Add an end-to-end test suite against a real ActiveAdmin install

[lloydwatkin]

Every spec in this repo was a unit test against mocks — nothing booted Rails, mounted the engine, or served an HTTP request. So the README's claims (the installer wires it up, Bearer tokens authenticate, permit_params is enforced, resources without an update action are refused) were verified only against mocks of the surrounding framework.

This adds spec/e2e/, which generates a real Rails 7.2 + ActiveAdmin + Devise application into tmp/e2e_app, installs this gem into it through the gem's own activeadmin_mcp:install --auth devise_token generator, boots it under Puma, and drives the mounted /mcp endpoint over HTTP with a real API token.

No browser is involved — the MCP endpoint is plain JSON-RPC over HTTP, so one would add nothing.

What it covers

19 examples:

• Install — ActiveAdmin present, the gem's initializer written with authentication_method = :devise_token, the token migration and MCP Tokens admin page generated, the fixture tables migrated
• Protocol — initialize returns protocol 2025-06-18 and the right serverInfo; tools/list advertises exactly the three tools
• Auth — missing token and unknown token both get HTTP 401 with JSON-RPC -32000; the minted token gets 200
• list_resources — resources and attributes, with Devise's sensitive columns filtered out of a real AdminUser table
• query — Ransack filtering, limit, unknown resource returns an error rather than raising
• update — a permitted attribute persists; an unpermitted one (slug) is dropped; a resource registered actions :index, :show is refused; a missing record returns an error

The two fixture resources are chosen so each claim has something to bite on: Post permits only title and body, and Author registers no update action.

Why this is worth the machinery

The auth examples are the only coverage McpController has anywhere in the repo. The permit-drop example reaches RecordUpdater#from_permit_params, which instantiates the real ActiveAdmin controller and reads its compiled permitted params — a path that cannot be honestly unit-tested. And getting a 200 from POST /mcp at all proves the engine's :prepend mount strategy works inside a real ActiveAdmin route set.

The suite was checked for vacuity by hand: permitting slug in the generated app makes the relevant example fail with expected: ["title"], got: ["title", "slug"].

Running it

bundle exec rake spec   # unit specs, unchanged, 71 examples
bundle exec rake e2e    # end-to-end, 19 examples

The generated app is cached by a fingerprint of the builder, so only the first run is slow (a full bundle install, and a gem install rails -v 7.2.2.2 if that version is absent). E2E_REBUILD=1 forces a rebuild. Documented in the README's new "Running the tests" section.

A CI job runs it on every PR, caching tmp/e2e_app and uploading the Rails log on failure.

Known issue this surfaced, deliberately not fixed here

RequestHandler#tool_query calls model.ransack(q) unguarded, and McpController rescues only JSON::ParserError. On Ransack 4, a host model that has not allowlisted ransackable_attributes therefore raises straight through the controller and the MCP client receives an HTML 500 instead of a JSON-RPC error. That is most applications that have not done the ActiveAdmin 3 upgrade chore.

The e2e builder works around it by writing ransackable_attributes onto the fixture models, and the README now documents the requirement — but the library should degrade gracefully instead. That is a change to lib/ behaviour and belongs in its own PR.

Notes for review

• The CI cache fix in the last commit addresses a bug where a cache hit restored the generated app without its bundle (gems were installing to the system gem home, outside the cached directory), which would have failed every run after the first. It has only been exercised locally — the failure only appears on the second CI run, so it's worth watching two runs before trusting it.
• gem "json", "< 2.9" is pinned in the generated app's Gemfile: Rails 7.2's ActiveSupport::JSON.decode calls JSON.parse(json, quirks_mode: true) and the json gem removed that keyword in 2.9.0.
• CLAUDE.md is new, recording that MCP actions need e2e coverage rather than unit specs alone.

🤖 Generated with Claude Code