fix(l7): harden json-rpc frame handling

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

crates/openshell-supervisor-network/data/sandbox-policy.rego

@@ -278,6 +278,8 @@ request_denied_for_endpoint(request, endpoint) if {
 # --- L7 deny rule matching: JSON-RPC method + params ---
 
 request_denied_for_endpoint(request, endpoint) if {
+	endpoint.protocol == "json-rpc"
+	request.method == "POST"
 	some deny_rule
 	deny_rule := endpoint.deny_rules[_]
 	deny_rule.rpc_method
@@ -445,6 +447,8 @@ request_allowed_for_endpoint(request, endpoint) if {
 # --- L7 rule matching: JSON-RPC method ---
 
 request_allowed_for_endpoint(request, endpoint) if {
+	endpoint.protocol == "json-rpc"
+	request.method == "POST"
 	some rule
 	rule := endpoint.rules[_]
 	rule.allow.rpc_method
@@ -460,6 +464,8 @@ request_allowed_for_endpoint(request, endpoint) if {
 	request.method == "GET"
 	is_object(request.jsonrpc)
 	jsonrpc_no_parse_error(request.jsonrpc)
+	object.get(request.jsonrpc, "method", null) == null
+	not object.get(request.jsonrpc, "has_response", false)
 }
 
 # --- L7 rule matching: GraphQL operation ---

crates/openshell-supervisor-network/src/l7/jsonrpc.rs

@@ -177,15 +177,21 @@ fn parse_jsonrpc_message(
         return Err(format!("unsupported JSON-RPC version '{version}'"));
     }
 
-    if value.get("method").is_some() {
-        return parse_jsonrpc_call(value).map(JsonRpcMessageInfo::Call);
+    let has_method = value.get("method").is_some();
+    let has_response_payload = jsonrpc_response_payload_present(value);
+    if has_method && has_response_payload {
+        return Err("JSON-RPC message includes both method and result/error".to_string());
     }
 
-    if jsonrpc_response_payload_present(value) {
+    if has_response_payload {
         parse_jsonrpc_response(value)?;
         return Ok(JsonRpcMessageInfo::Response);
     }
 
+    if has_method {
+        return parse_jsonrpc_call(value).map(JsonRpcMessageInfo::Call);
+    }
+
     Err("missing or non-string 'method' field".to_string())
 }
 
@@ -484,6 +490,41 @@ mod tests {
         );
     }
 
+    #[test]
+    fn rejects_message_with_method_and_result_or_error() {
+        let result_body = br#"{"jsonrpc":"2.0","id":1,"method":"initialize","result":{}}"#;
+        let result_info = parse_jsonrpc_body(result_body);
+        assert!(result_info.calls.is_empty());
+        assert_eq!(
+            result_info.error.as_deref(),
+            Some("JSON-RPC message includes both method and result/error")
+        );
+
+        let error_body = br#"{"jsonrpc":"2.0","id":1,"method":"initialize","error":{"code":-32603,"message":"failed"}}"#;
+        let error_info = parse_jsonrpc_body(error_body);
+        assert!(error_info.calls.is_empty());
+        assert_eq!(
+            error_info.error.as_deref(),
+            Some("JSON-RPC message includes both method and result/error")
+        );
+    }
+
+    #[test]
+    fn rejects_batch_item_with_method_and_result() {
+        let body = br#"[
+            {"jsonrpc":"2.0","id":1,"method":"tools/list"},
+            {"jsonrpc":"2.0","id":2,"method":"initialize","result":{}}
+        ]"#;
+        let info = parse_jsonrpc_body(body);
+
+        assert!(info.calls.is_empty());
+        assert!(info.is_batch);
+        assert_eq!(
+            info.error.as_deref(),
+            Some("batch item invalid: JSON-RPC message includes both method and result/error")
+        );
+    }
+
     #[test]
     fn params_digest_is_canonical_and_redacted() {
         let first = parse_jsonrpc_body(

crates/openshell-supervisor-network/src/opa.rs

@@ -2852,6 +2852,51 @@ network_policies:
         assert!(!eval_l7(&engine, &progress_input));
     }
 
+    #[test]
+    fn l7_jsonrpc_method_rules_require_post() {
+        let data = r#"
+network_policies:
+  jsonrpc_post:
+    name: jsonrpc_post
+    endpoints:
+      - host: mcp.post.test
+        port: 8000
+        path: /mcp
+        protocol: json-rpc
+        enforcement: enforce
+        rules:
+          - allow:
+              rpc_method: initialize
+        deny_rules:
+          - rpc_method: tools/delete
+    binaries:
+      - { path: /usr/bin/curl }
+"#;
+        let engine = OpaEngine::from_strings(TEST_POLICY, data).expect("engine from yaml");
+
+        let mut post_input = l7_jsonrpc_input_with_params(
+            "mcp.post.test",
+            8000,
+            "/mcp",
+            "initialize",
+            serde_json::json!({}),
+        );
+        assert!(eval_l7(&engine, &post_input));
+
+        post_input["request"]["method"] = serde_json::json!("PUT");
+        assert!(!eval_l7(&engine, &post_input));
+
+        let mut get_with_method = l7_jsonrpc_input_with_params(
+            "mcp.post.test",
+            8000,
+            "/mcp",
+            "initialize",
+            serde_json::json!({}),
+        );
+        get_with_method["request"]["method"] = serde_json::json!("GET");
+        assert!(!eval_l7(&engine, &get_with_method));
+    }
+
     #[test]
     fn l7_jsonrpc_params_rules_filter_tools_call() {
         let data = r#"