Merge pull request #1304 from jhivandb/task/mcp-proxy-resource-server-scopes

Add per-proxy resource-server scopes for MCP proxies

Author: jhivandb

agent-manager-service/api/app.go

@@ -80,7 +80,7 @@ func MakeHTTPHandler(params *wiring.AppParams, extraAPIRoutes func(*http.ServeMu
 	RegisterMonitorPublisherRoutes(rr, params.MonitorScoresPublisherController)
 	RegisterGitSecretRoutes(rr, params.GitSecretController)
 	registerIdentityRoutes(rr, params.IdentityController)
-	registerScopeRoutes(rr, params.ScopeController)
+	registerMCPProxyScopeRoutes(rr, params.MCPProxyScopeController)
 	registerAgentIdentityRoutes(rr, params.AgentIdentityController)
 
 	if extraAPIRoutes != nil {

agent-manager-service/api/scope_routes.go …er-service/api/mcp_proxy_scope_routes.goagent-manager-service/api/scope_routes.go renamed to agent-manager-service/api/mcp_proxy_scope_routes.go agent-manager-service/api/scope_routes.go renamed to agent-manager-service/api/mcp_proxy_scope_routes.go

@@ -22,9 +22,10 @@ import (
 	"github.com/wso2/agent-manager/agent-manager-service/rbac"
 )
 
-func registerScopeRoutes(rr *middleware.RouteRegistrar, ctrl controllers.ScopeController) {
-	rr.HandleFuncWithValidationAndAuthz("GET /orgs/{orgName}/scopes", rbac.ScopeRead, ctrl.ListScopes)
-	rr.HandleFuncWithValidationAndAuthz("POST /orgs/{orgName}/scopes", rbac.ScopeCreate, ctrl.CreateScope)
-	rr.HandleFuncWithValidationAndAuthz("PUT /orgs/{orgName}/scopes/{scopeName}", rbac.ScopeUpdate, ctrl.UpdateScope)
-	rr.HandleFuncWithValidationAndAuthz("DELETE /orgs/{orgName}/scopes/{scopeName}", rbac.ScopeDelete, ctrl.DeleteScope)
+func registerMCPProxyScopeRoutes(rr *middleware.RouteRegistrar, ctrl controllers.MCPProxyScopeController) {
+	rr.HandleFuncWithValidationAndAuthz("GET /orgs/{orgName}/mcp-proxies/{proxyId}/scopes", rbac.ScopeRead, ctrl.ListMCPProxyScopes)
+	rr.HandleFuncWithValidationAndAuthz("POST /orgs/{orgName}/mcp-proxies/{proxyId}/scopes", rbac.ScopeCreate, ctrl.CreateMCPProxyScope)
+	rr.HandleFuncWithValidationAndAuthz("PUT /orgs/{orgName}/mcp-proxies/{proxyId}/scopes/{scopeAction}", rbac.ScopeUpdate, ctrl.UpdateMCPProxyScope)
+	rr.HandleFuncWithValidationAndAuthz("DELETE /orgs/{orgName}/mcp-proxies/{proxyId}/scopes/{scopeAction}", rbac.ScopeDelete, ctrl.DeleteMCPProxyScope)
+	rr.HandleFuncWithValidationAndAuthz("GET /orgs/{orgName}/environments/{envName}/agent-identities/scopes", rbac.AgentIdentityRead, ctrl.ListAgentIdentityScopes)
 }

agent-manager-service/clients/clientmocks/env_identity_client_mock.go

@@ -85,7 +85,7 @@ type thunderClient struct {
 	tokenExpiry time.Time
 	tokenSfg    singleflight.Group // deduplicates concurrent token fetches
 
-	ensureScopeResourceServerMu sync.Mutex // serializes EnsureScopeResourceServer's check-then-create paths
+	ensureResourceServerMu sync.Mutex // serializes resource-server check-then-create paths (scope + proxy)
 }
 
 const httpClientTimeout = 30 * time.Second