fix: resolved ICM issue and added local setup steps

[Dhruvkumar-Microsoft]

Purpose

This pull request strengthens security around agent message handling, improves local development setup instructions, and enhances test coverage. The main focus is on ensuring that agent messages cannot be injected or manipulated across users by strictly validating plan_id ownership and always using the authenticated user's ID. Additional improvements include environment variable handling and documentation updates.

Security and Authorization Improvements

• The /api/v4/agent_message endpoint now requires a plan_id and verifies that the plan belongs to the authenticated user before accepting agent messages, preventing cross-user message injection. If the plan is missing or not owned by the user, the endpoint returns appropriate error codes (400 for missing, 404 for not found/owned).
• The build_agent_message_from_agent_message_response function is updated to always use the authenticated user's ID, ignoring any user ID supplied in the payload, further preventing unauthorized message assignment.

Testing Enhancements

• New tests are added to ensure that agent messages cannot be injected for other users, that missing plan_id is handled with a 400 error, and that the service method is not called in these cases.
• Additional regression tests verify that the payload-supplied user ID is ignored in favor of the authenticated user's ID.

Developer Experience and Configuration

• The local development setup documentation is improved with clearer, step-by-step instructions for configuring the .env file and connecting to Azure resources. [1] [2]
• Example environment variables are updated to include APP_ENV and other Azure-related settings.
• The configuration system now exposes app_env, and environment-based credential selection in image_service.py is improved for easier local development. [1] [2]

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
api
router.py	540	68	87%	63–64, 83–84, 93–94, 98, 113, 116, 124–125, 133–134, 363–365, 375, 407–408, 426, 431–432, 434–436, 439, 451–452, 460, 535–536, 624, 626, 629, 749–754, 758, 781, 812–815, 835, 916–917, 924, 987–988, 994, 1098–1099, 1124–1126, 1504–1513
services
plan_service.py	91	8	91%	54–55, 65–67, 82, 164–165
TOTAL	3837	552	85%

Tests	Skipped	Failures	Errors	Time
840	0 💤	0 ❌	0 🔥	5.746s ⏱️

[Copilot]

Copilot review overview

🟡 Changes recommended

Address missing-plan_id status handling, document new API responses, and add credential-selection tests.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 2 · 1

Open (3)

• Missing plan_id returns 422 instead of required 400 · New
• Add tests for environment-specific credential selection · New
• Document new 400 and 404 OpenAPI responses · New

What changed in this PR

Strengthens agent-message authorization and improves local MCP setup and configuration.

Changes:

• Validates plan ownership and enforces authenticated user IDs.
• Adds authorization and regression tests.
• Adds environment configuration, credential selection, and setup documentation.

File	Summary
src/​tests/​backend/​services/​test_plan_service.py	Tests authenticated user ID enforcement.
src/​tests/​backend/​api/​test_router.py	Tests plan authorization failures.
src/​mcp_server/​services/​image_service.py	Selects credentials by environment.
src/​mcp_server/​config/​settings.py	Adds app_env configuration.
src/​mcp_server/​.env.example	Adds Azure and environment settings.
src/​backend/​services/​plan_service.py	Uses the authenticated user ID.
src/​backend/​api/​router.py	Adds plan ownership validation and response handling.
docs/​LocalDevelopmentSetup.md	Expands local MCP setup instructions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.