fix: generate strong per-run JWT secret in plugin integration harness

[madhu-mohan-jaishankar]

Pull Request

🔗 Related Issue

Closes #

---

📝 Summary

The plugin E2E harness defaulted JWT_SECRET_KEY to my-test-key-but-now-longer-than-32-bytes, which is now on the known-weak blocklist (mcpgateway/_security_constants.py) rejected by Settings validation in every environment. As a result, every local make test-plugin-* run failed on both legs:

• the test gateway crashed at startup with SecurityConfigurationError, and
• the pytest legs died at conftest import time (tests/conftest.py → mcpgateway.db → Settings()).

The failure was also masked: a stale uvicorn-launched dev gateway holding port 4444 answered the harness health check, producing a false [info] gateway is up while the real test gateway was crash-looping — so the summary showed pytest failures instead of the actual gateway boot failure.

Changes (local test harness only — CI does not use these files, see Notes):

• tests/live_gateway/plugins/run_plugin_tests.sh: generate a strong random secret per run via openssl rand -base64 48 when none is supplied; the gateway and pytest legs share the same value, so tokens stay consistent within a run.
• tests/live_gateway/plugins/Makefile.plugin-integration: drop the weak default so the runner fallback applies; explicit JWT_SECRET_KEY=... overrides still work.
• Stale-gateway cleanup now also kills uvicorn-launched gateways (uvicorn mcpgateway.main:app), which previously kept the port and fooled wait_for_health into a false "gateway is up".

---

📏 Reviewability

• This PR has one clear purpose
• The linked issue is not labeled triage
• Unrelated bugs or improvements are tracked in separate issues/PRs
• Tests are included with the code they validate
• If AI-assisted, I understand and can explain the generated changes

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Reproduced the failure, applied the fix, and re-ran the affected target end-to-end:

Check	Command	Status
Plugin E2E (before fix)	make test-plugin-pii-filter	❌ 0/2 — SecurityConfigurationError: jwt_secret_key: known-weak/default value rejected
Plugin E2E (after fix)	make test-plugin-pii-filter	✅ 2/2 passed (static + binding)
Generated secret passes validation	JWT_SECRET_KEY="$(openssl rand -base64 48 | tr -d '\n')" python -c "from mcpgateway.config import Settings; Settings()"	✅ constructs cleanly
Lint suite	make lint	N/A — bash/Makefile only, no Python touched
Unit tests	make test	N/A — no runtime code changed
Coverage ≥ 80%	make coverage	N/A — no runtime code changed

Masked-failure repro: start a dev server (python -m uvicorn mcpgateway.main:app --port 4444), run any make test-plugin-* target on main — the harness reports gateway is up even though its own gateway never started (visible in /tmp/gateway-plugin-tests.log).

---

✅ Checklist

• Code formatted (make black isort pre-commit) — N/A for shell/Make changes
• Tests added/updated for changes — the harness is itself test infrastructure; verified live
• Documentation updated (if applicable) — header comments in both files updated
• No secrets or credentials committed — the weak hardcoded secret was removed; secrets are now generated per run and never written to disk

---

📓 Notes (optional)