From c1ac75cbc792d08eaa3ea94c1467e97569cc476b Mon Sep 17 00:00:00 2001
From: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Date: Thu, 29 Oct 2026 07:36:25 -0700
Subject: [PATCH] test(mcp): assert platform-header probe test observes the 401
 for an unknown caller

test_probe_receives_caller_platform_header_and_does_not_challenge had no assertion, which the test-quality gate counts as a new TQ001. Add a negative control showing a caller with a different platform header still gets the 401, so the test fails if the header stops reaching the probe.

Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
---
 .../test_mcp_server_tool_calls_and_headers.py        | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py b/tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py
index c68671a2958..87a9bc18301 100644
--- a/tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py
+++ b/tests/unit/proxy/mcp_server/test_mcp_server_tool_calls_and_headers.py
@@ -7280,6 +7280,18 @@ class TestTruePassthroughProbeForwardsCallerHeaders:
                 client_ip=None,
                 raw_headers={"X-Platform-User": "alice"},
             )
+            with pytest.raises(HTTPException) as exc_info:
+                await server_module._raise_preemptive_401_for_unauthenticated_servers(
+                    scope=self._scope(),
+                    mcp_servers=[self.ALIAS],
+                    oauth2_headers=None,
+                    mcp_server_auth_headers=None,
+                    user_api_key_auth=UserAPIKeyAuth(),
+                    client_ip=None,
+                    raw_headers={"X-Platform-User": "bob"},
+                )
+
+        assert exc_info.value.status_code == 401
 
     @pytest.mark.asyncio
     async def test_probe_never_forwards_authorization_via_extra_headers(self):