fix: tighten oauth and source resource handling

tests/wf_mcp/service/test_content_access.py

@@ -286,6 +286,26 @@ async def test_read_resource_by_source_uri_reads_upstream() -> None:
     assert result["contents"][0]["text"] == "Welcome from the fake adapter resource."
 
 
+async def test_read_resource_by_source_uri_bounds_text() -> None:
+    service = WfMcpService(
+        store=FileStore(local_temp_root() / "content_source_uri_bound")
+    )
+    service.register_connection(
+        ConnectionConfig(id="demo.personal", server="demo", account="personal")
+    )
+    service.register_adapter("demo", FakeAdapter())
+    await service.refresh_connection_catalog("demo.personal")
+
+    result = await service.content_access.read_resource_by_source_uri(
+        source_id="demo.personal",
+        uri="demo://docs/welcome",
+        max_chars=7,
+    )
+
+    assert result["contents"][0]["text"] == "Welcome"
+    assert result["truncated"] is True
+
+
 async def test_read_resource_by_source_uri_rejects_unknown_resource() -> None:
     service = WfMcpService(
         store=FileStore(local_temp_root() / "content_source_uri_unknown")

tests/wf_mcp/service/test_source_diagnostics.py

@@ -1,5 +1,7 @@
 from __future__ import annotations
 
+from pathlib import Path
+
 from wf_mcp.broker.service.source_diagnostics import SourceDiagnosticsProvider
 from wf_mcp.connections import ConnectionRegistry
 from wf_mcp.models import ConnectionConfig
@@ -18,7 +20,7 @@ def _connection(**metadata: object) -> ConnectionConfig:
     )
 
 
-def _provider(tmp_path, connection: ConnectionConfig) -> SourceDiagnosticsProvider:
+def _provider(tmp_path: Path, connection: ConnectionConfig) -> SourceDiagnosticsProvider:
     registry = ConnectionRegistry()
     registry.register(connection)
     return SourceDiagnosticsProvider(