From 8d499f2efb36f9f11751d53d0d4827a604189310 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= Date: Wed, 22 Jul 2026 13:28:02 +0200 Subject: [PATCH] fix(mcp): keep empty permission and relationship lists in user/role details Preserve permissions on DetailedRole and role_ids/membership_ids on DetailedUser when empty, so an empty list reads as an explicit 'none' rather than an omitted, unknown field. Matches the existing handling for unlimited_visibility and user_ids/provider_group_ids. --- .../prowler_app/models/roles.py | 18 ++++++++++++------ .../prowler_app/models/users.py | 10 ++++++++-- 2 files changed, 20 insertions(+), 8 deletions(-) diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/roles.py b/mcp_server/prowler_mcp_server/prowler_app/models/roles.py index 809a4a6763..e44f59d654 100644 --- a/mcp_server/prowler_mcp_server/prowler_app/models/roles.py +++ b/mcp_server/prowler_mcp_server/prowler_app/models/roles.py @@ -107,13 +107,19 @@ class DetailedRole(SimplifiedRole): def _should_exclude(self, key: str, value: Any) -> bool: """Keep fields whose "empty" form carries meaning. - ``unlimited_visibility`` is kept even when ``False``, and the - relationship lists are kept even when empty so that an empty - ``user_ids``/``provider_group_ids`` explicitly signals "not assigned to - any user / not scoped to any provider group" instead of looking like an - omitted, unknown field to an agent. + ``unlimited_visibility`` is kept even when ``False``, and ``permissions`` + and the relationship lists are kept even when empty so that an empty + ``permissions``/``user_ids``/``provider_group_ids`` explicitly signals + "grants no capabilities / not assigned to any user / not scoped to any + provider group" instead of looking like an omitted, unknown field to an + agent. """ - if key in ("unlimited_visibility", "user_ids", "provider_group_ids"): + if key in ( + "unlimited_visibility", + "permissions", + "user_ids", + "provider_group_ids", + ): return value is None return super()._should_exclude(key, value) diff --git a/mcp_server/prowler_mcp_server/prowler_app/models/users.py b/mcp_server/prowler_mcp_server/prowler_app/models/users.py index 18dc22528f..369911b989 100644 --- a/mcp_server/prowler_mcp_server/prowler_app/models/users.py +++ b/mcp_server/prowler_mcp_server/prowler_app/models/users.py @@ -83,8 +83,14 @@ class DetailedUser(SimplifiedUser): ) def _should_exclude(self, key: str, value: Any) -> bool: - """Always include is_verified even when it is False.""" - if key == "is_verified": + """Keep fields whose "empty" form carries meaning. + + ``is_verified`` is kept even when ``False``, and ``role_ids`` / + ``membership_ids`` are kept even when empty so that an empty list + explicitly signals "not assigned to any role / not a member of any + tenant" instead of looking like an omitted, unknown field to an agent. + """ + if key in ("is_verified", "role_ids", "membership_ids"): return value is None return super()._should_exclude(key, value)