go.uber.org/zap"
+)
+
+func TestStandaloneMCPPrefersUserRBACAndDisablesGlobalTokenByDefault(t *testing.T) {
+	db, err := database.NewDB(filepath.Join(t.TempDir(), "mcp-http-auth.db"), zap.NewNop())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	auth, err := security.NewAuthManager("admin-secret", 12)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := auth.AttachRBACStore(db); err != nil {
+		t.Fatal(err)
+	}
+	token, _, err := auth.Authenticate("admin", "admin-secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := mcp.NewServer(zap.NewNop())
+	server.SetToolAuthorizer(mcpToolAuthorizer(db))
+	a := &App{config: &config.Config{MCP: config.MCPConfig{AuthHeader: "X-MCP-Token", AuthHeaderValue: "static-secret"}}, auth: auth, mcpServer: server}
+	body := []byte(`{"jsonrpc":"2.0","id":1,"method":"tools/list"}`)
+
+	userReq := httptest.NewRequest(http.MethodPost, "/mcp", bytes.NewReader(body))
+	userReq.Header.Set("Authorization", "Bearer "+token)
+	userW := httptest.NewRecorder()
+	a.mcpHandlerWithAuth(userW, userReq)
+	if userW.Code != http.StatusOK {
+		t.Fatalf("user bearer status = %d: %s", userW.Code, userW.Body.String())
+	}
+
+	staticReq := httptest.NewRequest(http.MethodPost, "/mcp", bytes.NewReader(body))
+	staticReq.Header.Set("X-MCP-Token", "static-secret")
+	staticW := httptest.NewRecorder()
+	a.mcpHandlerWithAuth(staticW, staticReq)
+	if staticW.Code != http.StatusUnauthorized {
+		t.Fatalf("global static token status = %d, want 401", staticW.Code)
+	}
+}

internal/app/vulnerability_tools.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	"cyberstrike-ai/internal/agent"
+	"cyberstrike-ai/internal/authctx"
 	"cyberstrike-ai/internal/database"
 	"cyberstrike-ai/internal/mcp"
 	"cyberstrike-ai/internal/mcp/builtin"
@@ -313,6 +314,10 @@ func registerRecordVulnerabilityTool(mcpServer *mcp.Server, db *database.DB, log
 			}
 			return textResult(fmt.Sprintf("记录漏洞失败: %v", err), true), nil
 		}
+		if principal, ok := authctx.PrincipalFromContext(ctx); ok {
+			_ = db.SetResourceOwner("vulnerability", created.ID, principal.UserID)
+			_ = db.AssignResourceToUser(principal.UserID, "vulnerability", created.ID)
+		}
 
 		if logger != nil {
 			logger.Info("漏洞记录成功",