feat: flag-gated playground-token mint for local MCP testing

[kaje94]

Gives the agents playground a way to authenticate with aep-api's MCP discovery endpoint for local testing only — closing the "no way to run the playground against real catalogs" gap without prejudging the open agent→BFF authentication decision (#85 open question 1).

Stacked on #85 (the MCP surface it authenticates against lives there); GitHub will retarget this to aep-rewrite when #85 merges.

How it works

sequenceDiagram
    participant P as Playground TUI (host)
    participant A as aep-api :9090
    Note over P,A: every design turn
    P->>A: POST /internal/v1/mcp/playground-token {orgHandle}
    A-->>P: {token, expiresInSeconds: 300}
    P->>A: POST /internal/v1/mcp (Bearer token) — tools/list, tools/call
    A-->>P: catalogs (external resources, org endpoints, resource types)

Loading

• POST /internal/v1/mcp/playground-token — mints a fresh 5-minute MCP token ({orgHandle} optional, default "default"). The route is only mounted when PLAYGROUND_TOKEN_ENABLED=true: default is false, only docker-compose.yml sets it, helm pins it false explicitly, and when disabled the path 404s by absence. Registered as a raw mux handler beside the MCP mount, so it structurally cannot appear in the generated OpenAPI contract. No caller auth by design — the flag (plus local reachability) is the gate, and the endpoint comment documents that the production posture remains an open decision.
• Playground: when AEP_MCP_URL is set and AEP_MCP_TOKEN is not, it mints a fresh token per turn (no caching — the 5-minute TTL can never expire mid-session). An explicit AEP_MCP_TOKEN is used verbatim and skips minting. Mint failure warns once and the session continues without discovery tools. The /tasks breakdown command does not touch MCP at all — discovery is a design-turn concern; the planner reads the published bundle.
• Also fixes the TUI rendering successful MCP tool results as ✗ error (it assumed the file tools' result shape; MCP results are bare strings).

Verified live

All four dependency checks pass on the real TUI (driven end-to-end): external-kind discovery reusing a registered resource by exact name and schema keys; org-service resolution to the exact catalog name; platform-resource emitting postgres-cnpg from the type catalog; /tasks flagging the provisioning gate in its rationale. Per-turn minting confirmed at the wire (mints on design turns only; zero MCP traffic from /tasks).

🤖 Generated with Claude Code

https://claude.ai/code/session_01HaM9hGtqua4ZC2bKD2d2Fq

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9e14cf66-f20c-4510-977d-9cadc2c5e643

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch playground-token

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}