fix(tests): use resolve_gateway_auth_headers (async) + restore _meta guard

- Rename stale build_gateway_auth_headers patches to async
  resolve_gateway_auth_headers across transport/resource/tool/identity
  propagation unit tests (callers now use the async resolver).
- Remove duplicate build_ patch lines left next to resolve_ patches.
- Restore validate_meta_data import + guard in read_resource direct-proxy
  branch, forward meta as model_dump() dict, log only meta keys (CWE-532).

Signed-off-by: Olivier Gintrand <olivier.gintrand@forterro.com>

Author: Olivier Gintrand

mcpgateway/transports/streamablehttp_transport.py

@@ -65,6 +65,7 @@
 # First-Party
 from mcpgateway.cache.global_config_cache import global_config_cache
 from mcpgateway.common.models import LogLevel
+from mcpgateway.common.validators import validate_meta_data as _validate_meta_data
 from mcpgateway.config import settings
 from mcpgateway.db import Gateway as DbGateway
 from mcpgateway.db import Server as DbServer
@@ -2636,18 +2637,22 @@ async def read_resource(resource_uri: str) -> Union[str, bytes]:
                     meta = None
                     try:
                         request_ctx = mcp_app.request_context
-                        meta = request_ctx.meta
+                        if request_ctx and request_ctx.meta is not None:
+                            meta = request_ctx.meta.model_dump()
+                        # CWE-532: log only _meta keys, never values (may contain sensitive data)
                         logger.info(
-                            "Using direct_proxy mode for resources/read %s, server %s, gateway %s (from %s header), forwarding _meta: %s",
+                            "Using direct_proxy mode for resources/read %s, server %s, gateway %s (from %s header), forwarding _meta keys: %s",
                             resource_uri,
                             server_id,
                             gateway.id,
                             GATEWAY_ID_HEADER,
-                            meta,
+                            sorted(meta.keys()) if meta else None,
                         )
                     except (LookupError, AttributeError) as e:
                         logger.debug("No request context available for _meta extraction: %s", e)
 
+                    # CWE-400: validate _meta limits before network I/O (bypassed in direct-proxy branch)
+                    _validate_meta_data(meta)
                     contents = await _proxy_read_resource_to_gateway(gateway, str(resource_uri), user_context, meta)
                     if contents:
                         # Return first content (text or blob)

tests/unit/mcpgateway/services/test_resource_service.py

@@ -7272,7 +7272,7 @@ async def mock_streamable_client(*_args, **_kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={"Authorization": "Bearer remote-token"}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={"Authorization": "Bearer remote-token"}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.resource_service.ClientSession", return_value=client_session_cm),
             self._common_patches(resource_service),
@@ -7317,7 +7317,7 @@ async def mock_streamable_client(*_args, **_kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.resource_service.ClientSession", return_value=client_session_cm),
             self._common_patches(resource_service),
@@ -7360,7 +7360,7 @@ async def mock_streamable_client(*_args, **_kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.resource_service.ClientSession", return_value=client_session_cm),
             self._common_patches(resource_service),
@@ -7401,7 +7401,7 @@ async def mock_streamable_client(*_args, **_kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.resource_service.ClientSession", return_value=client_session_cm),
             self._common_patches(resource_service),
@@ -7458,7 +7458,7 @@ async def mock_streamable_client_error(*_args, **_kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client_error),
         ):
             mock_settings.mcpgateway_direct_proxy_enabled = True
@@ -7499,7 +7499,7 @@ async def mock_streamable_client(*_args, **_kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.resource_service.ClientSession", return_value=client_session_cm),
             self._common_patches(resource_service),
@@ -7545,7 +7545,7 @@ async def mock_streamable_client(*_args, **kwargs):
         with (
             patch("mcpgateway.services.resource_service.settings") as mock_settings,
             patch("mcpgateway.services.resource_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.resource_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.resource_service.ClientSession", return_value=client_session_cm),
             self._common_patches(resource_service),

tests/unit/mcpgateway/services/test_tool_service.py

@@ -8328,7 +8328,6 @@ async def mock_streamable_client(*_args, **_kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={"Authorization": "Bearer remote-token"}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={"Authorization": "Bearer remote-token"}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.tool_service.ClientSession", return_value=client_session_cm),
@@ -8368,7 +8367,6 @@ async def mock_streamable_client(*_args, **_kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.tool_service.ClientSession", return_value=client_session_cm),
@@ -8454,7 +8452,6 @@ async def mock_streamable_client_error(*_args, **_kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client_error),
         ):
@@ -8493,7 +8490,6 @@ async def mock_streamable_client(*_args, **kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={"Authorization": "Bearer xyz"}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={"Authorization": "Bearer xyz"}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.tool_service.ClientSession", return_value=client_session_cm),
@@ -8539,7 +8535,6 @@ async def mock_streamable_client(*_args, **kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.tool_service.ClientSession", return_value=client_session_cm),
@@ -8580,7 +8575,6 @@ async def mock_streamable_client(*_args, **_kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway, tool_row=mock_tool)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.tool_service.ClientSession", return_value=client_session_cm),
@@ -8619,7 +8613,6 @@ async def mock_streamable_client(*_args, **_kwargs):
             patch("mcpgateway.services.tool_service.fresh_db_session", self._make_fresh_db_session(mock_direct_gateway, tool_row=None)),
             patch("mcpgateway.services.tool_service.settings") as mock_settings,
             patch("mcpgateway.services.tool_service.check_gateway_access", new_callable=AsyncMock, return_value=True),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={}),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", new_callable=AsyncMock, return_value={}),
             patch("mcpgateway.services.tool_service.streamablehttp_client", mock_streamable_client),
             patch("mcpgateway.services.tool_service.ClientSession", return_value=client_session_cm),

tests/unit/mcpgateway/test_identity_propagation.py

@@ -1736,7 +1736,7 @@ def __init__(self, uri, mimeType=None, text=""):
             patch.object(service, "invoke_resource", AsyncMock(return_value="hello")),
             patch("mcpgateway.services.resource_service.check_gateway_access", AsyncMock(return_value=True)),
             patch.object(service, "_check_resource_access", AsyncMock(return_value=True)),
-            patch("mcpgateway.services.resource_service.build_gateway_auth_headers", return_value={"Authorization": "Bearer gateway"}),
+            patch("mcpgateway.services.resource_service.resolve_gateway_auth_headers", AsyncMock(return_value={"Authorization": "Bearer gateway"})),
             patch("mcpgateway.services.resource_service.build_identity_headers", return_value={"X-Identity": "1"}) as mock_build_headers,
             patch("mcpgateway.services.resource_service.streamablehttp_client", return_value=_AsyncCM()),
             patch("mcpgateway.services.resource_service.ClientSession", _ClientSessionCM),
@@ -1817,7 +1817,6 @@ async def __aexit__(self, exc_type, exc, tb):
             patch("mcpgateway.services.tool_service.fresh_db_session", return_value=_FreshDBSession(db)),
             patch("mcpgateway.services.tool_service.check_gateway_access", AsyncMock(return_value=True)),
             patch("mcpgateway.services.tool_service.resolve_gateway_auth_headers", AsyncMock(return_value={})),
-            patch("mcpgateway.services.tool_service.build_gateway_auth_headers", return_value={}),
             patch("mcpgateway.services.tool_service.build_identity_headers", return_value={"X-Identity": "1"}) as mock_build_headers,
             patch("mcpgateway.services.tool_service.build_identity_meta", return_value={"identity": True}) as mock_build_meta,
             patch("mcpgateway.services.tool_service.create_span", return_value=mock_span),
@@ -2023,7 +2022,7 @@ async def __aexit__(self, exc_type, exc, tb):
 
         try:
             with (
-                patch("mcpgateway.transports.streamablehttp_transport.build_gateway_auth_headers", return_value={}),
+                patch("mcpgateway.transports.streamablehttp_transport.resolve_gateway_auth_headers", AsyncMock(return_value={})),
                 patch("mcpgateway.transports.streamablehttp_transport.build_identity_headers", return_value={"X-Identity": "1"}) as mock_build_headers,
                 patch("mcpgateway.transports.streamablehttp_transport.streamablehttp_client", return_value=_AsyncCM()),
                 patch("mcpgateway.transports.streamablehttp_transport.ClientSession", _ClientSessionCM),
@@ -2065,7 +2064,7 @@ async def __aexit__(self, exc_type, exc, tb):
 
         try:
             with (
-                patch("mcpgateway.transports.streamablehttp_transport.build_gateway_auth_headers", return_value={}),
+                patch("mcpgateway.transports.streamablehttp_transport.resolve_gateway_auth_headers", AsyncMock(return_value={})),
                 patch("mcpgateway.transports.streamablehttp_transport.build_identity_headers", return_value={"X-Identity": "1"}) as mock_build_headers,
                 patch("mcpgateway.transports.streamablehttp_transport.streamablehttp_client", return_value=_AsyncCM()),
                 patch("mcpgateway.transports.streamablehttp_transport.ClientSession", _ClientSessionCM),
@@ -2108,7 +2107,7 @@ async def __aexit__(self, exc_type, exc, tb):
 
         try:
             with (
-                patch("mcpgateway.transports.streamablehttp_transport.build_gateway_auth_headers", return_value={}),
+                patch("mcpgateway.transports.streamablehttp_transport.resolve_gateway_auth_headers", AsyncMock(return_value={})),
                 patch("mcpgateway.transports.streamablehttp_transport.build_identity_headers", return_value={"X-Identity": "1"}) as mock_build_headers,
                 patch("mcpgateway.transports.streamablehttp_transport.streamablehttp_client", return_value=_AsyncCM()),
                 patch("mcpgateway.transports.streamablehttp_transport.ClientSession", _ClientSessionCM),