Authz list filters drop resultType, cacheScope and ttlMs from 2026-07-28 results #6708

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"maps"
	"net/http"
	"net/http/httptest"
	"slices"
	"strings"

	"github.com/stacklok/toolhive/pkg/auth"
	"github.com/stacklok/toolhive/pkg/authz"
	"github.com/stacklok/toolhive/pkg/authz/authorizers/cedar"
	"github.com/stacklok/toolhive/pkg/mcp"
)

// List members of a 2026-07-28 result; every item is permitted by the policies below.
var lists = map[string]string{
	"tools/list":               `"tools":[{"name":"echo","inputSchema":{"type":"object"}}]`,
	"prompts/list":             `"prompts":[{"name":"greet"}]`,
	"resources/list":           `"resources":[{"uri":"file:///a.txt","name":"a"}]`,
	"resources/templates/list": `"resourceTemplates":[{"uriTemplate":"file:///{p}","name":"t"}]`,
}

func main() {
	authorizer, err := cedar.NewCedarAuthorizer(cedar.ConfigOptions{Policies: []string{
		`permit(principal, action == Action::"call_tool", resource);`,
		`permit(principal, action == Action::"get_prompt", resource);`,
		`permit(principal, action == Action::"read_resource", resource);`,
	}, EntitiesJSON: `[]`}, "demo")
	if err != nil {
		panic(err)
	}
	for _, method := range []string{"tools/list", "prompts/list", "resources/list", "resources/templates/list"} {
		result := `{"resultType":"complete","cacheScope":"private","ttlMs":0,"_meta":{},` + lists[method] + `}`
		for _, sse := range []bool{false, true} {
			backend := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
				body := `{"jsonrpc":"2.0","id":1,"result":` + result + `}`
				if sse {
					w.Header().Set("Content-Type", "text/event-stream")
					body = "event: message\ndata: " + body + "\n\n"
				} else {
					w.Header().Set("Content-Type", "application/json")
				}
				_, _ = w.Write([]byte(body))
			})
			handler := mcp.ParsingMiddleware(authz.Middleware(authorizer, backend, nil))

			req := httptest.NewRequest(http.MethodPost, "/mcp", bytes.NewBufferString(
				`{"jsonrpc":"2.0","id":1,"method":"`+method+`",`+
					`"params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28"}}}`))
			req.Header.Set("Content-Type", "application/json")
			req.Header.Set("MCP-Protocol-Version", "2026-07-28")
			req.Header.Set("Mcp-Method", method)
			req = req.WithContext(auth.WithIdentity(req.Context(), &auth.Identity{
				PrincipalInfo: auth.PrincipalInfo{Subject: "user", Claims: map[string]any{"sub": "user"}},
			}))
			rec := httptest.NewRecorder()
			handler.ServeHTTP(rec, req)

			body := rec.Body.String()
			if i := strings.Index(body, "data: "); sse && i >= 0 {
				body = strings.TrimSpace(body[i+len("data: "):])
			}
			var resp struct {
				Result map[string]json.RawMessage `json:"result"`
			}
			if err := json.Unmarshal([]byte(body), &resp); err != nil {
				panic(err)
			}
			transport := map[bool]string{false: "json", true: "sse"}[sse]
			fmt.Printf("%-25s %-4s result keys: %v\n", method, transport, slices.Sorted(maps.Keys(resp.Result)))
		}
	}
}