Set MCP parent on resource entities for server-scoped policies

[jhrozek]

Summary

Server-scoped Cedar policies like resource in MCP::"github" silently matched nothing because resource entities (Tool, Prompt, Resource) had no MCP parent in their entity hierarchy. The serverName stored on the authorizer (#4861) was available but unused when building request entities.

• Thread a.serverName through authorizeToolCall, authorizePromptGet, authorizeResourceRead, and authorizeFeatureList into CreateEntitiesForRequest
• When serverName is non-empty, add MCP::"<serverName>" as a parent UID on the resource entity so Cedar's in operator can traverse the hierarchy
• Test through AuthorizeWithJWTClaims (the production entry point) to pin the serverName threading at all four call sites

Type of change

• New feature

Test plan

• Unit tests (task test)
• Linting (task lint-fix)
• Manual testing (describe below)

Tested end-to-end on a Kind cluster with a real Entra ID token (roles: ["developer", "mcp-admin"]) against two MCPServers sharing one compiled Cedar ConfigMap with server-scoped policies:

• permit(principal in THVRole::"dev-access", action, resource in MCP::"github") — github server: tools/list returned tools, call_tool returned HTTP 200
• permit(principal in THVRole::"ops-access", action, resource in MCP::"internal-tools") — internal-tools server: call_tool returned HTTP 403 (no ops-team role in token, default deny)

Does this introduce a user-facing change?

No — enables server-scoped Cedar policies that were previously inert.

Special notes for reviewers

The test uses AuthorizeWithJWTClaims rather than calling CreateEntitiesForRequest directly, so it would fail if any of the four a.serverName call sites were accidentally dropped.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.49%. Comparing base (108f6fa) to head (3cbc17e).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4965      +/-   ##
==========================================
- Coverage   69.55%   69.49%   -0.07%     
==========================================
  Files         551      551              
  Lines       55906    55917      +11     
==========================================
- Hits        38887    38858      -29     
- Misses      14025    14063      +38     
- Partials     2994     2996       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.