feat(mcp): centralize connection access policies

src-tauri/src/commands/mongo_cmd.rs

@@ -99,7 +99,11 @@ pub async fn mongo_find_documents(
     projection: Option<String>,
     sort: Option<String>,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_read_allowed_by_id(state.inner(), &connection_id, &database).await?;
+    }
     crate::commands::document_cmd::document_find_documents(
         state,
         connection_id,
@@ -126,8 +130,12 @@ pub async fn mongo_find_one(
     projection: Option<String>,
     options: Option<String>,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
     let app = state.inner().clone();
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_read_allowed_by_id(&app, &connection_id, &database).await?;
+    }
     run_cancellable(
         &app,
         execution_id,
@@ -153,8 +161,12 @@ pub async fn mongo_count_documents(
     filter: Option<String>,
     mode: Option<String>,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<u64, String> {
     let app = state.inner().clone();
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_read_allowed_by_id(&app, &connection_id, &database).await?;
+    }
     crate::commands::document_cmd::run_cancellable(
         &app,
         execution_id,
@@ -176,8 +188,12 @@ pub async fn mongo_server_version(
     connection_id: String,
     database: String,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<String, String> {
     let app = state.inner().clone();
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_read_allowed_by_id(&app, &connection_id, &database).await?;
+    }
     run_cancellable(&app, execution_id, dbx_core::mongo_ops::mongo_server_version_core(&app, &connection_id, &database))
         .await
 }
@@ -190,8 +206,12 @@ pub async fn mongo_collection_stats(
     collection: String,
     scale: Option<serde_json::Number>,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<dbx_core::db::mongo_driver::MongoCollectionStatsResult, String> {
     let app = state.inner().clone();
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_read_allowed_by_id(&app, &connection_id, &database).await?;
+    }
     run_cancellable(
         &app,
         execution_id,
@@ -210,8 +230,18 @@ pub async fn mongo_aggregate_documents(
     max_rows: Option<usize>,
     options_json: Option<String>,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
     let app = state.inner().clone();
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_mongo_aggregate_allowed_by_id(
+            &app,
+            &connection_id,
+            &database,
+            &pipeline_json,
+        )
+        .await?;
+    }
     run_cancellable(
         &app,
         execution_id,
@@ -237,8 +267,12 @@ pub async fn mongo_distinct(
     field: String,
     filter: Option<String>,
     execution_id: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
     let app = state.inner().clone();
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_read_allowed_by_id(&app, &connection_id, &database).await?;
+    }
     run_cancellable(
         &app,
         execution_id,
@@ -262,7 +296,17 @@ pub async fn mongo_create_index(
     collection: String,
     keys_json: String,
     options_json: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<serde_json::Value, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_dangerous_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Create index",
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Create index").await?;
     let name = dbx_core::mongo_ops::mongo_create_index_core(
         &state,
@@ -284,7 +328,17 @@ pub async fn mongo_drop_indexes(
     collection: String,
     indexes_json: Option<String>,
     single: bool,
+    mcp_request: Option<bool>,
 ) -> Result<dbx_core::db::mongo_driver::MongoDropIndexesResult, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_dangerous_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Drop indexes",
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Drop indexes").await?;
     dbx_core::mongo_ops::mongo_drop_indexes_core(
         &state,
@@ -324,7 +378,12 @@ pub async fn mongo_insert_documents(
     database: String,
     collection: String,
     docs_json: String,
+    mcp_request: Option<bool>,
 ) -> Result<u64, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_write_allowed_by_id(state.inner(), &connection_id, &database, "Insert")
+            .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Insert").await?;
     dbx_core::mongo_ops::mongo_insert_documents_core(&state, &connection_id, &database, &collection, &docs_json).await
 }
@@ -361,7 +420,18 @@ pub async fn mongo_update_documents(
     update_json: String,
     many: bool,
     options_json: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<u64, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_mongo_filtered_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Update",
+            &filter_json,
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Update").await?;
     dbx_core::mongo_ops::mongo_update_documents_core(
         &state,
@@ -397,7 +467,18 @@ pub async fn mongo_delete_documents(
     collection: String,
     filter_json: String,
     many: bool,
+    mcp_request: Option<bool>,
 ) -> Result<u64, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_mongo_filtered_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Delete",
+            &filter_json,
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Delete").await?;
     dbx_core::mongo_ops::mongo_delete_documents_core(&state, &connection_id, &database, &collection, &filter_json, many)
         .await
@@ -412,7 +493,18 @@ pub async fn mongo_find_one_and_update(
     filter_json: String,
     update_json: String,
     options_json: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_mongo_filtered_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Update",
+            &filter_json,
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Update").await?;
     dbx_core::mongo_ops::mongo_find_one_and_update_core(
         &state,
@@ -435,7 +527,18 @@ pub async fn mongo_find_one_and_replace(
     filter_json: String,
     replacement_json: String,
     options_json: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_mongo_filtered_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Update",
+            &filter_json,
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Update").await?;
     dbx_core::mongo_ops::mongo_find_one_and_replace_core(
         &state,
@@ -457,7 +560,18 @@ pub async fn mongo_find_one_and_delete(
     collection: String,
     filter_json: String,
     options_json: Option<String>,
+    mcp_request: Option<bool>,
 ) -> Result<MongoDocumentResult, String> {
+    if mcp_request == Some(true) {
+        crate::commands::mcp_bridge::ensure_mcp_mongo_filtered_write_allowed_by_id(
+            state.inner(),
+            &connection_id,
+            &database,
+            "Delete",
+            &filter_json,
+        )
+        .await?;
+    }
     ensure_connection_writable(&state, &connection_id, "Delete").await?;
     dbx_core::mongo_ops::mongo_find_one_and_delete_core(
         &state,