Skip to content

feat(l7): add JSON-RPC policy enforcement#1865

Open
krishicks wants to merge 9 commits into
mainfrom
hicks/push-nvuozlywzuwu
Open

feat(l7): add JSON-RPC policy enforcement#1865
krishicks wants to merge 9 commits into
mainfrom
hicks/push-nvuozlywzuwu

Conversation

@krishicks

@krishicks krishicks commented Jun 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Summary

Adds JSON-RPC L7 policy enforcement for sandbox proxy traffic. The implementation supports JSON-RPC endpoint configuration, rpc_method matching, scalar object params matching, forward-proxy inspection, CONNECT tunnel inspection, and deny-if-any-denied batch handling.

JSON-RPC enforcement applies to sandbox-to-server HTTP request bodies sent to the configured endpoint. It does not yet enforce policy on server-to-client JSON-RPC messages carried on MCP SSE streams or response bodies. Tool results continue to pass because responses are relayed, not matched against rpc_method.

Related Issue

Closes #1793

Changes

  • Add JSON-RPC as an L7 endpoint protocol in policy parsing, validation, proto conversion, and relay dispatch.
  • Parse JSON-RPC HTTP request bodies into normalized call metadata for single requests and batch arrays.
  • Extend OPA policy input and Rego rules to enforce rpc_method and flattened scalar object params matchers for allow and deny rules.
  • Inspect JSON-RPC request bodies on both forward-proxy and CONNECT tunnel paths before relaying upstream.
  • Evaluate JSON-RPC batch items independently and deny the whole batch when any call is denied.
  • Redact raw JSON-RPC params from L7 logs and record endpoint, RPC methods, params SHA-256 digest, and policy version instead.
  • Document current JSON-RPC directionality limits and params matcher scope.

Testing

  • mise run pre-commit passes
  • Unit tests added/updated
  • E2E tests added/updated (if applicable)

Additional targeted checks:

  • cargo test -p openshell-sandbox jsonrpc
  • mise run e2e:rust -- --test forward_proxy_jsonrpc_l7

Checklist

  • Follows Conventional Commits
  • Commits are signed off (DCO)
  • Architecture docs updated (if applicable)

@copy-pr-bot

copy-pr-bot Bot commented Jun 10, 2026

Copy link
Copy Markdown

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

@github-actions

github-actions Bot commented Jun 10, 2026

Copy link
Copy Markdown

🌿 Preview your docs: https://nvidia-preview-pr-1865.docs.buildwithfern.com/openshell

krishicks added 4 commits June 10, 2026 16:35
@krishicks
test(e2e): add JSON-RPC L7 proxy coverage
ed12716 
Add a Rust e2e test that drives MCP-style JSON-RPC requests through both the
forward proxy and CONNECT tunnel paths.

Cover method rules, params rules, batch handling, and invalid JSON denial
expectations so the JSON-RPC implementation can be built against one failing
scenario.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
feat(policy): recognize JSON-RPC L7 endpoints
4705a67 
Add json-rpc as a policy protocol and carry JSON-RPC rule fields through policy
parsing and validation.

Wire the protocol into the L7 dispatcher with a passthrough placeholder so
later commits can add enforcement without changing endpoint recognition.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
refactor(l7): share HTTP body inspection helper
5db7efa 
Move HTTP request body buffering and chunked-body normalization out of the
GraphQL module so other HTTP-carried L7 protocols can inspect request bodies
without depending on GraphQL internals.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
feat(l7): enforce JSON-RPC method rules
bc7a4a3 
Add the JSON-RPC HTTP parser and relay path, extract request methods, and pass
JSON-RPC metadata into L7 policy evaluation.

Wire rpc_method through proto and policy conversion, add Rego matching for
JSON-RPC methods, and inspect forward-proxy JSON-RPC bodies before relaying
upstream.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks krishicks force-pushed the hicks/push-nvuozlywzuwu branch from 8d0925f to 62da29d Compare June 10, 2026 23:35
krishicks added 5 commits June 11, 2026 08:19
@krishicks
fix(l7): honor JSON-RPC body size config
e4ff85f 
Carry JSON-RPC max body bytes from policy into runtime endpoint config and use
it on both CONNECT and forward JSON-RPC inspection paths instead of hardcoding
64 KiB.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
feat(l7): match JSON-RPC params in rules
a257133 
Add JSON-RPC params matcher maps to proto and YAML policy conversion, including
shared matcher conversion helpers.

Flatten object params into dot-separated keys for policy input and extend Rego
allow and deny matching to filter JSON-RPC calls by params.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
feat(l7): support JSON-RPC batch calls
755ec0f 
Parse JSON-RPC batch arrays into per-call metadata and evaluate each batch item
with the existing method and params policy rules.

Deny the whole batch when any call is denied.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
fix(l7): redact JSON-RPC params in logs
6302ec9 
Log JSON-RPC endpoint, RPC methods, params SHA-256 digest, and policy version
without recording raw params. Use <empty> when no params are present.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks
docs(policy): document JSON-RPC L7 rules
8dc2a54 
Document JSON-RPC endpoint configuration, rpc_method and params matchers, batch
denial behavior, current directionality limits, matcher scope, and the current
policy update CLI limitation.

Signed-off-by: Kris Hicks <khicks@nvidia.com>
@krishicks krishicks force-pushed the hicks/push-nvuozlywzuwu branch from 62da29d to 8dc2a54 Compare June 11, 2026 15:20
@krishicks krishicks marked this pull request as ready for review June 12, 2026 16:35
@krishicks krishicks requested review from a team, derekwaynecarr and mrunalp as code owners June 12, 2026 16:35
@johntmyers johntmyers added the gator:in-review Gator is reviewing or awaiting PR review feedback label Jun 13, 2026
@johntmyers

johntmyers commented Jun 13, 2026

Copy link
Copy Markdown
Collaborator

gator-agent

PR Review Status

Validation: This maintainer-authored PR is project-valid because it implements the JSON-RPC/MCP method-level policy work discussed in #1793, with documented v1 scope around sandbox-to-server HTTP request inspection.
Head SHA: 8dc2a54f9b99d2aa297ccfd49c102ea10ce982f4

Review findings:

  • Blocking: crates/openshell-sandbox/src/l7/jsonrpc.rs flattens JSON-RPC params into dot-separated keys without rejecting literal dotted keys or collisions. A request can present arguments.scope as a top-level param while sending a different nested arguments.scope object path to the upstream server, which can bypass params selectors. Please fail closed on ambiguous/dotted param keys or preserve nested params through policy evaluation.
  • Blocking: crates/openshell-sandbox/src/proxy.rs only force-denies GraphQL parse errors in the forward-proxy path. JSON-RPC parse errors are carried in request_info.jsonrpc.error but can still be allowed by generic REST-style method/path rules such as access: full or read-write. Please include JSON-RPC parse errors in the same force-deny path.
  • Warning: forward-proxy JSON-RPC audit logs use generic FORWARD_L7 / l7 output and omit RPC methods, params digest, and policy version, while the CONNECT path has richer JSON-RPC logging.
  • Warning: json_rpc.on_parse_error and json_rpc.batch_policy appear accepted by policy YAML but are not enforced or converted into proto behavior. Please either implement them or reject/remove them from the accepted schema.

Docs: Fern docs were updated for the new policy schema and sandbox policy behavior.

Next state: gator:in-review

@johntmyers johntmyers mentioned this pull request Jun 13, 2026
Open
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mrunalp mrunalp Awaiting requested review from mrunalp mrunalp is a code owner

@derekwaynecarr derekwaynecarr Awaiting requested review from derekwaynecarr derekwaynecarr is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

gator:in-review Gator is reviewing or awaiting PR review feedback

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Support method-level governance for MCP tool calls (JSON-RPC) in sandbox policy

2 participants

@krishicks @johntmyers