[FIX][UI]: Include public MCP objects in team-scoped server associations

[gcgoncalves]

🐛 Bug-fix PR

📌 Summary

When editing a team server, include selected objects from public MCP servers on saving.

Screen.Recording.2026-03-06.at.09.29.18.mov

Closes #3446

🔁 Reproduction Steps

Link the issue and minimal steps to reproduce the bug.

🐞 Root Cause

There was a filter for team items on the saving and fetching logic.

💡 Fix Description

Enabled both the team and public ones on the saving and fetching conditions.

🧪 Verification

Check	Command	Status
Lint suite	make lint	✅
Unit tests	make test	✅
Coverage ≥ 80 %	make coverage	✅
Manual regression no longer fails	steps / screenshots	✅

✅ Checklist

• Code formatted (make black isort pre-commit)
• No secrets/credentials committed

[crivetimihai]

Thanks @gcgoncalves. This is a solid fix for #3446 — the _merge_select_all_ids() extraction is a nice improvement over the duplicated inline logic, and the standalone visibility == 'public' condition correctly ensures platform-public items aren't silently dropped from team-scoped queries. Two items: (1) the CI checks are failing — please investigate and fix, (2) the title should follow the naming convention (e.g. [FIX][UI]: ...). The test coverage looks good.

[crivetimihai]

Review & Changes

Rebased onto main (clean, no conflicts) and performed a thorough code review + manual Playwright testing.

Code Review

The fix is well-designed with two complementary changes:

1. _merge_select_all_ids helper — refactors duplicated Select All parsing from admin_add_server/admin_edit_server into a reusable function. Key behavior change: takes the union of server-fetched IDs and UI-checked IDs (instead of replacing), so public items are never silently dropped on save.

2. /ids endpoints include public items in team-scoped queries — adds standalone visibility='public' OR condition to admin_get_all_tool_ids, admin_get_all_prompt_ids, and admin_get_all_resource_ids when team_id is set, so "Select All" count matches what's visible in the UI.

No security or performance concerns — public-visibility items are platform-wide by design, and downstream persistence code enforces final access control.

Manual Testing (Playwright)

Test	Result
Create server in team-alpha with "View Public" + Select All tools	PASS — 6 tools (2 team + 4 public) associated
Edit server, save without changes	PASS — all 6 tools preserved after save
API verification of tool associations after edit	PASS — all 6 tool IDs confirmed
/tools/ids?team_id=... returns public items	PASS — 6 IDs returned

My Changes (second commit)

Added 9 tests for 100% differential coverage:

• TestMergeSelectAllIds (7 tests): Direct unit tests for all branches of _merge_select_all_ids — flag not set, valid merge, int normalization, JSON decode error, missing key, empty checked list
• test_admin_get_all_prompt_ids_team_scoped_includes_public: Regression test for prompts /ids endpoint
• test_admin_get_all_resource_ids_team_scoped_includes_public: Regression test for resources /ids endpoint

All 1044 tests pass.

Note (non-blocking)

The /ids endpoints for tools/resources/prompts now unconditionally include public items when team_id is set, while the listing/search endpoints and the gateways /ids endpoint use an explicit include_public parameter. This minor inconsistency is acceptable for a bug fix — the unconditional approach is the safest default to prevent data loss. Could be harmonized in a future follow-up if desired.

[crivetimihai]

Approved. Code is correct, well-tested, and manually verified with Playwright. Added differential test coverage.