feat(m7.3): MCP tenant-scoped bearer tokens (#92)

MCP server validates per-tenant bearer tokens on incoming calls and routes each tool to the caller's tenant DB. Closes the cross-tenant data leak in the MCP path identified in M7.3.

compliance-mcp/src/main.rs

@@ -1,10 +1,11 @@
+mod auth;
 mod database;
 mod server;
 mod tools;
 
 use std::sync::Arc;
 
-use database::Database;
+use database::DatabasePool;
 use rmcp::transport::{
     streamable_http_server::session::local::LocalSessionManager, StreamableHttpServerConfig,
     StreamableHttpService,
@@ -24,36 +25,60 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
 
     let mongo_uri =
         std::env::var("MONGODB_URI").unwrap_or_else(|_| "mongodb://localhost:27017".to_string());
-    let db_name =
+    // MONGODB_DATABASE is reused as the per-tenant DB-name prefix —
+    // same convention as the agent so `<prefix>__admin.mcp_tokens`
+    // and `<prefix>_<tenant_id>` line up across services.
+    let db_prefix =
         std::env::var("MONGODB_DATABASE").unwrap_or_else(|_| "compliance_scanner".to_string());
 
-    let db = Database::connect(&mongo_uri, &db_name).await?;
+    let pool = DatabasePool::connect(&mongo_uri, &db_prefix).await?;
 
-    // If MCP_PORT is set, run as Streamable HTTP server; otherwise use stdio.
+    // HTTP transport: bind a small axum router with bearer-auth in
+    // front of the rmcp service. `/health` stays public for orca's
+    // container probe.
     if let Ok(port_str) = std::env::var("MCP_PORT") {
         let port: u16 = port_str.parse()?;
         tracing::info!("Starting MCP server on HTTP port {port}");
 
-        let db_clone = db.clone();
+        let pool_for_factory = pool.clone();
         let service = StreamableHttpService::new(
-            move || Ok(ComplianceMcpServer::new(db_clone.clone())),
+            move || Ok(ComplianceMcpServer::new(pool_for_factory.clone())),
             Arc::new(LocalSessionManager::default()),
             StreamableHttpServerConfig::default(),
         );
 
         let router = axum::Router::new()
             .route("/health", axum::routing::get(|| async { "ok" }))
-            .nest_service("/mcp", service);
+            .nest_service(
+                "/mcp",
+                axum::Router::new().fallback_service(service).layer(
+                    axum::middleware::from_fn_with_state(pool.clone(), auth::bearer_auth),
+                ),
+            );
         let listener = tokio::net::TcpListener::bind(("0.0.0.0", port)).await?;
         tracing::info!("MCP HTTP server listening on 0.0.0.0:{port}");
         axum::serve(listener, router).await?;
     } else {
+        // stdio transport — used when run as a local MCP server next
+        // to the LLM client. There's no HTTP layer to do bearer auth,
+        // so we synthesize a tenant_id from STDIO_TENANT_ID for local
+        // development. NEVER use this in production.
         tracing::info!("Starting MCP server on stdio");
-        let server = ComplianceMcpServer::new(db);
+        let synth_tenant = std::env::var("STDIO_TENANT_ID").unwrap_or_else(|_| "dev".to_string());
+        tracing::warn!(
+            tenant_id = %synth_tenant,
+            "stdio transport — using synthetic tenant id; DO NOT use in production"
+        );
+        let server = ComplianceMcpServer::new(pool);
         let transport = rmcp::transport::stdio();
         use rmcp::ServiceExt;
-        let handle = server.serve(transport).await?;
-        handle.waiting().await?;
+        auth::TENANT_ID
+            .scope(synth_tenant, async {
+                let handle = server.serve(transport).await?;
+                handle.waiting().await?;
+                Ok::<_, Box<dyn std::error::Error>>(())
+            })
+            .await?;
     }
 
     Ok(())