fix(security): admin gate on tool-toggle REST endpoints

The MCP-layer quarantine_security tool gates enable_tool / disable_tool
behind authCtx.IsAdmin() (mcp.go:2326). The three new REST endpoints
that landed in this PR did NOT mirror that check:

  POST /api/v1/servers/{id}/tools/{tool}/enabled
  POST /api/v1/servers/{id}/tools/enable_all
  POST /api/v1/servers/{id}/tools/disable_all

Result: an agent token (mcp_agt_ prefix) — scoped to a subset of
servers and read-only permissions via the agent-token system — could
hit any of these REST endpoints and flip per-tool visibility on any
server, bypassing the admin gate the MCP layer enforces.

Add the guard at the top of handleSetToolEnabled and the
handleSetAllToolsEnabled closure (covers both enable_all and
disable_all routes). Non-admin or unauthenticated callers receive 403
"operation requires admin access".

Scope limited to the new endpoints. The pre-existing per-server REST
mutation endpoints (e.g. POST /api/v1/servers/{name}/enable,
.../quarantine, .../tools/approve) also lack admin checks — that's a
broader hardening pattern worth a separate PR rather than entangling
it with the per-tool feature.

Regression tests in tool_quarantine_test.go:
- TestHandleSetToolEnabled_AgentTokenForbidden
- TestHandleSetAllToolsEnabled_EnableAll_AgentTokenForbidden
- TestHandleSetAllToolsEnabled_DisableAll_AgentTokenForbidden
- TestHandleSetToolEnabled_AdminKeyAllowed (positive control)

Helpers: mockToolToggleController wraps the existing mock with a real
*config.Config so the auth middleware activates; agentTokenServer
mints a live agent token via the token store.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: electrolobzik

internal/httpapi/server.go

@@ -3777,6 +3777,12 @@ func (s *Server) handleApproveTools(w http.ResponseWriter, r *http.Request) {
 
 // handleGetToolDiff handles GET /api/v1/servers/{id}/tools/{tool}/diff
 func (s *Server) handleSetToolEnabled(w http.ResponseWriter, r *http.Request) {
+	authCtx := auth.AuthContextFromContext(r.Context())
+	if authCtx == nil || !authCtx.IsAdmin() {
+		s.writeError(w, r, http.StatusForbidden, "operation requires admin access")
+		return
+	}
+
 	serverID := chi.URLParam(r, "id")
 	toolName := chi.URLParam(r, "tool")
 	if serverID == "" || toolName == "" {
@@ -3837,6 +3843,12 @@ func (s *Server) handleSetToolEnabled(w http.ResponseWriter, r *http.Request) {
 // @Router /api/v1/servers/{id}/tools/disable_all [post]
 func (s *Server) handleSetAllToolsEnabled(enabled bool) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
+		authCtx := auth.AuthContextFromContext(r.Context())
+		if authCtx == nil || !authCtx.IsAdmin() {
+			s.writeError(w, r, http.StatusForbidden, "operation requires admin access")
+			return
+		}
+
 		serverID := chi.URLParam(r, "id")
 		if serverID == "" {
 			s.writeError(w, r, http.StatusBadRequest, "Server ID required")

internal/httpapi/tool_quarantine_test.go

@@ -7,11 +7,13 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"time"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/zap"
 
+	"github.com/smart-mcp-proxy/mcpproxy-go/internal/auth"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/config"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/storage"
 )
@@ -592,3 +594,142 @@ func TestHandleUnquarantineServer_Error(t *testing.T) {
 
 	assert.Equal(t, http.StatusInternalServerError, w.Code)
 }
+
+// =============================================================================
+// Security: Admin gate on tool-toggle REST endpoints (fix: agent bypass)
+// =============================================================================
+
+// agentTokenServer returns a Server wired with a fake agent token so that
+// requests carrying that raw token go through the middleware as AuthTypeAgent
+// (non-admin). The returned rawToken must be placed in X-API-Key.
+func agentTokenServer(t *testing.T, ctrl ServerController) (*Server, string) {
+	t.Helper()
+	tmpDir := t.TempDir()
+	_, err := auth.GetOrCreateHMACKey(tmpDir)
+	require.NoError(t, err)
+
+	rawToken, err := auth.GenerateToken()
+	require.NoError(t, err)
+
+	agentToken := &auth.AgentToken{
+		Name:           "test-agent",
+		TokenPrefix:    auth.TokenPrefix(rawToken),
+		AllowedServers: []string{"*"},
+		Permissions:    []string{auth.PermRead, auth.PermWrite},
+		ExpiresAt:      time.Now().Add(24 * time.Hour),
+		CreatedAt:      time.Now(),
+	}
+
+	store := &testTokenStore{
+		validateFunc: func(token string, _ []byte) (*auth.AgentToken, error) {
+			if token == rawToken {
+				return agentToken, nil
+			}
+			return nil, fmt.Errorf("token not found")
+		},
+	}
+
+	logger := zap.NewNop().Sugar()
+	srv := NewServer(ctrl, logger, nil)
+	srv.SetTokenStore(store, tmpDir)
+	return srv, rawToken
+}
+
+// mockToolToggleController embeds mockToolQuarantineController and overrides
+// GetCurrentConfig to return a real *config.Config so the auth middleware
+// enforces authentication (required to distinguish admin vs agent).
+type mockToolToggleController struct {
+	mockToolQuarantineController
+}
+
+func (m *mockToolToggleController) GetCurrentConfig() any {
+	return &config.Config{APIKey: m.apiKey}
+}
+
+func TestHandleSetToolEnabled_AgentTokenForbidden(t *testing.T) {
+	ctrl := &mockToolToggleController{
+		mockToolQuarantineController: mockToolQuarantineController{
+			apiKey: "admin-secret",
+			approvals: []*storage.ToolApprovalRecord{{
+				ServerName: "github",
+				ToolName:   "create_issue",
+				Status:     storage.ToolApprovalStatusApproved,
+			}},
+		},
+	}
+
+	srv, agentToken := agentTokenServer(t, ctrl)
+
+	req := httptest.NewRequest("POST", "/api/v1/servers/github/tools/create_issue/enabled",
+		bytes.NewBufferString(`{"enabled":false}`))
+	req.Header.Set("X-API-Key", agentToken)
+	w := httptest.NewRecorder()
+
+	srv.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Contains(t, w.Body.String(), "admin access")
+}
+
+func TestHandleSetAllToolsEnabled_EnableAll_AgentTokenForbidden(t *testing.T) {
+	ctrl := &mockToolToggleController{
+		mockToolQuarantineController: mockToolQuarantineController{
+			apiKey: "admin-secret",
+		},
+	}
+
+	srv, agentToken := agentTokenServer(t, ctrl)
+
+	req := httptest.NewRequest("POST", "/api/v1/servers/github/tools/enable_all", nil)
+	req.Header.Set("X-API-Key", agentToken)
+	w := httptest.NewRecorder()
+
+	srv.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Contains(t, w.Body.String(), "admin access")
+}
+
+func TestHandleSetAllToolsEnabled_DisableAll_AgentTokenForbidden(t *testing.T) {
+	ctrl := &mockToolToggleController{
+		mockToolQuarantineController: mockToolQuarantineController{
+			apiKey: "admin-secret",
+		},
+	}
+
+	srv, agentToken := agentTokenServer(t, ctrl)
+
+	req := httptest.NewRequest("POST", "/api/v1/servers/github/tools/disable_all", nil)
+	req.Header.Set("X-API-Key", agentToken)
+	w := httptest.NewRecorder()
+
+	srv.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Contains(t, w.Body.String(), "admin access")
+}
+
+func TestHandleSetToolEnabled_AdminKeyAllowed(t *testing.T) {
+	ctrl := &mockToolToggleController{
+		mockToolQuarantineController: mockToolQuarantineController{
+			apiKey: "admin-secret",
+			approvals: []*storage.ToolApprovalRecord{{
+				ServerName: "github",
+				ToolName:   "create_issue",
+				Status:     storage.ToolApprovalStatusApproved,
+			}},
+		},
+	}
+
+	logger := zap.NewNop().Sugar()
+	srv := NewServer(ctrl, logger, nil)
+
+	req := httptest.NewRequest("POST", "/api/v1/servers/github/tools/create_issue/enabled",
+		bytes.NewBufferString(`{"enabled":false}`))
+	req.Header.Set("X-API-Key", "admin-secret")
+	w := httptest.NewRecorder()
+
+	srv.ServeHTTP(w, req)
+
+	assert.Equal(t, http.StatusOK, w.Code)
+}