? logFailure = null)
{
ArgumentException.ThrowIfNullOrWhiteSpace(baseDirectory);
diff --git a/src/McpServer.Support.Mcp/Web/PairingHtml.cs b/src/McpServer.Support.Mcp/Web/PairingHtml.cs
index ab9bb098..0fdd04b4 100644
--- a/src/McpServer.Support.Mcp/Web/PairingHtml.cs
+++ b/src/McpServer.Support.Mcp/Web/PairingHtml.cs
@@ -1,3 +1,5 @@
+using System.Net;
+
namespace McpServer.Support.Mcp.Web;
///
@@ -6,12 +8,12 @@ namespace McpServer.Support.Mcp.Web;
///
internal static class PairingHtml
{
- /// Renders the login form. Shows an error banner when is true.
- public static string LoginPage(bool error = false)
+ /// Renders the login form. Shows an error banner when is not empty.
+ public static string LoginPage(string? errorMessage = null)
{
- var errorBanner = error
- ? "Invalid username or password.
"
- : "";
+ var errorBanner = string.IsNullOrWhiteSpace(errorMessage)
+ ? string.Empty
+ : $"{WebUtility.HtmlEncode(errorMessage)}
";
return $$"""
diff --git a/src/McpServer.Support.Mcp/Web/PairingHtmlRenderer.cs b/src/McpServer.Support.Mcp/Web/PairingHtmlRenderer.cs
index f853f7fb..4a17da86 100644
--- a/src/McpServer.Support.Mcp/Web/PairingHtmlRenderer.cs
+++ b/src/McpServer.Support.Mcp/Web/PairingHtmlRenderer.cs
@@ -1,3 +1,5 @@
+using System.Net;
+
namespace McpServer.Support.Mcp.Web;
///
@@ -26,12 +28,12 @@ public PairingHtmlRenderer(Services.IPromptTemplateService templateService, ILog
_logger = logger;
}
- /// Renders the login form page. Shows an error banner when is true.
- public async Task RenderLoginPageAsync(bool error = false, CancellationToken cancellationToken = default)
+ /// Renders the login form page. Shows an error banner when is not empty.
+ public async Task RenderLoginPageAsync(string? errorMessage = null, CancellationToken cancellationToken = default)
{
- var errorBanner = error
- ? "Invalid username or password.
"
- : "";
+ var errorBanner = string.IsNullOrWhiteSpace(errorMessage)
+ ? string.Empty
+ : $"{WebUtility.HtmlEncode(errorMessage)}
";
var template = await GetTemplateContentAsync(LoginPageId, cancellationToken).ConfigureAwait(false);
if (template is not null)
@@ -39,7 +41,7 @@ public async Task RenderLoginPageAsync(bool error = false, CancellationT
return template.Replace("{errorBanner}", errorBanner, StringComparison.Ordinal);
}
- return PairingHtml.LoginPage(error);
+ return PairingHtml.LoginPage(errorMessage);
}
/// Renders the API key display page.
diff --git a/src/McpServer.Support.Mcp/appsettings.yaml b/src/McpServer.Support.Mcp/appsettings.yaml
index 9b2d2b27..be3f9617 100644
--- a/src/McpServer.Support.Mcp/appsettings.yaml
+++ b/src/McpServer.Support.Mcp/appsettings.yaml
@@ -47,6 +47,10 @@ Mcp:
RepoAllowlist:
- src/McpServer.Cqrs/**/*.cs
- src/McpServer.Cqrs.Mvvm/**/*.cs
+ DesktopLaunch:
+ Enabled: false
+ AccessToken: ''
+ AllowedExecutables: []
GraphRag:
Enabled: true
EnhanceContextSearch: true
@@ -109,8 +113,8 @@ Mcp:
Url: http://localhost:8000
IngestUrl: http://localhost:8000/api/v1/ingest
StreamName: mcp
- Username: admin
- Password: admin
+ Username: ''
+ Password: ''
FallbackLogPath: logs/mcp-.log
PairingUsers: []
Workspaces:
diff --git a/tests/McpServer.Client.Tests/DesktopClientTests.cs b/tests/McpServer.Client.Tests/DesktopClientTests.cs
index 7d554d5f..e6a60327 100644
--- a/tests/McpServer.Client.Tests/DesktopClientTests.cs
+++ b/tests/McpServer.Client.Tests/DesktopClientTests.cs
@@ -59,4 +59,31 @@ public async Task LaunchAsync_PostsStructuredDesktopLaunchRequest()
Assert.Contains("\"windowStyle\":\"Hidden\"", handler.LastRequestBody!);
Assert.Contains("\"waitForExit\":true", handler.LastRequestBody!);
}
+
+ ///
+ /// FR-MCP-047/TR-MCP-DESKTOP-001: Verifies that forwards the
+ /// optional privileged desktop-launch token as the dedicated HTTP header for the desktop
+ /// endpoint only.
+ /// The test uses the existing so the outbound headers can be
+ /// inspected without contacting a live MCP server.
+ ///
+ [Fact]
+ public async Task LaunchAsync_WhenDesktopLaunchTokenConfigured_AddsDesktopLaunchHeader()
+ {
+ var handler = new MockHttpHandler(HttpStatusCode.OK, """{"success":true,"processId":4242,"exitCode":0}""");
+ using var http = new HttpClient(handler);
+ var client = new DesktopClient(
+ http,
+ new McpServerClientOptions
+ {
+ ApiKey = "test-key",
+ BaseUrl = new Uri("http://localhost:7147"),
+ DesktopLaunchToken = "desktop-secret"
+ });
+
+ await client.LaunchAsync(new DesktopLaunchRequest { ExecutablePath = @"C:\Windows\System32\cmd.exe" });
+
+ Assert.True(handler.LastRequest!.Headers.TryGetValues("X-Desktop-Launch-Token", out var values));
+ Assert.Equal("desktop-secret", Assert.Single(values));
+ }
}
diff --git a/tests/McpServer.Client.Tests/TodoClientTests.cs b/tests/McpServer.Client.Tests/TodoClientTests.cs
index 3b4ac346..2f90676c 100644
--- a/tests/McpServer.Client.Tests/TodoClientTests.cs
+++ b/tests/McpServer.Client.Tests/TodoClientTests.cs
@@ -91,6 +91,69 @@ public async System.Threading.Tasks.Task GetAuditAsync_SendsCorrectUrl()
Assert.Equal("Before", result.Entries[0].PreviousSnapshot?.Title);
}
+ [Fact]
+ public async System.Threading.Tasks.Task GetProjectionStatusAsync_SendsCorrectUrl()
+ {
+ var handler = new MockHttpHandler(
+ HttpStatusCode.OK,
+ """
+ {
+ "authoritativeStore": "sqlite",
+ "authoritativeDataSource": "E:\\todo.db",
+ "projectionTargetPath": "E:\\docs\\Project\\TODO.yaml",
+ "projectionTargetExists": true,
+ "projectionConsistent": true,
+ "repairRequired": false,
+ "verifiedAtUtc": "2026-03-21T00:00:00Z",
+ "lastProjectedToYamlUtc": "2026-03-21T00:00:00Z",
+ "message": "TODO.yaml matches authoritative SQLite state."
+ }
+ """);
+ using var http = new HttpClient(handler);
+ var client = new TodoClient(http, DefaultOptions);
+
+ var result = await client.GetProjectionStatusAsync();
+
+ Assert.Equal("sqlite", result.AuthoritativeStore);
+ Assert.True(result.ProjectionConsistent);
+ Assert.False(result.RepairRequired);
+ Assert.Equal(HttpMethod.Get, handler.LastRequest!.Method);
+ Assert.Contains("/mcpserver/todo/projection/status", handler.LastRequest.RequestUri!.AbsolutePath);
+ }
+
+ [Fact]
+ public async System.Threading.Tasks.Task RepairProjectionAsync_PostsCorrectUrl()
+ {
+ var handler = new MockHttpHandler(
+ HttpStatusCode.OK,
+ """
+ {
+ "success": true,
+ "error": null,
+ "status": {
+ "authoritativeStore": "sqlite",
+ "authoritativeDataSource": "E:\\todo.db",
+ "projectionTargetPath": "E:\\docs\\Project\\TODO.yaml",
+ "projectionTargetExists": true,
+ "projectionConsistent": true,
+ "repairRequired": false,
+ "verifiedAtUtc": "2026-03-21T00:01:00Z",
+ "message": "TODO.yaml matches authoritative SQLite state."
+ }
+ }
+ """);
+ using var http = new HttpClient(handler);
+ var client = new TodoClient(http, DefaultOptions);
+
+ var result = await client.RepairProjectionAsync();
+
+ Assert.True(result.Success);
+ Assert.NotNull(result.Status);
+ Assert.True(result.Status.ProjectionConsistent);
+ Assert.Equal(HttpMethod.Post, handler.LastRequest!.Method);
+ Assert.Contains("/mcpserver/todo/projection/repair", handler.LastRequest.RequestUri!.AbsolutePath);
+ }
+
[Fact]
public async System.Threading.Tasks.Task CreateAsync_PostsJsonBody()
{
diff --git a/tests/McpServer.McpAgent.Tests/McpHostedAgentAdapterTests.cs b/tests/McpServer.McpAgent.Tests/McpHostedAgentAdapterTests.cs
index 992f0c57..e52e64a3 100644
--- a/tests/McpServer.McpAgent.Tests/McpHostedAgentAdapterTests.cs
+++ b/tests/McpServer.McpAgent.Tests/McpHostedAgentAdapterTests.cs
@@ -277,7 +277,7 @@ public async Task Registration_Functions_RepoOperations_ReuseExistingRepoClient(
[Fact]
public async Task Registration_Functions_DesktopLaunch_ReusesExistingDesktopClient()
{
- var (hostedAgent, handler) = CreateHostedAgent();
+ var (hostedAgent, handler) = CreateHostedAgent("desktop-secret");
var launchFunction = hostedAgent.Registration.Functions.Single(static function =>
function.Name == "mcp_desktop_launch");
@@ -303,6 +303,7 @@ public async Task Registration_Functions_DesktopLaunch_ReusesExistingDesktopClie
Assert.Single(handler.Requests);
Assert.Equal(HttpMethod.Post, handler.Requests[0].Method);
Assert.Equal("/mcpserver/desktop/launch", handler.Requests[0].RequestUri.AbsolutePath);
+ Assert.Equal("desktop-secret", handler.Requests[0].DesktopLaunchToken);
using var requestBody = JsonDocument.Parse(handler.Requests[0].Body!);
Assert.Equal(@"C:\Windows\System32\cmd.exe", requestBody.RootElement.GetProperty("executablePath").GetString());
@@ -416,7 +417,7 @@ public async Task PowerShellSessions_ExecuteInteractiveCommand_PreservesHostLoca
Assert.Empty(handler.Requests);
}
- private static (McpHostedAgent HostedAgent, RecordingMcpHttpMessageHandler Handler) CreateHostedAgent()
+ private static (McpHostedAgent HostedAgent, RecordingMcpHttpMessageHandler Handler) CreateHostedAgent(string? desktopLaunchToken = null)
{
var handler = new RecordingMcpHttpMessageHandler();
var httpClient = new HttpClient(handler);
@@ -426,6 +427,7 @@ private static (McpHostedAgent HostedAgent, RecordingMcpHttpMessageHandler Handl
{
ApiKey = "test-key",
BaseUrl = new Uri("http://localhost:7147"),
+ DesktopLaunchToken = desktopLaunchToken,
WorkspacePath = @"E:\github\McpServer",
});
var timeProvider = new FixedTimeProvider(new DateTimeOffset(2026, 03, 09, 15, 01, 05, TimeSpan.Zero));
@@ -434,6 +436,7 @@ private static (McpHostedAgent HostedAgent, RecordingMcpHttpMessageHandler Handl
{
ApiKey = "test-key",
BaseUrl = new Uri("http://localhost:7147"),
+ DesktopLaunchToken = desktopLaunchToken,
SourceType = "Codex",
WorkspacePath = @"E:\github\McpServer",
});
@@ -498,7 +501,11 @@ protected override async Task SendAsync(HttpRequestMessage
? null
: await request.Content.ReadAsStringAsync(cancellationToken).ConfigureAwait(false);
- Requests.Add(new RecordedRequest(request.Method, request.RequestUri!, body));
+ var desktopLaunchToken = request.Headers.TryGetValues("X-Desktop-Launch-Token", out var tokenValues)
+ ? tokenValues.SingleOrDefault()
+ : null;
+
+ Requests.Add(new RecordedRequest(request.Method, request.RequestUri!, body, desktopLaunchToken));
return request.RequestUri!.AbsolutePath switch
{
@@ -632,10 +639,12 @@ private static HttpResponseMessage CreateDesktopLaunchResponse() => CreateJsonRe
/// The emitted HTTP method.
/// The emitted request URI.
/// The serialized request body, when present.
+ /// The privileged desktop-launch header, when present.
private sealed record RecordedRequest(
HttpMethod Method,
Uri RequestUri,
- string? Body);
+ string? Body,
+ string? DesktopLaunchToken);
///
/// TEST-MCP-089: Provides a deterministic clock for the hosted-agent adapter tests.
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/ApiKeyEndpointTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/ApiKeyEndpointTests.cs
new file mode 100644
index 00000000..776506ab
--- /dev/null
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/ApiKeyEndpointTests.cs
@@ -0,0 +1,33 @@
+using System.Net;
+using Xunit;
+
+namespace McpServer.Support.Mcp.IntegrationTests.Controllers;
+
+/// TR-PLANNED-013: Integration tests for the default API-key issuance endpoint.
+public sealed class ApiKeyEndpointTests : IClassFixture
+{
+ private readonly CustomWebApplicationFactory _factory;
+
+ public ApiKeyEndpointTests(CustomWebApplicationFactory factory)
+ {
+ _factory = factory;
+ }
+
+ /// GET /api-key returns 429 after the fixed window issuance limit is exhausted.
+ [Fact]
+ public async Task GetApiKey_AfterPermitLimit_ReturnsTooManyRequests()
+ {
+ using var client = _factory.CreateClient();
+
+ for (var i = 0; i < 30; i++)
+ {
+ using var response = await client.GetAsync(new Uri("/api-key", UriKind.Relative)).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.OK, response.StatusCode);
+ }
+
+ using var throttled = await client.GetAsync(new Uri("/api-key", UriKind.Relative)).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.TooManyRequests, throttled.StatusCode);
+ Assert.True(throttled.Headers.TryGetValues("Retry-After", out var values));
+ Assert.NotEmpty(values);
+ }
+}
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/DesktopControllerTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/DesktopControllerTests.cs
index 1d81de5f..8b5182be 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/DesktopControllerTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/DesktopControllerTests.cs
@@ -19,6 +19,8 @@ namespace McpServer.Support.Mcp.IntegrationTests.Controllers;
///
public sealed class DesktopControllerTests
{
+ private const string DesktopLaunchToken = "desktop-launch-test-token";
+
///
/// FR-MCP-047/TR-MCP-DESKTOP-001: Verifies that POST /mcpserver/desktop/launch
/// returns the normalized launcher result and forwards the structured launch payload to the
@@ -35,7 +37,9 @@ public async Task Launch_ReturnsOkAndNormalizedResult()
.Returns(Task.FromResult(new ProcessRunResult(0, """{"success":true,"processId":4242,"exitCode":0}""", null)));
var launcherPath = Environment.ProcessPath
- ?? Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "cmd.exe");
+ ?? throw new InvalidOperationException("Expected the integration test host to expose an executable path.");
+ var workingDirectory = Path.GetDirectoryName(launcherPath)
+ ?? throw new InvalidOperationException("Expected a launcher working directory.");
using var factory = new CustomWebApplicationFactory(
services =>
@@ -45,19 +49,23 @@ public async Task Launch_ReturnsOkAndNormalizedResult()
},
new Dictionary
{
- ["Mcp:LauncherPath"] = launcherPath
+ ["Mcp:LauncherPath"] = launcherPath,
+ ["Mcp:DesktopLaunch:Enabled"] = "true",
+ ["Mcp:DesktopLaunch:AccessToken"] = DesktopLaunchToken,
+ ["Mcp:DesktopLaunch:AllowedExecutables:0"] = $"**/{Path.GetFileName(launcherPath)}"
});
var client = factory.CreateClient();
TestAuthHelper.AddAuthHeader(client, factory.Services);
+ client.DefaultRequestHeaders.Add("X-Desktop-Launch-Token", DesktopLaunchToken);
var response = await client.PostAsJsonAsync(
new Uri("/mcpserver/desktop/launch", UriKind.Relative),
new DesktopLaunchRequest
{
- ExecutablePath = @"C:\Windows\System32\cmd.exe",
+ ExecutablePath = launcherPath,
Arguments = "/c exit 0",
- WorkingDirectory = @"C:\Windows\System32",
+ WorkingDirectory = workingDirectory,
EnvironmentVariables = new Dictionary { ["TEST_ENV"] = "true" },
CreateNoWindow = true,
WindowStyle = "Hidden",
@@ -76,7 +84,7 @@ await processRunner.Received(1).RunAsync(
launcherPath,
Arg.Is(arguments =>
arguments != null
- && arguments.Contains("cmd.exe", StringComparison.Ordinal)
+ && arguments.Contains(Path.GetFileName(launcherPath), StringComparison.Ordinal)
&& arguments.Contains("TEST_ENV", StringComparison.Ordinal)
&& arguments.Contains("Hidden", StringComparison.Ordinal)),
Arg.Any());
@@ -99,4 +107,42 @@ public async Task Launch_WithoutBody_ReturnsBadRequest()
Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
}
+
+ ///
+ /// FR-MCP-047/TR-MCP-DESKTOP-001: Verifies that the HTTP desktop-launch endpoint rejects
+ /// authenticated workspace-key callers that do not also present the privileged desktop-launch
+ /// token header.
+ /// The test uses the real HTTP pipeline plus a substituted process runner so the stronger
+ /// authorization tier can be asserted without starting any local desktop program.
+ ///
+ [Fact]
+ public async Task Launch_WithoutDesktopLaunchToken_ReturnsForbidden()
+ {
+ var launcherPath = Environment.ProcessPath
+ ?? throw new InvalidOperationException("Expected the integration test host to expose an executable path.");
+ var processRunner = Substitute.For();
+ using var factory = new CustomWebApplicationFactory(
+ services =>
+ {
+ services.RemoveAll();
+ services.AddSingleton(processRunner);
+ },
+ new Dictionary
+ {
+ ["Mcp:LauncherPath"] = launcherPath,
+ ["Mcp:DesktopLaunch:Enabled"] = "true",
+ ["Mcp:DesktopLaunch:AccessToken"] = DesktopLaunchToken,
+ ["Mcp:DesktopLaunch:AllowedExecutables:0"] = $"**/{Path.GetFileName(launcherPath)}"
+ });
+
+ var client = factory.CreateClient();
+ TestAuthHelper.AddAuthHeader(client, factory.Services);
+
+ var response = await client.PostAsJsonAsync(
+ new Uri("/mcpserver/desktop/launch", UriKind.Relative),
+ new DesktopLaunchRequest { ExecutablePath = launcherPath }).ConfigureAwait(true);
+
+ Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+ await processRunner.DidNotReceive().RunAsync(Arg.Any(), Arg.Any(), Arg.Any());
+ }
}
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/Http500ErrorContractTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/Http500ErrorContractTests.cs
index a8fec020..ef323682 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/Http500ErrorContractTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/Http500ErrorContractTests.cs
@@ -240,6 +240,10 @@ public sealed class PassThroughTodoService : ITodoService
public Task GetByIdAsync(string id, CancellationToken cancellationToken) => _inner.GetByIdAsync(id, cancellationToken);
public Task GetAuditAsync(string id, int limit = 50, int offset = 0, CancellationToken cancellationToken = default)
=> _inner.GetAuditAsync(id, limit, offset, cancellationToken);
+ public Task GetProjectionStatusAsync(CancellationToken cancellationToken = default)
+ => _inner.GetProjectionStatusAsync(cancellationToken);
+ public Task RepairProjectionAsync(CancellationToken cancellationToken = default)
+ => _inner.RepairProjectionAsync(cancellationToken);
public Task CreateAsync(TodoCreateRequest request, CancellationToken cancellationToken) => Task.FromResult(new TodoMutationResult(true, null, new TodoFlatItem { Id = request.Id, Title = request.Title, Section = request.Section, Priority = request.Priority, Done = false }));
public Task UpdateAsync(string id, TodoUpdateRequest request, CancellationToken cancellationToken) => _inner.UpdateAsync(id, request, cancellationToken);
public Task DeleteAsync(string id, CancellationToken cancellationToken) => _inner.DeleteAsync(id, cancellationToken);
@@ -261,6 +265,10 @@ public Task QueryAsync(TodoQueryRequest request, CancellationTo
public Task GetByIdAsync(string id, CancellationToken cancellationToken) => _inner.GetByIdAsync(id, cancellationToken);
public Task GetAuditAsync(string id, int limit = 50, int offset = 0, CancellationToken cancellationToken = default)
=> _inner.GetAuditAsync(id, limit, offset, cancellationToken);
+ public Task GetProjectionStatusAsync(CancellationToken cancellationToken = default)
+ => _inner.GetProjectionStatusAsync(cancellationToken);
+ public Task RepairProjectionAsync(CancellationToken cancellationToken = default)
+ => _inner.RepairProjectionAsync(cancellationToken);
public Task CreateAsync(TodoCreateRequest request, CancellationToken cancellationToken) => _inner.CreateAsync(request, cancellationToken);
public Task UpdateAsync(string id, TodoUpdateRequest request, CancellationToken cancellationToken) => _inner.UpdateAsync(id, request, cancellationToken);
public Task DeleteAsync(string id, CancellationToken cancellationToken)
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MarkerRegenerationIntegrationTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MarkerRegenerationIntegrationTests.cs
index 4de683e5..6a8bf98f 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MarkerRegenerationIntegrationTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MarkerRegenerationIntegrationTests.cs
@@ -76,7 +76,7 @@ public ValueTask InitializeAsync()
// FileSystemWatcher on appsettings.json — fires when config writes complete.
_settingsWatcher = new FileSystemWatcher(_workspacePath, "appsettings.json")
{
- NotifyFilter = NotifyFilters.LastWrite | NotifyFilters.Size,
+ NotifyFilter = NotifyFilters.LastWrite | NotifyFilters.Size | NotifyFilters.CreationTime | NotifyFilters.FileName,
EnableRaisingEvents = true,
};
@@ -202,18 +202,28 @@ public async Task GlobalAndWorkspacePrompts_CombineInMarkerFile()
///
/// Returns a that completes when appsettings.json is written.
- /// The releases the latch on the first event.
+ /// The releases the latch on the first change/create/rename event so
+ /// atomic temp-file replace writes are observed deterministically.
///
private Task WatchForSettingsChange()
{
var tcs = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
FileSystemEventHandler? handler = null;
- handler = (_, _) =>
+ RenamedEventHandler? renamedHandler = null;
+
+ void Complete()
{
_settingsWatcher.Changed -= handler;
+ _settingsWatcher.Created -= handler;
+ _settingsWatcher.Renamed -= renamedHandler;
tcs.TrySetResult();
- };
+ }
+
+ handler = (_, _) => Complete();
+ renamedHandler = (_, _) => Complete();
_settingsWatcher.Changed += handler;
+ _settingsWatcher.Created += handler;
+ _settingsWatcher.Renamed += renamedHandler;
// Guard against the write completing before the handler was attached.
var cts = new CancellationTokenSource(TimeSpan.FromSeconds(10));
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/McpTransportMultiTenantTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/McpTransportMultiTenantTests.cs
index 4ed98c52..9298bbc9 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/McpTransportMultiTenantTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/McpTransportMultiTenantTests.cs
@@ -81,4 +81,34 @@ public async Task McpTransport_WithoutWorkspaceHeader_UsesDefaultWorkspace()
var body = await response.Content.ReadAsStringAsync();
Assert.Contains("serverInfo", body, StringComparison.Ordinal);
}
+
+ [Fact]
+ public async Task McpTransport_BearerWithoutWorkspaceHeader_Returns404()
+ {
+ var initRequest = new
+ {
+ jsonrpc = "2.0",
+ id = 1,
+ method = "initialize",
+ @params = new
+ {
+ protocolVersion = "2025-03-26",
+ capabilities = new { },
+ clientInfo = new { name = "test-client-bearer", version = "1.0.0" }
+ }
+ };
+
+ using var request = new HttpRequestMessage(HttpMethod.Post, "/mcp-transport");
+ request.Content = new StringContent(
+ JsonSerializer.Serialize(initRequest),
+ Encoding.UTF8,
+ "application/json");
+ request.Headers.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("application/json"));
+ request.Headers.Accept.Add(new System.Net.Http.Headers.MediaTypeWithQualityHeaderValue("text/event-stream"));
+ request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "synthetic-jwt");
+
+ var response = await _client.SendAsync(request);
+
+ Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+ }
}
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MultiTenantIntegrationTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MultiTenantIntegrationTests.cs
index f11c4de7..700420b1 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MultiTenantIntegrationTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/MultiTenantIntegrationTests.cs
@@ -119,6 +119,17 @@ public async Task NoHeaders_NoApiKey_Returns401()
}
}
+ [Fact]
+ public async Task BearerWithoutWorkspaceHeader_OnTenantRoute_Returns404()
+ {
+ var client = _factory.CreateClient();
+ client.DefaultRequestHeaders.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", "synthetic-jwt");
+
+ var response = await client.GetAsync(new Uri("/mcpserver/sessionlog/query", UriKind.Relative));
+
+ Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
+ }
+
[Fact]
public async Task WorkspaceResolutionMiddleware_OnlyRunsForMcpRoutes()
{
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/PairingEndpointTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/PairingEndpointTests.cs
index b8cc0801..2b460b3f 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/PairingEndpointTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/PairingEndpointTests.cs
@@ -44,6 +44,43 @@ public async Task PairPost_WithBadCredentials_ShowsError()
Assert.Contains("Invalid username or password", body, StringComparison.Ordinal);
}
+ [Fact]
+ public async Task PairPost_AfterRepeatedFailures_ReturnsTooManyRequests()
+ {
+ await using var factory = new PairingWebApplicationFactory();
+ using var client = factory.CreateClient(new Microsoft.AspNetCore.Mvc.Testing.WebApplicationFactoryClientOptions
+ {
+ AllowAutoRedirect = false,
+ });
+
+ for (var i = 0; i < 5; i++)
+ {
+ using var failedAttempt = new FormUrlEncodedContent(
+ [
+ new KeyValuePair("username", "admin"),
+ new KeyValuePair("password", "wrong"),
+ ]);
+
+ var failedResponse = await client.PostAsync("/pair", failedAttempt).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.OK, failedResponse.StatusCode);
+ }
+
+ using var lockedAttempt = new FormUrlEncodedContent(
+ [
+ new KeyValuePair("username", "admin"),
+ new KeyValuePair("password", "testpass"),
+ ]);
+
+ var response = await client.PostAsync("/pair", lockedAttempt).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.TooManyRequests, response.StatusCode);
+ Assert.True(response.Headers.TryGetValues("Retry-After", out var retryAfterValues));
+ Assert.NotEmpty(retryAfterValues);
+
+ var body = await response.Content.ReadAsStringAsync().ConfigureAwait(true);
+ Assert.Contains("Too many failed sign-in attempts", body, StringComparison.Ordinal);
+ Assert.False(response.Headers.TryGetValues("Set-Cookie", out _));
+ }
+
[Fact]
public async Task PairPost_WithGoodCredentials_RedirectsToKey()
{
diff --git a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/TodoControllerTests.cs b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/TodoControllerTests.cs
index f7674ff6..358650ec 100644
--- a/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/TodoControllerTests.cs
+++ b/tests/McpServer.Support.Mcp.IntegrationTests/Controllers/TodoControllerTests.cs
@@ -157,6 +157,29 @@ public async Task Create_ThenGetById_ReturnsCreatedItem()
Assert.Equal("Remaining from create", item.Remaining);
}
+ /// POST /mcpserver/todo with the default /api-key token returns 403 Forbidden.
+ [Fact]
+ public async Task Create_WithDefaultApiKey_ReturnsForbidden()
+ {
+ using var client = _factory.CreateClient();
+ var tokenService = _factory.Services.GetRequiredService();
+ var config = _factory.Services.GetRequiredService();
+ var defaultToken = tokenService.GetDefaultToken(config["Mcp:RepoRoot"]!)
+ ?? throw new InvalidOperationException("Workspace default API key was not generated for test host.");
+ client.DefaultRequestHeaders.TryAddWithoutValidation("X-Api-Key", defaultToken);
+
+ var createRequest = new
+ {
+ id = "DEFAULT-TODO-001",
+ title = "Default key write should fail",
+ section = "mvp-app",
+ priority = "low"
+ };
+
+ var response = await client.PostAsJsonAsync(new Uri("/mcpserver/todo", UriKind.Relative), createRequest).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+ }
+
/// POST /mcpserver/todo with duplicate id returns 400 Bad Request.
[Fact]
public async Task Create_DuplicateId_ReturnsConflict()
@@ -268,12 +291,90 @@ public async Task AuditEndpoint_AfterCreateUpdateDelete_ReturnsOrderedHistory()
Assert.Equal("Audit item", entry.PreviousSnapshot?.Title);
},
entry =>
+ {
+ Assert.Equal(3, entry.Version);
+ Assert.Equal("deleted", entry.Action);
+ Assert.Equal("Audit item updated", entry.Snapshot?.Title);
+ Assert.Equal("Audit item updated", entry.PreviousSnapshot?.Title);
+ });
+ }
+
+ ///
+ /// TR-MCP-TODO-006: Verifies that a real mutation-time projection failure remains visible through the
+ /// REST API while the SQLite-authoritative item is still committed and the repair endpoint can rebuild
+ /// TODO.yaml afterward. The fixture temporarily replaces the projected TODO.yaml file with a directory
+ /// so create fails deterministically without compromising the authoritative SQLite store.
+ ///
+ [Fact]
+ public async Task ProjectionEndpoints_AfterMutationProjectionFailure_ReportAndRepairAuthoritativeState()
+ {
+ var yamlPath = _factory.TodoYamlPath;
+ Assert.True(File.Exists(yamlPath));
+
+ File.Delete(yamlPath);
+ Directory.CreateDirectory(yamlPath);
+
+ try
+ {
+ var createRequest = new
{
- Assert.Equal(3, entry.Version);
- Assert.Equal("deleted", entry.Action);
- Assert.Equal("Audit item updated", entry.Snapshot?.Title);
- Assert.Equal("Audit item updated", entry.PreviousSnapshot?.Title);
- });
+ id = "INT-PROJ-001",
+ title = "Projection failure integration",
+ section = "mvp-app",
+ priority = "high"
+ };
+
+ var createResponse = await _client.PostAsJsonAsync(new Uri("/mcpserver/todo", UriKind.Relative), createRequest).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.InternalServerError, createResponse.StatusCode);
+
+ var createResult = await createResponse.Content.ReadFromJsonAsync().ConfigureAwait(true);
+ Assert.NotNull(createResult);
+ Assert.False(createResult.Success);
+ Assert.Equal("ProjectionFailed", createResult.FailureKind);
+
+ var getResponse = await _client.GetAsync(new Uri("/mcpserver/todo/INT-PROJ-001", UriKind.Relative)).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.OK, getResponse.StatusCode);
+
+ var statusResponse = await _client.GetAsync(new Uri("/mcpserver/todo/projection/status", UriKind.Relative)).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.OK, statusResponse.StatusCode);
+
+ var status = await statusResponse.Content.ReadFromJsonAsync().ConfigureAwait(true);
+ Assert.NotNull(status);
+ Assert.True(status.RepairRequired);
+ Assert.False(status.ProjectionTargetExists);
+ Assert.False(status.ProjectionConsistent);
+ Assert.Contains("directory", status.Message ?? string.Empty, StringComparison.OrdinalIgnoreCase);
+
+ Directory.Delete(yamlPath, recursive: true);
+
+ var repairResponse = await _client.PostAsync(new Uri("/mcpserver/todo/projection/repair", UriKind.Relative), content: null).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.OK, repairResponse.StatusCode);
+
+ var repair = await repairResponse.Content.ReadFromJsonAsync().ConfigureAwait(true);
+ Assert.NotNull(repair);
+ Assert.True(repair.Success);
+ Assert.NotNull(repair.Status);
+ Assert.False(repair.Status.RepairRequired);
+ Assert.True(repair.Status.ProjectionTargetExists);
+ Assert.True(repair.Status.ProjectionConsistent);
+ Assert.True(File.Exists(yamlPath));
+
+ var repairedStatusResponse = await _client.GetAsync(new Uri("/mcpserver/todo/projection/status", UriKind.Relative)).ConfigureAwait(true);
+ Assert.Equal(HttpStatusCode.OK, repairedStatusResponse.StatusCode);
+
+ var repairedStatus = await repairedStatusResponse.Content.ReadFromJsonAsync().ConfigureAwait(true);
+ Assert.NotNull(repairedStatus);
+ Assert.False(repairedStatus.RepairRequired);
+ Assert.True(repairedStatus.ProjectionConsistent);
+ }
+ finally
+ {
+ if (Directory.Exists(yamlPath))
+ Directory.Delete(yamlPath, recursive: true);
+
+ if (!File.Exists(yamlPath))
+ await _client.PostAsync(new Uri("/mcpserver/todo/projection/repair", UriKind.Relative), content: null).ConfigureAwait(true);
+ }
}
/// DELETE /mcpserver/todo/{id} for missing item returns 404.
@@ -480,7 +581,21 @@ public async Task Update_WithCircularDependency_ReturnsNotFound()
Assert.Contains("Circular", result.Error ?? "", StringComparison.OrdinalIgnoreCase);
}
- private sealed record MutationResult(bool Success, string? Error);
+ private sealed record MutationResult(bool Success, string? Error, string? FailureKind = null);
+ private sealed record ProjectionStatusResult(
+ string AuthoritativeStore,
+ string AuthoritativeDataSource,
+ string ProjectionTargetPath,
+ bool ProjectionTargetExists,
+ bool ProjectionConsistent,
+ bool RepairRequired,
+ string VerifiedAtUtc,
+ string? LastImportedFromYamlUtc,
+ string? LastProjectedToYamlUtc,
+ string? LastProjectionFailureUtc,
+ string? LastProjectionFailure,
+ string? Message);
+ private sealed record ProjectionRepairResult(bool Success, string? Error, ProjectionStatusResult Status);
#region Test DTOs (for deserialization)
@@ -516,12 +631,14 @@ public sealed class TodoWebFactory : WebApplicationFactory, ID
{
private readonly string _tempDir = Path.Combine(Path.GetTempPath(), "mcp-todo-tests-" + Guid.NewGuid().ToString("N")[..8]);
+ public string TodoYamlPath => Path.Combine(_tempDir, "docs", "Project", "TODO.yaml");
+
protected override void ConfigureWebHost(IWebHostBuilder builder)
{
// Create seed TODO.yaml
var projectDir = Path.Combine(_tempDir, "docs", "Project");
Directory.CreateDirectory(projectDir);
- File.WriteAllText(Path.Combine(projectDir, "TODO.yaml"), SeedYaml);
+ File.WriteAllText(TodoYamlPath, SeedYaml);
builder.UseEnvironment("Test");
builder.UseContentRoot(CustomWebApplicationFactory.ResolveContentRoot());
diff --git a/tests/McpServer.Support.Mcp.Tests/Controllers/GitHubControllerTests.cs b/tests/McpServer.Support.Mcp.Tests/Controllers/GitHubControllerTests.cs
new file mode 100644
index 00000000..e0a2abe8
--- /dev/null
+++ b/tests/McpServer.Support.Mcp.Tests/Controllers/GitHubControllerTests.cs
@@ -0,0 +1,89 @@
+using McpServer.Support.Mcp.Controllers;
+using McpServer.Support.Mcp.Options;
+using McpServer.Support.Mcp.Services;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging.Abstractions;
+using Microsoft.Extensions.Options;
+using NSubstitute;
+using Xunit;
+
+namespace McpServer.Support.Mcp.Tests.Controllers;
+
+///
+/// TEST-MCP-GH-006: Validates GitHub controller boundary hardening for state and close-reason query
+/// parameters so only canonical values reach and the gh CLI layer.
+///
+public sealed class GitHubControllerTests
+{
+ ///
+ /// TEST-MCP-GH-006: Verifies that invalid close reasons are rejected at the controller boundary before
+ /// the GitHub CLI service is invoked, preventing query-string flag injection in issue-close requests.
+ ///
+ [Fact]
+ public async Task CloseIssueAsync_WithInvalidReason_ReturnsBadRequest()
+ {
+ var gitHubCliService = Substitute.For();
+ var controller = CreateController(gitHubCliService);
+
+ var result = await controller.CloseIssueAsync(42, "completed --repo other/repo", CancellationToken.None).ConfigureAwait(true);
+
+ Assert.IsType(result.Result);
+ await gitHubCliService.DidNotReceive().CloseIssueAsync(Arg.Any(), Arg.Any(), Arg.Any()).ConfigureAwait(true);
+ }
+
+ ///
+ /// TEST-MCP-GH-006: Verifies that list-state query parameters are normalized to canonical lowercase
+ /// values before forwarding them to the GitHub CLI service, preventing raw user input from reaching gh.
+ ///
+ [Fact]
+ public async Task ListIssuesAsync_WithMixedCaseState_NormalizesBeforeCallingService()
+ {
+ var gitHubCliService = Substitute.For();
+ gitHubCliService.ListIssuesAsync("open", 30, Arg.Any())
+ .Returns(new GitHubIssueListResult(true, null, Array.Empty()));
+
+ var controller = CreateController(gitHubCliService);
+ var result = await controller.ListIssuesAsync(" Open ", 30, CancellationToken.None).ConfigureAwait(true);
+
+ Assert.IsType(result.Result);
+ await gitHubCliService.Received(1).ListIssuesAsync("open", 30, Arg.Any()).ConfigureAwait(true);
+ }
+
+ ///
+ /// TEST-MCP-GH-006: Verifies that invalid list-state query parameters are rejected before the GitHub CLI
+ /// service is invoked, blocking raw multi-token input from being incorporated into gh list commands.
+ ///
+ [Fact]
+ public async Task ListPullsAsync_WithInvalidState_ReturnsBadRequest()
+ {
+ var gitHubCliService = Substitute.For();
+ var controller = CreateController(gitHubCliService);
+
+ var result = await controller.ListPullsAsync("open --repo other/repo", 30, CancellationToken.None).ConfigureAwait(true);
+
+ Assert.IsType(result.Result);
+ await gitHubCliService.DidNotReceive().ListPullsAsync(Arg.Any(), Arg.Any(), Arg.Any()).ConfigureAwait(true);
+ }
+
+ private static GitHubController CreateController(IGitHubCliService gitHubCliService)
+ {
+ var tokenStore = Substitute.For();
+ var gitHubOptions = Substitute.For>();
+ gitHubOptions.CurrentValue.Returns(new GitHubIntegrationOptions());
+
+ return new GitHubController(
+ gitHubCliService,
+ tokenStore,
+ gitHubOptions,
+ syncService: null,
+ eventBus: null,
+ logger: NullLogger.Instance)
+ {
+ ControllerContext = new ControllerContext
+ {
+ HttpContext = new DefaultHttpContext()
+ }
+ };
+ }
+}
diff --git a/tests/McpServer.Support.Mcp.Tests/Controllers/TodoControllerTests.cs b/tests/McpServer.Support.Mcp.Tests/Controllers/TodoControllerTests.cs
index 1862cc88..6a489b1a 100644
--- a/tests/McpServer.Support.Mcp.Tests/Controllers/TodoControllerTests.cs
+++ b/tests/McpServer.Support.Mcp.Tests/Controllers/TodoControllerTests.cs
@@ -167,6 +167,90 @@ public async Task DeleteAsync_WhenProjectionFails_ReturnsInternalServerError()
Assert.Equal(TodoMutationFailureKind.ProjectionFailed, mutation.FailureKind);
}
+ ///
+ /// TR-MCP-TODO-006: Verifies that GET /mcpserver/todo/projection/status returns the service-provided
+ /// projection status payload when the active TODO provider supports SQLite projection diagnostics.
+ /// The fixture supplies a fully-populated status result so the controller's success shaping can be asserted.
+ ///
+ [Fact]
+ public async Task GetProjectionStatusAsync_WhenSupported_ReturnsOk()
+ {
+ var todoService = Substitute.For();
+ todoService.GetProjectionStatusAsync(Arg.Any())
+ .Returns(new TodoProjectionStatusResult(
+ "sqlite",
+ "E:\\todo.db",
+ "E:\\docs\\Project\\TODO.yaml",
+ true,
+ true,
+ false,
+ "2026-03-21T00:00:00.0000000Z",
+ LastProjectedToYamlUtc: "2026-03-21T00:00:00.0000000Z",
+ Message: "TODO.yaml matches authoritative SQLite state."));
+
+ var controller = CreateController(todoService);
+ var actionResult = await controller.GetProjectionStatusAsync(CancellationToken.None).ConfigureAwait(true);
+
+ var ok = Assert.IsType(actionResult.Result);
+ var status = Assert.IsType(ok.Value);
+ Assert.False(status.RepairRequired);
+ Assert.True(status.ProjectionConsistent);
+ }
+
+ ///
+ /// TR-MCP-TODO-006: Verifies that GET /mcpserver/todo/projection/status returns 501 when the active TODO
+ /// provider does not support SQLite projection diagnostics. The fixture uses a thrown
+ /// to exercise the controller's compatibility path.
+ ///
+ [Fact]
+ public async Task GetProjectionStatusAsync_WhenNotSupported_ReturnsNotImplemented()
+ {
+ var todoService = Substitute.For();
+ todoService.GetProjectionStatusAsync(Arg.Any())
+ .Returns(_ => Task.FromException(
+ new NotSupportedException("Projection status requires sqlite-backed TODO storage.")));
+
+ var controller = CreateController(todoService);
+ var actionResult = await controller.GetProjectionStatusAsync(CancellationToken.None).ConfigureAwait(true);
+
+ var objectResult = Assert.IsType(actionResult.Result);
+ Assert.Equal(StatusCodes.Status501NotImplemented, objectResult.StatusCode);
+ }
+
+ ///
+ /// TR-MCP-TODO-006: Verifies that POST /mcpserver/todo/projection/repair returns HTTP 500 when the
+ /// service reports an unsuccessful repair attempt. The fixture returns a failed repair result so the
+ /// controller can preserve the service's operator-visible error details.
+ ///
+ [Fact]
+ public async Task RepairProjectionAsync_WhenRepairFails_ReturnsInternalServerError()
+ {
+ var todoService = Substitute.For();
+ todoService.RepairProjectionAsync(Arg.Any())
+ .Returns(new TodoProjectionRepairResult(
+ false,
+ "repair failed",
+ new TodoProjectionStatusResult(
+ "sqlite",
+ "E:\\todo.db",
+ "E:\\docs\\Project\\TODO.yaml",
+ false,
+ false,
+ true,
+ "2026-03-21T00:00:00.0000000Z",
+ LastProjectionFailure: "Directory exists at projection target.",
+ Message: "Projected TODO target 'E:\\docs\\Project\\TODO.yaml' is a directory instead of a file.")));
+
+ var controller = CreateController(todoService);
+ var actionResult = await controller.RepairProjectionAsync(CancellationToken.None).ConfigureAwait(true);
+
+ var objectResult = Assert.IsType