From 2e95f2ac73bcdbdd4558ffaafa263d80cd87c953 Mon Sep 17 00:00:00 2001 From: Patrick Buckley Date: Sun, 15 Mar 2026 13:45:35 -0700 Subject: [PATCH] test: add scope coverage for internal MCP/config reload endpoints (#75) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * test: add scope coverage for internal MCP/config reload endpoints Verify required_scope() returns "approve" for _internal endpoints across all access patterns (bare, /v1/-prefixed, console proxy with and without /v1/), plus a GET negative test confirming only POST is elevated. Closes the "internal endpoints accept read scope" item in PROGRESS.md — the endpoints were already in APPROVE_PATHS. * test: add config-reload v1/proxy scope tests per review feedback Add /v1/-prefixed and console proxy variants for config-reload to match the mcp-reload coverage, as flagged by Copilot review. --- tests/test_auth.py | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/tests/test_auth.py b/tests/test_auth.py index 6b0338d7..cacb95ff 100644 --- a/tests/test_auth.py +++ b/tests/test_auth.py @@ -169,6 +169,35 @@ class TestRequiredScope: def test_admin_memory_delete_needs_approve(self): assert required_scope("DELETE", "/api/admin/memories/some-id") == "approve" + # Internal endpoints + def test_internal_mcp_reload_needs_approve(self): + assert required_scope("POST", "/api/_internal/mcp-reload") == "approve" + + def test_v1_internal_mcp_reload_needs_approve(self): + assert required_scope("POST", "/v1/api/_internal/mcp-reload") == "approve" + + def test_internal_config_reload_needs_approve(self): + assert required_scope("POST", "/api/_internal/config-reload") == "approve" + + def test_v1_internal_config_reload_needs_approve(self): + assert required_scope("POST", "/v1/api/_internal/config-reload") == "approve" + + def test_proxy_internal_config_reload_needs_approve(self): + assert required_scope("POST", "/node/n1/v1/api/_internal/config-reload") == "approve" + + def test_proxy_no_v1_internal_config_reload_needs_approve(self): + assert required_scope("POST", "/node/n1/api/_internal/config-reload") == "approve" + + def test_proxy_internal_mcp_reload_needs_approve(self): + assert required_scope("POST", "/node/n1/v1/api/_internal/mcp-reload") == "approve" + + def test_proxy_no_v1_internal_mcp_reload_needs_approve(self): + assert required_scope("POST", "/node/n1/api/_internal/mcp-reload") == "approve" + + def test_get_internal_mcp_reload_needs_read(self): + """Only POST is elevated — GET falls through to read.""" + assert required_scope("GET", "/api/_internal/mcp-reload") == "read" + # --------------------------------------------------------------------------- # TestAuthConfig