fix: serve OpenAI domain verification challenge

[adityaoberai]

OpenAI domain verification currently has no challenge endpoint on the hosted MCP server. Serve the supplied public verification token at GET /.well-known/openai-apps-challenge as plain text without requiring bearer authentication, allowing verification after deployment to mcp.appwrite.io.

Validation:

• Ruff and Black checks passed for src and tests.
• Pyright passed with --pythonplatform Linux (the CI target).
• All 32 HTTP unit tests passed; an unauthenticated TestClient request returned HTTP 200 with the exact token and text/plain.
• Full unit suite attempted: 247 tests, with one import error from unavailable Windows fcntl and one system CPU gauge failure. Native Windows Pyright also reports Unix-only API errors.
• Docker build could not run because the local Docker daemon is unavailable. Live integration tests were not run; CI validation remains pending.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; no outstanding correctness or repository-rule violations remain.

Findings

1.  Missing HTTP contract test ▶

Fix with agent prompt

### Issue 1
src/mcp_server_appwrite/http_app.py:485-490
This public verification route has no committed behavioral test. Add an unauthenticated ASGI request test that checks the successful status, exact token body, and `text/plain` content type. Without it, a later authentication, routing, or response change could silently break domain verification. These assertions cover the observable HTTP contract rather than implementation details.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

• Serves the supplied verification token from GET /.well-known/openai-apps-challenge.
• Returns the token as plain text without bearer authentication.
• Adds an unauthenticated request test covering status, exact body, and media type.
• Updates the content-type assertion to ignore incidental charset serialization.

_{Reviews (3) · Last reviewed commit: "test: assert challenge media type instea..."}

[greptile-apps]

Missing HTTP contract test

This public verification route has no committed behavioral test. Add an unauthenticated ASGI request test that checks the successful status, exact token body, and text/plain content type. Without it, a later authentication, routing, or response change could silently break domain verification. These assertions cover the observable HTTP contract rather than implementation details.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/mcp_server_appwrite/http_app.py
Line: 485-490

Comment:
**Missing HTTP contract test**

This public verification route has no committed behavioral test. Add an unauthenticated ASGI request test that checks the successful status, exact token body, and `text/plain` content type. Without it, a later authentication, routing, or response change could silently break domain verification. These assertions cover the observable HTTP contract rather than implementation details.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[adityaoberai]

This is fixed, isn't it?

[greptile-apps]

Yes, this is fixed. The PR now includes an unauthenticated TestClient test covering the route's 200 status, exact token body, and text/plain content type. The missing-test finding is resolved.

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.