fix(auth): block MCP token from app-role gates

src/api/routes.ts

@@ -4948,7 +4948,11 @@ async function getRoleSummaryForIdentity(env: Env, identity: AuthIdentity) {
 async function requireAppRole(c: ProtectedRouteContext, allowedRoles: ControlPanelRoleName[]): Promise<Response | null> {
   const identity = await authenticateRequestIdentity(c);
   if (!identity) return c.json({ error: "unauthorized" }, 401);
-  if (identity.kind !== "session") return null;
+  if (identity.kind !== "session") {
+    // GITTENSORY_MCP_TOKEN is a shared end-user credential; it must not satisfy app-role gates implicitly.
+    if (identity.actor === "mcp") return c.json({ error: "insufficient_role" }, 403);
+    return null;
+  }
   const summary = await loadControlPanelRoleSummary(c.env, identity.actor);
   return summary.roles.some((role) => allowedRoles.includes(role)) ? null : c.json({ error: "insufficient_role" }, 403);
 }

test/unit/routes-kill-switch.test.ts

@@ -57,6 +57,20 @@ describe("kill-switch operator route (#2359)", () => {
     expect(res.status).toBe(401);
   });
 
+  it("rejects the shared MCP token without changing the global kill-switch", async () => {
+    const app = createApp();
+    const env = createTestEnv();
+    const headers = { authorization: `Bearer ${env.GITTENSORY_MCP_TOKEN}`, "content-type": "application/json" };
+
+    const read = await app.request("/v1/app/kill-switch", { headers }, env);
+    expect(read.status).toBe(403);
+
+    const write = await app.request("/v1/app/kill-switch", { method: "POST", headers, body: JSON.stringify({ frozen: true }) }, env);
+    expect(write.status).toBe(403);
+    await expect(getGlobalAgentFrozenState(env)).resolves.toMatchObject({ frozen: false, updatedBy: null });
+    expect(setGlobalAgentFrozen).not.toHaveBeenCalled();
+  });
+
   it("GET surfaces a clear 503 (never a falsely reassuring unfrozen) when the singleton row is missing", async () => {
     const app = createApp();
     const env = createTestEnv();