test(mcp): isolate timeout tests from SSRF validation

[erichare]

Summary

• disable SSRF validation only in the two MCP timeout-plumbing tests that use an intentionally unresolvable placeholder host
• align the release-1.10.3 tests with the existing release-1.11.0 adjustment
• leave production SSRF enforcement unchanged

Context

The Python 3.14 unit-test job on #14039 failed after the release security backport because http://test-server is now validated and cannot resolve. The first failure masked a second test using the same placeholder.

Testing

• Python 3.14: 19 tests passed in test_mcp_timeout_configuration.py
• focused two-test regression run passed
• Ruff check and format check passed
• pre-commit passed

Summary by CodeRabbit

• Tests
  • Updated MCP timeout configuration tests to run reliably with SSRF protection disabled.
  • Continued validating that tool execution timeout values are correctly propagated to MCP clients.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: fa67048c-54ba-4495-b60f-b88aee04e27c

📥 Commits

Reviewing files that changed from the base of the PR and between 94859df and 9cf98a9.

📒 Files selected for processing (1)

• src/backend/tests/unit/base/mcp/test_mcp_timeout_configuration.py

---

Walkthrough

Two MCP timeout tests now disable SSRF protection through monkeypatch before exercising HTTP and SSE client timeout propagation. Their existing assertions that tool_execution_timeout reaches the created clients remain unchanged.

Changes

MCP timeout tests

Layer / File(s)	Summary
Configure SSRF protection for timeout tests src/backend/tests/unit/base/mcp/test_mcp_timeout_configuration.py	The HTTP and SSE timeout tests use monkeypatch to disable SSRF protection before invoking MCP client logic while retaining timeout assertions.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 9

✅ Passed checks (9 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the change to isolate MCP timeout tests from SSRF validation.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Test Coverage For New Implementations	✅ Passed	The PR updates an existing backend unit test file with two regression tests that assert timeout plumbing; names and scope match project conventions.
Test Quality And Coverage	✅ Passed	PASS: The backend pytest async tests assert real timeout plumbing and retry behavior with AsyncMock/monkeypatch, so they’re substantive and follow project patterns.
Test File Naming And Structure	✅ Passed	PASS: The modified backend unit test file is named test_*.py, uses pytest classes/async test functions with descriptive names, and includes positive/negative timeout and validation cases.
Excessive Mock Usage Warning	✅ Passed	Mocking is limited to external MCP transport/session boundaries for timeout-plumbing tests; core timeout behavior is also covered with real client instances.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}