fix(l7): ignore unsupported JSON-RPC params

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

crates/openshell-supervisor-network/data/sandbox-policy.rego

@@ -742,8 +742,8 @@ query_value_matches(value, matcher) if {
 	glob.match(any_patterns[i], [], value)
 }
 
-# JSON-RPC-family method matching. Generic JSON-RPC policies match only method;
-# MCP policies also match scalar params, including params.name from tool aliases.
+# JSON-RPC-family method matching. Generic JSON-RPC policies match only method.
+# MCP policies may also match params.name from tool aliases.
 jsonrpc_rule_matches(request, endpoint, rule) if {
 	jsonrpc := object.get(request, "jsonrpc", null)
 	is_object(jsonrpc)

crates/openshell-supervisor-network/src/l7/jsonrpc.rs

@@ -101,12 +101,12 @@ pub struct JsonRpcRequestInfo {
 pub struct JsonRpcCallInfo {
     /// JSON-RPC method, or the MCP method name after typed MCP parsing.
     pub method: String,
-    /// Flattened scalar params used by the current Rego matcher path. Strings,
-    /// numbers, and booleans are represented as strings for compatibility with
-    /// the existing query matcher implementation.
+    /// Policy-visible params for JSON-RPC-family matching. Generic JSON-RPC
+    /// leaves this empty because params matching is not supported. MCP exposes
+    /// only `params.name` for tools/call tool selection.
     pub params: HashMap<String, String>,
-    /// MCP `tools/call` tool name when known. Generic JSON-RPC leaves this as
-    /// a best-effort projection of `params.name`.
+    /// MCP `tools/call` tool name when known. Generic JSON-RPC leaves this
+    /// unset because params are not inspected.
     pub tool: Option<String>,
 }
 
@@ -288,12 +288,10 @@ fn parse_jsonrpc_call(
         .get("method")
         .and_then(|m| m.as_str())
         .ok_or_else(|| "missing or non-string 'method' field".to_string())?;
-    let params = flatten_jsonrpc_params_opt(value.get("params"))?;
-    let tool = params.get("name").cloned();
     Ok(JsonRpcCallInfo {
         method: method.to_string(),
-        params,
-        tool,
+        params: HashMap::new(),
+        tool: None,
     })
 }
 
@@ -345,9 +343,10 @@ fn parse_mcp_call(
             validate_mcp_tool_name(tool_name)?;
         }
 
+        let params = mcp_policy_params(tool.as_deref());
         return Ok(JsonRpcCallInfo {
             method: mcp_request.method_name().to_string(),
-            params: flatten_jsonrpc_params_opt(request.params.as_ref())?,
+            params,
             tool,
         });
     }
@@ -367,28 +366,11 @@ fn parse_mcp_call(
 
     Ok(JsonRpcCallInfo {
         method: notification.method,
-        params: flatten_jsonrpc_params_opt(notification.params.as_ref())?,
+        params: HashMap::new(),
         tool: None,
     })
 }
 
-fn flatten_jsonrpc_params(
-    value: &serde_json::Value,
-) -> std::result::Result<HashMap<String, String>, String> {
-    let mut params = HashMap::<String, FlattenedParam>::new();
-    flatten_json_value("", 0, value, &mut params)?;
-    Ok(params
-        .into_iter()
-        .map(|(key, param)| (key, param.value))
-        .collect())
-}
-
-fn flatten_jsonrpc_params_opt(
-    value: Option<&serde_json::Value>,
-) -> std::result::Result<HashMap<String, String>, String> {
-    value.map_or_else(|| Ok(HashMap::new()), flatten_jsonrpc_params)
-}
-
 fn mcp_tool_name(request: &McpRequest) -> Option<String> {
     if let McpRequest::CallTool(params) = request {
         Some(params.name.clone())
@@ -397,6 +379,14 @@ fn mcp_tool_name(request: &McpRequest) -> Option<String> {
     }
 }
 
+fn mcp_policy_params(tool: Option<&str>) -> HashMap<String, String> {
+    let mut params = HashMap::new();
+    if let Some(tool) = tool {
+        params.insert("name".to_string(), tool.to_string());
+    }
+    params
+}
+
 // OpenShell's default MCP hardening enforces the spec-recommended tool-name
 // boundary for tools/call. See McpOptions in proto/sandbox.proto for sources.
 fn validate_mcp_tool_name(name: &str) -> std::result::Result<(), String> {
@@ -413,69 +403,6 @@ fn validate_mcp_tool_name(name: &str) -> std::result::Result<(), String> {
     }
     Ok(())
 }
-
-fn flatten_json_value(
-    prefix: &str,
-    path_segments: usize,
-    value: &serde_json::Value,
-    out: &mut HashMap<String, FlattenedParam>,
-) -> std::result::Result<(), String> {
-    // Keep the runtime input flat for the existing OPA matcher. Literal dotted
-    // keys are accepted; if they collide with a flattened nested path, the
-    // literal key wins because it has fewer JSON path segments.
-    match value {
-        serde_json::Value::Object(map) => {
-            for (key, child) in map {
-                let next_path_segments = path_segments + 1;
-                let next = if prefix.is_empty() {
-                    key.clone()
-                } else {
-                    format!("{prefix}.{key}")
-                };
-                flatten_json_value(&next, next_path_segments, child, out)?;
-            }
-        }
-        serde_json::Value::String(s) if !prefix.is_empty() => {
-            insert_flattened_param(out, prefix, s.clone(), path_segments)?;
-        }
-        serde_json::Value::Number(n) if !prefix.is_empty() => {
-            insert_flattened_param(out, prefix, n.to_string(), path_segments)?;
-        }
-        serde_json::Value::Bool(b) if !prefix.is_empty() => {
-            insert_flattened_param(out, prefix, b.to_string(), path_segments)?;
-        }
-        _ => {}
-    }
-    Ok(())
-}
-
-#[derive(Debug, Clone)]
-struct FlattenedParam {
-    value: String,
-    path_segments: usize,
-}
-
-fn insert_flattened_param(
-    out: &mut HashMap<String, FlattenedParam>,
-    key: &str,
-    value: String,
-    path_segments: usize,
-) -> std::result::Result<(), String> {
-    let param = FlattenedParam {
-        value,
-        path_segments,
-    };
-    if let Some(existing) = out.get_mut(key) {
-        if param.path_segments < existing.path_segments {
-            *existing = param;
-        } else if param.path_segments == existing.path_segments {
-            return Err(format!("ambiguous params key collision at '{key}'"));
-        }
-        return Ok(());
-    }
-    out.insert(key.to_string(), param);
-    Ok(())
-}
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -519,21 +446,32 @@ mod tests {
 
     #[test]
     fn ignores_params_when_extracting_method() {
-        let body = br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"submit_report","arguments":{"scope":"workspace/main"}}}"#;
+        let body = br#"{"jsonrpc":"2.0","id":1,"method":"reports.search","params":{"query":"quarterly","filters":{"scope":"workspace/main"}}}"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
         assert!(info.error.is_none());
         assert_eq!(
             info.calls.first().map(|call| call.method.as_str()),
-            Some("tools/call")
+            Some("reports.search")
         );
-        let params = &info.calls.first().expect("single request call").params;
+        let call = info.calls.first().expect("single request call");
+        assert!(call.params.is_empty());
+        assert!(call.tool.is_none());
+    }
+
+    #[test]
+    fn ignores_dotted_param_collisions_for_generic_jsonrpc() {
+        let body = br#"{"jsonrpc":"2.0","id":1,"method":"reports.search","params":{"filters.scope":{"value":"literal"},"filters":{"scope.value":"nested"}}}"#;
+        let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
+
+        assert!(info.error.is_none(), "params should be ignored: {info:?}");
         assert_eq!(
-            params.get("name").map(String::as_str),
-            Some("submit_report")
+            info.calls.first().map(|call| call.method.as_str()),
+            Some("reports.search")
         );
-        assert_eq!(
-            params.get("arguments.scope").map(String::as_str),
-            Some("workspace/main")
+        assert!(
+            info.calls
+                .first()
+                .is_some_and(|call| call.params.is_empty() && call.tool.is_none())
         );
     }
 
@@ -547,9 +485,10 @@ mod tests {
         assert_eq!(call.method, "tools/call");
         assert_eq!(call.tool.as_deref(), Some("search_web"));
         assert_eq!(
-            call.params.get("arguments.query").map(String::as_str),
-            Some("openshell")
+            call.params.get("name").map(String::as_str),
+            Some("search_web")
         );
+        assert_eq!(call.params.len(), 1);
     }
 
     #[test]
@@ -583,6 +522,10 @@ mod tests {
             .expect("permissive MCP call should parse");
         assert!(info.error.is_none(), "permissive MCP call failed: {info:?}");
         assert_eq!(call.tool.as_deref(), Some("read status"));
+        assert_eq!(
+            call.params.get("name").map(String::as_str),
+            Some("read status")
+        );
     }
 
     #[test]
@@ -613,31 +556,43 @@ mod tests {
             info.calls.first().map(|call| call.method.as_str()),
             Some("vendor/extension")
         );
+        assert!(
+            info.calls
+                .first()
+                .is_some_and(|call| call.params.is_empty() && call.tool.is_none())
+        );
     }
 
     #[test]
-    fn allows_literal_dotted_param_keys() {
-        let body = br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"arguments.scope":"workspace/other","arguments":{"scope":"workspace/main"}}}"#;
-        let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
-        let params = &info.calls.first().expect("single request call").params;
+    fn mcp_mode_ignores_tool_arguments_when_extracting_policy_params() {
+        let body = br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"read_status","arguments":{"scope.key":"literal","scope":{"key":"nested"}}}}"#;
+        let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::Mcp);
+        let call = info.calls.first().expect("single MCP call");
 
-        assert!(info.error.is_none());
+        assert!(info.error.is_none(), "expected valid MCP call: {info:?}");
+        assert_eq!(call.tool.as_deref(), Some("read_status"));
         assert_eq!(
-            params.get("arguments.scope").map(String::as_str),
-            Some("workspace/other")
+            call.params.get("name").map(String::as_str),
+            Some("read_status")
         );
+        assert_eq!(call.params.len(), 1);
     }
 
     #[test]
     fn accepts_any_valid_jsonrpc_params_shape() {
         let body =
-            br#"{"jsonrpc":"2.0","id":1,"method":"tools/call","params":["ignored",{"nested":true}]}"#;
+            br#"{"jsonrpc":"2.0","id":1,"method":"reports.search","params":["ignored",{"nested":true}]}"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
 
         assert!(info.error.is_none());
         assert_eq!(
             info.calls.first().map(|call| call.method.as_str()),
-            Some("tools/call")
+            Some("reports.search")
+        );
+        assert!(
+            info.calls
+                .first()
+                .is_some_and(|call| call.params.is_empty() && call.tool.is_none())
         );
     }
 
@@ -676,7 +631,7 @@ mod tests {
 
     #[test]
     fn rejects_requests_missing_jsonrpc_version() {
-        let body = br#"{"id":1,"method":"tools/list"}"#;
+        let body = br#"{"id":1,"method":"reports.list"}"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
 
         assert!(info.calls.is_empty());
@@ -689,8 +644,8 @@ mod tests {
     #[test]
     fn rejects_batch_items_missing_jsonrpc_version() {
         let body = br#"[
-            {"jsonrpc":"2.0","id":1,"method":"tools/list"},
-            {"id":2,"method":"tools/call","params":{"name":"read_status"}}
+            {"jsonrpc":"2.0","id":1,"method":"reports.list"},
+            {"id":2,"method":"reports.search","params":{"query":"quarterly"}}
         ]"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
 
@@ -704,7 +659,7 @@ mod tests {
 
     #[test]
     fn rejects_unsupported_jsonrpc_version() {
-        let body = br#"{"jsonrpc":"1.0","id":1,"method":"tools/list"}"#;
+        let body = br#"{"jsonrpc":"1.0","id":1,"method":"reports.list"}"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
 
         assert!(info.calls.is_empty());
@@ -714,41 +669,25 @@ mod tests {
         );
     }
 
-    #[test]
-    fn detects_flattened_param_collisions() {
-        let mut params = HashMap::from([(
-            "arguments.scope".to_string(),
-            FlattenedParam {
-                value: "first".to_string(),
-                path_segments: 2,
-            },
-        )]);
-
-        let error = insert_flattened_param(&mut params, "arguments.scope", "second".to_string(), 2)
-            .expect_err("duplicate flattened key should be ambiguous");
-
-        assert!(error.contains("ambiguous params key collision"));
-    }
-
     #[test]
     fn parses_valid_batch_without_error() {
         let body = br#"[
-            {"jsonrpc":"2.0","id":1,"method":"tools/list"},
-            {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"read_status"}}
+            {"jsonrpc":"2.0","id":1,"method":"reports.list"},
+            {"jsonrpc":"2.0","id":2,"method":"reports.search","params":{"query":"quarterly"}}
         ]"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
         assert!(info.error.is_none());
         assert!(info.is_batch);
         assert!(!info.has_response);
         assert_eq!(info.calls.len(), 2);
-        assert_eq!(info.calls[0].method, "tools/list");
-        assert_eq!(info.calls[1].method, "tools/call");
+        assert_eq!(info.calls[0].method, "reports.list");
+        assert_eq!(info.calls[1].method, "reports.search");
     }
 
     #[test]
     fn parses_batch_with_calls_and_responses() {
         let body = br#"[
-            {"jsonrpc":"2.0","id":1,"method":"tools/list"},
+            {"jsonrpc":"2.0","id":1,"method":"reports.list"},
             {"jsonrpc":"2.0","id":2,"result":{"ok":true}}
         ]"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);
@@ -757,7 +696,7 @@ mod tests {
         assert!(info.is_batch);
         assert!(info.has_response);
         assert_eq!(info.calls.len(), 1);
-        assert_eq!(info.calls[0].method, "tools/list");
+        assert_eq!(info.calls[0].method, "reports.list");
     }
 
     #[test]
@@ -796,7 +735,7 @@ mod tests {
     #[test]
     fn rejects_batch_item_with_method_and_result() {
         let body = br#"[
-            {"jsonrpc":"2.0","id":1,"method":"tools/list"},
+            {"jsonrpc":"2.0","id":1,"method":"reports.list"},
             {"jsonrpc":"2.0","id":2,"method":"initialize","result":{}}
         ]"#;
         let info = parse_jsonrpc_body(body, JsonRpcInspectionMode::JsonRpc);