FreeOnePlus opened a new pull request, #157:
URL: https://github.com/apache/doris-mcp-server/pull/157
## Summary
- replace external OAuth role, permission, security-level, and trusted-domain
hardcoding with validated configuration
- add environment settings for default roles/permissions, role mappings,
trusted domains, and fallback security levels
- require `email_verified=true` before a trusted email domain can elevate a
user's security classification
- remove placeholder trusted domains and make permission output deterministic
- replace the misleading Python-only README example with deployable
environment configuration and Doris authorization boundaries
## Configuration
The new settings are:
- `OAUTH_DEFAULT_ROLES`
- `OAUTH_DEFAULT_SECURITY_LEVEL`
- `OAUTH_DEFAULT_PERMISSIONS`
- `OAUTH_TRUSTED_DOMAINS`
- `OAUTH_TRUSTED_DOMAIN_SECURITY_LEVEL`
- `OAUTH_ROLE_SECURITY_LEVELS_JSON`
- `OAUTH_ROLE_PERMISSIONS_JSON`
JSON mappings replace the complete built-in mapping when supplied. An
explicit
empty permission array denies permissions for that mapped role, and an empty
`OAUTH_DEFAULT_PERMISSIONS` value makes unknown roles fail closed.
## Root cause
The README described authorization as configurable, but the active external
OAuth provider embedded role mappings and placeholder trusted domains
directly
in Python. Operators could not supply their own roles or safely disable the
implicit `read_data` fallback.
## Validation
- `uv run pytest -q`: 1090 passed, 68 skipped; coverage 58.11%
- external OAuth configuration and validation suite: 49 passed
- post-rebase OAuth/result-limit regression set: 62 passed
- `uv run ruff check .`
- `uv run mypy doris_mcp_server`
- CI-equivalent Bandit scan
- `uv build`
Fixes #88
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
