Publish curated ITWorx_MCP_Hub source from 6c7434368ce2a594005983c5a6601a31a639e7f1

services/runtime/client_service.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+import hashlib
+import json
 from datetime import UTC, datetime, timedelta
 from typing import Any
 from uuid import UUID, uuid4
@@ -14,7 +16,9 @@ from packages.hub_clients import (
     ClientStatus,
     generate_config,
 )
+from services.control_api.auth.models import AuthenticatedPrincipal
 from services.control_api.persistence.models import (
+    AuditEventRow,
     ClientBindingRow,
     ClientRow,
     EnvironmentRow,
@@ -158,13 +162,21 @@ class PersistentClientService:
         selected = record if kind is None else record.model_copy(update={"kind": kind})
         return generate_config(selected, public_host=self.public_host)
 
-    def _transition(self, client_id: UUID, status: ClientStatus) -> ClientRecord:
+    def transition(
+        self, client_id: UUID, status: ClientStatus, actor: AuthenticatedPrincipal | None = None
+    ) -> ClientRecord:
         now = datetime.now(UTC)
         with self.sessions() as session, session.begin():
-            row = session.get(ClientRow, client_id)
+            row = session.scalar(
+                select(ClientRow)
+                .join(WorkspaceRow, WorkspaceRow.id == ClientRow.workspace_id)
+                .where(ClientRow.id == client_id, WorkspaceRow.slug == "itworx")
+            )
             if row is None:
                 raise KeyError(client_id)
             metadata = dict(row.record_metadata or {})
+            if row.status == "revoked" and status is ClientStatus.DISABLED:
+                raise ValueError("revoked clients cannot be changed to disabled")
             metadata["operatorDisabled"] = True
             if status is ClientStatus.DISABLED:
                 metadata["disabledAt"] = now.isoformat()
@@ -173,18 +185,55 @@ class PersistentClientService:
                 row.status = "revoked"
                 row.revoked_at = now
             row.record_metadata = metadata
-            for binding in session.scalars(
+            bindings = session.scalars(
                 select(ClientBindingRow).where(ClientBindingRow.client_id == client_id)
-            ).all():
+            ).all()
+            for binding in bindings:
                 binding.enabled = False
+            scope_binding = bindings[0] if len(bindings) == 1 else None
+            scope_server = (
+                session.get(VirtualServerRow, scope_binding.virtual_server_id)
+                if scope_binding is not None
+                else None
+            )
             session.flush()
+            action = "client.disable" if status is ClientStatus.DISABLED else "client.revoke"
+            arguments = {"clientId": str(client_id), "action": action}
+            session.add(
+                AuditEventRow(
+                    id=uuid4(),
+                    occurred_at=now,
+                    trace_id=str(uuid4()),
+                    workspace_id=row.workspace_id,
+                    project_id=scope_binding.project_id if scope_binding else None,
+                    environment_id=scope_server.environment_id if scope_server else None,
+                    virtual_server_id=scope_server.id if scope_server else None,
+                    client_id=row.id,
+                    event_type=action,
+                    tool_name=action,
+                    principal_issuer=(actor.issuer if actor is not None else self.issuer)[:512],
+                    principal_subject=(
+                        actor.subject if actor is not None else "runtime-client-management"
+                    )[:256],
+                    policy_decision="allow",
+                    matched_rule_ids=[action],
+                    policy_trace=[{"action": action, "decision": "allow"}],
+                    arguments_hash=hashlib.sha256(
+                        json.dumps(arguments, sort_keys=True).encode("utf-8")
+                    ).hexdigest(),
+                    sanitized_arguments=arguments,
+                    duration_ms=0,
+                    outcome="success",
+                    retention_until=now + timedelta(days=30),
+                )
+            )
             return self._record(row)
 
     def disable(self, client_id: UUID) -> ClientRecord:
-        return self._transition(client_id, ClientStatus.DISABLED)
+        return self.transition(client_id, ClientStatus.DISABLED)
 
     def revoke(self, client_id: UUID) -> ClientRecord:
-        return self._transition(client_id, ClientStatus.REVOKED)
+        return self.transition(client_id, ClientStatus.REVOKED)
 
     def bootstrap(self, client_id: UUID) -> BootstrapHandle:
         record = self._get(client_id)

services/runtime/connector_gitea.py

@@ -677,9 +677,7 @@ def build_server() -> MCPServer[Any]:
     )
     async def portfolio_governance_apply(
         context: Context[Any, Any],
-        plans: Annotated[
-            list[PortfolioGovernanceApplyPlan], Field(min_length=1, max_length=5)
-        ],
+        plans: Annotated[list[PortfolioGovernanceApplyPlan], Field(min_length=1, max_length=5)],
     ) -> dict[str, Any]:
         """Apply at most five exact governance plans; every item is independently verified."""
         return connector.portfolio_governance_apply(
@@ -813,7 +811,9 @@ def build_server() -> MCPServer[Any]:
         structured_output=True,
     )
     async def pull_request_validation_ensure(
-        repositoryRef: str, number: int, expectedHeadSha: str,
+        repositoryRef: str,
+        number: int,
+        expectedHeadSha: str,
         context: Context[Any, Any],
     ) -> dict[str, Any]:
         """Ensure a real canonical full PR run for the exact current head."""