mcp-gee-sweet 0.8.2.dev321__tar.gz → 0.8.2.dev323__tar.gz

{mcp_gee_sweet-0.8.2.dev321 → mcp_gee_sweet-0.8.2.dev323}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: mcp-gee-sweet
-Version: 0.8.2.dev321
+Version: 0.8.2.dev323
 Summary: MCP server for Google Workspace — Sheets, Drive, Docs (HTML or Markdown), and Calendar.
 Project-URL: Homepage, https://github.com/khuisman/mcp-gee-sweet
 Project-URL: Bug Tracker, https://github.com/khuisman/mcp-gee-sweet/issues

{mcp_gee_sweet-0.8.2.dev321 → mcp_gee_sweet-0.8.2.dev323}/docs/qa/tests/calendar.md

@@ -428,6 +428,20 @@ Fixtures: see [`docs/qa/setup.md`](../setup.md). Substitute your `{CALENDAR_ID}`
 
 ---
 
+### TC-CAL77: scope_value rejected when scope_type is 'default' (issue #458)
+
+**Prompt**
+> "Add a calendar ACL rule on {CALENDAR_ID} with role 'freeBusyReader', scope_type 'default', and scope_value 'someone@example.com'"
+
+**Checks**
+- Call `add_calendar_acl(calendar_id="{CALENDAR_ID}", role="freeBusyReader", scope_type="default", scope_value="someone@example.com")`
+- Returns `{"error": "..."}` naming `scope_value` and `'default'` — not a silently-accepted rule with the value ignored (the prior behavior)
+- No new rule appears in a follow-up `list_calendar_acl` call
+
+**Result:** PASS (live, 2026-08-16) — `add_calendar_acl(calendar_id="primary", role="freeBusyReader", scope_type="default", scope_value="someone@example.com")` returned `{"error": "scope_value must not be set when scope_type is 'default'."}`. Follow-up `list_calendar_acl(calendar_id="primary")` showed no new rule — the 4 existing rules were unchanged. No dedicated QA fixture calendar exists yet (tracked under #304); tested against `primary` instead, which is safe here since the validation short-circuits before any Calendar API call is made.
+
+---
+
 ### TC-CAL64: Invalid role rejected without calling the API
 
 **Prompt**

{mcp_gee_sweet-0.8.2.dev321 → mcp_gee_sweet-0.8.2.dev323}/docs/roadmap.md

@@ -160,7 +160,7 @@ No new tools. Stabilize on what Tier 1 shipped before starting Tier 2 feature wo
 - [x] Log the running `mcp-gee-sweet` package version at startup — `server.py::main()` logs tool-filtering state but never the version, which is dynamic (`uv-dynamic-versioning`) so needs an `importlib.metadata.version()` lookup rather than a static string (PR #479) ([#356](https://github.com/khuisman/mcp-gee-sweet/issues/356))
 - [x] `server.py::main()`'s new version-logging call (#356) has no fallback for `importlib.metadata.PackageNotFoundError` — a broken/repackaged install or invoking `main()` directly without the package installed crashes the whole server before any tool-filtering log or transport startup, instead of degrading gracefully. Found during #356's own QA (PR #483) ([#481](https://github.com/khuisman/mcp-gee-sweet/issues/481))
 - [x] `transfer_ownership` missing from `server://auth-status`'s `_SA_LIMITED_TOOLS` despite its own docstring documenting the OAuth-only restriction — found during #140's review. Needed a design call on generalizing `_auth_status_json`'s failure-reason schema (storage-quota vs. no-Drive-identity are different failure classes), so routed to Joy instead of Amy. (PR #507) ([#447](https://github.com/khuisman/mcp-gee-sweet/issues/447))
-- [ ] `server://auth-status`'s `auth_method: "adc"` can't distinguish a real user credential from a service-account-backed one (GCE/Cloud Run/GKE metadata identity, or `GOOGLE_APPLICATION_CREDENTIALS` pointed at a key file) — both get tagged plain `"adc"` with `can_create_in_personal_drive: true` and zero limitations, which is wrong whenever ADC resolves to a service account. Found during #447's design work; not blocking it. `ready-for-development` (on deck, no lane yet) ([#506](https://github.com/khuisman/mcp-gee-sweet/issues/506))
+- [x] `server://auth-status`'s `auth_method: "adc"` can't distinguish a real user credential from a service-account-backed one (GCE/Cloud Run/GKE metadata identity, or `GOOGLE_APPLICATION_CREDENTIALS` pointed at a key file) — both get tagged plain `"adc"` with `can_create_in_personal_drive: true` and zero limitations, which is wrong whenever ADC resolves to a service account. Found during #447's design work; not blocking it. `ready-for-development` (on deck, no lane yet) ([#506](https://github.com/khuisman/mcp-gee-sweet/issues/506)) (PR #613)
 - [x] Dependabot's `pip`-ecosystem config doesn't always regenerate `uv.lock` for a version bump (confirmed on 2 of 7 PRs in the same batch) — silently defeats every `--frozen` CI/release install, which doesn't validate lock-vs-manifest consistency. Immediate drift fixed by hand 2026-08-06; switched to native `uv` ecosystem config and added a lockfile-sync CI guard ([#528](https://github.com/khuisman/mcp-gee-sweet/issues/528), PR #533)
 
 **Documentation**

{mcp_gee_sweet-0.8.2.dev321 → mcp_gee_sweet-0.8.2.dev323}/src/mcp_gee_sweet/tools/calendar.py

@@ -374,9 +374,11 @@ def register(tool):
             calendar_id: The calendar ID, or 'primary'.
             role: Access role to grant. One of: 'reader', 'writer', 'owner', 'freeBusyReader'.
             scope_type: Who the rule applies to. One of: 'user', 'group', 'domain', 'default'
-                        ('default' grants public access to all users and needs no scope_value).
+                        ('default' grants public access to all users and must not have a
+                        scope_value).
             scope_value: Email address (for 'user'/'group') or domain name (for 'domain').
-                         Required unless scope_type is 'default'.
+                         Required unless scope_type is 'default', in which case it must be
+                         omitted.
             send_notifications: Whether to send a notification email to the grantee.
                                  Defaults to True.
 
@@ -396,6 +398,8 @@ def register(tool):
             }
         if scope_type != "default" and not scope_value:
             return {"error": f"scope_value is required when scope_type is '{scope_type}'."}
+        if scope_type == "default" and scope_value:
+            return {"error": "scope_value must not be set when scope_type is 'default'."}
 
         scope: dict[str, str] = {"type": scope_type}
         if scope_value:

{mcp_gee_sweet-0.8.2.dev321 → mcp_gee_sweet-0.8.2.dev323}/tests/test_calendar.py

@@ -522,6 +522,22 @@ class TestAddCalendarAcl:
         assert "error" in result
         cal_svc.acl.return_value.insert.assert_not_called()
 
+    async def test_scope_value_with_default_scope_type_returns_error(self):
+        """A stray scope_value alongside scope_type='default' must be rejected, not silently ignored."""
+        cal_svc = MagicMock()
+        ctx = _make_ctx(calendar_service=cal_svc)
+
+        result = await _cal_tools["add_calendar_acl"](
+            calendar_id="cal-1",
+            role="freeBusyReader",
+            scope_type="default",
+            scope_value="someone@example.com",
+            ctx=ctx,
+        )
+
+        assert "error" in result
+        cal_svc.acl.return_value.insert.assert_not_called()
+
     async def test_default_scope_type_omits_value_and_scope_value_not_required(self):
         """scope_type='default' must not require scope_value and body must omit 'value'."""
         cal_svc = MagicMock()