fix(mcp): keep empty permission and relationship lists in user/role details

Preserve permissions on DetailedRole and role_ids/membership_ids on
DetailedUser when empty, so an empty list reads as an explicit 'none'
rather than an omitted, unknown field. Matches the existing handling for
unlimited_visibility and user_ids/provider_group_ids.

mcp_server/prowler_mcp_server/prowler_app/models/roles.py

@@ -107,13 +107,19 @@ class DetailedRole(SimplifiedRole):
     def _should_exclude(self, key: str, value: Any) -> bool:
         """Keep fields whose "empty" form carries meaning.
 
-        ``unlimited_visibility`` is kept even when ``False``, and the
-        relationship lists are kept even when empty so that an empty
-        ``user_ids``/``provider_group_ids`` explicitly signals "not assigned to
-        any user / not scoped to any provider group" instead of looking like an
-        omitted, unknown field to an agent.
+        ``unlimited_visibility`` is kept even when ``False``, and ``permissions``
+        and the relationship lists are kept even when empty so that an empty
+        ``permissions``/``user_ids``/``provider_group_ids`` explicitly signals
+        "grants no capabilities / not assigned to any user / not scoped to any
+        provider group" instead of looking like an omitted, unknown field to an
+        agent.
         """
-        if key in ("unlimited_visibility", "user_ids", "provider_group_ids"):
+        if key in (
+            "unlimited_visibility",
+            "permissions",
+            "user_ids",
+            "provider_group_ids",
+        ):
             return value is None
         return super()._should_exclude(key, value)
 

mcp_server/prowler_mcp_server/prowler_app/models/users.py

@@ -83,8 +83,14 @@ class DetailedUser(SimplifiedUser):
     )
 
     def _should_exclude(self, key: str, value: Any) -> bool:
-        """Always include is_verified even when it is False."""
-        if key == "is_verified":
+        """Keep fields whose "empty" form carries meaning.
+
+        ``is_verified`` is kept even when ``False``, and ``role_ids`` /
+        ``membership_ids`` are kept even when empty so that an empty list
+        explicitly signals "not assigned to any role / not a member of any
+        tenant" instead of looking like an omitted, unknown field to an agent.
+        """
+        if key in ("is_verified", "role_ids", "membership_ids"):
             return value is None
         return super()._should_exclude(key, value)