M54: harden operations and demo resilience

backend/tests/test_mcp_integrations.py

@@ -1,4 +1,12 @@
 from app.core.config import get_settings
+from app.main import app
+
+MCP_ROUTE_ALLOWLIST = {
+    ("GET", "/api/v1/integrations/mcp/operations-summary"),
+    ("GET", "/api/v1/integrations/mcp/attention-vehicles"),
+    ("GET", "/api/v1/integrations/mcp/vehicles/{vehicle_ref}"),
+    ("POST", "/api/v1/integrations/mcp/search-knowledge"),
+}
 
 
 def _headers(token: str | None = None, client_id: str = "test-mcp-client"):
@@ -154,3 +162,26 @@ def test_no_write_endpoints_exist_under_mcp_namespace(client):
     ]:
         response = getattr(client, method)(path, headers=_headers())
         assert response.status_code in (404, 405)
+
+
+def test_mcp_namespace_matches_exact_route_allowlist_and_rejects_lookalikes(client):
+    implemented = {
+        (method.upper(), path)
+        for path, operations in app.openapi()["paths"].items()
+        if path.startswith("/api/v1/integrations/mcp/")
+        for method in operations
+        if method in {"get", "post", "put", "patch", "delete"}
+    }
+    assert implemented == MCP_ROUTE_ALLOWLIST
+
+    lookalikes = [
+        ("get", "/api/v1/integrations/mcp-extra/operations-summary"),
+        ("get", "/api/v1/integrations/mcp/operations-summary-extra"),
+        ("get", "/api/v1/integrations/mcp/prefix/attention-vehicles"),
+        ("get", "/api/v1/integrations/mcp/attention-vehicles/suffix"),
+        ("post", "/api/v1/integrations/mcp/search-knowledge-extra"),
+        ("post", "/api/v1/integrations/mcp/prefix/search-knowledge"),
+    ]
+    for method, path in lookalikes:
+        response = client.request(method, path, headers=_headers(), json={})
+        assert response.status_code == 404, path