feat: harden gateway with policy engine, secure tools, and governance docs

tests/test_config.py

@@ -3,7 +3,7 @@
 import pytest
 from pydantic import ValidationError
 
-from aegis_gitea_mcp.config import Settings, get_settings, reset_settings
+from aegis_gitea_mcp.config import get_settings, reset_settings
 
 
 def test_settings_from_env(mock_env: None) -> None:
@@ -12,7 +12,7 @@ def test_settings_from_env(mock_env: None) -> None:
 
     assert settings.gitea_base_url == "https://gitea.example.com"
     assert settings.gitea_token == "test-token-12345"
-    assert settings.mcp_host == "0.0.0.0"
+    assert settings.mcp_host == "127.0.0.1"
     assert settings.mcp_port == 8080
     assert settings.log_level == "DEBUG"
 
@@ -21,10 +21,11 @@ def test_settings_defaults(monkeypatch: pytest.MonkeyPatch) -> None:
     """Test default values when not specified."""
     monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
     monkeypatch.setenv("GITEA_TOKEN", "test-token")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
 
     settings = get_settings()
 
-    assert settings.mcp_host == "0.0.0.0"
+    assert settings.mcp_host == "127.0.0.1"
     assert settings.mcp_port == 8080
     assert settings.log_level == "INFO"
     assert settings.max_file_size_bytes == 1_048_576
@@ -33,7 +34,6 @@ def test_settings_defaults(monkeypatch: pytest.MonkeyPatch) -> None:
 
 def test_settings_validation_missing_required(monkeypatch: pytest.MonkeyPatch, tmp_path) -> None:
     """Test that missing required fields raise validation errors."""
-    import os
 
     monkeypatch.delenv("GITEA_URL", raising=False)
     monkeypatch.delenv("GITEA_TOKEN", raising=False)
@@ -51,6 +51,7 @@ def test_settings_invalid_log_level(monkeypatch: pytest.MonkeyPatch) -> None:
     """Test that invalid log levels are rejected."""
     monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
     monkeypatch.setenv("GITEA_TOKEN", "test-token")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
     monkeypatch.setenv("LOG_LEVEL", "INVALID")
 
     reset_settings()
@@ -63,6 +64,7 @@ def test_settings_empty_token(monkeypatch: pytest.MonkeyPatch) -> None:
     """Test that empty tokens are rejected."""
     monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
     monkeypatch.setenv("GITEA_TOKEN", "   ")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
 
     reset_settings()
 
@@ -70,7 +72,7 @@ def test_settings_empty_token(monkeypatch: pytest.MonkeyPatch) -> None:
         get_settings()
 
 
-def test_settings_singleton() -> None:
+def test_settings_singleton(mock_env: None) -> None:
     """Test that get_settings returns same instance."""
     settings1 = get_settings()
     settings2 = get_settings()