ewilliams28/turnstone
1
0
Fork 0
mirror of https://github.com/turnstonelabs/turnstone.git synced 2026-08-12 23:12:23 -06:00
Code Issues Packages Projects Releases Wiki Activity

test: add scope coverage for internal MCP/config reload endpoints (#75)

Browse Source 
* test: add scope coverage for internal MCP/config reload endpoints

Verify required_scope() returns "approve" for _internal endpoints
across all access patterns (bare, /v1/-prefixed, console proxy with
and without /v1/), plus a GET negative test confirming only POST is
elevated. Closes the "internal endpoints accept read scope" item in
PROGRESS.md — the endpoints were already in APPROVE_PATHS.

* test: add config-reload v1/proxy scope tests per review feedback

Add /v1/-prefixed and console proxy variants for config-reload to
match the mcp-reload coverage, as flagged by Copilot review.
This commit is contained in:
Patrick Buckley
2026-03-15 13:45:35 -07:00
committed by GitHub
parent 5f27ed9fca
commit 2e95f2ac73
1 changed files with 29 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_auth.py
+29
View File
@@ -169,6 +169,35 @@ class TestRequiredScope:
def test_admin_memory_delete_needs_approve(self):
assert required_scope("DELETE", "/api/admin/memories/some-id") == "approve"
# Internal endpoints
def test_internal_mcp_reload_needs_approve(self):
assert required_scope("POST", "/api/_internal/mcp-reload") == "approve"
def test_v1_internal_mcp_reload_needs_approve(self):
assert required_scope("POST", "/v1/api/_internal/mcp-reload") == "approve"
def test_internal_config_reload_needs_approve(self):
assert required_scope("POST", "/api/_internal/config-reload") == "approve"
def test_v1_internal_config_reload_needs_approve(self):
assert required_scope("POST", "/v1/api/_internal/config-reload") == "approve"
def test_proxy_internal_config_reload_needs_approve(self):
assert required_scope("POST", "/node/n1/v1/api/_internal/config-reload") == "approve"
def test_proxy_no_v1_internal_config_reload_needs_approve(self):
assert required_scope("POST", "/node/n1/api/_internal/config-reload") == "approve"
def test_proxy_internal_mcp_reload_needs_approve(self):
assert required_scope("POST", "/node/n1/v1/api/_internal/mcp-reload") == "approve"
def test_proxy_no_v1_internal_mcp_reload_needs_approve(self):
assert required_scope("POST", "/node/n1/api/_internal/mcp-reload") == "approve"
def test_get_internal_mcp_reload_needs_read(self):
"""Only POST is elevated — GET falls through to read."""
assert required_scope("GET", "/api/_internal/mcp-reload") == "read"
# ---------------------------------------------------------------------------
# TestAuthConfig