Dustin Healy 87341c67c0 fix(mcp): carry apps flag through the request resolver and canonicalize resource-read auth ... resolveMCPAllowlists now returns appsEnabled from the merged tenant-scoped config, so a tenant/role/user override of mcpSettings.apps reaches the registry's per-request resolution and callTool attaches no UI resource for users whose tenant disabled apps. Authorize app-driven resource reads in the canonical (fully percent-decoded) space the server resolves and reject any relative path segment, so a percent-encoded traversal such as %2e%2e%2f can no longer match an advertised template. Exact resources/list matches are unaffected. Trim narrating comments across the MCP Apps changes so the code is self-documenting.		2026-06-29 00:52:58 -07:00
..
__tests__	🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814)	2026-06-17 20:14:53 -04:00
agents	🖇️ feat: Reference Selected Chat Text with Multi-Quote Popup (#13868)	2026-06-21 08:33:11 -04:00
assistants	🔐 feat: Add Signed CloudFront File Downloads (#12970)	2026-05-06 19:48:30 -04:00
auth	🤝 fix: Honor OPENID_REUSE_TOKENS in Admin OAuth Exchange (#13154)	2026-05-18 09:34:58 -04:00
AuthController.js	⏳ feat: Make OpenID Token Reuse Window Configurable (#13546)	2026-06-06 15:15:58 -04:00
AuthController.spec.js	⏳ feat: Make OpenID Token Reuse Window Configurable (#13546)	2026-06-06 15:15:58 -04:00
Balance.js	🤫 chore: Quiet Repetitive Log Noise from Balance, CloudFront, and Capability Paths (#13461)	2026-06-01 20:40:16 -04:00
Balance.spec.js	🤫 chore: Quiet Repetitive Log Noise from Balance, CloudFront, and Capability Paths (#13461)	2026-06-01 20:40:16 -04:00
ContextProjectionController.js	🪙 feat: SDK-Aligned Context-Usage Projection (gauge for window-switch & snapshot-less branches) (#13801)	2026-06-16 17:54:13 -04:00
EndpointController.js	✨ refactor: Integrate Capabilities into Agent File Uploads and Tool Handling (#5048)	2024-12-19 13:04:48 -05:00
FavoritesController.js	📌 feat: Add Pin Support for Model Specs (#11219)	2026-04-09 18:37:25 -04:00
FavoritesController.spec.js	📌 feat: Add Pin Support for Model Specs (#11219)	2026-04-09 18:37:25 -04:00
mcp.js	🥽 fix: Restrict MCP Server URL Disclosure to Admins, Owners, and Editors (#13784)	2026-06-16 11:20:52 -04:00
mcpApps.js	fix(mcp): carry apps flag through the request resolver and canonicalize resource-read auth	2026-06-29 00:52:58 -07:00
ModelController.js	🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466)	2026-03-30 16:49:48 -04:00
PermissionsController.js	🪪 fix: Filter ACL Principal Details (#13524)	2026-06-05 19:06:41 -04:00
PluginController.js	🪪 fix: Resolve Group-Scoped Config Overrides (#13176)	2026-05-18 10:16:20 -04:00
PluginController.spec.js	🪪 fix: Resolve Group-Scoped Config Overrides (#13176)	2026-05-18 10:16:20 -04:00
SkillStatesController.js	🗂️ feat: Add Deployment Skill Directory (#13523)	2026-06-05 10:24:28 -04:00
TokenConfigController.js	🗂️ fix: Scope Token Config Cache (#13770)	2026-06-15 15:25:19 -04:00
tools.js	🧯 fix: Harden Data Retention Semantics (#13049)	2026-05-19 21:58:42 -04:00
TwoFactorController.js	🔑 fix: Require OTP Verification for 2FA Re-Enrollment and Backup Code Regeneration (#12223)	2026-03-14 01:51:31 -04:00
UserController.js	🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814)	2026-06-17 20:14:53 -04:00
UserController.spec.js	🛂 fix: Normalize Verification Flow Error Responses (#13558)	2026-06-06 15:08:43 -04:00