fix: View as Agent must enforce the target user's data policy (#71)

<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## What was going wrong

A **new Agent chat thread** while Viewing as `marts-editor` still
returned `crm.customers` rows (including `amount`). SQL Editor already
blocked `crm`. Direct MCP API calls with a marts-editor token also
blocked `crm`. The Agent path did not.

End-to-end logs for the failing turn (`session=fca723ca8171`, 14:14
UTC):

1. `/api/agent/session` minted MCP token **257** for `marts-editor` and
provisioned `u-marts-editor`.
2. Hermes `POST /api/profile/switch` returned **200** three times; the
session JSON is tagged `"profile": "u-marts-editor"`.
3. `mcp__deepsql__get_brain_context` and `mcp__deepsql__execute_sql`
authenticated as **admin** token **253**.
4. Audit: `EDITOR_QUERY_EXECUTED` / `clientType=mcp` / `user_id=1`
(`admin@demo.local`) / `SELECT … FROM crm.customers` / `rowCount=2`.
5. Token 257 `last_used_at` is only the Spring `probeMcpAuth` right
after mint — Hermes never sent it.
6. `u-marts-editor` has **no** `mcp-stderr.log`; `u-admin` MCP was
started on Aug 18 and reused.

Hermes keeps **one** DeepSQL MCP stdio process, started from the first
loaded profile (`u-admin`). `POST /api/profile/switch` is explicitly
`process_wide=False` (cookie / thread-local only). A new chat does not
respawn MCP. `resolveEffectivePolicy(..., actorIsAdmin=true)` returns
`none()`, so schema and column policy never run.

`probeMcpAuth` only proves the minted token works against Spring, not
that the live MCP process will use it.

## Fix

`scripts/local-agent-provisioner.py` (the Agent container's `/provision`
handler) now mirrors the minted token onto `$HERMES_HOME/deepsql.token`
**and every** `profiles/*/deepsql.token`. The long-lived MCP client
re-reads `DEEPSQL_TOKEN_FILE` per request (mtime cache), so the next
`execute_sql` authenticates as the viewed-as user and policy applies.

Chat-path policy is also fail-closed for unparseable/unhandled SQL and
missing actors, and walks CTEs, UNIONs, and nested `FROM`/`WHERE`
selects.

## Merge with main

Resolved conflicts with `main` (`#70` whole-statement schema allowlist +
nested protected-table inspectability, `#72` brain endpoint authz).

Kept this branch's recursive SELECT walker and fail-closed parse/actor
rules. Took main's `assertProtectedTablesAreInspectable` / `namesMatch`
so a qualified protection (`public.customer_profiles`) does not catch
the same table name in another schema, while an unqualified nested
reference still fails closed.

`UserDataAccessPolicyServiceTest` (24) and
`BrainControllerAuthorizationSafetyTest` (2) pass after the merge.

## How to verify

1. View as `marts-editor`, Agent tab, **New chat**.
2. Ask: `show me all customer information from crm tables`.
3. Expect a policy block, not Acme/Globex rows. `security_event.user_id`
for that SQL must be the editor, not admin.

Rebuild/restart `deepsql-agent` so the container picks up the
provisioner change, or copy `scripts/local-agent-provisioner.py` onto
`/opt/deepsql-agent/provisioner.py` and restart the provisioner process,
then reopen the Agent tab (triggers `/provision`).

## Re-test after the fix

Same prompt in a new Agent thread while Viewing as marts-editor. Agent
refused CRM; audit `user_id=2` / `clientAgent=marts-editor`.

[Agent refuses CRM while viewing as
marts-editor](https://cursor.com/agents/bc-019fe687-99b1-76fd-80fa-dd213aecc497/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fagent_view_as_crm_blocked.webp)

[agent_view_as_crm_policy_block.mp4](https://cursor.com/agents/bc-019fe687-99b1-76fd-80fa-dd213aecc497/artifacts?path=%2Fopt%2Fcursor%2Fartifacts%2Fagent_view_as_crm_policy_block.mp4)


<sub>To show artifacts inline, <a
href="https://cursor.com/dashboard/cloud-agents#my-pull-requests">enable</a>
in settings.</sub>
<!-- CURSOR_AGENT_PR_BODY_END -->

<div><a
href="https://cursor.com/agents/bc-019fe687-99b1-76fd-80fa-dd213aecc497?cursor_ref=pr_footer&cursor_cta=open_in_web"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a>&nbsp;<a
href="https://cursor.com/background-agent?bcId=bc-019fe687-99b1-76fd-80fa-dd213aecc497&cursor_ref=pr_footer&cursor_cta=open_in_cursor"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a>&nbsp;</div>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>

Author: venkateshsakamuri-lab

CLAUDE.md

@@ -199,8 +199,9 @@ returns a number).
 2. **LLM Provider Registry**: Use `LlmProviderRegistry` for all provider-specific LLM behavior. Do NOT add if/else or switch on provider type. Chat and embedding providers are registered and resolved independently — some providers offer only one. Providers are *factories* over credentials, not `ChatModel`s, so credentials stay resolvable per call and key rotation needs no restart.
 3. **SSH-Aware Access**: Always use `ConnectionService.getJdbcTemplate(connectionId, request)` — handles SSH tunneling transparently.
 4. **SQL Rule**: All generated SQL MUST use table-qualified column names (`table.column_name`).
-5. **RAG Caching**: Three-tier cache (memory → Redis → Azure Search). Redis failure is graceful (app continues without caching).
-6. **Virtual Threads**: Enabled for concurrency (JDK 25).
+5. **Chat access policy**: Fail closed. Walk the whole SQL tree (CTEs, set ops, subqueries). Deny unparseable or unhandled statements. Require an actor except `INTERNAL`/`SCHEDULED`. MCP/Editor identity comes from `SecurityContext`, not `QueryActorContextHolder`. Persist `allowed_schemas`. Do not let "how many" override a protected-column mention. Public share is refused when the connection has an active policy.
+6. **RAG Caching**: Three-tier cache (memory → Redis → Azure Search). Redis failure is graceful (app continues without caching).
+7. **Virtual Threads**: Enabled for concurrency (JDK 25).
 
 ### Frontend Rules
 1. **API Centralization**: ALL API calls through `src/lib/api/client.js`. Never create direct axios instances.
@@ -210,7 +211,13 @@ returns a number).
 5. **Design**: Minimal black/white/grey palette, Inter font, subtle transitions. See UX guidelines in full CLAUDE.md.
 
 ### Admin profile switch
-Admins can **View as** a sub-user from the top-right of the home layout (`ProfileSwitch`) to verify connection ACLs, chat/editor policies, and role-gated nav. The admin JWT stays on the session; `ImpersonationService` sets an httpOnly `impersonate_user` cookie and `JwtAuthenticationFilter` overlays the target principal. `POST|DELETE|GET /api/admin/impersonate` are excluded from the overlay so stop/list still run as the real admin. Cannot target another ADMIN, self, or a non-ACTIVE account. `/auth/me` returns the **effective** user plus `impersonating` / `impersonatorUsername`.
+Admins can **View as** a sub-user from the top-right of the home layout (`ProfileSwitch`) to verify connection ACLs, chat/editor policies, and role-gated nav.
+
+The admin JWT **subject** stays the administrator so logout, refresh, and `/admin/impersonate` still own the real session. Policy identity is the target: an httpOnly `impersonate_user` cookie plus an `impUid` claim on the access token. `JwtAuthenticationFilter` overlays that principal onto the SecurityContext for every request except the impersonation control plane, logout, and session refresh. Chat, Editor, schema listing, and Agent MCP calls then run `AccessControlService` / `ConnectionChatAccessPolicyService` as the target (`actorIsAdmin` is false, so policies apply).
+
+The Agent tab must not inherit the admin MCP token. `/api/agent/session` mints an MCP token for the effective user and never falls back to the admin session JWT while View as is active. nginx `auth_request` on `/agent-api` forwards `/api/auth/me`'s `X-Remote-User` (the overlaid username) instead of hardcoding `admin`.
+
+`POST|DELETE|GET /api/admin/impersonate` are excluded from the overlay so stop/list still run as the real admin. Cannot target another ADMIN, self, or a non-ACTIVE account. `/auth/me` returns the **effective** user plus `impersonating` / `impersonatorUsername`.
 
 ### Git Rules
 - Do NOT commit automatically — wait for explicit user instruction.
@@ -238,7 +245,16 @@ Admins can **View as** a sub-user from the top-right of the home layout (`Profil
    `hermes_requires <0.20.0` on a "verified" 401 that came from a hand-rolled
    `hermes serve` run rather than `hermes webui`. 0.20.0 works. Verify against the
    real start path before writing a version constraint.
-5. **The agent image build clones two third-party repos over the public internet,
+5. **Hermes MCP is process-global.** One `deepsql-phase1-server.js` stdio server
+   is started from the first loaded profile (usually `u-admin`) and lives until
+   the Agent API process dies. `POST /api/profile/switch` is `process_wide=False`
+   on purpose (per-browser cookie), so a View as / new-thread Agent chat tagged
+   `profile: u-marts-editor` still sends the admin MCP bearer. Chat-access policy
+   then `resolveEffectivePolicy(..., actorIsAdmin=true)` → `none()`. The
+   provisioner mirrors the target user's token onto every `deepsql.token` the
+   live process might re-read (`DEEPSQL_TOKEN_FILE` mtime cache in
+   `mcp/deepsql-phase1-lib.js`).
+6. **The agent image build clones two third-party repos over the public internet,
    unauthenticated.** `agent/Dockerfile` fetches `NousResearch/hermes-agent` and
    `nesquena/hermes-webui` at build time. GitHub rate-limits unauthenticated
    requests *per source IP*, and Actions runners share pooled egress addresses, so
@@ -276,6 +292,16 @@ broken. Assert the *outcome*, never the attempt:
 - **`set -e` + `read` at EOF aborts silently.** Prompts in `install.sh` use
   `read … || true` so the explicit emptiness checks report the problem. Without it the
   installer exited 1 with no message, after writing generated secrets to `.env`.
+- **Minting an Agent MCP token ≠ Hermes using it.** `/api/agent/session` can mint
+  `u-marts-editor`'s token and `POST /api/profile/switch` can 200 while
+  `execute_sql` still authenticates as admin. Hermes keeps one DeepSQL MCP
+  stdio process (started from the first profile that loaded `mcp_servers`) and
+  `profile/switch` is `process_wide=False`. A new chat thread does not respawn
+  MCP. `probeMcpAuth` only proves the *minted* token works against Spring, not
+  that the live MCP process will send it. The provisioner must mirror the
+  token onto every `deepsql.token` the live process might be watching
+  (`scripts/local-agent-provisioner.py`). Audit: `security_event.user_id` on
+  `EDITOR_QUERY_EXECUTED` with `clientType=mcp`.
 - **Silent-failure rule, concretely:** the CLI rendered an unreachable server as
   `No databases connected yet` because one `catch` covered both the connection fetch
   and decorative extras. An unreachable host must never look like an empty account.

backend/src/main/java/com/dbaagent/controller/AuthController.java

@@ -207,11 +207,21 @@ public ResponseEntity<?> refreshSession(HttpServletRequest httpRequest, HttpServ
         User effectiveUser = impersonationService.resolveFromCookie(httpRequest, user)
             .map(ImpersonationContext.State::target)
             .orElse(user);
-        // Keep the user's agent token alive for as long as the UI session lives.
-        // The SPA refreshes on access-token expiry (~every 15 min of activity), so
-        // this slides the agent token forward on each active interval — a logged-in
-        // UI never ends up with a dead agent.
+        if (effectiveUser != user && effectiveUser.getId() != null) {
+            authSessionService.reissueAccessToken(
+                httpResponse,
+                session.getId(),
+                user,
+                effectiveUser.getId()
+            );
+        }
+        // Keep agent tokens alive for as long as the UI session lives.
+        // During View as the SPA still refreshes the *admin* session; also
+        // slide the target user's minted MCP token or their Agent tab dies.
         agentBridgeService.extendAgentTokens(user.getUsername());
+        if (!effectiveUser.getUsername().equals(user.getUsername())) {
+            agentBridgeService.extendAgentTokens(effectiveUser.getUsername());
+        }
         Map<String, Object> payload = toAuthPayload(
             effectiveUser,
             effectiveUser.getRoleEnum(),

backend/src/main/java/com/dbaagent/controller/BrainController.java

@@ -65,6 +65,7 @@
 import com.dbaagent.service.brain.query.PlanPatternLibraryService;
 import com.dbaagent.service.brain.BrainInsightEmbeddingService;
 import com.dbaagent.service.SlowQueryHistoryService;
+import com.dbaagent.service.UserDataAccessPolicyService;
 import com.dbaagent.service.security.AccessControlService;
 import com.dbaagent.model.SlowQueryAnalysis;
 import lombok.RequiredArgsConstructor;
@@ -139,6 +140,7 @@ public class BrainController {
     private final SlowQueryHistoryService slowQueryHistoryService;
     private final BrainInsightEmbeddingService brainInsightEmbeddingService;
     private final AccessControlService accessControlService;
+    private final UserDataAccessPolicyService userDataAccessPolicyService;
 
     @GetMapping("/understanding/{connectionId}")
     public ResponseEntity<BrainUnderstandingResponse> getUnderstanding(
@@ -531,7 +533,12 @@ public ResponseEntity<List<InferredTableRelationship>> getInferredRelationships(
     ) {
         try {
             accessControlService.assertCanReadConnectionContent(connectionId);
-            return ResponseEntity.ok(joinRelationshipInferenceService.getRelationships(connectionId));
+            return ResponseEntity.ok(userDataAccessPolicyService.filterInferredRelationships(
+                connectionId,
+                accessControlService.getCurrentUsername(),
+                accessControlService.isCurrentUserAdmin(),
+                joinRelationshipInferenceService.getRelationships(connectionId)
+            ));
         } catch (ResponseStatusException e) {
             throw e;
         } catch (Exception e) {

backend/src/main/java/com/dbaagent/controller/DashboardQueryController.java

@@ -77,7 +77,10 @@ public ResponseEntity<?> query(@RequestBody DashboardQueryRequest request) {
             qr.setExecutionOrigin(QueryExecutionOrigin.API);
             QueryResult result = queryExecutorService.executeQuery(
                 request.connectionId(), qr,
-                QueryExecutionContext.api(accessControlService.getCurrentUsername()));
+                QueryExecutionContext.api(
+                    accessControlService.getCurrentUsername(),
+                    accessControlService.isCurrentUserAdmin()
+                ));
             return ResponseEntity.ok(Map.of(
                 "success", true,
                 "columns", result.getColumns() == null ? java.util.List.of() : result.getColumns(),

backend/src/main/java/com/dbaagent/controller/McpController.java

@@ -8,7 +8,6 @@
 import com.dbaagent.model.QueryResult;
 import com.dbaagent.service.ExplainPlanService;
 import com.dbaagent.service.McpSqlGuardService;
-import com.dbaagent.service.QueryActorContextHolder;
 import com.dbaagent.service.QueryExecutionContext;
 import com.dbaagent.service.QueryExecutionPolicyException;
 import com.dbaagent.service.QueryExecutorService;
@@ -77,7 +76,10 @@ public ResponseEntity<?> executeReadOnlyQuery(@RequestBody McpReadOnlyQueryReque
             QueryResult result = queryExecutorService.executeQuery(
                 request.getConnectionId(),
                 queryRequest,
-                QueryExecutionContext.mcp(QueryActorContextHolder.currentUsername())
+                QueryExecutionContext.mcp(
+                    accessControlService.getCurrentUsername(),
+                    accessControlService.isCurrentUserAdmin()
+                )
             );
             return ResponseEntity.ok(Map.of(
                 "success", true,

backend/src/main/java/com/dbaagent/controller/SavedDashboardController.java

@@ -2,6 +2,7 @@
 
 import com.dbaagent.model.DashboardVersion;
 import com.dbaagent.model.SavedDashboard;
+import com.dbaagent.service.ConnectionChatAccessPolicyService;
 import com.dbaagent.service.SavedDashboardService;
 import com.dbaagent.service.security.AccessControlService;
 import lombok.extern.slf4j.Slf4j;
@@ -27,6 +28,9 @@ public class SavedDashboardController {
     @Autowired
     private AccessControlService accessControlService;
 
+    @Autowired
+    private ConnectionChatAccessPolicyService connectionChatAccessPolicyService;
+
     // Every write method below is load-then-save on a row a background generation
     // turn (SavedDashboardService.beginGenerationTurn etc.) may be writing at the
     // same time. Without this helper, the loser's raw Hibernate message
@@ -47,6 +51,13 @@ public ResponseEntity<Map<String, Object>> enableShare(@PathVariable UUID id) {
             SavedDashboard existing = savedDashboardService.getDashboardById(id)
                 .orElseThrow(() -> new IllegalArgumentException("Dashboard not found"));
             accessControlService.assertCanReadConnectionContent(existing.getConnectionId());
+            if (connectionChatAccessPolicyService.hasActivePolicy(existing.getConnectionId())) {
+                return ResponseEntity.status(HttpStatus.CONFLICT).body(Map.of(
+                    "success", false,
+                    "errorCode", "POLICY_PUBLIC_SHARE_FORBIDDEN",
+                    "message", "This connection has an active chat access policy, so the dashboard cannot be shared publicly."
+                ));
+            }
             SavedDashboard d = savedDashboardService.enablePublicShare(id);
             return ResponseEntity.ok(Map.of("success", true,
                 "shareToken", d.getShareToken(), "isPublic", true));

backend/src/main/java/com/dbaagent/controller/SchemaController.java

@@ -7,6 +7,7 @@
 import com.dbaagent.service.QueryExecutionContext;
 import com.dbaagent.service.QueryExecutionPolicyException;
 import com.dbaagent.service.ActiveQueryService;
+import com.dbaagent.service.McpTokenService;
 import com.dbaagent.service.QueryExecutorService;
 import com.dbaagent.service.RunningQueryRegistry;
 import com.dbaagent.service.SqlExecutionAuditService;
@@ -15,6 +16,7 @@
 import com.dbaagent.service.SchemaScannerService;
 import com.dbaagent.service.VisualizationService;
 import com.dbaagent.service.security.AccessControlService;
+import org.springframework.http.HttpHeaders;
 import jakarta.servlet.http.HttpServletRequest;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -195,11 +197,7 @@ public ResponseEntity<Map<String, Object>> executeQuery(
             QueryResult result = queryExecutorService.executeQuery(
                 connectionId,
                 queryRequest,
-                QueryExecutionContext.editor(
-                    accessControlService.getCurrentUsername(),
-                    accessControlService.isCurrentUserAdmin(),
-                    Boolean.TRUE.equals(queryRequest.getMutationConfirmed())
-                )
+                queryExecutionContext(queryRequest, httpRequest)
             );
             sqlExecutionAuditService.record(SqlExecutionAuditService.AuditRecord.executed()
                 .connectionId(connectionId)
@@ -413,6 +411,26 @@ public ResponseEntity<Map<String, Object>> getTableStats(
         }
     }
 
+    private QueryExecutionContext queryExecutionContext(QueryRequest queryRequest, HttpServletRequest httpRequest) {
+        String username = accessControlService.getCurrentUsername();
+        boolean admin = accessControlService.isCurrentUserAdmin();
+        if (isMcpBearer(httpRequest)) {
+            return QueryExecutionContext.mcp(username, admin);
+        }
+        return QueryExecutionContext.editor(
+            username,
+            admin,
+            Boolean.TRUE.equals(queryRequest.getMutationConfirmed())
+        );
+    }
+
+    private boolean isMcpBearer(HttpServletRequest httpRequest) {
+        String authorization = httpRequest.getHeader(HttpHeaders.AUTHORIZATION);
+        return authorization != null
+            && authorization.startsWith("Bearer ")
+            && authorization.substring(7).startsWith(McpTokenService.TOKEN_PREFIX);
+    }
+
     private SchemaMetadata scopedSchema(String connectionId, SchemaMetadata schema) {
         return userDataAccessPolicyService.filterSchemaMetadata(
             connectionId,

backend/src/main/java/com/dbaagent/controller/TrainingController.java

@@ -10,6 +10,7 @@
 import com.dbaagent.service.SemanticModelService;
 import com.dbaagent.service.TrainingJobService;
 import com.dbaagent.service.TrainingService;
+import com.dbaagent.service.UserDataAccessPolicyService;
 import com.dbaagent.service.security.AccessControlService;
 import lombok.Data;
 import lombok.RequiredArgsConstructor;
@@ -37,6 +38,7 @@ public class TrainingController {
     private final CredentialRepository credentialRepository;
     private final SemanticModelService semanticModelService;
     private final AccessControlService accessControlService;
+    private final UserDataAccessPolicyService userDataAccessPolicyService;
 
     /**
      * Train with schema DDL
@@ -186,7 +188,9 @@ public ResponseEntity<Map<String, Object>> debugRetrieve(
             if (question == null || question.isBlank()) {
                 return ResponseEntity.badRequest().body(Map.of("error", "Query parameter 'q' is required"));
             }
-            return ResponseEntity.ok(trainingService.debugRetrieve(connectionId, question, topK));
+            Map<String, Object> payload = trainingService.debugRetrieve(connectionId, question, topK);
+            filterDebugRetrieval(connectionId, payload);
+            return ResponseEntity.ok(payload);
         } catch (org.springframework.web.server.ResponseStatusException e) {
             throw e;
         } catch (Exception e) {
@@ -346,6 +350,34 @@ private void rebuildAndReindexConnection(String connectionId) {
         trainingService.reindexConnection(connectionId);
     }
 
+    @SuppressWarnings("unchecked")
+    private void filterDebugRetrieval(String connectionId, Map<String, Object> payload) {
+        if (payload == null) {
+            return;
+        }
+        Object results = payload.get("results");
+        if (!(results instanceof List<?> rows)) {
+            return;
+        }
+        List<Map<String, Object>> filtered = new java.util.ArrayList<>();
+        for (Object row : rows) {
+            if (!(row instanceof Map<?, ?> map)) {
+                continue;
+            }
+            Object metadata = map.get("metadata");
+            if (userDataAccessPolicyService.isRagMetadataInScope(
+                connectionId,
+                accessControlService.getCurrentUsername(),
+                accessControlService.isCurrentUserAdmin(),
+                metadata == null ? null : String.valueOf(metadata)
+            )) {
+                filtered.add((Map<String, Object>) map);
+            }
+        }
+        payload.put("results", filtered);
+        payload.put("resultCount", filtered.size());
+    }
+
     @Data
     public static class DocumentationRequest {
         private String connectionId;

backend/src/main/java/com/dbaagent/dto/ConnectionChatAccessPolicyResponse.java

@@ -16,6 +16,8 @@ public class ConnectionChatAccessPolicyResponse {
     List<String> blockedSensitivityCategories;
     List<String> deniedTables;
     List<String> deniedColumns;
+    List<String> allowedSchemas;
+    boolean allowAggregates;
     boolean blockMode;
     boolean redactMode;
     boolean active;

backend/src/main/java/com/dbaagent/dto/PolicyPreviewResponse.java

@@ -11,6 +11,8 @@ public class PolicyPreviewResponse {
     List<String> blockedSensitivityCategories;
     List<String> deniedTables;
     List<String> deniedColumns;
+    List<String> allowedSchemas;
+    boolean allowAggregates;
     List<String> impactedTables;
     List<String> impactedColumns;
     boolean blockMode;