feat: add auth admin mutations

tests/wf_mcp/service/test_auth_admin.py

@@ -4,6 +4,7 @@ from pathlib import Path
 
 import pytest
 
+from wf_api.auth import AuthRecord as NeutralAuthRecord
 from wf_mcp.broker.service.auth_admin import McpAuthAdminProvider
 from wf_mcp.models import AuthRecord
 from wf_mcp.storage import FileStore
@@ -73,3 +74,48 @@ def test_auth_admin_inspect_unknown_raises_key_error(tmp_path: Path) -> None:
 
     with pytest.raises(KeyError, match="unknown auth record"):
         provider.inspect_auth_record("missing.auth")
+
+
+def test_auth_admin_provider_saves_auth_without_returning_payload(tmp_path) -> None:
+    store = FileStore(tmp_path / "store")
+    provider = McpAuthAdminProvider(store)
+
+    payload = provider.save_auth_record(
+        NeutralAuthRecord(
+            id="drive.work",
+            scheme="bearer",
+            payload={"token": "secret"},
+            metadata={"owner": "test"},
+        )
+    )
+
+    assert payload == {
+        "id": "drive.work",
+        "scheme": "bearer",
+        "metadata": {},
+        "payload_keys": ["token"],
+    }
+    assert "secret" not in str(payload)
+    assert store.load_auth("drive.work") == AuthRecord(
+        connection_id="drive.work",
+        scheme="bearer",
+        payload={"token": "secret"},
+    )
+
+
+def test_auth_admin_provider_deletes_auth(tmp_path) -> None:
+    store = FileStore(tmp_path / "store")
+    provider = McpAuthAdminProvider(store)
+    store.save_auth(AuthRecord(connection_id="drive.work", scheme="bearer"))
+
+    payload = provider.delete_auth_record("drive.work")
+
+    assert payload == {"deleted": True, "id": "drive.work"}
+    assert store.load_auth("drive.work") is None
+
+
+def test_auth_admin_provider_delete_unknown_auth_raises_key_error(tmp_path) -> None:
+    provider = McpAuthAdminProvider(FileStore(tmp_path / "store"))
+
+    with pytest.raises(KeyError, match="unknown auth record 'missing.auth'"):
+        provider.delete_auth_record("missing.auth")