Amin Ghadersohi 9ca3f8ec01 fix(mcp): deny all tools on invalid credentials in search filtering ...

Split the combined except clause in _tool_allowed_for_current_user so
that PermissionError (bad API key) returns False for every tool,
matching RBACToolVisibilityMiddleware's fail-closed behaviour.
ValueError (no auth source configured) retains the existing public-tool
fallback. Adds a test to cover the new deny-all path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-20 21:49:39 +00:00

..

common

…

consts

…

example_data

…

fixtures

…

integration_tests

test(charts): regression for last-modified sort order (#27500) (#40231)

2026-05-20 11:43:19 -07:00

unit_tests

fix(mcp): deny all tools on invalid credentials in search filtering

2026-05-20 21:49:39 +00:00

__init__.py

…

conftest.py

…