fix(mcp): withhold Allow unless the consent page holds a served ceiling - #21254

The hole

Every failure of the consent page's policy read landed it on the generic "access
your account" card with Allow enabled, and the POST then succeeded. A
transient outage was enough. The page issued an MCP grant without disclosing what
the grant was worth.

Live, on origin/main, against a workspace whose real ceiling is READ_ONLY,
with only the GetMCPInfo request blocked:

Authorization Request
This application will be able to: Access your Bytebase account with your permissions
[Deny] [Allow]

That sentence is not true of any session this server issues. Every grant is an
MCP grant, and the workspace ceiling decides what one is worth.

The same refusal also killed the workspace MCP settings drawer at exactly the
moment an admin needed it — while repairing an unreadable ceiling.

Both come from one line: GetMCPInfo refused whole on
MCPCeilingUnreadable / MCPCeilingUnserved.

Why refusing was wrong

The mode contents do not come from the stored row. modes, methods and
engines are resolved from the compiled descriptors and the enforcement code,
and they are the whole reason either surface calls this method. The refusal
withheld the comparison from the one admin who has to repair the row, and left
the consent page with no policy to disclose.

(capability and ignore_masking_exemptions do come from the row — that is
what carries the state to the client. An earlier draft of this comment claimed
the response held nothing from the row at all; pre-review caught it.)

What changed

Backend. The three refusing ceilings are answered. A new OUTPUT_ONLY
MCPInfo.policy_unreadable carries the one state the number cannot, following
BOT-100's data-not-status-code precedent. It is named for the consequence: a
wrong JSON type on any field fails the whole unmarshal, so a malformed
ignore_masking_exemptions sets it over a perfectly readable capability. It is
therefore wider than MCPSetting.capability_unreadable and not interchangeable
with it — see "One field, two row shapes" below. A ceiling that parsed but no
mode serves needs no field: the number survives on capability and modes has
no row for it.

A failed read still refuses, with CodeUnavailable. It is the one verdict with
no ceiling to describe, and answering with an empty one would read as a stored
value nobody can resolve — which an admin repairs rather than a retry clearing.

Frontend. readConsentCeiling reads the response into five states, and
Allow renders in exactly one: a ceiling the server serves and this bundle can
name. The disclosure is the consent, so approving against an unnamed policy is
agreement to nothing.

The generic card is deleted rather than demoted. refuseConsentByCeiling
(backend/api/oauth2/consent_audit.go:63) runs on every allow POST, so no
non-MCP grant flow exists — the card had no producing flow and survived only as
a failure fallback.

Leaving Allow to fail server-side was not an option: only two of the four
undisclosed states also refuse the POST, and a failed read on this page says
nothing about the read the POST makes for itself.

Settings. The drawer feeds from the static half, so it works while an admin
repairs an unreadable ceiling. That is BOT-106's first half and it falls out of
the backend change; a test pins it.

Evidence

Every test below was run RED against the pre-change code first.

Live check on the running dev server, Allow counted by accessible name:

Clicking Check again in state (c) with the block lifted returns the ceiling
card and Allow, without a reload.

Gates

buf format / lint / generate · gofmt · golangci-lint run ./... → 0
issues · go build ./... · go test -p=8 -timeout 30m ./backend/... → 107
packages green · pnpm --dir frontend fix / check / type-check / test →
3832 passed.

Three later local runs each hit one flake in backend/tests — a different
test every time (TestTransactionMode, TestTenantBackfill,
TestSQLQueryStopOnError), every one failing with port "<port>/tcp" not found from testcontainers, and the two I re-ran alone both passed. Local Docker
had accumulated 66 containers against an 8.2 GB limit. The only non-comment
production change on this branch is inside GetMCPInfo's ceiling switch, which
none of those three tests reaches. Left to CI's amd64 lane, which runs this
suite in a clean container environment.
Locale keys added to all five files — 16 each, verified identical, with the
deleted generic-card keys gone from every one. The four dynamic reason prefixes
are registered in check-react-i18n.mjs.

scripts/comment-share.sh reports 33% (80 added comment lines / 159 code).
Two re-read passes cut 31 lines of prose against the three comment types; what
remains is constraints and external facts. Gross overstates it — 33 of those 79
lines replace comments this change made false (the old "GetMCPInfo refuses
outright" claims in MCPModeContentsSheet and MCPAccessPolicySection). Net
growth is +46.

The script itself had a hole and this PR's first measurement was wrong because
of it: its pathspec excluded *.test.ts but not *.test.tsx, so test comments
counted as production. Fixed in the workspace copy.

One field, two row shapes — and why it stays a bool

Codex found that this field is true for two different rows: a
capability key this build cannot resolve ("READ_ONLYY", null, ""), which
an admin repairs in the settings UI, and a value of the wrong JSON type
({}, true, 1.5, []), which fails the whole unmarshal and needs an
operator to correct the stored value. GetSetting refuses the second kind
outright, so the settings page correctly offers no Edit action for it — while
this page told the user "an admin sets the policy again". Reproduced end to end.

The defect was that sentence, not the field. policy_unreadable means
"this build cannot resolve a ceiling from the stored row", which is true of both.
Walking the consumers, nothing branches on the difference: Allow is withheld
either way, the gate/token/connection doors refuse either way, and
IsPolicy() already returns true for MCPCeilingUnreadable, so both are
already audited as policy denials. The only surface that distinguishes them is
the settings page, and it learns that from GetSetting failing, not from here.
One bit of consequence, so one bool.

Three changes rather than a new representation:

• The unreadable line is now operator-neutral — "until this workspace's MCP
  policy is repaired" — true for every row that reaches the card. Deliberately
  passive: this page cannot know which actor applies, and the previous wording
  picked the wrong one for four row shapes.
• The field is renamed policy_unreadable and its doc no longer claims it is
  the "same state, same representation" as MCPSetting.capability_unreadable.
  Codex found the old name asserts something false: given
  {"capability":"READ_ONLY","ignoreMaskingExemptions":[]} the capability is
  readable and the field is still true, because one bad field fails the whole
  unmarshal. Renaming was free — the field is unreleased.
• {}, true, 1.5, [] and two malformed-sibling rows are pinned through
  GetMCPInfo. That branch had no coverage, which is why it was missed. Mutation-checked: making the store
  stop classifying unparseable rows as unreadable fails the new subtest and
  nothing else.

A three-valued resolution enum was designed and rejected — tracked in BOT-115
with the analysis, including why mapping malformed rows onto
MCPCeilingUnavailable would have been worse (it says "Retry shortly" for a
permanent condition and drops the denial audit row).

Known limitation

Dismissing an undisclosed policy posts action=deny, and authorize.go:121
answers that before the ceiling is ever classified — so the waiting client gets
access_denied with the description "user denied the request". For the
unknown state nobody denied anything, and the same condition reached through
the POST returns temporarily_unavailable. RFC 6749 admits access_denied for
an authorization-server refusal, so this is imprecise rather than wrong, but the
description string is false and the two doors disagree. Fixing it needs the
consenting user resolved before the deny branch, which is a different mechanism
from the one this PR changes. Flagged rather than folded in.

Withholding Allow also removes the audit row those attempts used to produce:
before, an unreadable or unserved ceiling reached the POST and refuseConsent
wrote an MCPConsentApprove denial. MCPConsentDisabled already carries this
gap for the disabled screen; this extends it to two more states. Same fix, same
place.

Not in this PR

The MCPSetting etag. A provenance check found the design-doc §17 requirement
had no codebase precedent to copy and no producing flow; it is filed as BOT-113
as a settings-wide decision and is not a flip prerequisite. No flip, no isDev
change, no seed (BOT-108), no SDK work (BYT-10061), no gate/clamp/masking
changes.

Closes BOT-106.