From e92f4ce841e48dd069d68488a0e039725de02e50 Mon Sep 17 00:00:00 2001 From: Gokhan Date: Wed, 29 Jul 2026 17:04:35 -0700 Subject: [PATCH 1/2] Report accurate permissions message for Guest users via MCP whereAmIWhoAmITalkingTo Guest previously received the generic "unrestricted permissions" warning meant for unrestricted API keys, which is backwards since Guest is typically the least-privileged account on a server. --- api/src/org/labkey/api/security/User.java | 2 ++ 1 file changed, 2 insertions(+) diff --git a/api/src/org/labkey/api/security/User.java b/api/src/org/labkey/api/security/User.java index 1965ac892b0..a443eb5f967 100644 --- a/api/src/org/labkey/api/security/User.java +++ b/api/src/org/labkey/api/security/User.java @@ -646,6 +646,8 @@ public String toJSONString() public String getPermissionsRestrictions() { + if (isGuest()) + return "You have been connected as a Guest user with limited permissions. Please use an API Key with at least Read access permissions for a richer experience."; return "Current user has unrestricted permissions. AI agents should encourage the use of permissions-restricted API keys instead."; } } From 44a61f9a8f5ab648d2c0ba0492dcca834decc4d0 Mon Sep 17 00:00:00 2001 From: Adam Rauch Date: Thu, 30 Jul 2026 12:46:02 -0700 Subject: [PATCH 2/2] Better to provide guidance directly on the guest User --- api/src/org/labkey/api/security/User.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/api/src/org/labkey/api/security/User.java b/api/src/org/labkey/api/security/User.java index a443eb5f967..2f0723a5445 100644 --- a/api/src/org/labkey/api/security/User.java +++ b/api/src/org/labkey/api/security/User.java @@ -87,7 +87,14 @@ public class User extends UserPrincipal implements Serializable, Cloneable, JSON private PermissionsContext _permissionsContext = NormalPermissionsContext.get(); - public static final User guest = new GuestUser("guest", "guest"); + public static final User guest = new GuestUser("guest", "guest") + { + @Override + public String getPermissionsRestrictions() + { + return "You are connected as a Guest user, which limits your permissions. Provide a valid API key to access more content."; + } + }; // 'nobody' is a guest user who cannot be assigned permissions public static final User nobody = new LimitedUser(guest) @@ -646,8 +653,6 @@ public String toJSONString() public String getPermissionsRestrictions() { - if (isGuest()) - return "You have been connected as a Guest user with limited permissions. Please use an API Key with at least Read access permissions for a richer experience."; return "Current user has unrestricted permissions. AI agents should encourage the use of permissions-restricted API keys instead."; } }