From 5ce1820086dab72999d9943efa68d98cdcf2d0eb Mon Sep 17 00:00:00 2001 From: VibeSWE <338779468+VibeSWE@users.noreply.github.com> Date: Sat, 24 Oct 2026 12:40:58 -0500 Subject: [PATCH] Document caller gates for execute_oss_tool helpers execute_oss_tool and execute_oss_tool_with_query_headers are public and dispatch any tool in the full OSS catalog, including alert action tools, but unlike call_tool_registry they do not check session validity, tenant suspension or the global Query permission. Spell out these obligations in the doc comments so a future in-process caller applies them. No runtime behaviour change. Co-Authored-By: Claude Opus 5.5 --- src/tool_executor.rs | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/src/tool_executor.rs b/src/tool_executor.rs index f2c477041..e5126aad6 100644 --- a/src/tool_executor.rs +++ b/src/tool_executor.rs @@ -1787,6 +1787,26 @@ async fn execute_oss_tool_inner( /// Execute a registered OSS tool in-process. Enterprise uses this only after /// applying its own agent policy and action-confirmation checks, so catalog /// validation and the underlying platform implementation remain canonical. +/// +/// # Caller obligations +/// +/// Unlike [`call_tool_registry`], this function applies only catalog argument +/// validation and each tool's own per-resource `authorize()` check. Before +/// calling it, the caller must: +/// +/// - confirm the session is still valid (`Users.session_exists`); +/// - reject suspended tenants with +/// `middleware::check_suspension_for_tenant(tenant_id, Action::Query)`; +/// - authorize the global `Action::Query` gate for the session; +/// - restrict which tools may run. Lookup uses the full [`oss_tool_specs`], +/// including action tools such as `create_alert`, `enable_alert`, +/// `disable_alert`, `evaluate_alert` and `create_alert_target`, whereas the +/// HTTP route exposes only [`oss_read_tool_specs`] (plus dashboard writes +/// when enabled). Action tools need the caller's own confirmation policy. +/// +/// The same obligations apply to [`execute_oss_tool_with_query_headers`]. +/// +/// [`oss_read_tool_specs`]: crate::tool_catalog::oss_read_tool_specs pub async fn execute_oss_tool( name: &str, arguments: &Value, @@ -1801,6 +1821,10 @@ pub async fn execute_oss_tool( /// Execute a registered OSS tool with separate headers for internal query-node /// requests. Prism callers use this to preserve their server-authenticated /// routing headers without changing the external MCP execution path. +/// +/// Callers must apply the session, tenant-suspension, global `Query` and +/// tool-restriction gates listed on [`execute_oss_tool`]; none are enforced +/// here. pub async fn execute_oss_tool_with_query_headers( name: &str, arguments: &Value,