Enforce ACLs on aggregated MCP servers

echo '
_format_version: "3.0"
plugins:
  - name: key-auth
    route: mcp-aggregation
    config:
      key_names:
      - apikey
' | deck gateway apply -

echo '
_format_version: "3.0"
consumer_groups:
  - name: gold-partner
  - name: silver-partner
  - name: bronze-partner
' | deck gateway apply -

echo '
_format_version: "3.0"
consumers:
  - username: alice
    groups:
    - name: gold-partner
    keyauth_credentials:
    - key: alice-key
  - username: bob
    groups:
    - name: silver-partner
    keyauth_credentials:
    - key: bob-key
  - username: carol
    groups:
    - name: bronze-partner
    keyauth_credentials:
    - key: carol-key
  - username: eason
    keyauth_credentials:
    - key: eason-key
' | deck gateway apply -

echo '
_format_version: "3.0"
plugins:
  - name: request-transformer-advanced
    service: weather-internet-service
    config:
      add:
        querystring:
        - key:${{ env "DECK_WEATHERAPI_API_KEY" }}
' | deck gateway apply -

echo '
_format_version: "3.0"
plugins:
  - name: ai-mcp-proxy
    route: weather-internet-mcp
    tags:
    - ai-gateway-mcp-aggregation
    config:
      mode: conversion-only
      logging:
        log_audits: true
        log_payloads: true
        log_statistics: true
      tools:
      - name: weather-internet
        description: Get current weather for a location
        method: GET
        path: "./v1/current.json"
        acl:
          allow:
          - gold-partner
          - silver-partner
          deny:
          - bronze-partner
        parameters:
        - name: q
          in: query
          required: true
          description: Location query. Accepts US Zipcode, UK Postcode, Canada Postalcode,
            IP address, latitude/longitude, or city name.
          schema:
            type: string
            default: London
' | deck gateway apply -

echo '
_format_version: "3.0"
plugins:
  - name: ai-mcp-proxy
    route: cards-api-mcp
    tags:
    - ai-gateway-mcp-aggregation
    config:
      mode: conversion-only
      logging:
        log_audits: true
        log_payloads: true
        log_statistics: true
      max_request_body_size: 16384
      tools:
      - name: shuffle-cards
        description: Shuffle a new deck of cards. Returns a deck_id to use with draw-cards.
        method: GET
        path: "/cards-api/new/shuffle/"
        acl:
          allow:
          - gold-partner
          - silver-partner
          deny:
          - bronze-partner
        parameters:
        - name: deck_count
          in: query
          required: false
          description: Number of decks to use (default 1, blackjack typically uses 6)
          schema:
            type: integer
            default: 1
      - name: draw-cards
        description: Draw cards from an existing deck. Requires a deck_id from shuffle-cards.
        method: GET
        path: "/cards-api/{deck_id}/draw/"
        acl:
          allow:
          - gold-partner
          - silver-partner
          deny:
          - bronze-partner
        parameters:
        - name: deck_id
          in: path
          required: true
          description: Deck ID returned from shuffle-cards
          schema:
            type: string
        - name: count
          in: query
          required: true
          description: Number of cards to draw
          schema:
            type: integer
            default: 1
      - name: shuffle-and-draw
        description: Create a new shuffled deck and draw cards in one request.
        method: GET
        path: "./new/draw/"
        acl:
          allow:
          - gold-partner
          - silver-partner
          deny:
          - bronze-partner
        parameters:
        - name: count
          in: query
          required: true
          description: Number of cards to draw
          schema:
            type: integer
            default: 1
' | deck gateway apply -

echo '
_format_version: "3.0"
plugins:
  - name: ai-mcp-proxy
    route: mcp-aggregation
    tags:
    - ai-gateway-mcp-aggregation
    config:
      mode: listener
      include_consumer_groups: true
      server:
        tag: ai-gateway-mcp-aggregation
        timeout: 45000
      logging:
        log_audits: true
        log_statistics: true
        log_payloads: true
      max_request_body_size: 32768
' | deck gateway apply -