fix(jsonrpc): reject policy params matchers

Preserve params for MCP and request parsing, but make generic JSON-RPC policy matching method-only.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

architecture/sandbox.md

@@ -51,14 +51,14 @@ identifies the calling binary, checks trust-on-first-use binary identity, reject
 unsafe internal destinations, and evaluates the active policy.
 For inspected HTTP traffic, the proxy can enforce REST method/path rules,
 WebSocket upgrade and text-message rules, GraphQL operation rules, and
-MCP or generic JSON-RPC method and params rules on sandbox-to-server request
-bodies. MCP and JSON-RPC inspection buffers up to the endpoint
-`mcp.max_body_bytes` or `json_rpc.max_body_bytes` limit. MCP `tools/call`
-tool names are checked against the spec-recommended syntax by default before
-policy evaluation, with a per-endpoint `mcp.strict_tool_names` compatibility
-opt-out. Literal dotted keys in generic JSON-RPC params are accepted. If a
-literal key and a flattened nested selector path produce the same matcher key,
-the literal key takes precedence.
+MCP method, tool, and supported params rules or generic JSON-RPC method rules
+on sandbox-to-server request bodies. MCP and JSON-RPC inspection buffers up to
+the endpoint `mcp.max_body_bytes` or `json_rpc.max_body_bytes` limit. MCP
+`tools/call` tool names are checked against the spec-recommended syntax by
+default before policy evaluation, with a per-endpoint `mcp.strict_tool_names`
+compatibility opt-out. Generic JSON-RPC request `params` are valid payload data
+but are not presently supported as policy matchers while we settle the user
+experience for nested payload rules.
 JSON-RPC responses and server-to-client MCP messages on response or SSE streams
 are relayed but are not currently parsed for policy enforcement.
 

crates/openshell-policy/src/lib.rs

@@ -241,8 +241,8 @@ enum QueryMatcherDef {
     Any(QueryAnyDef),
 }
 
-// JSON-RPC/MCP params can be authored as nested maps in YAML, but the runtime
-// matcher map remains flat so the Rego policy can share query-param matching.
+// MCP params can be authored as nested maps in YAML, but the runtime matcher
+// map remains flat so the Rego policy can share query-param matching.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(untagged)]
 enum ParamMatcherDef {
@@ -497,8 +497,8 @@ fn split_tool_param(
     protocol: &str,
     params: BTreeMap<String, QueryMatcherDef>,
 ) -> (Option<QueryMatcherDef>, BTreeMap<String, QueryMatcherDef>) {
-    // Only MCP has the tool-name convention. Generic JSON-RPC keeps `name` as a
-    // normal params matcher so serialization does not invent MCP semantics.
+    // Only MCP has the tool-name convention. Generic JSON-RPC preserves proto
+    // params on round-trip without inventing MCP semantics.
     if !is_mcp_protocol(protocol) {
         return (None, params);
     }

crates/openshell-supervisor-network/data/sandbox-policy.rego

@@ -275,15 +275,15 @@ request_denied_for_endpoint(request, endpoint) if {
 	command_matches(request.command, deny_rule.command)
 }
 
-# --- L7 deny rule matching: JSON-RPC method + params ---
+# --- L7 deny rule matching: JSON-RPC method ---
 
 request_denied_for_endpoint(request, endpoint) if {
 	jsonrpc_family_endpoint(endpoint)
 	request.method == "POST"
 	some deny_rule
 	deny_rule := endpoint.deny_rules[_]
 	deny_rule.method
-	jsonrpc_rule_matches(request, deny_rule)
+	jsonrpc_rule_matches(request, endpoint, deny_rule)
 }
 
 request_denied_for_endpoint(request, endpoint) if {
@@ -454,7 +454,7 @@ request_allowed_for_endpoint(request, endpoint) if {
 	rule := endpoint.rules[_]
 	rule.allow.method
 	not jsonrpc_response_frame_present(request)
-	jsonrpc_rule_matches(request, rule.allow)
+	jsonrpc_rule_matches(request, endpoint, rule.allow)
 }
 
 # MCP can allow the method layer by endpoint option while still using
@@ -742,10 +742,9 @@ query_value_matches(value, matcher) if {
 	glob.match(any_patterns[i], [], value)
 }
 
-# JSON-RPC method and params matching. The sandbox presents scalar object params
-# as dot-separated matcher keys, e.g. arguments.scope. Literal dotted param keys
-# are preserved by Rust flattening and take precedence over deeper nested paths.
-jsonrpc_rule_matches(request, rule) if {
+# JSON-RPC-family method matching. Generic JSON-RPC policies match only method;
+# MCP policies also match scalar params, including params.name from tool aliases.
+jsonrpc_rule_matches(request, endpoint, rule) if {
 	jsonrpc := object.get(request, "jsonrpc", null)
 	is_object(jsonrpc)
 	method := object.get(jsonrpc, "method", "")
@@ -755,6 +754,15 @@ jsonrpc_rule_matches(request, rule) if {
 	is_string(rule_method)
 	rule_method != ""
 	glob.match(rule_method, [], method)
+	jsonrpc_rule_params_match_for_protocol(jsonrpc, endpoint, rule)
+}
+
+jsonrpc_rule_params_match_for_protocol(_, endpoint, _) if {
+	endpoint.protocol == "json-rpc"
+}
+
+jsonrpc_rule_params_match_for_protocol(jsonrpc, endpoint, rule) if {
+	endpoint.protocol == "mcp"
 	jsonrpc_params_match(jsonrpc, rule)
 }
 

crates/openshell-supervisor-network/src/l7/jsonrpc.rs

@@ -3,10 +3,9 @@
 
 //! JSON-RPC 2.0 over HTTP L7 inspection.
 
-use miette::Result;
-use sha2::{Digest, Sha256};
-use std::collections::BTreeMap;
 use std::collections::HashMap;
+
+use miette::Result;
 use tokio::io::{AsyncRead, AsyncWrite};
 use tower_mcp_types::protocol::{
     JSONRPC_VERSION, JsonRpcNotification, JsonRpcRequest, McpNotification, McpRequest,
@@ -123,28 +122,6 @@ impl JsonRpcRequestInfo {
             error: None,
         }
     }
-
-    /// Logs store only a digest of params. For batches, hash the per-call
-    /// canonical maps so denied-call logging cannot leak raw argument values.
-    pub(crate) fn params_sha256(&self) -> Option<String> {
-        if self.is_batch {
-            if self.calls.is_empty() || self.calls.iter().all(|call| call.params.is_empty()) {
-                return None;
-            }
-            let canonical_params = self
-                .calls
-                .iter()
-                .map(|call| canonical_params_map(&call.params))
-                .collect::<Vec<_>>();
-            return Some(sha256_json(&canonical_params));
-        }
-
-        let call = self.calls.first()?;
-        if call.params.is_empty() {
-            return None;
-        }
-        Some(sha256_json(&canonical_params_map(&call.params)))
-    }
 }
 
 pub(crate) fn jsonrpc_receive_stream_request(request: &L7Request) -> bool {
@@ -437,18 +414,6 @@ fn validate_mcp_tool_name(name: &str) -> std::result::Result<(), String> {
     Ok(())
 }
 
-fn canonical_params_map(params: &HashMap<String, String>) -> BTreeMap<String, String> {
-    params
-        .iter()
-        .map(|(key, value)| (key.clone(), value.clone()))
-        .collect()
-}
-
-fn sha256_json(value: &impl serde::Serialize) -> String {
-    let encoded = serde_json::to_vec(value).expect("canonical JSON-RPC params should serialize");
-    hex::encode(Sha256::digest(&encoded))
-}
-
 fn flatten_json_value(
     prefix: &str,
     path_segments: usize,
@@ -511,10 +476,10 @@ fn insert_flattened_param(
     out.insert(key.to_string(), param);
     Ok(())
 }
-
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::collections::HashMap;
 
     #[test]
     fn parses_method_from_request_body() {
@@ -539,7 +504,6 @@ mod tests {
         assert!(!info.is_batch);
         assert!(info.has_response);
         assert!(info.error.is_none());
-        assert!(info.params_sha256().is_none());
     }
 
     #[test]
@@ -554,9 +518,14 @@ mod tests {
     }
 
     #[test]
-    fn flattens_object_params_for_policy_matching() {
+    fn ignores_params_when_extracting_method() {
         let body = br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"submit_report","arguments":{"scope":"workspace/main"}}}"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
+        assert!(info.error.is_none());
+        assert_eq!(
+            info.calls.first().map(|call| call.method.as_str()),
+            Some("tools/call")
+        );
         let params = &info.calls.first().expect("single request call").params;
         assert_eq!(
             params.get("name").map(String::as_str),
@@ -659,6 +628,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn accepts_any_valid_jsonrpc_params_shape() {
+        let body =
+            br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":["ignored",{"nested":true}]}"#;
+        let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
+
+        assert!(info.error.is_none());
+        assert_eq!(
+            info.calls.first().map(|call| call.method.as_str()),
+            Some("tools/call")
+        );
+    }
+
     #[test]
     fn recognizes_streamable_http_get_receive_streams() {
         let request = L7Request {
@@ -675,7 +657,6 @@ mod tests {
         assert!(info.receive_stream);
         assert!(info.error.is_none());
         assert!(info.calls.is_empty());
-        assert!(info.params_sha256().is_none());
     }
 
     #[test]
@@ -762,10 +743,6 @@ mod tests {
         assert_eq!(info.calls.len(), 2);
         assert_eq!(info.calls[0].method, "tools/list");
         assert_eq!(info.calls[1].method, "tools/call");
-        assert_eq!(
-            info.calls[1].params.get("name").map(String::as_str),
-            Some("read_status")
-        );
     }
 
     #[test]
@@ -831,52 +808,4 @@ mod tests {
             Some("batch item invalid: JSON-RPC message includes both method and result/error")
         );
     }
-
-    #[test]
-    fn params_digest_is_canonical_and_redacted() {
-        let first = parse_jsonrpc_body(
-            br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"submit_report","arguments":{"scope":"workspace/main"}}}"#,
-            JsonRpcInspectionMode::JsonRpc,
-        );
-        let reordered = parse_jsonrpc_body(
-            br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"arguments":{"scope":"workspace/main"},"name":"submit_report"}}"#,
-            JsonRpcInspectionMode::JsonRpc,
-        );
-        let changed = parse_jsonrpc_body(
-            br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"submit_report","arguments":{"scope":"workspace/other"}}}"#,
-            JsonRpcInspectionMode::JsonRpc,
-        );
-
-        let digest = first.params_sha256().expect("params digest");
-        assert_eq!(Some(digest.as_str()), reordered.params_sha256().as_deref());
-        assert_ne!(Some(digest.as_str()), changed.params_sha256().as_deref());
-        assert_eq!(digest.len(), 64);
-        assert!(digest.chars().all(|c| c.is_ascii_hexdigit()));
-        assert!(!digest.contains("workspace/main"));
-        assert!(!digest.contains("submit_report"));
-    }
-
-    #[test]
-    fn batch_params_digest_covers_call_params_without_raw_values() {
-        let batch = parse_jsonrpc_body(
-            br#"[
-                {"jsonrpc":"2.0","id":1,"method":"tools/list"},
-                {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"blocked_action"}}
-            ]"#,
-            JsonRpcInspectionMode::JsonRpc,
-        );
-        let empty_batch = parse_jsonrpc_body(
-            br#"[
-                {"jsonrpc":"2.0","id":1,"method":"tools/list"},
-                {"jsonrpc":"2.0","id":2,"method":"initialize"}
-            ]"#,
-            JsonRpcInspectionMode::JsonRpc,
-        );
-
-        let digest = batch.params_sha256().expect("batch params digest");
-        assert_eq!(digest.len(), 64);
-        assert!(digest.chars().all(|c| c.is_ascii_hexdigit()));
-        assert!(!digest.contains("blocked_action"));
-        assert!(empty_batch.params_sha256().is_none());
-    }
 }