quick fix

tests/test_server.py

@@ -5,6 +5,7 @@ from fastapi.testclient import TestClient
 
 from aegis_gitea_mcp.auth import reset_validator
 from aegis_gitea_mcp.config import reset_settings
+from aegis_gitea_mcp.gitea_client import GiteaAuthenticationError, GiteaAuthorizationError
 
 
 @pytest.fixture(autouse=True)
@@ -238,3 +239,50 @@ def test_rate_limiting(client):
     # Last response should mention rate limiting
     data = response.json()
     assert "Too many failed" in data["message"]
+
+
+@pytest.mark.asyncio
+async def test_startup_event_fails_with_authentication_guidance(monkeypatch):
+    """Startup validation should fail with explicit auth guidance on 401."""
+    monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
+    monkeypatch.setenv("GITEA_TOKEN", "test-gitea-token-12345")
+    monkeypatch.setenv("ENVIRONMENT", "production")
+    monkeypatch.setenv("AUTH_ENABLED", "true")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
+    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "true")
+
+    from aegis_gitea_mcp import server
+
+    async def raise_auth_error(*_args, **_kwargs):
+        raise GiteaAuthenticationError("Authentication failed - check bot token")
+
+    monkeypatch.setattr(server.GiteaClient, "get_current_user", raise_auth_error)
+
+    with pytest.raises(
+        RuntimeError, match=r"Startup validation failed: Gitea authentication was rejected"
+    ):
+        await server.startup_event()
+
+
+@pytest.mark.asyncio
+async def test_startup_event_fails_with_authorization_guidance(monkeypatch):
+    """Startup validation should fail with explicit permission guidance on 403."""
+    monkeypatch.setenv("GITEA_URL", "https://gitea.example.com")
+    monkeypatch.setenv("GITEA_TOKEN", "test-gitea-token-12345")
+    monkeypatch.setenv("ENVIRONMENT", "production")
+    monkeypatch.setenv("AUTH_ENABLED", "true")
+    monkeypatch.setenv("MCP_API_KEYS", "a" * 64)
+    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "true")
+
+    from aegis_gitea_mcp import server
+
+    async def raise_authorization_error(*_args, **_kwargs):
+        raise GiteaAuthorizationError("Bot user lacks permission for this operation")
+
+    monkeypatch.setattr(server.GiteaClient, "get_current_user", raise_authorization_error)
+
+    with pytest.raises(
+        RuntimeError,
+        match=r"Startup validation failed: Gitea token lacks permission for /api/v1/user",
+    ):
+        await server.startup_event()