From 347ccb0c68ff4366ef3a189d059923b920ea3c45 Mon Sep 17 00:00:00 2001
From: Leopold <leopold@media-on.de>
Date: Mon, 6 Jul 2026 07:10:35 +0200
Subject: [PATCH] fix: C3 case-insensitive Bearer prefix + S1 MCP asyncio.Lock
 (closes 2 xfail)

---
 agent_platform/auth.py       |  7 ++++++-
 agent_platform/mcp_client.py | 21 ++++++++++++---------
 2 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/agent_platform/auth.py b/agent_platform/auth.py
index c9fd3ae..cc0145f 100644
--- a/agent_platform/auth.py
+++ b/agent_platform/auth.py
@@ -15,7 +15,12 @@ async def get_current_user(
     if not authorization:
         raise HTTPException(status_code=401, detail="Missing Authorization header")
 
-    token = authorization.replace("Bearer ", "").strip()
+    # Case-insensitive Bearer prefix handling (C3)
+    auth_value = authorization.strip()
+    if auth_value.lower().startswith("bearer "):
+        token = auth_value[7:].strip()
+    else:
+        token = auth_value
 
     # Static-Auth-Token als Master-Key (für Setup/Bootstrap)
     if token == settings.AUTH_TOKEN:
diff --git a/agent_platform/mcp_client.py b/agent_platform/mcp_client.py
index 1e382bf..a5ea89e 100644
--- a/agent_platform/mcp_client.py
+++ b/agent_platform/mcp_client.py
@@ -1,4 +1,5 @@
 """MCP-Client: Verbindung zum Tool-Server."""
+import asyncio
 from typing import List, Dict, Any, Optional
 from mcp import ClientSession
 from mcp.client.streamable_http import streamablehttp_client
@@ -12,16 +13,18 @@ class MCPClient:
         self._session: Optional[ClientSession] = None
         self._streams = None
         self._ctx = None
+        self._lock = asyncio.Lock()
 
     async def connect(self):
         """Stellt Verbindung zum MCP-Server her (lazy + reconnect-fähig)."""
-        if self._session:
-            return
-        self._ctx = streamablehttp_client(url=self.server_url)
-        read, write, _ = await self._ctx.__aenter__()
-        self._session = ClientSession(read, write)
-        await self._session.__aenter__()
-        await self._session.initialize()
+        async with self._lock:
+            if self._session:
+                return
+            self._ctx = streamablehttp_client(url=self.server_url)
+            read, write, _ = await self._ctx.__aenter__()
+            self._session = ClientSession(read, write)
+            await self._session.__aenter__()
+            await self._session.initialize()
 
     async def disconnect(self):
         if self._session:
@@ -76,8 +79,8 @@ class MCPClient:
         """Prüft ob MCP-Server erreichbar ist."""
         try:
             await self.connect()
-            return True
-        except Exception:
+            return self._session is not None
+        except BaseException:
             return False