fix: enforce access control on all meta-server handlers

All 12 meta-server tool handlers now enforce visibility-based access
control using user_email and token_teams from the JWT context.

Previously fixed (execute_tool, authorize_gateway, authorize_all_gateways)
already passed user context correctly. The following handlers were
bypassing access control entirely:

- _list_tools: now passes user_email/token_teams to ToolService.list_tools()
- _search_tools: replaced raw db.query(Tool) with ToolService.list_tools()
- _stub_describe_tool: passes user_email/token_teams to MetaToolService
- _get_similar_tools: filters vector search results against accessible
  tool set via ToolService.list_tools()
- _list_resources: applies ResourceService._apply_access_control() to query
- _read_resource: checks ResourceService._check_resource_access() before
  returning content
- _list_prompts: applies PromptService._apply_access_control() to query
- _get_prompt: checks PromptService._check_prompt_access() before
  returning content

Adds _extract_user_context() static helper for consistent extraction
of (user_email, token_teams, request_headers) from handler kwargs.

_get_tool_categories remains hardcoded to actor_scope=public_user which
is already restrictive by default.

Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>

Author: Olivier Gintrand

mcpgateway/meta_server/service.py

@@ -264,6 +264,24 @@ def _to_snake(key: str) -> str:
 
         return {_to_snake(k): v for k, v in arguments.items()}
 
+    @staticmethod
+    def _extract_user_context(kwargs: Dict[str, Any]) -> tuple:
+        """Extract access-control parameters from handler kwargs.
+
+        ``handle_meta_tool_call`` passes ``user_email``, ``token_teams``,
+        and ``request_headers`` through to every handler.  This helper
+        provides a single extraction point so handlers don't repeat the
+        pattern.
+
+        Returns:
+            Tuple of (user_email, token_teams, request_headers).
+        """
+        return (
+            kwargs.get("user_email"),
+            kwargs.get("token_teams"),
+            kwargs.get("request_headers"),
+        )
+
     # ------------------------------------------------------------------
     # Implemented handlers
     # ------------------------------------------------------------------
@@ -297,6 +315,9 @@ async def _search_tools(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[
         tags = arguments.get("tags", [])
         include_metrics = arguments.get("include_metrics", False)
 
+        # -- Extract user context for access control --
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         # -- Step 1: Semantic search --
         semantic_results = []
         try:
@@ -309,39 +330,44 @@ async def _search_tools(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[
         # -- Step 2: Keyword fallback search --
         keyword_results = []
         try:
+            from mcpgateway.services.tool_service import ToolService as _KwToolService  # pylint: disable=import-outside-toplevel
+            _kw_ts = _KwToolService()
+
             db_gen = get_db()
             db = next(db_gen)
             try:
-                search_pattern = f"%{query}%"
-                keyword_tools = (
-                    db.query(Tool)
-                    .filter(
-                        Tool.enabled.is_(True),
-                        or_(
-                            Tool._computed_name.ilike(search_pattern),
-                            Tool.description.ilike(search_pattern),
-                        ),
-                    )
-                    .limit(limit)
-                    .all()
+                # Use ToolService.list_tools for consistent access control
+                kw_result = await _kw_ts.list_tools(
+                    db=db,
+                    include_inactive=False,
+                    limit=limit,
+                    user_email=user_email,
+                    token_teams=token_teams,
                 )
+                kw_tools_list, _ = kw_result if isinstance(kw_result, tuple) else (kw_result, None)
 
                 query_lower = query.lower()
-                for tool in keyword_tools:
+                search_pattern = query_lower
+                for tool in kw_tools_list:
+                    tool_name = getattr(tool, "name", "")
+                    tool_desc = getattr(tool, "description", "") or ""
+                    # Filter to only matching tools
+                    if search_pattern not in tool_name.lower() and search_pattern not in tool_desc.lower():
+                        continue
                     # Score 1.0 for exact name match, 0.5 for partial match
-                    if tool._computed_name.lower() == query_lower:
+                    if tool_name.lower() == query_lower:
                         score = 1.0
-                    elif query_lower in tool.name.lower():
+                    elif query_lower in tool_name.lower():
                         score = 0.7
                     else:
                         score = 0.5
 
                     keyword_results.append(
                         ToolSearchResult(
-                            tool_name=tool.name,
-                            description=tool.description,
-                            server_id=tool.gateway_id,
-                            server_name=tool.gateway.name if tool.gateway else None,
+                            tool_name=tool_name,
+                            description=tool_desc,
+                            server_id=getattr(tool, "gateway_id", None),
+                            server_name=None,
                             similarity_score=score,
                         )
                     )
@@ -414,6 +440,9 @@ async def _get_similar_tools(self, arguments: Dict[str, Any], **kwargs: Any) ->
         tool_name = arguments.get("tool_name", "")
         limit = arguments.get("limit", 10)
 
+        # -- Extract user context for access control --
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         if not tool_name:
             return GetSimilarToolsResponse(
                 reference_tool=tool_name,
@@ -501,6 +530,34 @@ async def _get_similar_tools(self, arguments: Dict[str, Any], **kwargs: Any) ->
         # -- Step 4: Filter out the reference tool itself --
         similar_results = [r for r in similar_results if r.tool_name != tool_name][:limit]
 
+        # -- Step 4.5: Apply access-control filtering --
+        # Build set of tool names the user can access, then discard the rest.
+        if user_email is not None or token_teams is not None:
+            try:
+                from mcpgateway.services.tool_service import ToolService as _AcToolService  # pylint: disable=import-outside-toplevel
+
+                _ac_ts = _AcToolService()
+                db_gen = get_db()
+                db = next(db_gen)
+                try:
+                    ac_result = await _ac_ts.list_tools(
+                        db=db,
+                        include_inactive=False,
+                        limit=0,
+                        user_email=user_email,
+                        token_teams=token_teams,
+                    )
+                    ac_tools_list, _ = ac_result if isinstance(ac_result, tuple) else (ac_result, None)
+                    accessible_names = {getattr(t, "name", "") for t in ac_tools_list}
+                    similar_results = [r for r in similar_results if r.tool_name in accessible_names]
+                finally:
+                    try:
+                        next(db_gen)
+                    except StopIteration:
+                        pass
+            except Exception as e:
+                logger.warning(f"Access control filtering failed for similar tools: {e}")
+
         # -- Step 5: Apply scope filtering --
         filtered_results = self._apply_scope_filtering(similar_results, arguments.get("scope"))
 
@@ -738,6 +795,9 @@ async def _list_tools(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[st
         sort_order = arguments.get("sort_order", "desc")
         include_schema = arguments.get("include_schema", False)
 
+        # -- Extract user context for access control --
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         # -- Step 1: Query tools from database using ToolService --
         # First-Party
         from mcpgateway.services.tool_service import ToolService
@@ -759,6 +819,8 @@ async def _list_tools(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[st
                     tags=tags if tags else None,
                     gateway_id=server_id,
                     limit=query_limit,
+                    user_email=user_email,
+                    token_teams=token_teams,
                 )
 
                 # Extract tools from result (could be tuple or dict)
@@ -838,6 +900,8 @@ async def _stub_describe_tool(self, arguments: Dict[str, Any], **kwargs: Any) ->
         # First-Party
         from mcpgateway.services.meta_tool_service import MetaToolService
 
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         try:
             db_gen = get_db()
             db = next(db_gen)
@@ -847,6 +911,8 @@ async def _stub_describe_tool(self, arguments: Dict[str, Any], **kwargs: Any) ->
                     tool_name=arguments.get("tool_name", ""),
                     include_metrics=arguments.get("include_metrics", False),
                     scope=arguments.get("scope"),
+                    user_email=user_email,
+                    token_teams=token_teams,
                 )
                 return result.model_dump(by_alias=True)
             finally:
@@ -1278,18 +1344,26 @@ async def _list_resources(self, arguments: Dict[str, Any], **kwargs: Any) -> Dic
             ListResourcesResponse as dict.
         """
         from mcpgateway.db import Resource  # pylint: disable=import-outside-toplevel
+        from mcpgateway.services.resource_service import ResourceService as _RsService  # pylint: disable=import-outside-toplevel
 
         limit = arguments.get("limit", 50)
         offset = arguments.get("offset", 0)
         tags = arguments.get("tags", [])
         mime_type = arguments.get("mime_type")
 
+        # Extract user context for access control
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         try:
             db_gen = get_db()
             db = next(db_gen)
             try:
                 query = db.query(Resource).filter(Resource.enabled.is_(True))
 
+                # Apply access control
+                _rs = _RsService()
+                query = await _rs._apply_access_control(query, db, user_email, token_teams)
+
                 if mime_type:
                     query = query.filter(Resource.mime_type == mime_type)
 
@@ -1347,6 +1421,7 @@ async def _read_resource(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict
         """
         from mcpgateway.db import Resource  # pylint: disable=import-outside-toplevel
         from mcpgateway.services.observability_service import ObservabilityService, current_trace_id  # pylint: disable=import-outside-toplevel
+        from mcpgateway.services.resource_service import ResourceService as _RsService  # pylint: disable=import-outside-toplevel
 
         uri = arguments.get("uri", "")
         if not uri:
@@ -1356,6 +1431,9 @@ async def _read_resource(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict
                 text="Error: uri is required",
             ).model_dump(by_alias=True)
 
+        # Extract user context for access control
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         start_time = time.monotonic()
         success = False
         error_message = None
@@ -1400,6 +1478,16 @@ async def _read_resource(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict
                         text=error_message,
                     ).model_dump(by_alias=True)
 
+                # Check access control
+                _rs = _RsService()
+                if not await _rs._check_resource_access(db, resource, user_email, token_teams):
+                    error_message = f"Resource not found: {uri}"
+                    return ReadResourceResponse(
+                        uri=uri,
+                        name="",
+                        text=error_message,
+                    ).model_dump(by_alias=True)
+
                 text_content = resource.text_content
                 if text_content is None and resource.binary_content is not None:
                     text_content = "(binary content — not displayable as text)"
@@ -1457,16 +1545,25 @@ async def _list_prompts(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[
             ListPromptsResponse as dict.
         """
         from mcpgateway.db import Prompt  # pylint: disable=import-outside-toplevel
+        from mcpgateway.services.prompt_service import PromptService as _PsService  # pylint: disable=import-outside-toplevel
 
         limit = arguments.get("limit", 50)
         offset = arguments.get("offset", 0)
         tags = arguments.get("tags", [])
 
+        # Extract user context for access control
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         try:
             db_gen = get_db()
             db = next(db_gen)
             try:
                 query = db.query(Prompt).filter(Prompt.enabled.is_(True))
+
+                # Apply access control
+                _ps = _PsService()
+                query = await _ps._apply_access_control(query, db, user_email, token_teams)
+
                 all_prompts = query.order_by(Prompt.created_at.desc()).all()
 
                 # Apply tag filtering in Python (tags stored as JSON)
@@ -1519,6 +1616,7 @@ async def _get_prompt(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[st
         """
         from mcpgateway.db import Prompt  # pylint: disable=import-outside-toplevel
         from mcpgateway.services.observability_service import ObservabilityService, current_trace_id  # pylint: disable=import-outside-toplevel
+        from mcpgateway.services.prompt_service import PromptService as _PsService  # pylint: disable=import-outside-toplevel
 
         name = arguments.get("name", "")
         prompt_args = arguments.get("arguments", {})
@@ -1530,6 +1628,9 @@ async def _get_prompt(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[st
                 description="Error: name is required",
             ).model_dump(by_alias=True)
 
+        # Extract user context for access control
+        user_email, token_teams, _ = self._extract_user_context(kwargs)
+
         start_time = time.monotonic()
         success = False
         error_message = None
@@ -1575,6 +1676,16 @@ async def _get_prompt(self, arguments: Dict[str, Any], **kwargs: Any) -> Dict[st
                         description=error_message,
                     ).model_dump(by_alias=True)
 
+                # Check access control
+                _ps = _PsService()
+                if not await _ps._check_prompt_access(db, prompt, user_email, token_teams):
+                    error_message = f"Prompt not found: {name}"
+                    return GetPromptResponse(
+                        name=name,
+                        template="",
+                        description=error_message,
+                    ).model_dump(by_alias=True)
+
                 rendered = None
                 if prompt_args:
                     try: