feat: expose auth admin summaries

tests/wf_mcp/service/test_auth_admin.py

@@ -0,0 +1,75 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+from wf_mcp.broker.service.auth_admin import McpAuthAdminProvider
+from wf_mcp.models import AuthRecord
+from wf_mcp.storage import FileStore
+
+
+def _store(tmp_path: Path) -> FileStore:
+    return FileStore(tmp_path)
+
+
+def test_auth_admin_lists_safe_summaries_sorted(tmp_path: Path) -> None:
+    store = _store(tmp_path)
+    store.save_auth(
+        AuthRecord(
+            connection_id="github.work",
+            scheme="bearer",
+            payload={"token": "secret", "headers": {"Authorization": "Bearer secret"}},
+        )
+    )
+    store.save_auth(
+        AuthRecord(
+            connection_id="api.work",
+            scheme="headers",
+            payload={"headers": {"X-API-Key": "secret"}},
+        )
+    )
+    provider = McpAuthAdminProvider(store=store)
+
+    records = provider.list_auth_records()
+
+    assert records == [
+        {
+            "id": "api.work",
+            "scheme": "headers",
+            "metadata": {},
+            "payload_keys": ["headers"],
+        },
+        {
+            "id": "github.work",
+            "scheme": "bearer",
+            "metadata": {},
+            "payload_keys": ["headers", "token"],
+        },
+    ]
+
+
+def test_auth_admin_inspects_safe_summary(tmp_path: Path) -> None:
+    store = _store(tmp_path)
+    store.save_auth(
+        AuthRecord(
+            connection_id="github.work",
+            scheme="bearer",
+            payload={"token": "secret"},
+        )
+    )
+    provider = McpAuthAdminProvider(store=store)
+
+    assert provider.inspect_auth_record("github.work") == {
+        "id": "github.work",
+        "scheme": "bearer",
+        "metadata": {},
+        "payload_keys": ["token"],
+    }
+
+
+def test_auth_admin_inspect_unknown_raises_key_error(tmp_path: Path) -> None:
+    provider = McpAuthAdminProvider(store=_store(tmp_path))
+
+    with pytest.raises(KeyError, match="unknown auth record"):
+        provider.inspect_auth_record("missing.auth")

tests/wf_mcp/test_mcp_workflow_server.py

@@ -96,3 +96,38 @@ def test_workflow_server_from_service_rejects_missing_stores(tmp_path) -> None:
             config=config,
             source_registry_store=FileSourceRegistryStore(config.store_root),
         )
+
+
+async def test_workflow_server_from_service_exposes_auth_admin(tmp_path) -> None:
+    from wf_mcp.models import AuthRecord
+
+    config = BrokerConfig(
+        store_root=tmp_path / "store",
+        connections=[
+            ConnectionConfig(id="demo.default", server="demo", account="default")
+        ],
+    )
+    service = build_service_from_config(config)
+    service.save_auth(
+        AuthRecord(
+            connection_id="github.work",
+            scheme="bearer",
+            payload={"token": "secret"},
+        )
+    )
+    server = workflow_server_from_service(
+        service,
+        config=config,
+        source_registry_store=FileSourceRegistryStore(config.store_root),
+    )
+
+    payload = await server.admin.list_auth_records()
+
+    assert payload["auth_records"] == [
+        {
+            "id": "github.work",
+            "scheme": "bearer",
+            "metadata": {},
+            "payload_keys": ["token"],
+        }
+    ]