refactor(routes): move mcp domain into routes/mcp/ subpackage (#5899)

Slice 2o of the route-domain reorganization (#4082/#4071). Moves
mcp_routes.py (697 lines) into routes/mcp/, leaving a backward-compat
sys.modules shim. Pure file reorganization, no behavior change.

The shim uses sys.modules replacement so sys.modules.pop + re-import,
monkeypatch.setattr(mcp_routes, "MCP_OAUTH_DIR", ...), and __file__
introspection in test_security_regressions.py all reach the canonical
module. One source-introspection path string repointed (line 1001).

Canonical module imports only from core/, src/, and stdlib (zero internal
routes/ coupling). Adds tests/test_mcp_routes_shim.py.

Verified: compileall clean; full suite 4804 passed, 3 skipped.
This commit is contained in:
Tal.Yuan
2026-08-11 02:24:55 -06:00
committed by GitHub
parent 1fef4929cf
commit c00ef8f9c2
6 changed files with 737 additions and 695 deletions
+19
View File
@@ -0,0 +1,19 @@
"""Regression test for the mcp route shim (slice 2o, #4082/#4071).
The backward-compat shim at ``routes/mcp_routes.py`` uses ``sys.modules``
replacement so the legacy import path and the canonical ``routes.mcp.*``
path resolve to the *same* module object. This is required because
``test_security_regressions.py`` does ``sys.modules.pop("routes.mcp_routes")``
+ re-import, ``monkeypatch.setattr(mcp_routes, "MCP_OAUTH_DIR", ...)``, and
reads ``mcp_routes.__file__`` for source introspection.
"""
import importlib
import routes.mcp_routes as _shim_mcp # noqa: F401
def test_legacy_and_canonical_mcp_module_are_same_object():
legacy = importlib.import_module("routes.mcp_routes")
canonical = importlib.import_module("routes.mcp.mcp_routes")
assert legacy is canonical
+1 -1
View File
@@ -998,7 +998,7 @@ def test_session_html_export_escapes_name():
def test_mcp_oauth_page_escapes_reflected_values():
src = Path(__file__).resolve().parents[1] / "routes" / "mcp_routes.py"
src = Path(__file__).resolve().parents[1] / "routes" / "mcp" / "mcp_routes.py"
text = src.read_text()
body = text.split("def _oauth_authorize_page(", 1)[1].split("return f", 1)[0]
for var in ("auth_url", "server_id", "host", "redirect_uri"):