feat: add MCPLogs RBAC resource and enforce access control on MCP logs route and sidebar

[impoiler]

Summary

Introduces a dedicated MCPLogs RBAC resource, decoupling MCP log access control from the MCPGateway resource. This allows permissions for viewing and deleting MCP logs to be managed independently from gateway-level permissions.

Changes

• Added MCPLogs as a new RbacResource enum value in the fallback RBAC context.
• The MCP Logs route now checks MCPLogs view permission and renders a NoPermissionView when access is denied, rather than rendering the page unconditionally.
• Delete access on the MCP Logs page now checks RbacResource.MCPLogs instead of RbacResource.MCPGateway.
• The sidebar MCP Logs entry now uses hasMCPLogsAccess (derived from RbacResource.MCPLogs) to control visibility, rather than reusing hasMCPGatewayAccess.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

1. Configure a role that has MCPGateway access but no MCPLogs access.
2. Log in as a user with that role and navigate to the MCP Logs page — the NoPermissionView should be displayed and the sidebar entry should be hidden.
3. Grant the role MCPLogs view access and confirm the page and sidebar entry become accessible.
4. Verify that delete functionality on the MCP Logs page is gated by MCPLogs delete permission independently of MCPGateway delete permission.

cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

Any role configuration that previously relied on MCPGateway permissions to grant access to MCP Logs will need to be updated to explicitly grant MCPLogs permissions.

Related issues

N/A

Security considerations

Access to MCP log data (which may contain sensitive tool execution details) is now enforced by a dedicated RBAC resource, reducing the risk of unintended access through overly broad MCPGateway permissions.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 28a7859c-e4cf-4af3-a5aa-47980a0731b8

📥 Commits

Reviewing files that changed from the base of the PR and between 7b8dbfc and c892344.

📒 Files selected for processing (4)

• ui/app/_fallbacks/enterprise/lib/contexts/rbacContext.tsx
• ui/app/workspace/mcp-logs/layout.tsx
• ui/app/workspace/mcp-logs/page.tsx
• ui/components/sidebar.tsx

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Enforced RBAC for MCP Logs across the app: route access, sidebar visibility, and delete/view flows now respect MCP Logs permissions; unauthorized users see a no-permission view.

• Bug Fixes

  • Fixed deletion permission checks to use MCP Logs-specific access instead of gateway permissions.

Walkthrough

Adds a new RbacResource.MCPLogs enum entry and uses it to gate MCP Logs access at the route level, update delete permission checks on the MCPLogs page, and control sidebar visibility for the MCP Logs navigation item.

Changes

MCP Logs RBAC Permission Gating

Layer / File(s)	Summary
RBAC Resource Definition ui/app/_fallbacks/enterprise/lib/contexts/rbacContext.tsx	RbacResource enum gains MCPLogs entry for permission resource identification.
Route-Level Access Control ui/app/workspace/mcp-logs/layout.tsx	Route wrapper component enforces view permission check on RbacResource.MCPLogs, conditionally rendering NoPermissionView or MCPLogsPage.
Page Delete Permission ui/app/workspace/mcp-logs/page.tsx	Delete operation permission check updated to use RbacResource.MCPLogs instead of MCPGateway.
Sidebar Navigation Integration ui/components/sidebar.tsx	Sidebar derives hasMCPLogsAccess permission check and gates "MCP Logs" menu item visibility accordingly, with useMemo dependency list updated.

Sequence Diagram(s)

sequenceDiagram
  participant User
  participant Browser
  participant RouteComponent
  participant RBAC
  participant MCPLogsPage
  User->>Browser: navigate to /workspace/mcp-logs
  Browser->>RouteComponent: mount
  RouteComponent->>RBAC: check view permission (MCPLogs)
  RBAC-->>RouteComponent: allowed / denied
  alt allowed
    RouteComponent->>MCPLogsPage: render page
    MCPLogsPage->>RBAC: check delete permission when user attempts delete
    RBAC-->>MCPLogsPage: allowed / denied
  else denied
    RouteComponent->>Browser: render NoPermissionView
  end

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• maximhq/bifrost#3316: Implements the same MCPLogs RbacResource addition and updates route, page, and sidebar RBAC checks.

Suggested reviewers

• akshaydeo

Poem

I’m a rabbit in the code, ears up for logs,
A new MCPLogs flag clears permissioned bogs,
Routes stand sentinel, deletes ask first please,
Sidebar shows only what the RBAC keys seize. 🐰✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a new MCPLogs RBAC resource and enforcing access control on related routes and UI elements.
Description check	✅ Passed	The description is comprehensive and well-structured, covering all key template sections including summary, changes, type of change, affected areas, testing instructions, breaking changes, and security considerations.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-08-feat_added_mcp_logs_as_a_dedicated_rbac_resource

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[impoiler]

• fix: remove 100-item upper limit on paginated teams query #3323
• feat: add MCPToolGroups RBAC resource and separate access control from MCPGateway #3319
• feat: add MCPLogs RBAC resource and enforce access control on MCP logs route and sidebar #3316 👈 (View in Graphite)
• fix: hide delete log button instead of disabling it when user lacks delete access #3314
• fix: hide provider and key action buttons based on RBAC permissions #3296
• feat: add granular RBAC checks for API keys, inference, metrics, and filter inaccessible sidebar items #3295
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Confidence Score: 5/5

Safe to merge — the changes are narrowly scoped UI permission checks with no logic shared between OSS and enterprise paths.

All four touched files make straightforward, self-consistent changes: a new enum value, a view-permission gate in the route, a corrected delete-permission resource, and a new sidebar access variable. The OSS fallback always returns true so no OSS user is affected. The breaking-change impact on enterprise roles is documented and expected.

No files require special attention.

Important Files Changed

Filename	Overview
ui/app/_fallbacks/enterprise/lib/contexts/rbacContext.tsx	Adds MCPLogs to RbacResource enum; OSS fallback always returns true so no OSS impact
ui/app/workspace/mcp-logs/layout.tsx	Wraps MCPLogsPage in a RouteComponent that gates on MCPLogs view permission; clean guard pattern
ui/app/workspace/mcp-logs/page.tsx	Switches delete-access check from RbacResource.MCPGateway to RbacResource.MCPLogs; correct and isolated change
ui/components/sidebar.tsx	Adds hasMCPLogsAccess hook call and uses it for the MCP Logs sidebar entry; also adds it to useMemo deps

_{Reviews (2): Last reviewed commit: "feat: added MCP logs as a dedicated RBAC..." | Re-trigger Greptile}

[akshaydeo]

Merge activity

• May 8, 11:29 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 8, 11:33 AM UTC: Graphite rebased this pull request as part of a merge.
• May 8, 11:33 AM UTC: @akshaydeo merged this pull request with Graphite.