test: sweep every tool through the MCP server against a seeded Gitea

tests/integration/test_sweep_isolated.py

@@ -0,0 +1,43 @@
+"""Tools the generic sweep must not call because they would break the run itself."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+from mcp import Client
+
+from aegis_gitea_mcp.audit import AuditLogger
+from aegis_gitea_mcp.server import build_server
+from tests.integration.conftest import McpSession, integration_settings
+from tests.integration.harness import GiteaInstance
+from tests.integration.sweep_plan import EXCLUDED
+
+
+async def test_delete_current_token_deletes_only_a_throwaway_token(
+    gitea: GiteaInstance, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    assert set(EXCLUDED) == {"gitea_misc_delete_current_token"}
+    monkeypatch.setenv("GITEA_URL", gitea.base_url)
+    throwaway = gitea.mint_token(gitea.admin_login, gitea.admin_password, ["all"])
+    settings = integration_settings(gitea, tmp_path / "state", gitea_token=throwaway)
+    audit = AuditLogger(settings.resolved_audit_log_path)
+    try:
+        async with Client(build_server(settings, audit=audit)) as client:
+            session = McpSession(client, settings.resolved_audit_log_path)
+            current = await session.ok("gitea_misc_get_current_token")
+            assert "all" in current.data["scopes"]
+            assert gitea.api("GET", "/user", token=throwaway).status_code == 200
+
+            deleted = await session.ok("gitea_misc_delete_current_token")
+            assert deleted.data is None
+            assert throwaway not in session.audit_text()
+
+            # The token is gone: Gitea now refuses it, while the harness admin token lives on.
+            assert gitea.api("GET", "/user", token=throwaway).status_code == 401
+            assert gitea.api("GET", "/user").status_code == 200
+            again = await session.call("gitea_misc_get_current_token")
+            assert again.is_error and again.status == 401
+            assert throwaway not in again.text
+    finally:
+        audit.close()