Split MCP and approval agent keys

2026-06-24 10:31:52 +00:00
parent d739f17393
commit 5922aea68f
16 changed files with 471 additions and 56 deletions
@@ -476,6 +476,38 @@ async fn rejects_initialize_without_platform_api_key() {
    assert_eq!(response.status(), reqwest::StatusCode::UNAUTHORIZED);
 }

+#[tokio::test]
+async fn rejects_initialize_with_approval_platform_api_key() {
+    let registry = test_registry().await;
+    publish_agent_with_bindings(&registry, "sales-approval-key", vec![]).await;
+    let api_key =
+        create_approval_platform_api_key(&registry, "sales-approval-key", "approval-only").await;
+    let base_url = spawn_mcp_server(build_test_app(
+        registry,
+        Duration::from_millis(0),
+        Some("https://crank.example.com".to_owned()),
+    ))
+    .await;
+    let client = reqwest::Client::new();
+    let response = client
+        .post(agent_mcp_url(&base_url, "sales-approval-key"))
+        .header(header::ACCEPT, "application/json, text/event-stream")
+        .header(header::AUTHORIZATION, format!("Bearer {api_key}"))
+        .json(&json!({
+            "jsonrpc": "2.0",
+            "id": 1,
+            "method": "initialize",
+            "params": {
+                "protocolVersion": "2025-11-25"
+            }
+        }))
+        .send()
+        .await
+        .unwrap();
+
+    assert_eq!(response.status(), reqwest::StatusCode::UNAUTHORIZED);
+}
+
 #[tokio::test]
 async fn rejects_tool_call_with_read_only_platform_api_key() {
    let registry = test_registry().await;