mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-26 23:44:17 +02:00
db4450e40b
A background task still needs to know who asked for the work, so FastMCP captures the caller's access token and every inbound HTTP header at submission time and writes that snapshot to the Docket backend. On a distributed backend the credentials sit in Redis as plaintext for the task's TTL, and a rediss:// URL protects only the wire. Set FASTMCP_ENCRYPTION_KEY and the snapshot becomes a Fernet token instead. Restore fails closed: a worker that cannot decrypt a snapshot fails the task rather than run the tool with no caller. Closes #4747 🤖 Generated with Claude Code Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
42 lines
1.1 KiB
Python
42 lines
1.1 KiB
Python
import pytest
|
|
|
|
from fastmcp.settings import Settings
|
|
|
|
|
|
def test_http_host_origin_protection_defaults_to_false():
|
|
assert Settings().http_host_origin_protection is False
|
|
|
|
|
|
@pytest.mark.parametrize(
|
|
("value", "expected"),
|
|
[
|
|
("auto", "auto"),
|
|
("true", True),
|
|
("false", False),
|
|
],
|
|
)
|
|
def test_http_host_origin_protection_env_var(value, expected, monkeypatch):
|
|
monkeypatch.setenv("FASTMCP_HTTP_HOST_ORIGIN_PROTECTION", value)
|
|
|
|
assert Settings().http_host_origin_protection == expected
|
|
|
|
|
|
def test_encryption_key_defaults_to_none(monkeypatch):
|
|
monkeypatch.delenv("FASTMCP_ENCRYPTION_KEY", raising=False)
|
|
|
|
assert Settings().encryption_key is None
|
|
|
|
|
|
def test_encryption_key_env_var(monkeypatch):
|
|
monkeypatch.setenv("FASTMCP_ENCRYPTION_KEY", "s3kr1t-material")
|
|
|
|
key = Settings().encryption_key
|
|
assert key is not None
|
|
assert key.get_secret_value() == "s3kr1t-material"
|
|
|
|
|
|
def test_encryption_key_is_not_printable(monkeypatch):
|
|
"""A settings dump must never carry the key into a log."""
|
|
monkeypatch.setenv("FASTMCP_ENCRYPTION_KEY", "s3kr1t-material")
|
|
|
|
assert "s3kr1t-material" not in repr(Settings())
|