fix: harden project writes and uploads

tests/test_server.py

@@ -2,6 +2,9 @@ import asyncio
 import unittest
 from unittest.mock import patch
 
+import httpx
+from starlette.responses import JSONResponse
+
 from nocobase_crm_mcp.server import (
     DEFAULT_HTTP_HOST,
     DEFAULT_HTTP_PATH,
@@ -77,9 +80,8 @@ class FakeProjectService:
 
 
 class FakeUploadEndpoint:
-    async def __call__(self, scope, receive, send):
-        await send({"type": "http.response.start", "status": 200, "headers": []})
-        await send({"type": "http.response.body", "body": b"uploaded"})
+    async def __call__(self, request):
+        return JSONResponse({"uploaded": True})
 
 
 class ServerTests(unittest.TestCase):
@@ -150,6 +152,25 @@ class ServerTests(unittest.TestCase):
 
         self.assertEqual(run_asgi_request(app, path="/uploads")[0]["status"], 401)
 
+    def test_upload_route_accepts_the_matching_bearer_token(self) -> None:
+        if FastMCP is None:
+            self.skipTest("MCP SDK is not installed")
+
+        server = create_server(crm_service=FakeCrmService(), readonly=True)
+
+        async def upload_endpoint(request):
+            return JSONResponse({"uploaded": True})
+
+        app = create_http_app(server, "secret", upload_endpoint=upload_endpoint)
+
+        async def request_upload() -> httpx.Response:
+            async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app), base_url="http://testserver") as client:
+                return await client.post("/uploads", headers={"Authorization": "Bearer secret"})
+
+        response = asyncio.run(request_upload())
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.json(), {"uploaded": True})
+
     def test_http_write_mode_requires_upload_api_base_url(self) -> None:
         with patch.dict("os.environ", {"NOCOBASE_MCP_TOKEN": "secret"}, clear=True):
             with patch("uvicorn.run") as uvicorn_run: