Function TestStaticConfigEnforcement

pkg/http/handler_test.go:421–635

(t *testing.T)

}

func TestStaticConfigEnforcement(t *testing.T) {
	// Use default toolsets to match real-world behavior where repos/issues/pull_requests are defaults
	tools := []inventory.ServerTool{
		mockToolFull("get_file_contents", "repos", true, true),
		mockToolFull("create_repository", "repos", false, true),
		mockToolFull("list_issues", "issues", true, true),
		mockToolFull("create_issue", "issues", false, true),
		mockToolFull("list_pull_requests", "pull_requests", true, true),
		mockToolFull("create_pull_request", "pull_requests", false, true),
		mockToolWithFeatureFlag("hidden_by_holdback", "repos", true, "", "mcp_holdback_consolidated_projects"),
	}

	tests := []struct {
		name          string
		config        *ServerConfig
		path          string
		headers       map[string]string
		expectedTools []string
	}{
		{
			name:          "no static config preserves existing behavior",
			config:        &ServerConfig{Version: "test"},
			path:          "/",
			expectedTools: []string{"get_file_contents", "create_repository", "list_issues", "create_issue", "list_pull_requests", "create_pull_request", "hidden_by_holdback"},
		},
		{
			name:          "static read-only filters write tools",
			config:        &ServerConfig{Version: "test", ReadOnly: true},
			path:          "/",
			expectedTools: []string{"get_file_contents", "list_issues", "list_pull_requests", "hidden_by_holdback"},
		},
		{
			name:   "static read-only cannot be overridden by header",
			config: &ServerConfig{Version: "test", ReadOnly: true},
			path:   "/",
			headers: map[string]string{
				headers.MCPReadOnlyHeader: "false",
			},
			expectedTools: []string{"get_file_contents", "list_issues", "list_pull_requests", "hidden_by_holdback"},
		},
		{
			name:          "static toolsets restricts available tools",
			config:        &ServerConfig{Version: "test", EnabledToolsets: []string{"repos"}},
			path:          "/",
			expectedTools: []string{"get_file_contents", "create_repository", "hidden_by_holdback"},
		},
		{
			name:   "static toolsets cannot be expanded by header",
			config: &ServerConfig{Version: "test", EnabledToolsets: []string{"repos"}},
			path:   "/",
			headers: map[string]string{
				headers.MCPToolsetsHeader: "issues",
			},
			// Header asks for "issues" but only "repos" tools exist in the static universe
			expectedTools: []string{},
		},
		{
			name:   "per-request header can narrow within static toolset bounds",