feat(P2): restore lock-to-Space wiring deferred from P1 (Strategy Y)

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

apps/desktop/src-tauri/src/commands/oauth.rs

@@ -943,6 +943,7 @@ pub async fn delete_oauth_client(
 pub struct RegisteredApiKeyClient {
     pub client_id: String,
     pub client_name: String,
+    pub locked_space_id: Option<String>,
     pub api_key: String,
     pub key_prefix: String,
 }
@@ -973,12 +974,13 @@ fn generate_api_key() -> (String, String, String) {
     (key_id, plaintext, key_prefix)
 }
 
-/// Register a new pre-approved client authenticated by an API key. The returned
-/// `api_key` is shown once and never stored.
+/// Register a new pre-approved client authenticated by an API key, optionally
+/// locked to a Space. The returned `api_key` is shown once and never stored.
 #[tauri::command]
 pub async fn register_api_key_client(
     gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
     name: String,
+    locked_space_id: Option<String>,
 ) -> Result<RegisteredApiKeyClient, String> {
     let app_state = gateway_state.read().await;
     let Some(ref gw_state) = app_state.gateway_state else {
@@ -1024,6 +1026,12 @@ pub async fn register_api_key_client(
         .await
         .map_err(|e| format!("Failed to create client: {}", e))?;
 
+    if let Some(ref space) = locked_space_id {
+        repo.set_locked_space(&client_id, Some(space))
+            .await
+            .map_err(|e| format!("Failed to lock client to space: {}", e))?;
+    }
+
     let (key_id, plaintext, key_prefix) = generate_api_key();
     repo.create_api_key(&key_id, &client_id, &plaintext, &key_prefix, None, None)
         .await
@@ -1037,6 +1045,7 @@ pub async fn register_api_key_client(
     Ok(RegisteredApiKeyClient {
         client_id,
         client_name: trimmed.to_string(),
+        locked_space_id,
         api_key: plaintext,
         key_prefix,
     })
@@ -1079,9 +1088,15 @@ pub async fn create_client_api_key(
     .await
     .map_err(|e| format!("Failed to create API key: {}", e))?;
 
+    let locked_space_id = repo
+        .get_locked_space(&client_id)
+        .await
+        .map_err(|e| format!("Failed to read client: {}", e))?;
+
     Ok(RegisteredApiKeyClient {
         client_id,
         client_name: client.client_name,
+        locked_space_id,
         api_key: plaintext,
         key_prefix,
     })

apps/desktop/src/features/clients/RegisterApiKeyClientModal.tsx

@@ -10,10 +10,11 @@
  * never display it again — if lost, revoke it and issue a new one.
  */
 
-import { useState } from 'react';
-import { AlertTriangle, Check, Copy, KeyRound, Loader2, ShieldCheck, X } from 'lucide-react';
+import { useEffect, useState } from 'react';
+import { AlertTriangle, Check, Copy, KeyRound, Loader2, Lock, ShieldCheck, X } from 'lucide-react';
 import { Button, Card, CardContent, CardDescription, CardHeader, CardTitle } from '@mcpmux/ui';
 import { registerApiKeyClient, type RegisteredApiKeyClient } from '@/lib/api/gateway';
+import { listSpaces, type Space } from '@/lib/api/spaces';
 
 interface RegisterApiKeyClientModalProps {
   onClose: () => void;
@@ -26,11 +27,23 @@ export function RegisterApiKeyClientModal({
   onRegistered,
 }: RegisterApiKeyClientModalProps) {
   const [name, setName] = useState('');
+  const [lockedSpaceId, setLockedSpaceId] = useState('');
+  const [spaces, setSpaces] = useState<Space[]>([]);
   const [isSubmitting, setIsSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [result, setResult] = useState<RegisteredApiKeyClient | null>(null);
   const [copied, setCopied] = useState(false);
 
+  useEffect(() => {
+    listSpaces()
+      .then(setSpaces)
+      .catch(() => setSpaces([]));
+  }, []);
+
+  const lockedSpaceName = result?.lockedSpaceId
+    ? (spaces.find((s) => s.id === result.lockedSpaceId)?.name ?? 'a Space')
+    : null;
+
   const handleGenerate = async () => {
     const trimmed = name.trim();
     if (!trimmed) {
@@ -40,7 +53,7 @@ export function RegisterApiKeyClientModal({
     setIsSubmitting(true);
     setError(null);
     try {
-      const client = await registerApiKeyClient(trimmed);
+      const client = await registerApiKeyClient(trimmed, lockedSpaceId || null);
       setResult(client);
     } catch (e) {
       setError(e instanceof Error ? e.message : String(e));
@@ -130,6 +143,13 @@ export function RegisterApiKeyClientModal({
                 <code className="block break-all font-mono text-xs text-[rgb(var(--text))]">
                   Authorization: Bearer {result.keyPrefix}…
                 </code>
+                {lockedSpaceName && (
+                  <p className="mt-2 flex items-center gap-1.5 text-xs text-[rgb(var(--muted))]">
+                    <Lock className="h-3.5 w-3.5" />
+                    Locked to <span className="font-medium">{lockedSpaceName}</span> — this key can
+                    only ever reach that Space.
+                  </p>
+                )}
               </div>
 
               <div className="flex justify-end">
@@ -159,6 +179,30 @@ export function RegisterApiKeyClientModal({
                 />
               </div>
 
+              <div>
+                <label htmlFor="api-key-lock-space" className="mb-1.5 block text-sm font-medium">
+                  Lock to a Space <span className="text-[rgb(var(--muted))]">(optional)</span>
+                </label>
+                <select
+                  id="api-key-lock-space"
+                  data-testid="register-api-key-lock-space"
+                  value={lockedSpaceId}
+                  onChange={(e) => setLockedSpaceId(e.target.value)}
+                  className="w-full rounded-xl border border-[rgb(var(--border))] bg-[rgb(var(--surface))] px-3.5 py-2.5 text-sm transition-all focus:border-[rgb(var(--accent))] focus:outline-none focus:ring-2 focus:ring-[rgb(var(--accent))]/40"
+                >
+                  <option value="">No lock — route by mapping (any Space)</option>
+                  {spaces.map((s) => (
+                    <option key={s.id} value={s.id}>
+                      {s.name}
+                    </option>
+                  ))}
+                </select>
+                <p className="mt-1.5 text-xs text-[rgb(var(--muted))]">
+                  Locking confines this client to one Space — a leaked key can never reach the
+                  others. Leave unlocked to route it later from the Workspaces tab.
+                </p>
+              </div>
+
               <div className="flex items-start gap-3 rounded-xl border border-[rgb(var(--border-subtle))] bg-[rgb(var(--surface))] p-3.5">
                 <ShieldCheck className="mt-0.5 h-5 w-5 flex-shrink-0 text-[rgb(var(--accent))]" />
                 <p className="text-xs text-[rgb(var(--muted))]">

apps/desktop/src/lib/api/gateway.ts

@@ -350,6 +350,7 @@ export async function revokeOAuthClientFeatureSet(
 export interface RegisteredApiKeyClient {
   clientId: string;
   clientName: string;
+  lockedSpaceId: string | null;
   /** The full key — shown once; afterwards only its hash is kept. */
   apiKey: string;
   keyPrefix: string;
@@ -366,11 +367,14 @@ export interface ApiKeyInfo {
 }
 
 /**
- * Register a pre-approved client authenticated by an API key. The returned key
- * is shown once and never retrievable again.
+ * Register a pre-approved client authenticated by an API key, optionally locked
+ * to a space. The returned key is shown once and never retrievable again.
  */
-export async function registerApiKeyClient(name: string): Promise<RegisteredApiKeyClient> {
-  return invoke('register_api_key_client', { name });
+export async function registerApiKeyClient(
+  name: string,
+  lockedSpaceId?: string | null
+): Promise<RegisteredApiKeyClient> {
+  return invoke('register_api_key_client', { name, lockedSpaceId: lockedSpaceId ?? null });
 }
 
 /** Issue an additional API key for an existing client (rotation). Shown once. */

crates/mcpmux-storage/src/repositories/inbound_client_repository.rs

@@ -707,6 +707,36 @@ impl InboundClientRepository {
         Ok(())
     }
 
+    /// Set (or clear, with `None`) the Space a client is locked to. A locked
+    /// client is confined to that Space during resolution (see the gateway
+    /// FeatureSet resolver).
+    pub async fn set_locked_space(&self, client_id: &str, space_id: Option<&str>) -> Result<()> {
+        let now = chrono::Utc::now().to_rfc3339();
+        let db = self.db.lock().await;
+        let conn = db.connection();
+        conn.execute(
+            "UPDATE inbound_clients SET locked_space_id = ?1, updated_at = ?2 WHERE client_id = ?3",
+            params![space_id, now, client_id],
+        )?;
+        Ok(())
+    }
+
+    /// The Space a client is locked to, if any.
+    pub async fn get_locked_space(&self, client_id: &str) -> Result<Option<String>> {
+        let db = self.db.lock().await;
+        let conn = db.connection();
+        let result = conn.query_row(
+            "SELECT locked_space_id FROM inbound_clients WHERE client_id = ?1",
+            params![client_id],
+            |r| r.get::<_, Option<String>>(0),
+        );
+        match result {
+            Ok(v) => Ok(v),
+            Err(rusqlite::Error::QueryReturnedNoRows) => Ok(None),
+            Err(e) => Err(e.into()),
+        }
+    }
+
     /// Save a token record
     pub async fn save_token(&self, record: &TokenRecord) -> Result<()> {
         let db = self.db.lock().await;