feat(testmanagement): stamp "MCP generated" tag on createTestCase

[SavioBS629]

Manual test cases created via the MCP server carried no origin marker, so they were missing from the Test Case Activity Report (PMAA-166). Stamp the "MCP generated" tag on the create payload, preserving and de-duping any user-supplied tags. "AI Generated" stays reserved for TCG Agent output.

[SavioBS629]

Claude Code PR Review

PR: #347 • Head: 6f3669e • Reviewers: stack:code-review

Summary

Stamps a "MCP generated" tag on every test case created via createTestCase (deduped, user tags preserved), so MCP-originated test cases are identifiable in Test Management. Ships with a dedicated unit test.

Review Table

Priority	Category	Check	Status	Notes
High	Security	No hardcoded secrets or credentials	Pass	Test uses obvious fakes (fake-user:fake-key); none in source
High	Security	Authentication/authorization checks present	N/A	Auth flow unchanged
High	Security	Input validation and sanitization	Pass	Tag added after schema parse; no untrusted input introduced
High	Security	No IDOR — resource ownership validated	N/A	—
High	Security	No SQL injection (parameterized queries)	N/A	—
High	Correctness	Logic is correct, handles edge cases	Pass	Set dedup preserves order; verified tag reaches both v2 (body.test_case) and v1/template_id (v1TestCase spread) payloads
High	Correctness	Error handling is explicit, no swallowed exceptions	N/A	No new error paths
High	Correctness	No race conditions or concurrency issues	Pass	Mutates a local {...params} copy — no shared/global state (multi-tenant safe)
Medium	Testing	New code has corresponding tests	Pass	New create-testcase-tag.test.ts: no-tags, user-tags-appended, no-duplicate
Medium	Testing	Error paths and edge cases tested	Pass	Dedup + empty-tags edge cases covered
Medium	Testing	Existing tests still pass (no regressions)	Pass	Additive; hits real createTestCase with external deps stubbed
Medium	Performance	No N+1 queries or unbounded data fetching	Pass	O(n) Set over a small tag list
Medium	Performance	Long-running tasks use background jobs	N/A	—
Medium	Quality	Follows existing codebase patterns	Pass	Payload built via existing testCaseParams; test mock style matches repo
Medium	Quality	Changes are focused (single concern)	Pass	One concern: origin tagging
Low	Quality	Meaningful names, no dead code	Pass	Clear intent
Low	Quality	Comments explain why, not what	Pass	Test header cites PMAA-166 rationale
Low	Quality	No unnecessary dependencies added	Pass	None

Findings

No blocking findings. Verified in depth:

• Both API paths get the tag. The tag is stamped on testCaseParams before the v1/v2 branch. The v2 path sends body: { test_case: testCaseParams }; the v1 (template_id) path builds v1TestCase = { ...testCaseParams } and deletes only project_identifier/folder_id/custom_fields, so tags survives. No path silently drops the tag.
• Dedup is correct and order-preserving. Array.from(new Set([...existing, "MCP generated"])) → ['MCP generated'], ['smoke','regression','MCP generated'], and ['MCP generated'] (no dup) — matching all three test assertions.
• Type-safe & multi-tenant safe. TestCaseCreateRequest.tags?: string[] exists; mutation is on a local copy, no process-shared state.

Non-blocking suggestions

1. v1 path untested. The test only exercises the v2 path (no template_id). The v1 path carries the tag by construction, but a template_id-set test asserting v1TestCase.tags would lock that in. Informational.
2. Magic string. "MCP generated" is a literal; a shared constant would ease reuse/consistency if other tools start stamping origin. Trivial.

---

Verdict: PASS — correct, focused, and well-tested origin-tagging; tag reaches both create paths, dedup verified, only trivial non-blocking follow-ups.