feat: surface missing auth diagnostics

tests/wf_mcp/service/test_source_registry_admin.py

@@ -336,3 +336,54 @@ def test_source_registry_apply_requires_runtime_context(tmp_path: Path) -> None:
 
     with pytest.raises(RuntimeError, match="requires runtime service context"):
         provider.apply_registry_changes()
+
+
+def test_source_registry_apply_reports_missing_auth_ref(tmp_path: Path) -> None:
+    entry = McpSourceRegistryEntry(
+        id="github.work",
+        provider="github",
+        account="work",
+        auth_ref="github.creds",
+        transport=StdioSourceTransport(command="npx"),
+    )
+    provider, connection_service, _source_catalog = _apply_provider(
+        tmp_path,
+        registry_sources=[entry],
+    )
+    provider.load_auth = lambda auth_ref: None
+
+    payload = provider.apply_registry_changes()
+
+    assert payload["applied"] is True
+    assert payload["registered"] == ["github.work"]
+    assert connection_service.get("github.work").metadata["auth_ref"] == "github.creds"
+    diagnostic = payload["auth_diagnostics"][0]
+    assert diagnostic["code"] == "auth_not_found"
+    assert diagnostic["bound_source"] == "github.work"
+    assert "github.creds" in diagnostic["message"]
+
+
+def test_source_registry_apply_empty_auth_diagnostics_when_auth_present(
+    tmp_path: Path,
+) -> None:
+    from wf_mcp.models import AuthRecord as McpAuthRecord
+
+    entry = McpSourceRegistryEntry(
+        id="github.work",
+        provider="github",
+        account="work",
+        auth_ref="github.creds",
+        transport=StdioSourceTransport(command="npx"),
+    )
+    provider, _connection_service, _source_catalog = _apply_provider(
+        tmp_path,
+        registry_sources=[entry],
+    )
+    provider.load_auth = lambda auth_ref: McpAuthRecord(
+        connection_id=auth_ref, scheme="bearer", payload={"token": "secret"}
+    )
+
+    payload = provider.apply_registry_changes()
+
+    assert payload["applied"] is True
+    assert payload["auth_diagnostics"] == []

tests/wf_mcp/service/test_upstream_transport.py

@@ -247,3 +247,54 @@ def test_upstream_load_connection_auth_ignores_non_string_auth_ref(
         scheme="bearer",
         payload={"token": "legacy"},
     )
+
+
+async def test_upstream_transport_live_diagnostics_report_missing_auth_ref(
+    tmp_path: Path,
+) -> None:
+    events: list[McpEvent] = []
+    store = FileStore(tmp_path)
+    connections = ConnectionRegistry()
+    connection = ConnectionConfig(
+        id="github.work",
+        server="demo",
+        account="work",
+        metadata={"auth_ref": "github.creds"},
+    )
+    connections.register(connection)
+    transport = UpstreamTransportService(store=store, event_sink=events.append)
+    transport.register_adapter("demo", FakeAdapter())
+    source_catalog = SourceCatalogService(
+        store=store,
+        connection_lookup=connections.get,
+        connection_list_enabled=connections.list_enabled,
+        connection_list_all=connections.list_all,
+        tool_executor_for=transport.tool_executor_for,
+        load_auth=transport.load_connection_auth,
+        emit_event=events.append,
+    )
+    source_catalog.register_capability_source(
+        CapabilitySource(
+            id="github.work",
+            kind="connection",
+            permissions=SourcePermissions(calls_upstream=True),
+            capabilities=CapabilityBuckets(),
+        )
+    )
+    artifact = echo_artifact()
+    deployment = WorkflowDeployment(
+        id="echo.personal",
+        artifact_id="echo",
+        artifact_version=1,
+        bindings=[{"logical_source": "demo", "concrete_source": "github.work"}],
+    )
+
+    diagnostics = await transport.deployment_diagnostics(
+        deployment=deployment,
+        artifacts=[artifact],
+        source_catalog=source_catalog,
+    )
+
+    assert diagnostics[0].code == "auth_not_found"
+    assert diagnostics[0].bound_source == "github.work"
+    assert "github.creds" in diagnostics[0].message

tests/wf_mcp/test_auth.py

@@ -3,13 +3,16 @@ from __future__ import annotations
 from pathlib import Path
 
 from wf_api.auth import AuthRecord as NeutralAuthRecord
+from wf_artifacts import DiagnosticSeverity
 from wf_mcp.auth import (
+    auth_ref_for_connection,
+    connection_auth_diagnostic,
     mcp_auth_env,
     mcp_auth_headers,
     mcp_auth_from_neutral,
     neutral_auth_from_mcp,
 )
-from wf_mcp.models import AuthRecord as McpAuthRecord
+from wf_mcp.models import AuthRecord as McpAuthRecord, ConnectionConfig
 from wf_mcp.storage import FileStore
 
 
@@ -116,3 +119,84 @@ def test_file_store_legacy_auth_methods_still_work(tmp_path: Path) -> None:
         scheme="bearer",
         payload={"token": "secret"},
     )
+
+
+def test_auth_ref_for_connection_returns_string_only() -> None:
+    assert (
+        auth_ref_for_connection(
+            ConnectionConfig(
+                id="github.work",
+                server="github",
+                account="work",
+                metadata={"auth_ref": "github.creds"},
+            )
+        )
+        == "github.creds"
+    )
+    assert (
+        auth_ref_for_connection(
+            ConnectionConfig(
+                id="github.work",
+                server="github",
+                account="work",
+                metadata={"auth_ref": 123},
+            )
+        )
+        is None
+    )
+
+
+def test_connection_auth_diagnostic_reports_missing_auth_ref() -> None:
+    connection = ConnectionConfig(
+        id="github.work",
+        server="github",
+        account="work",
+        metadata={"auth_ref": "github.creds"},
+    )
+
+    diagnostic = connection_auth_diagnostic(
+        connection,
+        load_auth=lambda auth_ref: None,
+        logical_ref="github",
+    )
+
+    assert diagnostic is not None
+    assert diagnostic.severity == DiagnosticSeverity.ERROR
+    assert diagnostic.code == "auth_not_found"
+    assert diagnostic.logical_ref == "github"
+    assert diagnostic.bound_source == "github.work"
+    assert "github.creds" in diagnostic.message
+    assert diagnostic.repair_hint is not None
+    assert "Add an auth record" in diagnostic.repair_hint
+
+
+def test_connection_auth_diagnostic_ignores_absent_or_present_auth_ref() -> None:
+    no_ref = ConnectionConfig(id="github.work", server="github", account="work")
+    with_ref = ConnectionConfig(
+        id="github.work",
+        server="github",
+        account="work",
+        metadata={"auth_ref": "github.creds"},
+    )
+    auth = McpAuthRecord(
+        connection_id="github.creds",
+        scheme="bearer",
+        payload={"token": "secret"},
+    )
+
+    assert (
+        connection_auth_diagnostic(
+            no_ref,
+            load_auth=lambda auth_ref: None,
+            logical_ref="github",
+        )
+        is None
+    )
+    assert (
+        connection_auth_diagnostic(
+            with_ref,
+            load_auth=lambda auth_ref: auth,
+            logical_ref="github",
+        )
+        is None
+    )