Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

tests/test_wp145_projects.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+from services.control_api.catalog.loader import CatalogLoader
+
+ROOT = Path(__file__).resolve().parents[1]
+PROJECTS = ("ludarium", "vacatureradar", "forgeflow", "geointel", "devrunbook")
+LOCAL_ROOTS = {
+    "ludarium": Path(r"C:\Projects\Ludarium"),
+    "vacatureradar": Path(r"C:\Projects\VacatureRadar"),
+    "forgeflow": Path(r"C:\Projects\ForgeFlow"),
+    "geointel": Path(r"C:\Projects\geointel"),
+    "devrunbook": Path(r"C:\Projects\DevRunbook"),
+}
+
+
+def catalog(slug: str) -> dict:
+    return json.loads((ROOT / "catalog/projects" / f"{slug}.yaml").read_text(encoding="utf-8"))
+
+
+def test_all_known_projects_have_deny_first_scoped_virtual_servers() -> None:
+    report = CatalogLoader(ROOT / "catalog").load()
+    assert report.valid, report.issues
+    assert {catalog(slug)["metadata"]["slug"] for slug in PROJECTS} == set(PROJECTS)
+    for slug in PROJECTS:
+        document = catalog(slug)
+        servers = document["spec"]["virtualServers"]
+        assert servers
+        for server in servers:
+            assert server["endpointAlias"] == f"/mcp/{slug}/{server['environment']}"
+            assert server["defaultDecision"] == "deny"
+            assert any(
+                pattern.startswith(f"itworx-project://{slug}/")
+                for pattern in server["resourceAllowPatterns"]
+            )
+            assert all(
+                slug not in pattern or pattern.startswith(("itworx-project://", "itworx-docs://"))
+                for pattern in server["resourceAllowPatterns"]
+            )
+        assert (
+            "project-reader" in document["spec"]["capabilityPacks"]
+            or slug == "general-infrastructure"
+        )
+
+
+def test_local_sources_are_evidence_backed_and_remote_mappings_are_not_guessed() -> None:
+    inventory = json.loads(
+        (ROOT / "evidence/WP-145/ONBOARDING_INVENTORY.json").read_text(encoding="utf-8")
+    )
+    assert {item["project"] for item in inventory} == set(PROJECTS)
+    for item in inventory:
+        root = Path(item["localRoot"])
+        assert root == LOCAL_ROOTS[item["project"]]
+        assert item["gitPresent"] is True
+        assert item["sourceChecks"]["readme"] is True
+        assert item["sourceChecks"]["docs"] is True
+        assert item["knowledgeSourceMapping"] == "verified-local-filesystem"
+        assert item["repositoryMapping"] == "external-input-required"
+        assert item["giteaSmoke"] == "external-input-required"
+        assert item["unraidSmoke"] == "external-input-required"
+    assert catalog("forgeflow")["spec"]["repository"]["exposeMetadata"] == "never-public"
+
+
+def test_project_connector_visibility_is_explicitly_scoped() -> None:
+    for slug in PROJECTS:
+        bindings = catalog(slug)["spec"]["connectorBindings"]
+        refs = {binding["ref"] for binding in bindings}
+        assert "knowledge-default" in refs
+        assert all(binding["environments"] for binding in bindings)
+        assert all(
+            binding["verification"]
+            in {"verified", "external-input-required", "unverified", "fake-only"}
+            for binding in bindings
+        )
+        for server in catalog(slug)["spec"]["virtualServers"]:
+            patterns = server["toolAllowPatterns"]
+            assert "project.status.get" in patterns
+            assert "knowledge.*" in patterns
+            assert not any(
+                pattern.startswith("*") and "project" not in pattern for pattern in patterns
+            )