feat: implement permission filtering system (fixes #177)

[sapientpants]

Summary

• Implements comprehensive permission filtering system for SonarQube MCP server
• Ensures users only see data they're authorized to access based on OAuth token groups/roles
• Addresses all requirements from issue Story 5: Permission Filtering System #177
• Clean rebase on latest main branch

Changes

• Add comprehensive permission types and interfaces
• Create PermissionService for access control and filtering
• Implement PermissionManager for configuration management
• Integrate permissions into HTTP transport layer
• Add context provider for request-scoped permissions
• Create permission-aware handlers for projects and issues
• Support group-based access control with regex project patterns
• Implement tool-level authorization with read/write operations
• Add issue filtering by severity, status, and sensitive data
• Include permission caching for performance optimization
• Add comprehensive documentation

Breaking Changes

When permissions are enabled via MCP_PERMISSION_CONFIG_PATH, users will only see resources they are authorized to access based on their OAuth token groups/roles.

Test Plan

• All existing tests pass
• CI checks pass (format, lint, type-check, build, test)
• Manual testing with permission configuration
• Test group-based access control
• Test project filtering with regex patterns
• Test tool authorization (read/write operations)
• Test issue filtering by severity and status
• Test sensitive data redaction
• Test permission caching
• Test backward compatibility (permissions disabled)

Documentation

• Added comprehensive docs/permission-system.md with:
  • Configuration examples
  • Security considerations
  • Troubleshooting guide
  • Performance optimization tips

Fixes #177

🤖 Generated with Claude Code

[Copilot]

Pull Request Overview

This PR introduces a permission filtering system that enforces group- and role-based access control throughout the MCP server.

• Integrates permissionManager and contextProvider into the HTTP transport to attach user context
• Adds permission-aware handlers for listing projects and searching issues
• Provides core permission management infrastructure (PermissionManager, caching, regex-based project rules)

Reviewed Changes

Copilot reviewed 11 out of 12 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/transports/http.ts	Hooks context middleware and extracts userContext
src/handlers/projects-with-permissions.ts	New handler with project-level permission filtering
src/handlers/issues-with-permissions.ts	New handler with issue-level and sensitive-data filtering
src/handlers/permission-wrapper.ts	Generic wrapper for permission-aware handlers
src/handlers/handler-factory.ts	Routes calls to standard or permission-aware handlers
src/auth/permission-manager.ts	Loads and validates permission config, exposes service
src/auth/context-provider.ts	Implements request-scoped AsyncLocalStorage context
docs/permission-system.md	Documentation for configuration and usage

Comments suppressed due to low confidence (1)

src/handlers/projects-with-permissions.ts:20

• This new handler should have focused unit tests covering both allowed and denied scenarios based on various permission configs.

export const handleSonarQubeProjectsWithPermissions = withMCPErrorHandling(

[sonarqubecloud]

Quality Gate failed

Failed conditions
68.5% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud