From ec45dc05ec75f4d0582a07e5efbcf66bb62b6542 Mon Sep 17 00:00:00 2001
From: Colin Maudry <colin@maudry.com>
Date: Fri, 10 Jul 2026 15:04:46 +0200
Subject: [PATCH] feat(mcp): l'API REST refuse les jetons kind=mcp (scope B
 #111)

---
 src/api/auth.py        |  4 +++-
 tests/api/test_auth.py | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/src/api/auth.py b/src/api/auth.py
index c657eda..ca0c609 100644
--- a/src/api/auth.py
+++ b/src/api/auth.py
@@ -16,7 +16,6 @@ def _abort_401(message: str):
 def require_token(fn):
     @wraps(fn)
     def wrapper(*args, **kwargs):
-        print(API_AUTH_DISABLED)
         if not API_AUTH_DISABLED:
             header = request.headers.get("Authorization", "")
             if not header.startswith("Bearer "):
@@ -30,6 +29,9 @@ def require_token(fn):
                 _abort_401("invalid_token")
             if row["revoked_at"] is not None:
                 _abort_401("revoked_token")
+            if row["kind"] == "mcp":
+                # jeton dédié MCP : non valable sur l'API REST
+                _abort_401("invalid_token")
             g.token_id = row["id"]
         return fn(*args, **kwargs)
 
diff --git a/tests/api/test_auth.py b/tests/api/test_auth.py
index 7b97fbd..9618e9e 100644
--- a/tests/api/test_auth.py
+++ b/tests/api/test_auth.py
@@ -57,3 +57,22 @@ def test_valid_token_sets_g_and_calls_view(temp_db):
     )
     assert resp.status_code == 200
     assert resp.get_json()["token_id"] == token_id
+
+
+def test_mcp_kind_token_rejected_by_rest_api(temp_db):
+    token, _ = tokens_db.create_token(temp_db, "x", user_id=1, kind="mcp")
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert resp.status_code == 401
+    assert resp.get_json()["message"] == "invalid_token"
+
+
+def test_api_kind_token_accepted_by_rest_api(temp_db):
+    token, _ = tokens_db.create_token(temp_db, "x", kind="api")
+    app = _make_app()
+    resp = app.test_client().get(
+        "/protected", headers={"Authorization": f"Bearer {token}"}
+    )
+    assert resp.status_code == 200