mcp: throttle rapid stream session polls

2026-05-01 16:36:50 +00:00
parent 8ac55ebcc2
commit 4cd5d5b132
3 changed files with 182 additions and 1 deletions
@@ -1455,6 +1455,112 @@ mod tests {
        );
    }

+    #[tokio::test]
+    async fn rejects_rapid_repeat_session_poll() {
+        let registry = test_registry().await;
+        let server_addr = grpc_test_support::spawn_unary_echo_server().await;
+        let operation = test_grpc_session_operation(&server_addr, "echo_stream_session_rate");
+
+        registry
+            .create_operation(&test_workspace_id(), &operation, Some("alice"))
+            .await
+            .unwrap();
+        registry
+            .publish_operation(PublishRequest {
+                workspace_id: &test_workspace_id(),
+                operation_id: &operation.id,
+                version: 1,
+                published_at: &OffsetDateTime::parse("2026-03-26T10:00:00Z", &Rfc3339).unwrap(),
+                published_by: Some("alice"),
+            })
+            .await
+            .unwrap();
+
+        publish_agent_for_operation(&registry, &operation, "sales-session-rate").await;
+        let api_key = create_platform_api_key(
+            &registry,
+            "mcp-session-rate",
+            &[PlatformApiKeyScope::Read, PlatformApiKeyScope::Write],
+        )
+        .await;
+
+        let base_url = spawn_mcp_server(build_test_app(
+            registry,
+            Duration::from_millis(0),
+            Some("https://crank.example.com".to_owned()),
+        ))
+        .await;
+        let client = reqwest::Client::new();
+        let mcp_url = agent_mcp_url(&base_url, "sales-session-rate");
+        let initialized_session = initialize_session(&client, &mcp_url, &api_key).await;
+
+        let start_response = post_jsonrpc(
+            &client,
+            &mcp_url,
+            &api_key,
+            Some(&initialized_session),
+            json!({
+                "jsonrpc": "2.0",
+                "id": 1,
+                "method": "tools/call",
+                "params": {
+                    "name": "echo_stream_session_rate_start",
+                    "arguments": { "message": "hello" }
+                }
+            }),
+        )
+        .await;
+        let session_id = start_response["result"]["structuredContent"]["session_id"]
+            .as_str()
+            .unwrap()
+            .to_owned();
+
+        let first_poll = post_jsonrpc(
+            &client,
+            &mcp_url,
+            &api_key,
+            Some(&initialized_session),
+            json!({
+                "jsonrpc": "2.0",
+                "id": 2,
+                "method": "tools/call",
+                "params": {
+                    "name": "echo_stream_session_rate_poll",
+                    "arguments": { "session_id": session_id }
+                }
+            }),
+        )
+        .await;
+        assert_eq!(first_poll["result"]["isError"], false);
+
+        let second_poll = post_jsonrpc(
+            &client,
+            &mcp_url,
+            &api_key,
+            Some(&initialized_session),
+            json!({
+                "jsonrpc": "2.0",
+                "id": 3,
+                "method": "tools/call",
+                "params": {
+                    "name": "echo_stream_session_rate_poll",
+                    "arguments": { "session_id": session_id }
+                }
+            }),
+        )
+        .await;
+
+        assert_eq!(
+            second_poll["result"]["structuredContent"]["error"]["code"],
+            json!("stream_session_poll_rate_limited")
+        );
+        let poll_after_ms =
+            second_poll["result"]["structuredContent"]["error"]["context"]["poll_after_ms"]
+                .as_u64()
+                .unwrap();
+        assert!((1..=250).contains(&poll_after_ms));
+    }
+
    #[tokio::test]
    async fn rejects_cross_agent_async_job_access() {
        let registry = test_registry().await;