slave 0.13.1

CLI for slave, a Laravel-inspired Rust framework for MCP-first apps: scaffold an MCP backend with auth, roles, teams and SurrealDB migrations, add server-rendered web apps, and route them by domain or path
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

//! MCP tools for roles. Business rules live in `RoleService`.

use axum::extract::FromRef;
use axum::http::request::Parts;
use rmcp::handler::server::router::tool::ToolRouter;
use rmcp::handler::server::tool::Extension;
use rmcp::handler::server::wrapper::{Json, Parameters};
use rmcp::{tool, tool_router};

use crate::base::error::AppResult;
use crate::base::mcp::McpServer;
use crate::modules::role::dto::role::{RoleAssignmentRequest, RoleListResponse, UserRolesRequest};
use crate::modules::role::services::role_service::RoleService;

pub fn tools() -> ToolRouter<McpServer> {
    McpServer::role_tools()
}

#[tool_router(router = role_tools, vis = "pub(crate)")]
impl McpServer {
    /// List every role (super admin only).
    #[tool(annotations(read_only_hint = true, open_world_hint = false))]
    async fn role_list(
        &self,
        Extension(parts): Extension<Parts>,
    ) -> AppResult<Json<RoleListResponse>> {
        self.authenticate_super_admin(&parts).await?;
        Ok(Json(
            RoleService::from_ref(&self.state).list().await?.into(),
        ))
    }

    /// A user's roles. Super admins can view anyone's, other users only their own.
    #[tool(annotations(read_only_hint = true, open_world_hint = false))]
    async fn role_list_for_user(
        &self,
        Extension(parts): Extension<Parts>,
        Parameters(input): Parameters<UserRolesRequest>,
    ) -> AppResult<Json<RoleListResponse>> {
        let user = self.authenticate(&parts).await?;
        user.require_self_or_super_admin(input.user_id)?;
        let roles = RoleService::from_ref(&self.state)
            .roles_of(input.user_id)
            .await?;
        Ok(Json(roles.into()))
    }

    /// Grant a role to a user and return their roles (super admin only).
    #[tool(annotations(idempotent_hint = true, open_world_hint = false))]
    async fn role_assign(
        &self,
        Extension(parts): Extension<Parts>,
        Parameters(input): Parameters<RoleAssignmentRequest>,
    ) -> AppResult<Json<RoleListResponse>> {
        self.authenticate_super_admin(&parts).await?;
        let roles = RoleService::from_ref(&self.state)
            .assign(input.user_id, input.role.trim())
            .await?;
        Ok(Json(roles.into()))
    }

    /// Remove a role from a user and return their remaining roles (super admin only).
    /// The last super admin can never be removed.
    #[tool(annotations(destructive_hint = true, open_world_hint = false))]
    async fn role_revoke(
        &self,
        Extension(parts): Extension<Parts>,
        Parameters(input): Parameters<RoleAssignmentRequest>,
    ) -> AppResult<Json<RoleListResponse>> {
        self.authenticate_super_admin(&parts).await?;
        let roles = RoleService::from_ref(&self.state)
            .revoke(input.user_id, input.role.trim())
            .await?;
        Ok(Json(roles.into()))
    }
}