Expose patch-product as an MCP tool, scoped to a new restocker role

Adds the restocker KongConsumerGroup and patch-product to the tools policy,
allow: [admin, product_manager, restocker]. classic-models-api backs this the
same way — restocker may PATCH a product and nothing else.

Regenerated with generate-mcp-tools.py.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kong/mcp/ai-mcp-proxy.yaml

@@ -282,3 +282,97 @@ config:
               - productscale
               - productvendor
               - quantityinstock
+  - annotations:
+      title: Partially update a product
+      read_only_hint: false
+      idempotent_hint: false
+      destructive_hint: false
+      open_world_hint: false
+    description: Update specific fields of an existing product.
+    method: PATCH
+    name: patch-product
+    parameters:
+    - description: A unique value identifying this product.
+      in: path
+      name: productcode
+      required: true
+      schema:
+        type: string
+    path: /catalog/v1/products/{productcode}/
+    request_body:
+      content:
+        application/json:
+          schema:
+            properties:
+              buyprice:
+                type: string
+              msrp:
+                type: string
+              productcode:
+                type: string
+              productdescription:
+                type: string
+              productline:
+                type: string
+              productname:
+                type: string
+              productscale:
+                type: string
+              productvendor:
+                type: string
+              quantityinstock:
+                type: integer
+            type: object
+    acl:
+      allow:
+      - admin
+      - product_manager
+      - restocker
+    scheme: http
+    host: ${REST_HOSTNAME}
+    responses:
+      '200':
+        content:
+          application/json:
+            schema:
+              type: object
+              description: Product catalog information
+              properties:
+                productcode:
+                  type: string
+                  maxLength: 15
+                productname:
+                  type: string
+                  maxLength: 70
+                productscale:
+                  type: string
+                  maxLength: 10
+                productvendor:
+                  type: string
+                  maxLength: 50
+                productdescription:
+                  type: string
+                quantityinstock:
+                  type: integer
+                  maximum: 32767
+                  minimum: -32768
+                buyprice:
+                  type: string
+                  format: decimal
+                  pattern: ^-?\d{0,8}(?:\.\d{0,2})?$
+                msrp:
+                  type: string
+                  format: decimal
+                  pattern: ^-?\d{0,8}(?:\.\d{0,2})?$
+                productline:
+                  type: string
+              required:
+              - buyprice
+              - msrp
+              - productcode
+              - productdescription
+              - productline
+              - productname
+              - productscale
+              - productvendor
+              - quantityinstock

kong/mcp/consumergroups.yaml

@@ -57,3 +57,15 @@ spec:
     konnectNamespacedRef:
       name: ${CONTROL_PLANE_REF_NAME}
   name: support
+  ---
+  apiVersion: configuration.konghq.com/v1beta1
+  kind: KongConsumerGroup
+  metadata:
+    name: ${NAME}-restocker
+    namespace: ${NAMESPACE}
+  spec:
+    controlPlaneRef:
+      type: konnectNamespacedRef
+      konnectNamespacedRef:
+        name: ${CONTROL_PLANE_REF_NAME}
+    name: restocker

kong/mcp/tools-policy.yaml

@@ -18,3 +18,8 @@ tools:
     allow: [admin, read_only, product_manager, customer, support]
   create-product:
     allow: [admin, product_manager]
+  patch-product:
+    # restocker: the fulfilment identity moving stock on delivery. The Django
+    # side backs this the same way — CatalogPermission accepts restocker on
+    # PATCH only, never create/replace/delete.
+    allow: [admin, product_manager, restocker]