From 6d6ee00d7a6d15738865fc9b5b8aba35a3e2232d Mon Sep 17 00:00:00 2001
From: Chirag Aggarwal <chiragaggarwal5k@gmail.com>
Date: Thu, 8 Oct 2026 13:48:05 +0100
Subject: [PATCH] feat: advertise WAF tools to API-key sessions

The WAF rule endpoints accept project API keys (wafRules.read and wafRules.write), but waf was missing from the API-key allowlist, so local API-key sessions never listed its tools. Also applies ruff format to server.py.
---
 src/mcp_server_appwrite/catalog_policy.py |  1 +
 src/mcp_server_appwrite/server.py         | 34 +++++++++++++----------
 tests/unit/test_server.py                 |  6 ++--
 3 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/src/mcp_server_appwrite/catalog_policy.py b/src/mcp_server_appwrite/catalog_policy.py
index 2be5675..0c3b70a 100644
--- a/src/mcp_server_appwrite/catalog_policy.py
+++ b/src/mcp_server_appwrite/catalog_policy.py
@@ -46,6 +46,7 @@
         "tokens",
         "users",
         "vectors_db",
+        "waf",
         "webhooks",
     }
 )
diff --git a/src/mcp_server_appwrite/server.py b/src/mcp_server_appwrite/server.py
index 30fab21..84bbf6f 100644
--- a/src/mcp_server_appwrite/server.py
+++ b/src/mcp_server_appwrite/server.py
@@ -1014,14 +1014,16 @@ def execute_registered_tool(
             setattr(
                 client,
                 "call",
-                lambda method, path="", headers=None, params=None, response_type="json": _bounded_binary_client_call(
-                    client,
-                    name,
-                    method,
-                    path,
-                    headers,
-                    params,
-                    response_type,
+                lambda method, path="", headers=None, params=None, response_type="json": (
+                    _bounded_binary_client_call(
+                        client,
+                        name,
+                        method,
+                        path,
+                        headers,
+                        params,
+                        response_type,
+                    )
                 ),
             )
             try:
@@ -1681,13 +1683,15 @@ def build_operator(
 
     return Operator(
         tools_manager,
-        lambda tool_name, tool_arguments, target_project=None, organization_id=None: execute_registered_tool(
-            tools_manager,
-            tool_name,
-            tool_arguments,
-            client=client,
-            target_project=target_project,
-            organization_id=organization_id,
+        lambda tool_name, tool_arguments, target_project=None, organization_id=None: (
+            execute_registered_tool(
+                tools_manager,
+                tool_name,
+                tool_arguments,
+                client=client,
+                target_project=target_project,
+                organization_id=organization_id,
+            )
         ),
         context_provider=lambda arguments: _get_context_for_request(arguments, client),
         docs_search=docs_search,
diff --git a/tests/unit/test_server.py b/tests/unit/test_server.py
index 1d86613..e83a360 100644
--- a/tests/unit/test_server.py
+++ b/tests/unit/test_server.py
@@ -1033,8 +1033,10 @@ def test_api_key_profile_only_advertises_server_capabilities(self):
         service_names = {service.service_name for service in manager.services}
         tool_names = {tool.name for tool in manager.get_all_tools()}
 
-        self.assertEqual(len(manager.services), 26)
-        self.assertEqual(len(tool_names), 663)
+        self.assertEqual(len(manager.services), 27)
+        self.assertEqual(len(tool_names), 676)
+        self.assertIn("waf_list_rules", tool_names)
+        self.assertIn("waf_create_deny_rule", tool_names)
         self.assertIn("avatars_get_photo", tool_names)
         self.assertIn("project_update_o_auth2_hugging_face", tool_names)
         self.assertIn("documents_db_list", tool_names)