fix(rbac): require gateway use, and count only grants that give it (#70)

The AI gateway never checked `ai_gateway:use` (nor the MCP gateway
`mcp_gateway:use`), and a role that did not grant it counted as
"unrestricted" when model and tool scopes were merged. So a user with no
role, or only `viewer`, could call every model and tool, and adding
`viewer` to a user limited to one model opened all of them. A role
granted at team scope also contributed its model and tool access to
every request, platform-wide.

- The gateway middleware refuses with 403 (naming the missing
  permission, in the caller's error format) unless a role of the key's
  owner grants the surface's `*_gateway:use`; an explicit Deny on the
  action closes it. An ownerless key gets nothing.
- Model / tool scopes are the union over roles that grant the surface;
  a role that does not contributes nothing. Action wildcards
  (`ai_gateway:*`, `*`) count.
- Gateway decisions read global assignments and roles attached to the
  user's teams; team-scoped assignments administer the team only.
- An empty model allow-list allows nothing (the MCP side already did),
  and the key/role intersection is pattern-aware so a key narrowed
  inside a prefix grant keeps working.
- The console's effective-permissions preview follows the same rules,
  and the role assignment editor says a team-scoped role grants no
  gateway access.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: fylorn

CHANGELOG.md

@@ -11,6 +11,59 @@ target.
 
 ## [Unreleased]
 
+### Read before upgrading
+
+- **The gateways now require `ai_gateway:use` / `mcp_gateway:use`.** A
+  request to the AI gateway is refused with `403` unless a role held by
+  the key's owner grants `ai_gateway:use`, and a request to the MCP
+  gateway unless one grants `mcp_gateway:use`. The body names the
+  missing permission. Users with no role at all, and users whose only
+  roles are `viewer` or custom roles without these actions, used to
+  reach every model and tool and are now refused. The built-in
+  `developer`, `admin`, `super_admin` and `team_manager` roles grant
+  both, so users holding one of them at global scope, or through a role
+  attached to one of their teams, keep working. Before upgrading, list
+  gateway users without such a role and give them `developer` (or a
+  custom role with the actions). If SSO users are meant to use the
+  gateway on first sign-in, set *Default Role for New Users*
+  (`auth.default_role`) in Settings to `developer`; it is empty by
+  default.
+- **A role that does not grant gateway use no longer widens model or
+  tool access.** Model and MCP tool scopes are now the union over the
+  roles that grant `ai_gateway:use` / `mcp_gateway:use` only. A role
+  without those actions (such as `viewer`) used to count as
+  "unrestricted", so adding it to a user limited to some models opened
+  every model to them. Users relying on that lose the extra models.
+- **A role granted at team scope no longer grants gateway access.** An
+  assignment with scope `team:<id>` administers that team from the
+  console (team roster, team limits); it no longer contributes models,
+  MCP tools or gateway use, which it used to do for every request the
+  user made, member of the team or not. Roles attached to a team itself
+  (Teams → Roles), which every member inherits, still count. A user
+  whose only gateway role was a team-scoped `developer` or
+  `team_manager` needs that role at global scope, or attached to their
+  team.
+- **An empty model allow-list allows nothing.** A key whose
+  `allowed_models` is `[]`, or whose list shares no model with what its
+  owner's roles grant, used to call any model; it now calls none, as
+  `allowed_mcp_tools: []` already did on the MCP gateway. The console
+  never saves `[]` (clearing the picker sends `null`), so only keys
+  written through the API are affected. Model entries still match by
+  prefix, and a key narrowed to `gpt-4o-mini` under a role granting
+  `gpt-4o` keeps `gpt-4o-mini`.
+
+### Security
+
+- **Gateway use is checked, and a missing grant means no access.** See
+  the first three items above: a user with no role, or only roles
+  without gateway use, could call every model and MCP tool; a
+  `viewer`-style role widened a restricted user to every model; a role
+  granted at the scope of any team, even one the user was not a member
+  of, widened model and tool access platform-wide. An explicit `Deny`
+  on `ai_gateway:use` or `mcp_gateway:use` now closes that gateway.
+  Action wildcards (`ai_gateway:*`, `*`) grant it, as they already did
+  for console permissions.
+
 ## [2.1.0] — 2026-09-30
 
 Amazon Bedrock becomes a provider you can run from the console. It

crates/auth/src/rbac.rs

@@ -9,7 +9,10 @@ use uuid::Uuid;
 // permissions, model/tool scopes, rate limits, and budgets.
 //
 // Permissions (Allow actions): UNION across roles — most permissive.
-// Model scope: UNION; if any role has Resource:"*" → unrestricted.
+// Model / MCP tool scope: UNION over the roles that grant
+// `ai_gateway:use` / `mcp_gateway:use`; a role that grants neither
+// contributes nothing, and only global and team-inherited roles count
+// (a role granted at team scope administers that team only).
 // Rate limits: per (metric, window) take MIN MaxCount — most restrictive.
 // Budgets: per Period take MIN MaxTokens — most restrictive.
 // Deny statements: win over Allow across all roles.
@@ -69,6 +72,36 @@ async fn load_user_policy_documents(
     Ok(rows.into_iter().map(|(v,)| v).collect())
 }
 
+/// The policy documents that decide gateway access for `user_id`:
+/// roles assigned at global scope, plus roles attached to a team the
+/// user is a member of (a team's roles are its members' working roles).
+///
+/// Roles granted at `scope_kind = 'team'` are left out. Such a grant
+/// lets the holder administer that team from the console; gateway
+/// requests carry no team, so honouring it here would turn a team
+/// grant into platform-wide model and tool access.
+async fn load_gateway_policy_documents(
+    pool: &PgPool,
+    user_id: Uuid,
+) -> Result<Vec<serde_json::Value>, sqlx::Error> {
+    let rows: Vec<(serde_json::Value,)> = sqlx::query_as(
+        "SELECT DISTINCT r.policy_document FROM ( \
+           SELECT ra.role_id FROM rbac_role_assignments ra \
+            WHERE ra.user_id = $1 AND ra.scope_kind = 'global' \
+           UNION \
+           SELECT tra.role_id \
+             FROM team_members tm \
+             JOIN team_role_assignments tra ON tra.team_id = tm.team_id \
+            WHERE tm.user_id = $1 \
+         ) roles \
+         JOIN rbac_roles r ON r.id = roles.role_id",
+    )
+    .bind(user_id)
+    .fetch_all(pool)
+    .await?;
+    Ok(rows.into_iter().map(|(v,)| v).collect())
+}
+
 /// Load the list of role NAMES (system + custom) assigned to `user_id`,
 /// including roles inherited through team membership.
 /// Used by the UI for badges and by `claims.roles`.
@@ -157,63 +190,124 @@ pub async fn compute_user_role_assignments(
         .collect())
 }
 
-/// Effective resource constraints for a user, derived by union'ing
-/// every role's model and MCP tool scopes from their policy_documents.
+/// Effective gateway access for a user, derived from the roles that
+/// decide it (see [`load_gateway_policy_documents`]).
 ///
-///   - If ANY role has `Resource: "*"` on the relevant gateway
-///     statement, the field in the result is `None` (unrestricted).
-///   - Otherwise the result is the union of every role's scoped
-///     resources, deduplicated.
+///   - `ai_gateway` / `mcp_gateway` is true when some role grants
+///     `ai_gateway:use` / `mcp_gateway:use` and no role denies it.
+///   - Only roles that grant a surface contribute resources to it. If
+///     one of them has `Resource: "*"`, the list is `None`
+///     (unrestricted); otherwise it is the union of their scoped
+///     resources.
+///   - A surface that is not granted has an empty list (`Some([])`),
+///     never `None`, so a caller that forgets the flag still allows
+///     nothing.
 ///
 /// This is what the gateway middleware merges with the per-API-key
 /// allow-list (if any) before calling into the proxy.
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct UserResourceLimits {
+    pub ai_gateway: bool,
     pub allowed_models: Option<Vec<String>>,
+    pub mcp_gateway: bool,
     /// MCP tool patterns: `None` = unrestricted, `["mysql__*"]` = server
     /// wildcard, `["mysql__query"]` = exact tool.
     pub allowed_mcp_tools: Option<Vec<String>>,
 }
 
+impl UserResourceLimits {
+    /// Neither gateway, nothing on either.
+    pub fn none() -> Self {
+        Self {
+            ai_gateway: false,
+            allowed_models: Some(Vec::new()),
+            mcp_gateway: false,
+            allowed_mcp_tools: Some(Vec::new()),
+        }
+    }
+}
+
 pub async fn compute_user_resource_limits(
     pool: &PgPool,
     user_id: Uuid,
 ) -> Result<UserResourceLimits, sqlx::Error> {
-    let docs = load_user_policy_documents(pool, user_id).await?;
-    if docs.is_empty() {
-        return Ok(UserResourceLimits {
-            allowed_models: None,
-            allowed_mcp_tools: None,
-        });
-    }
+    let docs = load_gateway_policy_documents(pool, user_id).await?;
+    Ok(resource_limits_from_documents(&docs))
+}
 
-    let mut models_unrestricted = false;
-    let mut tools_unrestricted = false;
-    let mut models: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
-    let mut tools: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
+/// One gateway surface, folded across roles.
+struct SurfaceGrant {
+    granted: bool,
+    unrestricted: bool,
+    items: std::collections::BTreeSet<String>,
+}
 
-    for doc in &docs {
-        match think_watch_common::limits::extract_allowed_models(doc) {
-            None => models_unrestricted = true,
-            Some(list) => models.extend(list),
+impl SurfaceGrant {
+    fn new() -> Self {
+        Self {
+            granted: false,
+            unrestricted: false,
+            items: std::collections::BTreeSet::new(),
         }
-        match think_watch_common::limits::extract_allowed_mcp_tools(doc) {
-            None => tools_unrestricted = true,
-            Some(list) => tools.extend(list),
+    }
+
+    fn add(&mut self, scope: think_watch_common::limits::ResourceScope) {
+        use think_watch_common::limits::ResourceScope;
+        match scope {
+            ResourceScope::NotGranted => {}
+            ResourceScope::All => {
+                self.granted = true;
+                self.unrestricted = true;
+            }
+            ResourceScope::Only(list) => {
+                self.granted = true;
+                self.items.extend(list);
+            }
         }
     }
 
-    Ok(UserResourceLimits {
-        allowed_models: if models_unrestricted {
-            None
-        } else {
-            Some(models.into_iter().collect())
-        },
-        allowed_mcp_tools: if tools_unrestricted {
-            None
+    fn finish(self, denied: bool) -> (bool, Option<Vec<String>>) {
+        if !self.granted || denied {
+            (false, Some(Vec::new()))
+        } else if self.unrestricted {
+            (true, None)
         } else {
-            Some(tools.into_iter().collect())
-        },
-    })
+            (true, Some(self.items.into_iter().collect()))
+        }
+    }
+}
+
+fn resource_limits_from_documents(docs: &[serde_json::Value]) -> UserResourceLimits {
+    use think_watch_common::limits::{extract_mcp_tool_scope, extract_model_scope};
+
+    let mut models = SurfaceGrant::new();
+    let mut tools = SurfaceGrant::new();
+    for doc in docs {
+        models.add(extract_model_scope(doc));
+        tools.add(extract_mcp_tool_scope(doc));
+    }
+
+    // An explicit Deny on the whole action, in any of these roles, closes
+    // the surface — the same rule `compute_denied_permissions` applies to
+    // console permissions.
+    let policies: Vec<PolicyDocument> = docs
+        .iter()
+        .filter_map(|v| serde_json::from_value(v.clone()).ok())
+        .collect();
+    let denied = |action: &str| {
+        policies
+            .iter()
+            .any(|doc| evaluate_policy(doc, action, "*") == PolicyResult::Deny)
+    };
+
+    let (ai_gateway, allowed_models) = models.finish(denied("ai_gateway:use"));
+    let (mcp_gateway, allowed_mcp_tools) = tools.finish(denied("mcp_gateway:use"));
+    UserResourceLimits {
+        ai_gateway,
+        allowed_models,
+        mcp_gateway,
+        allowed_mcp_tools,
+    }
 }
 
 /// Role-only merged surface constraints — the baseline before any
@@ -336,19 +430,6 @@ pub async fn compute_effective_surface_constraints(
     Ok(apply_user_overrides(user_merged, key_overrides))
 }
 
-/// Check if a namespaced MCP tool name matches any of the allowed patterns.
-/// Patterns: `"*"` matches all, `"mysql__*"` matches prefix, exact otherwise.
-pub fn is_mcp_tool_allowed(patterns: Option<&[String]>, namespaced_name: &str) -> bool {
-    match patterns {
-        None => true, // NULL = unrestricted
-        Some(pats) => pats.iter().any(|p| {
-            p == "*"
-                || (p.ends_with("__*") && namespaced_name.starts_with(&p[..p.len() - 1]))
-                || p == namespaced_name
-        }),
-    }
-}
-
 /// Compute the set of permissions that are explicitly denied to `user_id`
 /// by policy documents attached to any of their roles (direct + team).
 ///
@@ -848,4 +929,84 @@ mod tests {
             PolicyResult::Deny
         );
     }
+
+    // --- Gateway resource limits ---
+
+    fn doc(statement: serde_json::Value) -> serde_json::Value {
+        serde_json::json!({"Version": "2024-01-01", "Statement": [statement]})
+    }
+
+    fn viewer() -> serde_json::Value {
+        doc(serde_json::json!({
+            "Effect": "Allow",
+            "Action": ["api_keys:read", "providers:read", "models:read", "mcp_servers:read", "analytics:read_own"],
+            "Resource": "*"
+        }))
+    }
+
+    fn developer() -> serde_json::Value {
+        doc(serde_json::json!({
+            "Effect": "Allow",
+            "Action": ["ai_gateway:use", "mcp_gateway:use", "api_keys:read"],
+            "Resource": "*"
+        }))
+    }
+
+    #[test]
+    fn no_roles_grant_nothing() {
+        assert_eq!(
+            resource_limits_from_documents(&[]),
+            UserResourceLimits::none()
+        );
+    }
+
+    #[test]
+    fn a_role_without_gateway_use_grants_nothing() {
+        assert_eq!(
+            resource_limits_from_documents(&[viewer()]),
+            UserResourceLimits::none()
+        );
+    }
+
+    #[test]
+    fn a_role_without_gateway_use_does_not_widen_another() {
+        let only_a = doc(serde_json::json!({
+            "Effect": "Allow",
+            "Action": ["ai_gateway:use"],
+            "Resource": ["model:model-a"]
+        }));
+        let limits = resource_limits_from_documents(&[only_a, viewer()]);
+        assert!(limits.ai_gateway);
+        assert_eq!(limits.allowed_models, Some(vec!["model-a".to_string()]));
+        assert!(!limits.mcp_gateway);
+        assert_eq!(limits.allowed_mcp_tools, Some(vec![]));
+    }
+
+    #[test]
+    fn a_gateway_role_with_resource_star_is_unrestricted() {
+        let limits = resource_limits_from_documents(&[developer(), viewer()]);
+        assert_eq!(
+            limits,
+            UserResourceLimits {
+                ai_gateway: true,
+                allowed_models: None,
+                mcp_gateway: true,
+                allowed_mcp_tools: None,
+            }
+        );
+    }
+
+    #[test]
+    fn a_deny_on_the_action_closes_the_surface() {
+        let deny = doc(serde_json::json!({
+            "Effect": "Deny",
+            "Action": "ai_gateway:use",
+            "Resource": "*"
+        }));
+        let limits = resource_limits_from_documents(&[developer(), deny]);
+        assert!(!limits.ai_gateway);
+        assert_eq!(limits.allowed_models, Some(vec![]));
+        assert!(limits.mcp_gateway);
+        assert_eq!(limits.allowed_mcp_tools, None);
+    }
 }