feat(tenancy): establish cloud isolation foundations

tests/unit_tests/api/http/test_entitlement_context.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+from types import SimpleNamespace
+from unittest.mock import AsyncMock
+
+import pytest
+import quart
+
+from langbot.pkg.api.http.context import (
+    ExecutionContext,
+    PrincipalContext,
+    PrincipalType,
+    RequestContext,
+    WorkspaceContext,
+)
+from langbot.pkg.api.http.controller.group import RouterGroup
+from langbot.pkg.cloud.entitlements import EntitlementSnapshot, EntitlementUnavailableError
+from langbot.pkg.cloud.entitlements import EntitlementResolver
+
+
+class _Group(RouterGroup):
+    async def initialize(self) -> None:
+        return None
+
+
+def _router(deployment) -> _Group:
+    provider = getattr(deployment, 'entitlement_provider', None)
+    resolver = EntitlementResolver('instance-a', provider) if provider is not None else None
+    ap = SimpleNamespace(deployment=deployment, entitlement_resolver=resolver)
+    return _Group(ap, quart.Quart(__name__))
+
+
+@pytest.mark.asyncio
+async def test_cloud_request_resolves_verified_entitlement_revision():
+    snapshot = EntitlementSnapshot(
+        instance_uuid='instance-a',
+        workspace_uuid='workspace-a',
+        entitlement_revision=9,
+        status='active',
+        not_before=1,
+        expires_at=4_000_000_000,
+        features={},
+        limits={},
+    )
+    provider = SimpleNamespace(get_workspace_entitlement=AsyncMock(return_value=snapshot))
+    router = _router(SimpleNamespace(multi_workspace_enabled=True, entitlement_provider=provider))
+
+    revision = await router._resolve_entitlement_revision('instance-a', 'workspace-a')
+
+    assert revision == 9
+    provider.get_workspace_entitlement.assert_awaited_once_with('workspace-a')
+
+
+@pytest.mark.asyncio
+async def test_cloud_request_fails_closed_without_entitlement_provider():
+    router = _router(SimpleNamespace(multi_workspace_enabled=True, entitlement_provider=None))
+
+    with pytest.raises(EntitlementUnavailableError):
+        await router._resolve_entitlement_revision('instance-a', 'workspace-a')
+
+
+def test_execution_context_preserves_entitlement_revision():
+    request = RequestContext(
+        instance_uuid='instance-a',
+        placement_generation=1,
+        request_id='request-a',
+        auth_type='user-token',
+        principal=PrincipalContext(PrincipalType.ACCOUNT, account_uuid='account-a'),
+        workspace=WorkspaceContext(
+            workspace_uuid='workspace-a',
+            membership_uuid='membership-a',
+            role='owner',
+            permissions=frozenset(),
+        ),
+        entitlement_revision=11,
+    )
+
+    assert ExecutionContext.from_request(request).entitlement_revision == 11

tests/unit_tests/api/service/test_mcp_service.py

@@ -29,6 +29,7 @@ from langbot.pkg.api.http.context import (
 )
 from langbot.pkg.api.http.service.mcp import MCPService, redact_mcp_secrets, restore_mcp_secret_placeholders
 from langbot.pkg.entity.persistence.mcp import MCPServer
+from langbot.pkg.provider.tools.loaders.mcp_policy import MCPStdioDisabledError
 from langbot.pkg.workspace.errors import WorkspaceNotFoundError
 
 
@@ -351,6 +352,27 @@ class TestMCPServiceGetMCPServers:
 class TestMCPServiceCreateMCPServer:
     """Tests for create_mcp_server method."""
 
+    async def test_create_stdio_rejected_by_independent_instance_gate(self):
+        ap = SimpleNamespace(
+            instance_config=SimpleNamespace(
+                data={
+                    'mcp': {'stdio': {'enabled': False}},
+                    'system': {'limitation': {'max_extensions': -1}},
+                }
+            ),
+            persistence_mgr=SimpleNamespace(execute_async=AsyncMock()),
+            tool_mgr=None,
+        )
+        service = _service(ap)
+
+        with pytest.raises(MCPStdioDisabledError, match='disabled by instance policy'):
+            await service.create_mcp_server(
+                _CONTEXT,
+                {'name': 'local', 'mode': 'stdio', 'enable': True, 'extra_args': {}},
+            )
+
+        ap.persistence_mgr.execute_async.assert_not_awaited()
+
     async def test_create_mcp_server_max_extensions_reached_raises(self):
         """Raises ValueError when max_extensions limit reached."""
         # Setup
@@ -887,6 +909,24 @@ class TestMCPServiceDeleteMCPServer:
 class TestMCPServiceTestMCPServer:
     """Tests for test_mcp_server method."""
 
+    async def test_transient_stdio_test_rejected_by_instance_gate(self):
+        ap = SimpleNamespace(
+            instance_config=SimpleNamespace(data={'mcp': {'stdio': {'enabled': False}}}),
+            tool_mgr=SimpleNamespace(mcp_tool_loader=SimpleNamespace(load_mcp_server=AsyncMock())),
+            task_mgr=SimpleNamespace(create_user_task=Mock()),
+        )
+        service = _service(ap)
+
+        with pytest.raises(MCPStdioDisabledError, match='disabled by instance policy'):
+            await service.test_mcp_server(
+                _CONTEXT,
+                '_',
+                {'name': 'local', 'mode': 'stdio', 'enable': True, 'extra_args': {}},
+            )
+
+        ap.tool_mgr.mcp_tool_loader.load_mcp_server.assert_not_awaited()
+        ap.task_mgr.create_user_task.assert_not_called()
+
     async def test_test_mcp_server_existing_server(self):
         """Tests existing MCP server connection."""
         # Setup