test: fix a2a diff-cover regressions

Signed-off-by: lucarlig <luca.carlig@ibm.com>

Author: lucarlig

tests/unit/mcpgateway/services/test_a2a_protocol.py

@@ -621,6 +621,52 @@ def test_prepare_a2a_invocation_api_key_auth():
     assert prepared.headers["Authorization"] == "Bearer my-api-key"
 
 
+def test_prepare_a2a_invocation_api_key_auth_falls_back_to_raw_value_on_decode_error(monkeypatch):
+    monkeypatch.setattr("mcpgateway.services.a2a_protocol.decode_auth", MagicMock(side_effect=ValueError("boom")))
+
+    prepared = prepare_a2a_invocation(
+        agent_type="generic",
+        endpoint_url="https://example.com/",
+        protocol_version="1.0.0",
+        parameters={"query": "hi"},
+        interaction_type="query",
+        auth_type="api_key",
+        auth_value="raw-api-key",  # pragma: allowlist secret
+    )
+
+    assert prepared.headers["Authorization"] == "Bearer raw-api-key"  # pragma: allowlist secret
+
+
+def test_prepare_a2a_invocation_api_key_auth_uses_decoded_scalar(monkeypatch):
+    monkeypatch.setattr("mcpgateway.services.a2a_protocol.decode_auth", lambda _val: "decoded-key")
+
+    prepared = prepare_a2a_invocation(
+        agent_type="generic",
+        endpoint_url="https://example.com/",
+        protocol_version="1.0.0",
+        parameters={"query": "hi"},
+        interaction_type="query",
+        auth_type="api_key",
+        auth_value="encrypted-api-key",  # pragma: allowlist secret
+    )
+
+    assert prepared.headers["Authorization"] == "Bearer decoded-key"  # pragma: allowlist secret
+
+
+def test_prepare_a2a_invocation_api_key_auth_from_mapping_uses_first_value():
+    prepared = prepare_a2a_invocation(
+        agent_type="generic",
+        endpoint_url="https://example.com/",
+        protocol_version="1.0.0",
+        parameters={"query": "hi"},
+        interaction_type="query",
+        auth_type="api_key",
+        auth_value={"x-api-key": "mapped-key"},  # pragma: allowlist secret
+    )
+
+    assert prepared.headers["Authorization"] == "Bearer mapped-key"  # pragma: allowlist secret
+
+
 def test_prepare_a2a_invocation_rejects_non_mapping_decoded_auth(monkeypatch):
     """A decoded auth value that is not a mapping should raise ValueError."""
     monkeypatch.setattr("mcpgateway.services.a2a_protocol.decode_auth", lambda _val: "not-a-mapping")

tests/unit/mcpgateway/services/test_a2a_server_service.py

@@ -149,6 +149,16 @@ def test_get_server_agent_card_aggregates_skills_from_enabled_agents(self, servi
         assert len(card["skills"]) == 1
         assert card["skills"][0]["id"] == "summarize"
 
+    def test_get_server_agent_card_hidden_server_returns_none(self, service, mock_db):
+        server = _make_server(name="private-server")
+        server.visibility = "private"
+        server.owner_email = "other@example.com"
+        mock_db.execute.return_value.scalar_one_or_none.return_value = server
+
+        result = service.get_server_agent_card(mock_db, "private-server", user_email="user@example.com", token_teams=[])
+
+        assert result is None
+
     # ------------------------------------------------------------------
     # resolve_server_agent
     # ------------------------------------------------------------------
@@ -198,6 +208,27 @@ def test_resolve_server_agent_protocol_version_defaults_to_1_0(self, service, mo
         assert result is not None
         assert result["protocol_version"] == "1.0"
 
+    def test_resolve_server_agent_hidden_server_returns_none(self, service, mock_db):
+        server = _make_server(name="private-server")
+        server.visibility = "private"
+        server.owner_email = "other@example.com"
+        mock_db.execute.return_value.scalar_one_or_none.return_value = server
+
+        result = service.resolve_server_agent(mock_db, "private-server", user_email="user@example.com", token_teams=[])
+
+        assert result is None
+
+    def test_resolve_server_agent_without_a2a_interface_returns_none(self, service, mock_db):
+        server = _make_server(name="srv")
+        mock_db.execute.side_effect = [
+            MagicMock(**{"scalar_one_or_none.return_value": server}),
+            MagicMock(**{"scalar_one_or_none.return_value": None}),
+        ]
+
+        result = service.resolve_server_agent(mock_db, "srv")
+
+        assert result is None
+
     # ------------------------------------------------------------------
     # select_downstream_agent
     # ------------------------------------------------------------------