fix: Dev to main merge

[Dhruvkumar-Microsoft]

Purpose

This pull request strengthens security around agent message handling, improves environment configuration for local development, and adds related tests and documentation updates. The changes ensure that agent messages can only be associated with plans owned by the authenticated user, preventing cross-user data injection, and clarify how environment variables are managed for development and deployment.

Security and Authorization Improvements:

• The /api/v4/agent_message endpoint now requires a plan_id and verifies that the plan belongs to the authenticated user before processing agent messages, returning a 404 if the plan is not found or not owned by the user. This prevents cross-user message injection.
• The build_agent_message_from_agent_message_response function now always uses the authenticated user's ID, ignoring any user ID supplied in the payload, to prevent unauthorized data injection.

Testing Enhancements:

• Added tests to ensure that agent messages cannot be written to plans not owned by the user, that missing plan_id returns a 400, and that the authenticated user ID is always enforced in the service layer. [1] [2]

Local Development and Environment Configuration:

• Updated documentation to clarify and improve the process for setting up local environment variables for the MCP server, including explicit steps for copying and editing the .env file and configuring development-specific settings. [1] [2]
• Added new environment variables to .env.example and introduced the APP_ENV variable to control dev vs. prod behavior. [1] [2]
• Updated the image service to use the new APP_ENV configuration for selecting credentials, defaulting to development settings when appropriate.

Does this introduce a breaking change?

• Yes
• No

How to Test

• Get the code

git clone [repo-address]
cd [repo-name]
git checkout [branch-name]
npm install

• Test the code

What to Check

Verify that the following are valid

• ...

Other Information

[github-actions]

Coverage Report •

File	Stmts	Miss	Cover	Missing
api
router.py	540	68	87%	63–64, 83–84, 93–94, 98, 113, 116, 124–125, 133–134, 363–365, 375, 407–408, 426, 431–432, 434–436, 439, 451–452, 460, 535–536, 624, 626, 629, 749–754, 758, 781, 812–815, 835, 916–917, 924, 987–988, 994, 1098–1099, 1124–1126, 1504–1513
services
plan_service.py	91	8	91%	54–55, 65–67, 82, 164–165
TOTAL	3837	552	85%

Tests	Skipped	Failures	Errors	Time
840	0 💤	0 ❌	0 🔥	9.779s ⏱️

[Copilot]

Copilot review overview

🟡 Changes recommended

Fix missing-plan_id validation behavior and update the endpoint documentation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Missing plan_id returns 422 instead of documented 400 · New

What changed in this PR

Strengthens agent-message authorization and improves MCP environment configuration and documentation.

Changes:

• Validates plan ownership and authenticated user identity.
• Adds authorization and identity regression tests.
• Adds APP_ENV configuration and local setup guidance.

File	Summary
src/​tests/​backend/​services/​test_plan_service.py	Tests authenticated user-ID enforcement.
src/​tests/​backend/​api/​test_router.py	Tests authorization and validation behavior.
src/​mcp_server/​services/​image_service.py	Selects credentials by environment.
src/​mcp_server/​config/​settings.py	Adds app_env configuration.
src/​mcp_server/​.env.example	Documents environment variables.
src/​backend/​services/​plan_service.py	Enforces authenticated user identity.
src/​backend/​api/​router.py	Adds plan ownership validation and message handling.
docs/​LocalDevelopmentSetup.md	Clarifies MCP environment setup.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.