fix: rate limit /token and /revoke, bucket IPv6 by /64 and warn about untrusted forwarded headers (SEC-08)

tests/test_transports_startup.py

@@ -16,6 +16,7 @@ from aegis_gitea_mcp.cli import main
 from aegis_gitea_mcp.config import Settings
 from aegis_gitea_mcp.oauth import OAuthSetupError
 from aegis_gitea_mcp.transports import (
+    ForwardedHeadersMiddleware,
     HttpAuthExtras,
     http_startup_errors,
     load_oauth_components,
@@ -83,8 +84,10 @@ def test_non_loopback_bind_with_bearer_is_allowed(uvicorn_spy: UvicornSpy) -> No
     assert callable(app)
     assert kwargs["host"] == ANY_HOST
     assert kwargs["port"] == 9000
-    assert kwargs["proxy_headers"] is True
-    assert kwargs["forwarded_allow_ips"] == "127.0.0.1"
+    # Proxy headers are applied by ForwardedHeadersMiddleware, not by uvicorn.
+    assert kwargs["proxy_headers"] is False
+    assert isinstance(app, ForwardedHeadersMiddleware)
+    assert app.trusted == "127.0.0.1"
     assert kwargs["log_level"] == "info"
     assert kwargs["server_header"] is False
 
@@ -99,7 +102,7 @@ def test_loopback_without_auth_runs(uvicorn_spy: UvicornSpy) -> None:
 def test_forwarded_allow_ips_setting_is_passed_to_uvicorn(uvicorn_spy: UvicornSpy) -> None:
     assert run_http(server_settings(forwarded_allow_ips="10.0.0.0/8, 172.18.0.2")) == 0
 
-    assert uvicorn_spy.calls[0][1]["forwarded_allow_ips"] == "10.0.0.0/8,172.18.0.2"
+    assert uvicorn_spy.calls[0][0].trusted == "10.0.0.0/8,172.18.0.2"
 
 
 def test_forwarded_allow_ips_wildcard_needs_an_explicit_value_and_warns(
@@ -109,7 +112,7 @@ def test_forwarded_allow_ips_wildcard_needs_an_explicit_value_and_warns(
 
     assert run_http(server_settings(forwarded_allow_ips="*")) == 0
 
-    assert uvicorn_spy.calls[0][1]["forwarded_allow_ips"] == "*"
+    assert uvicorn_spy.calls[0][0].trusted == "*"
     assert "FORWARDED_ALLOW_IPS=*" in capsys.readouterr().err