From ec2f0c6861fee64bab85622abea4583ab3fa6683 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <peter@steipete.me>
Date: Mon, 13 Jul 2026 09:08:51 -0700
Subject: [PATCH] fix(gateway): restore session attach grant revocation
 (#106487)

---
 src/gateway/mcp-grant-store.test.ts | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/src/gateway/mcp-grant-store.test.ts b/src/gateway/mcp-grant-store.test.ts
index f739643a06dc..1d7fc6a79c0a 100644
--- a/src/gateway/mcp-grant-store.test.ts
+++ b/src/gateway/mcp-grant-store.test.ts
@@ -7,6 +7,7 @@ import {
   resolveAttachGrant,
   resolveMcpLoopbackClientGrant,
   revokeAttachGrant,
+  revokeAttachGrantsForSession,
   revokeMcpLoopbackClientGrant,
   revokeMcpLoopbackClientGrantsForRuntime,
 } from "./mcp-grant-store.js";
@@ -58,6 +59,17 @@ describe("mcp-grant-store", () => {
     expect(revokeAttachGrant(g.token)).toBe(false);
   });
 
+  it("revokes every attach grant for one session", () => {
+    const first = mintAttachGrant({ sessionKey: "agent:main:first", nowMs: T0 });
+    const second = mintAttachGrant({ sessionKey: "agent:main:first", nowMs: T0 });
+    const other = mintAttachGrant({ sessionKey: "agent:main:other", nowMs: T0 });
+
+    expect(revokeAttachGrantsForSession(" agent:main:first ")).toBe(2);
+    expect(resolveAttachGrant(first.token, T0)).toBeUndefined();
+    expect(resolveAttachGrant(second.token, T0)).toBeUndefined();
+    expect(resolveAttachGrant(other.token, T0)?.sessionKey).toBe("agent:main:other");
+  });
+
   it("clamps TTL: default for non-positive, ceiling at 12h", () => {
     const def = mintAttachGrant({ sessionKey: "s", nowMs: T0 });
     expect(def.expiresAtMs).toBe(T0 + 60 * 60 * 1000);