[HIGH] H4: No PHPUnit tests for any of the 6 new MCP write-handlers introduced in PR #153

[rubenvdlinde]

Severity: HIGH

Location: tests/Unit/Mcp/OpenBuiltToolProviderTest.php (only 9 tests covering old monolithic handler)

Description:
PR #153 decomposed OpenBuiltToolProvider from 1165 LOC into 9 handler classes. The test suite was not updated: it still only covers openbuilt.listApps, openbuilt.getAppManifest, unknown-tool dispatch, and authentication invariants. None of the 6 new write-handlers (CreateAppHandler, UpsertSchemaHandler, UpsertPageHandler, AddWidgetHandler, UpsertMenuItemHandler, PromoteVersionHandler) have any unit tests.

The RBAC bypass (C1) and direct mapper call (C2) reported separately would have been caught by even basic happy-path tests asserting the per-Application authorization contract.

Suggested fix:
Create one test class per write-handler, each asserting:

• (a) Unauthenticated calls are rejected.
• (b) Authenticated callers without an owners/editors role on the target app are rejected (once C1 is fixed).
• (c) Happy-path mutation hits ObjectService with the expected arguments and returns the spec-defined success envelope.
• (d) Error envelopes are returned (not exceptions) for spec-defined failure cases (app not found, schema collision, etc.).

Source: deep team-reviewer pass 2026-05-27

[rubenvdlinde]

Fixed in PR #177 (merged to development).