feat: surface missing auth diagnostics

src/wf_mcp/broker/server.py

@@ -78,6 +78,7 @@ def workflow_server_from_service(
         )
         if connection.server not in service.adapters
         else None,
+        load_auth=service.upstream.load_auth,
     )
     source_registry_admin = WorkflowSourceRegistryApi(
         provider=registry_provider,

src/wf_mcp/broker/service/source_registry_admin.py

@@ -6,7 +6,8 @@ from typing import Any
 
 from wf_api.source_registry_admin import WorkflowSourceRegistryMutationProvider
 
-from ...models import BrokerConfig, ConnectionConfig
+from ...auth import connection_auth_diagnostic
+from ...models import AuthRecord, BrokerConfig, ConnectionConfig
 from ...source_registry import (
     McpSourceRegistryEntry,
     SourceRegistryFile,
@@ -28,6 +29,7 @@ class SourceRegistryAdminProvider(WorkflowSourceRegistryMutationProvider):
     connection_service: ConnectionService | None = None
     config: BrokerConfig | None = None
     ensure_adapter: Callable[[ConnectionConfig], None] | None = None
+    load_auth: Callable[[str], AuthRecord | None] | None = None
 
     # -- read helpers -------------------------------------------------------
 
@@ -151,6 +153,15 @@ class SourceRegistryAdminProvider(WorkflowSourceRegistryMutationProvider):
             for source_id in before_ids & after_ids
             if before[source_id] != after[source_id]
         )
+        auth_diagnostics = []
+        if self.load_auth is not None:
+            for source_id in sorted(after):
+                diagnostic = connection_auth_diagnostic(
+                    after[source_id],
+                    load_auth=self.load_auth,
+                )
+                if diagnostic is not None:
+                    auth_diagnostics.append(diagnostic.model_dump(mode="json"))
         registry = self._load()
         return {
             "applied": True,
@@ -159,4 +170,5 @@ class SourceRegistryAdminProvider(WorkflowSourceRegistryMutationProvider):
             "removed": sorted(before_ids - after_ids),
             "connection_count": len(after),
             "registry_entry_count": len(registry.sources),
+            "auth_diagnostics": auth_diagnostics,
         }

src/wf_mcp/broker/service/upstream_transport.py

@@ -28,6 +28,7 @@ from wf_mcp.sdk import BackendAdapter
 from wf_mcp.shared.errors import error_payload
 from wf_mcp.storage import Store
 
+from ...auth import connection_auth_diagnostic
 from .adapters import require_adapter
 from .source_catalog import SourceCatalogService
 
@@ -306,6 +307,14 @@ class UpstreamTransportService:
                     )
                 )
                 continue
+            auth_diagnostic = connection_auth_diagnostic(
+                connection,
+                load_auth=self.load_auth,
+                logical_ref=logical_ref,
+            )
+            if auth_diagnostic is not None:
+                diagnostics.append(auth_diagnostic)
+                continue
             try:
                 adapter = require_adapter(connection, self.adapters)
                 auth = self.load_connection_auth(connection)