feat(scada): require complete authorized investigation evidence

2026-11-07 21:15:01 +08:00
parent 2552a9b40d
commit 06d8539aa8
12 changed files with 498 additions and 30 deletions
@@ -129,6 +129,11 @@ async def authorize_query(
    if not granted and binding.task_id and source in binding.task_scope_cap:
        async with scope.connection.transaction():
            granted = await task_service(scope).can_read_source(binding.task_id, source)
+            if granted and tool.name == "query_scada_readings" and args.device_ids is None:
+                granted = (
+                    "scada_devices" in binding.task_scope_cap
+                    and await task_service(scope).can_read_source(binding.task_id, "scada_devices")
+                )
    if not granted:
        raise HTTPException(403, "Data source permission is required")
    if tool.name == "run_burst_location" and args.burst_leakage is None:
@@ -175,7 +180,10 @@ async def execute_query(
    source_ref = "mcp:" + str(uuid4())
    evidence_id = None
    replay_context = getattr(binding, "replay_context", None)
-    if name == "query_scada_readings" and replay_context:
+    if name == "query_scada_readings" and args.device_ids is None:
+        from app.mcp.scada_readings import read_complete_scada
+        data, units, gaps, origin = await read_complete_scada(scope, binding, args)
+    elif name == "query_scada_readings" and replay_context:
        from app.services.scada_replay_queries import replay_snapshot_rows
        rows = await replay_snapshot_rows(conn, scope.project.project_id, replay_context,
                                          args.device_ids, args.start, args.end, args.limit + 1, args.offset)