Requirements

Security

Requirement: All endpoints must require authentication REQ_SEC_AUTH
status: implemented
priority: high
component: Infrastructure
satisfies: FEAT_AUTH

All API endpoints (REST and MCP) must require authentication, except the /health/* probes. Development mode may bypass authentication when no Authority is configured.
Requirement: Write operations must enforce WriteAccess policy REQ_SEC_WRITE_AUTH
status: implemented
priority: high
component: Infrastructure
satisfies: FEAT_AUTH
implemented by: API_ALARMS_ACKNOWLEDGE, API_ETHERCAT_RESET_ERROR_COUNTERS, API_FILES_WRITE, API_RPC_INVOKE, API_VARIABLES_BATCH_WRITE, API_VARIABLES_WRITE

Operations that modify PLC state (variable writes, file uploads, error counter resets) must enforce the WriteAccess authorization policy (operator or admin role + ads:write scope).
Requirement: PLC access must be restricted by claims REQ_SEC_PLC_ACCESS
status: implemented
priority: high
component: Infrastructure
satisfies: FEAT_AUTH, FEAT_MULTI_PLC
implemented by: API_ALARMS_LIST_FLEET, API_ALARMS_STREAM_FLEET

Access must be restricted to the PLCs listed in the plc_access JWT claim. A token without the claim reaches no PLC, unless PlcAccessDefault is set to allow as a migration opt-in.
Requirement: Security response headers must be applied REQ_SEC_HEADERS
status: implemented
priority: medium
component: Infrastructure
satisfies: FEAT_AUTH

All responses must include security headers: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, Cache-Control, Referrer-Policy, Permissions-Policy.
Requirement: Symbol writes must be validated REQ_SEC_SYMBOL_GUARD
status: implemented
priority: high
component: Variables
satisfies: FEAT_VARIABLES
implemented by: API_VARIABLES_BATCH_WRITE, API_VARIABLES_WRITE

Write operations must be checked against the symbol guard (allowlist/denylist) before executing. Denied writes return 403.
Requirement: Value constraints must be enforced on writes REQ_SEC_VALUE_CONSTRAINTS
status: implemented
priority: medium
component: Variables
satisfies: FEAT_VARIABLES
implemented by: API_VARIABLES_BATCH_WRITE, API_VARIABLES_CONSTRAINTS, API_VARIABLES_WRITE

Variable writes must be validated against configured constraints (min/max range, enum values, regex pattern, read-only flag). Invalid writes return 400.

MCP server

Requirement: MCP endpoint must enforce authentication REQ_MCP_AUTH
status: implemented
priority: high
component: Mcp
satisfies: FEAT_MCP
implemented by: API_MCP_ENDPOINT

The /mcp endpoint must enforce the ReadAccess authorization policy. Write operations must additionally enforce WriteAccess.
Requirement: MCP must respect PLC access claims REQ_MCP_PLC_ACCESS
status: implemented
priority: high
component: Mcp
satisfies: FEAT_MCP
implemented by: API_MCP_ENDPOINT

MCP tools and resources must filter PLCs based on the plc_access JWT claim, matching the behavior of the REST API’s PlcAccessHandler.
Requirement: MCP must reuse existing service layer REQ_MCP_SERVICE_REUSE
status: implemented
priority: medium
component: Mcp
satisfies: FEAT_MCP
implemented by: SPEC_MCP_RESOURCES, SPEC_MCP_TOOLS

MCP tools must delegate to existing services (VariablesService, SymbolsService, DeviceInfoService, EtherCatService) rather than accessing ADS connections directly. This ensures rate limiting, symbol guards, and feature flags all apply.
Requirement: MCP must be feature-gated REQ_MCP_FEATURE_GATE
status: implemented
priority: medium
component: Mcp
satisfies: FEAT_FLAGS, FEAT_MCP
implemented by: API_MCP_ENDPOINT

The MCP server must be disabled by default via Features:Mcp:Enabled and must not register services or endpoints when disabled.