OrgTJWater/next-tjwater-server
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(server): integrate MCP queries and investigation messaging

Browse Source 
Add project-bound OAuth MCP queries and controlled analysis with scoped evidence,
limits, timeouts and a nearby-model spatial query using EPSG:4326 inputs.
Default nearby searches to 200 meters and five results.

Integrate investigation messaging/presentation, health/readiness and typed history;
remove duplicate web search and fix online simulation and compressed baseline writes.
Include project migrations 023-025; keep local credentials and demo seeding excluded.

Validation: 319 focused pytest checks; real PostGIS temporary-table regression;
read-only Jinqian bridge radius comparison; cross-language MCP discovery/calls.
This commit is contained in:
jiang
2026-10-19 18:46:58 +08:00
parent 2b6fc5aa52
commit be6317eb48
117 changed files with 12703 additions and 638 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/auth/test_keycloak_dependencies.py
+18
View File
@@ -71,3 +71,21 @@ def test_decode_keycloak_token_accepts_a_recent_token(
)
assert _decode_keycloak_token("recent") == {"iat": 1_000, "sub": "subject"}
@pytest.mark.parametrize("claims", [
{"aud": "tjwater-mcp"}, {"aud": ["account", "tjwater-mcp"]},
{"azp": "tjwater-agent-mcp"},
])
@pytest.mark.parametrize("host_client_id", ["agent-mcp", "tjwater-agent-mcp"])
def test_product_rest_rejects_mcp_resource_tokens_even_without_api_audience(monkeypatch, claims, host_client_id):
monkeypatch.setattr(keycloak_dependencies.mcp_resource_settings, "audience", "tjwater-mcp")
monkeypatch.setattr(keycloak_dependencies.mcp_resource_settings, "host_client_id", host_client_id)
if "azp" in claims:
claims = {**claims, "azp": host_client_id}
monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_PUBLIC_KEY", "public-key")
monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_AUDIENCE", "")
monkeypatch.setattr(keycloak_dependencies.settings, "KEYCLOAK_ACCESS_TOKEN_MAX_AGE_SECONDS", 0)
monkeypatch.setattr(keycloak_dependencies.jwt, "decode", lambda *args, **kwargs: claims)
with pytest.raises(keycloak_dependencies.JWTError):
_decode_keycloak_token("resource-token")