feat: harden gateway with policy engine, secure tools, and governance docs

tests/test_server.py

@@ -22,8 +22,10 @@ def mock_env(monkeypatch):
     """Set up test environment."""
     monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
     monkeypatch.setenv("GITEA_TOKEN", "test-gitea-token-12345")
+    monkeypatch.setenv("ENVIRONMENT", "test")
     monkeypatch.setenv("AUTH_ENABLED", "true")
     monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
+    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")
 
 
 @pytest.fixture
@@ -31,8 +33,10 @@ def mock_env_auth_disabled(monkeypatch):
     """Set up test environment with auth disabled."""
     monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
     monkeypatch.setenv("GITEA_TOKEN", "test-gitea-token-12345")
+    monkeypatch.setenv("ENVIRONMENT", "test")
     monkeypatch.setenv("AUTH_ENABLED", "false")
     monkeypatch.setenv("MCP_API_KEYS", "")
+    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")
 
 
 @pytest.fixture
@@ -72,6 +76,13 @@ def test_health_endpoint(client):
     assert data["status"] == "healthy"
 
 
+def test_metrics_endpoint(client):
+    """Metrics endpoint should be available for observability."""
+    response = client.get("/metrics")
+    assert response.status_code == 200
+    assert "aegis_http_requests_total" in response.text
+
+
 def test_health_endpoint_no_auth_required(client):
     """Test that health check doesn't require authentication."""
     response = client.get("/health")
@@ -169,6 +180,22 @@ def test_call_nonexistent_tool(client):
     assert "not found" in data["detail"].lower()
 
 
+def test_write_tool_denied_by_default_policy(client):
+    """Write tools must be denied when write mode is disabled."""
+    response = client.post(
+        "/mcp/tool/call",
+        headers={"Authorization": f"Bearer {'a' * 64}"},
+        json={
+            "tool": "create_issue",
+            "arguments": {"owner": "acme", "repo": "demo", "title": "test"},
+        },
+    )
+
+    assert response.status_code == 403
+    data = response.json()
+    assert "policy denied" in data["detail"].lower()
+
+
 def test_sse_endpoint_without_auth(client):
     """Test that SSE endpoint requires authentication."""
     response = client.get("/mcp/sse")