refactor(rate-limiter): review fixes, Redis hardening, key-format parity tests

- Extract _dispatch_hook() shared by prompt_pre_fetch and tool_pre_invoke,
  reducing each hook to a single-line wrapper
- Elevate Redis val_i64/val_f64 parse-error logging from warn to error so
  silent fail-open degradation surfaces in operator dashboards
- Clamp sliding-window reset_timestamp with .max(1) so it is always strictly
  in the future even when the oldest entry expires in < 1 s
- Add 5 s tokio::time::timeout around Redis connection establishment to
  prevent indefinite blocking on network partition
- Replace silent except-pass in EVALSHA SHA tracking with logger.debug
- Document dual Lua-script invariant (rolling-upgrade key-format parity)
  in both Python RedisBackend docstring and Rust redis_backend.rs header
- Add 7 parametrized test_redis_key_format_parity_* tests validating that
  Python and Rust produce identical Redis keys for the same inputs
- Revert unrelated .pyi stub changes for encoded_exfil_detection, pii_filter,
  retry_with_backoff, and secrets_detection

Signed-off-by: Jonathan Springer <jps@s390x.com>

Author: jonpspri

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "package-lock.json|Cargo.lock|^.secrets.baseline$|scripts/sign_image.sh|scripts/zap|sonar-project.properties|^/Users/brian/dev/github.ibm.com/contextforge-org/sps-pipeline-config/.secrets.baseline$|^./.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2026-03-28T19:41:44Z",
+  "generated_at": "2026-04-02T13:34:26Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -10510,83 +10510,83 @@
         "type": "Secret Keyword",
         "verified_result": null
       },
-      {
-        "hashed_secret": "f5cd573c18bf811f82a886ceb6866b05d5ef02cd",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 885,
-        "type": "Secret Keyword",
-        "verified_result": null
-      },
       {
         "hashed_secret": "8ce647089e0614d3b924f4a0b8fb78268562ec7c",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 1430,
+        "line_number": 1426,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "dc6f6cc49f767ae38db110a9e6c1adf5c651ecbf",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 1474,
+        "line_number": 1470,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "7939ea1cdfc6d73115b0d736fa04012be2b25b18",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 1565,
+        "line_number": 1561,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "91014bcbf183cf77807b4bd24f2e8652f67b56a0",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 2073,
+        "line_number": 2069,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "61ac75f7e6677b79c219ce819d954e05f61b5d2c",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 2091,
+        "line_number": 2087,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "8223fafd35f399e55c3cf611c3d6ebbf43d68d71",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 2737,
+        "line_number": 2733,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "dfd99b5f25f839608a3c275c0f8ceb363f8f0bc0",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 3514,
+        "line_number": 3510,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "5038e18712161fca54e52805726d3c70b296eff6",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 3623,
+        "line_number": 3619,
+        "type": "Secret Keyword",
+        "verified_result": null
+      },
+      {
+        "hashed_secret": "f5cd573c18bf811f82a886ceb6866b05d5ef02cd",
+        "is_secret": false,
+        "is_verified": false,
+        "line_number": 3697,
         "type": "Secret Keyword",
         "verified_result": null
       },
       {
         "hashed_secret": "79bead8e6d65862a00cffaa12ccde1189ec34d29",
         "is_secret": false,
         "is_verified": false,
-        "line_number": 3822,
+        "line_number": 4080,
         "type": "Secret Keyword",
         "verified_result": null
       }

mcpgateway/auth.py

@@ -1248,9 +1248,9 @@ def _set_trace_for_user(user_obj: EmailUser, *, teams: Any = _UNSET, auth_method
                 if request and global_context:
                     request.state.plugin_global_context = global_context
 
-                _propagate_tenant_id(request)
                 if plugin_manager and plugin_manager.config.plugin_settings.include_user_info:
                     _inject_userinfo_instate(request, user)
+                _propagate_tenant_id(request)
 
                 _set_trace_for_user(user)
                 return user
@@ -1378,9 +1378,9 @@ def _set_trace_for_user(user_obj: EmailUser, *, teams: Any = _UNSET, auth_method
                                     headers={"WWW-Authenticate": "Bearer"},
                                 )
 
-                        _propagate_tenant_id(request)
                         if plugin_manager and plugin_manager.config.plugin_settings.include_user_info:
                             _inject_userinfo_instate(request, _user_from_cached_dict(cached_ctx.user))
+                        _propagate_tenant_id(request)
 
                         cached_user = _user_from_cached_dict(cached_ctx.user)
                         _set_trace_for_user(
@@ -1517,9 +1517,9 @@ def _set_trace_for_user(user_obj: EmailUser, *, teams: Any = _UNSET, auth_method
                             headers={"WWW-Authenticate": "Bearer"},
                         )
 
-                _propagate_tenant_id(request)
                 if plugin_manager and plugin_manager.config.plugin_settings.include_user_info:
                     _inject_userinfo_instate(request, _batched_user)
+                _propagate_tenant_id(request)
 
                 _set_trace_for_user(
                     _batched_user,
@@ -1699,9 +1699,9 @@ def _set_trace_for_user(user_obj: EmailUser, *, teams: Any = _UNSET, auth_method
             headers={"WWW-Authenticate": "Bearer"},
         )
 
-    _propagate_tenant_id(request)
     if plugin_manager and plugin_manager.config.plugin_settings.include_user_info:
         _inject_userinfo_instate(request, user)
+    _propagate_tenant_id(request)
 
     trace_teams = getattr(request.state, "token_teams", _UNSET) if request else _UNSET
     _set_trace_for_user(user, teams=trace_teams, team_name=getattr(request.state, "trace_team_name", None) if request else None)
@@ -1717,6 +1717,9 @@ def _propagate_tenant_id(request: Optional[object] = None) -> None:
     (the default) and the middleware has already created plugin_global_context.
 
     Only writes when tenant_id is still None (no overwrite of plugin-set values).
+
+    Args:
+        request: The incoming request object, or ``None`` if unavailable.
     """
     if not request:
         return
@@ -1764,11 +1767,5 @@ def _inject_userinfo_instate(request: Optional[object] = None, user: Optional[Em
         global_context.user["is_admin"] = user.is_admin
         global_context.user["full_name"] = user.full_name
 
-    # Propagate team_id → tenant_id for by_tenant rate limiting (only when not already set)
-    if request and global_context.tenant_id is None:
-        team_id = getattr(getattr(request, "state", None), "team_id", None)
-        if team_id:
-            global_context.tenant_id = team_id
-
     if request and global_context:
         request.state.plugin_global_context = global_context

plugins/config.yaml

@@ -212,7 +212,7 @@ plugins:
     author: "Mihai Criveti"
     hooks: ["prompt_pre_fetch", "tool_pre_invoke"]
     tags: ["limits", "throttle"]
-    mode: "enforce"
+    mode: "disabled"
     priority: 20
     conditions: []
     config: