# Authorisation on tool-call *parameters*, not just the tool name.
#
# The estate already answers "may this identity call this tool?" — the MCP
# server filters tool discovery by the caller's roles. What nothing answered is
# "may it call it with *these* arguments". `write` authorises writing; it does
# not authorise this particular record. A read cap counts calls; it does not
# stop one call asking for ten thousand rows.
#
# This runs at the gateway, so it holds whether the caller is an agent behaving
# itself, an agent that has been talked into something, or a person with curl.

package kong

import rego.v1

default allow := false

# Everything that is not an MCP tool call passes: the session handshake, the
# tool listing, the REST surface. This policy has an opinion about arguments
# and no opinion about anything else.
allow if not is_tool_call

allow if {
	is_tool_call
	count(violations) == 0
}

is_tool_call if {
	input.request.http.parsed_body.method == "tools/call"
}

tool := input.request.http.parsed_body.params.name

args := object.get(input.request.http.parsed_body.params, "arguments", {})

# --- how much one call may read -------------------------------------------
#
# The rate limit counts requests. Without this, one request asking for a
# hundred thousand rows costs the same as one asking for ten — which is how a
# volume cap is defeated without breaking it.
max_page_size := 200

violations contains msg if {
	size := to_number(object.get(args, "query_page_size", 0))
	size > max_page_size
	msg := sprintf("query_page_size %d exceeds the maximum of %d", [size, max_page_size])
}

# --- what one call may commit ---------------------------------------------
#
# A price is the parameter that turns a permitted write into an expensive
# mistake. The bound is deliberately wide: this is not pricing policy, it is a
# guard against a value that can only be an error or an attack.
max_unit_price := 100000

violations contains msg if {
	body := object.get(args, "body", {})
	some field in ["buyprice", "msrp"]
	value := to_number(object.get(body, field, 0))
	value > max_unit_price
	msg := sprintf("%s %v exceeds the maximum of %d", [field, value, max_unit_price])
}

violations contains msg if {
	body := object.get(args, "body", {})
	some field in ["buyprice", "msrp"]
	to_number(object.get(body, field, 1)) <= 0
	msg := sprintf("%s must be greater than zero", [field])
}

# What the caller is told. A refusal that does not say which argument was
# refused sends someone looking in the wrong place.
reason := concat("; ", violations)