fix: fail-closed chat access policy for View as and MCP

Walk the full SQL tree, deny unparseable or unhandled statements, and
take the MCP/Editor actor from SecurityContext. Persist allowed schemas,
scope RAG/brain retrieval, block protected-column prompt mentions, and
refuse public shares on connections with an active policy.

Co-authored-by: Venkat SF <venkatesh.sakamuri@stayflexi.com>

Author: cursoragent

CLAUDE.md

@@ -199,8 +199,9 @@ returns a number).
 2. **LLM Provider Registry**: Use `LlmProviderRegistry` for all provider-specific LLM behavior. Do NOT add if/else or switch on provider type. Chat and embedding providers are registered and resolved independently — some providers offer only one. Providers are *factories* over credentials, not `ChatModel`s, so credentials stay resolvable per call and key rotation needs no restart.
 3. **SSH-Aware Access**: Always use `ConnectionService.getJdbcTemplate(connectionId, request)` — handles SSH tunneling transparently.
 4. **SQL Rule**: All generated SQL MUST use table-qualified column names (`table.column_name`).
-5. **RAG Caching**: Three-tier cache (memory → Redis → Azure Search). Redis failure is graceful (app continues without caching).
-6. **Virtual Threads**: Enabled for concurrency (JDK 25).
+5. **Chat access policy**: Fail closed. Walk the whole SQL tree (CTEs, set ops, subqueries). Deny unparseable or unhandled statements. Require an actor except `INTERNAL`/`SCHEDULED`. MCP/Editor identity comes from `SecurityContext`, not `QueryActorContextHolder`. Persist `allowed_schemas`. Do not let "how many" override a protected-column mention. Public share is refused when the connection has an active policy.
+6. **RAG Caching**: Three-tier cache (memory → Redis → Azure Search). Redis failure is graceful (app continues without caching).
+7. **Virtual Threads**: Enabled for concurrency (JDK 25).
 
 ### Frontend Rules
 1. **API Centralization**: ALL API calls through `src/lib/api/client.js`. Never create direct axios instances.

backend/src/main/java/com/dbaagent/controller/BrainController.java

@@ -65,6 +65,7 @@
 import com.dbaagent.service.brain.query.PlanPatternLibraryService;
 import com.dbaagent.service.brain.BrainInsightEmbeddingService;
 import com.dbaagent.service.SlowQueryHistoryService;
+import com.dbaagent.service.UserDataAccessPolicyService;
 import com.dbaagent.service.security.AccessControlService;
 import com.dbaagent.model.SlowQueryAnalysis;
 import lombok.RequiredArgsConstructor;
@@ -138,6 +139,7 @@ public class BrainController {
     private final SlowQueryHistoryService slowQueryHistoryService;
     private final BrainInsightEmbeddingService brainInsightEmbeddingService;
     private final AccessControlService accessControlService;
+    private final UserDataAccessPolicyService userDataAccessPolicyService;
 
     @GetMapping("/understanding/{connectionId}")
     public ResponseEntity<BrainUnderstandingResponse> getUnderstanding(
@@ -523,7 +525,12 @@ public ResponseEntity<List<InferredTableRelationship>> getInferredRelationships(
     ) {
         try {
             accessControlService.assertCanReadConnectionContent(connectionId);
-            return ResponseEntity.ok(joinRelationshipInferenceService.getRelationships(connectionId));
+            return ResponseEntity.ok(userDataAccessPolicyService.filterInferredRelationships(
+                connectionId,
+                accessControlService.getCurrentUsername(),
+                accessControlService.isCurrentUserAdmin(),
+                joinRelationshipInferenceService.getRelationships(connectionId)
+            ));
         } catch (ResponseStatusException e) {
             throw e;
         } catch (Exception e) {

backend/src/main/java/com/dbaagent/controller/DashboardQueryController.java

@@ -77,7 +77,10 @@ public ResponseEntity<?> query(@RequestBody DashboardQueryRequest request) {
             qr.setExecutionOrigin(QueryExecutionOrigin.API);
             QueryResult result = queryExecutorService.executeQuery(
                 request.connectionId(), qr,
-                QueryExecutionContext.api(accessControlService.getCurrentUsername()));
+                QueryExecutionContext.api(
+                    accessControlService.getCurrentUsername(),
+                    accessControlService.isCurrentUserAdmin()
+                ));
             return ResponseEntity.ok(Map.of(
                 "success", true,
                 "columns", result.getColumns() == null ? java.util.List.of() : result.getColumns(),

backend/src/main/java/com/dbaagent/controller/McpController.java

@@ -8,7 +8,6 @@
 import com.dbaagent.model.QueryResult;
 import com.dbaagent.service.ExplainPlanService;
 import com.dbaagent.service.McpSqlGuardService;
-import com.dbaagent.service.QueryActorContextHolder;
 import com.dbaagent.service.QueryExecutionContext;
 import com.dbaagent.service.QueryExecutionPolicyException;
 import com.dbaagent.service.QueryExecutorService;
@@ -77,7 +76,10 @@ public ResponseEntity<?> executeReadOnlyQuery(@RequestBody McpReadOnlyQueryReque
             QueryResult result = queryExecutorService.executeQuery(
                 request.getConnectionId(),
                 queryRequest,
-                QueryExecutionContext.mcp(QueryActorContextHolder.currentUsername())
+                QueryExecutionContext.mcp(
+                    accessControlService.getCurrentUsername(),
+                    accessControlService.isCurrentUserAdmin()
+                )
             );
             return ResponseEntity.ok(Map.of(
                 "success", true,

backend/src/main/java/com/dbaagent/controller/SavedDashboardController.java

@@ -2,6 +2,7 @@
 
 import com.dbaagent.model.DashboardVersion;
 import com.dbaagent.model.SavedDashboard;
+import com.dbaagent.service.ConnectionChatAccessPolicyService;
 import com.dbaagent.service.SavedDashboardService;
 import com.dbaagent.service.security.AccessControlService;
 import lombok.extern.slf4j.Slf4j;
@@ -27,6 +28,9 @@ public class SavedDashboardController {
     @Autowired
     private AccessControlService accessControlService;
 
+    @Autowired
+    private ConnectionChatAccessPolicyService connectionChatAccessPolicyService;
+
     // Every write method below is load-then-save on a row a background generation
     // turn (SavedDashboardService.beginGenerationTurn etc.) may be writing at the
     // same time. Without this helper, the loser's raw Hibernate message
@@ -47,6 +51,13 @@ public ResponseEntity<Map<String, Object>> enableShare(@PathVariable UUID id) {
             SavedDashboard existing = savedDashboardService.getDashboardById(id)
                 .orElseThrow(() -> new IllegalArgumentException("Dashboard not found"));
             accessControlService.assertCanReadConnectionContent(existing.getConnectionId());
+            if (connectionChatAccessPolicyService.hasActivePolicy(existing.getConnectionId())) {
+                return ResponseEntity.status(HttpStatus.CONFLICT).body(Map.of(
+                    "success", false,
+                    "errorCode", "POLICY_PUBLIC_SHARE_FORBIDDEN",
+                    "message", "This connection has an active chat access policy, so the dashboard cannot be shared publicly."
+                ));
+            }
             SavedDashboard d = savedDashboardService.enablePublicShare(id);
             return ResponseEntity.ok(Map.of("success", true,
                 "shareToken", d.getShareToken(), "isPublic", true));

backend/src/main/java/com/dbaagent/controller/SchemaController.java

@@ -7,6 +7,7 @@
 import com.dbaagent.service.QueryExecutionContext;
 import com.dbaagent.service.QueryExecutionPolicyException;
 import com.dbaagent.service.ActiveQueryService;
+import com.dbaagent.service.McpTokenService;
 import com.dbaagent.service.QueryExecutorService;
 import com.dbaagent.service.RunningQueryRegistry;
 import com.dbaagent.service.SqlExecutionAuditService;
@@ -15,6 +16,7 @@
 import com.dbaagent.service.SchemaScannerService;
 import com.dbaagent.service.VisualizationService;
 import com.dbaagent.service.security.AccessControlService;
+import org.springframework.http.HttpHeaders;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -195,11 +197,7 @@ public ResponseEntity<Map<String, Object>> executeQuery(
             QueryResult result = queryExecutorService.executeQuery(
                 connectionId,
                 queryRequest,
-                QueryExecutionContext.editor(
-                    accessControlService.getCurrentUsername(),
-                    accessControlService.isCurrentUserAdmin(),
-                    Boolean.TRUE.equals(queryRequest.getMutationConfirmed())
-                )
+                queryExecutionContext(queryRequest, httpRequest)
             );
             sqlExecutionAuditService.record(SqlExecutionAuditService.AuditRecord.executed()
                 .connectionId(connectionId)
@@ -413,6 +411,26 @@ public ResponseEntity<Map<String, Object>> getTableStats(
         }
     }
 
+    private QueryExecutionContext queryExecutionContext(QueryRequest queryRequest, HttpServletRequest httpRequest) {
+        String username = accessControlService.getCurrentUsername();
+        boolean admin = accessControlService.isCurrentUserAdmin();
+        if (isMcpBearer(httpRequest)) {
+            return QueryExecutionContext.mcp(username, admin);
+        }
+        return QueryExecutionContext.editor(
+            username,
+            admin,
+            Boolean.TRUE.equals(queryRequest.getMutationConfirmed())
+        );
+    }
+
+    private boolean isMcpBearer(HttpServletRequest httpRequest) {
+        String authorization = httpRequest.getHeader(HttpHeaders.AUTHORIZATION);
+        return authorization != null
+            && authorization.startsWith("Bearer ")
+            && authorization.substring(7).startsWith(McpTokenService.TOKEN_PREFIX);
+    }
+
     private SchemaMetadata scopedSchema(String connectionId, SchemaMetadata schema) {
         return userDataAccessPolicyService.filterSchemaMetadata(
             connectionId,

backend/src/main/java/com/dbaagent/controller/TrainingController.java

@@ -10,6 +10,7 @@
 import com.dbaagent.service.SemanticModelService;
 import com.dbaagent.service.TrainingJobService;
 import com.dbaagent.service.TrainingService;
+import com.dbaagent.service.UserDataAccessPolicyService;
 import com.dbaagent.service.security.AccessControlService;
 import lombok.Data;
 import lombok.RequiredArgsConstructor;
@@ -37,6 +38,7 @@ public class TrainingController {
     private final CredentialRepository credentialRepository;
     private final SemanticModelService semanticModelService;
     private final AccessControlService accessControlService;
+    private final UserDataAccessPolicyService userDataAccessPolicyService;
 
     /**
      * Train with schema DDL
@@ -186,7 +188,9 @@ public ResponseEntity<Map<String, Object>> debugRetrieve(
             if (question == null || question.isBlank()) {
                 return ResponseEntity.badRequest().body(Map.of("error", "Query parameter 'q' is required"));
             }
-            return ResponseEntity.ok(trainingService.debugRetrieve(connectionId, question, topK));
+            Map<String, Object> payload = trainingService.debugRetrieve(connectionId, question, topK);
+            filterDebugRetrieval(connectionId, payload);
+            return ResponseEntity.ok(payload);
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
         } catch (Exception e) {
@@ -346,6 +350,34 @@ private void rebuildAndReindexConnection(String connectionId) {
         trainingService.reindexConnection(connectionId);
     }
 
+    @SuppressWarnings("unchecked")
+    private void filterDebugRetrieval(String connectionId, Map<String, Object> payload) {
+        if (payload == null) {
+            return;
+        }
+        Object results = payload.get("results");
+        if (!(results instanceof List<?> rows)) {
+            return;
+        }
+        List<Map<String, Object>> filtered = new java.util.ArrayList<>();
+        for (Object row : rows) {
+            if (!(row instanceof Map<?, ?> map)) {
+                continue;
+            }
+            Object metadata = map.get("metadata");
+            if (userDataAccessPolicyService.isRagMetadataInScope(
+                connectionId,
+                accessControlService.getCurrentUsername(),
+                accessControlService.isCurrentUserAdmin(),
+                metadata == null ? null : String.valueOf(metadata)
+            )) {
+                filtered.add((Map<String, Object>) map);
+            }
+        }
+        payload.put("results", filtered);
+        payload.put("resultCount", filtered.size());
+    }
+
     @Data
     public static class DocumentationRequest {
         private String connectionId;

backend/src/main/java/com/dbaagent/dto/ConnectionChatAccessPolicyResponse.java

@@ -16,6 +16,8 @@ public class ConnectionChatAccessPolicyResponse {
     List<String> blockedSensitivityCategories;
     List<String> deniedTables;
     List<String> deniedColumns;
+    List<String> allowedSchemas;
+    boolean allowAggregates;
     boolean blockMode;
     boolean redactMode;
     boolean active;

backend/src/main/java/com/dbaagent/dto/PolicyPreviewResponse.java

@@ -11,6 +11,8 @@ public class PolicyPreviewResponse {
     List<String> blockedSensitivityCategories;
     List<String> deniedTables;
     List<String> deniedColumns;
+    List<String> allowedSchemas;
+    boolean allowAggregates;
     List<String> impactedTables;
     List<String> impactedColumns;
     boolean blockMode;

backend/src/main/java/com/dbaagent/model/ConnectionChatAccessPolicy.java

@@ -40,6 +40,13 @@ public class ConnectionChatAccessPolicy {
     @Column(name = "denied_columns", columnDefinition = "jsonb")
     private List<String> deniedColumns;
 
+    @JdbcTypeCode(SqlTypes.JSON)
+    @Column(name = "allowed_schemas", columnDefinition = "jsonb")
+    private List<String> allowedSchemas;
+
+    @Column(name = "allow_aggregates", nullable = false)
+    private boolean allowAggregates = false;
+
     @Column(name = "block_mode", nullable = false)
     private boolean blockMode = true;