feat(multi-tenant): resolve per-caller credentials in every tool

All 20 tools now drop the athlete_id/api_key parameters and instead resolve the
authenticated caller's stored, enabled credentials via
credentials.resolve_caller_credentials() (get_access_token().subject -> store).

Security: there is no tool parameter a caller can pass to supply a key, so a
disabled/unapproved user cannot bypass the admin-approval gate — each tool
returns a helpful "not approved / set up your credentials" message instead.
Gear resolution now uses the caller's athlete id rather than an env var.

Tests: conftest autouse fixture runs tool tests as an enabled user; a
parametrized test asserts every tool refuses when unauthorized; existing tool
tests updated (no more athlete_id/api_key kwargs). 221 passing at 91.5%.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/conftest.py

@@ -0,0 +1,22 @@
+"""Shared test fixtures."""
+
+import pytest
+
+from intervals_mcp_server import credentials
+
+
+@pytest.fixture(autouse=True)
+def _default_caller_credentials(monkeypatch):
+    """Run tool tests as an enabled user with fixed credentials.
+
+    Tools resolve the caller via ``credentials.resolve_caller_credentials()``;
+    patching the module attribute covers every tool at once. A test can override
+    this (e.g. patch it to raise ``CredentialError``) to exercise the not-approved
+    path. Tests that exercise the resolver itself import the function directly and
+    are unaffected.
+    """
+
+    async def _creds():
+        return ("i1", "testkey")
+
+    monkeypatch.setattr(credentials, "resolve_caller_credentials", _creds)

tests/test_activities.py

@@ -75,7 +75,7 @@ def test_format_response_empty_named_hint():
 # --------------------------------------------------------------------------- #
 def test_get_activities_error(monkeypatch):
     _patch_request(monkeypatch, lambda _n, _k: {"error": True, "message": "rate limited"})
-    out = asyncio.run(activities.get_activities(athlete_id="i1"))
+    out = asyncio.run(activities.get_activities())
     assert "Error fetching activities: rate limited" in out
 
 
@@ -87,7 +87,7 @@ def test_get_activities_requests_triple_limit_and_filters(monkeypatch):
 
     calls = _patch_request(monkeypatch, handler)
     out = asyncio.run(
-        activities.get_activities(athlete_id="i1", start_date="2026-06-01", end_date="2026-06-30", limit=5)
+        activities.get_activities(start_date="2026-06-01", end_date="2026-06-30", limit=5)
     )
     assert calls[0]["params"]["limit"] == 15  # limit * 3 when filtering unnamed
     assert len(calls) == 2  # topped up because named < limit
@@ -97,7 +97,7 @@ def test_get_activities_requests_triple_limit_and_filters(monkeypatch):
 
 def test_get_activities_include_unnamed_no_topup(monkeypatch):
     calls = _patch_request(monkeypatch, lambda _n, _k: [{"name": "Unnamed", "id": 1, "distance": 5}])
-    out = asyncio.run(activities.get_activities(athlete_id="i1", include_unnamed=True, limit=10))
+    out = asyncio.run(activities.get_activities(include_unnamed=True, limit=10))
     assert calls[0]["params"]["limit"] == 10  # no *3
     assert len(calls) == 1  # no fetch-more
     assert "Activities:" in out

tests/test_credentials.py

@@ -51,6 +51,20 @@ def test_no_token_falls_back_to_env_config(monkeypatch):
     assert asyncio.run(resolve_caller_credentials()) == ("i999", "envkey")
 
 
+def test_get_access_token_raising_is_treated_as_no_context(monkeypatch):
+    # outside a request the SDK accessor may raise; that must fall back to env config
+    def _boom():
+        raise RuntimeError("no request context")
+
+    monkeypatch.setattr(credentials, "get_access_token", _boom)
+    monkeypatch.setattr(
+        credentials,
+        "get_config",
+        lambda: Config(api_key="envkey", athlete_id="i999", intervals_api_base_url="x", user_agent="t"),
+    )
+    assert asyncio.run(resolve_caller_credentials()) == ("i999", "envkey")
+
+
 def test_no_token_no_env_raises(monkeypatch):
     monkeypatch.setattr(credentials, "get_access_token", lambda: None)
     monkeypatch.setattr(

tests/test_custom_items.py

@@ -38,19 +38,19 @@ def _run(coro):
 # --------------------------------------------------------------------------- #
 def test_get_custom_items_lists(monkeypatch):
     _patch(monkeypatch, lambda _k: [{"id": 1, "name": "Zones", "type": "ZONES", "description": "d"}])
-    out = _run(custom_items.get_custom_items(athlete_id="i1"))
+    out = _run(custom_items.get_custom_items())
     assert "Custom Items:" in out
     assert "ID: 1" in out and "Name: Zones" in out and "Type: ZONES" in out
 
 
 def test_get_custom_items_error(monkeypatch):
     _patch(monkeypatch, lambda _k: {"error": True, "message": "boom"})
-    assert "Error fetching custom items: boom" in _run(custom_items.get_custom_items(athlete_id="i1"))
+    assert "Error fetching custom items: boom" in _run(custom_items.get_custom_items())
 
 
 def test_get_custom_item_by_id_not_found(monkeypatch):
     _patch(monkeypatch, lambda _k: [])  # falsy / not a dict
-    assert "No custom item found with ID 7" in _run(custom_items.get_custom_item_by_id(7, athlete_id="i1"))
+    assert "No custom item found with ID 7" in _run(custom_items.get_custom_item_by_id(7))
 
 
 # --------------------------------------------------------------------------- #
@@ -60,7 +60,7 @@ def test_create_builds_full_payload(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": 9, "name": "Chart", "type": "FITNESS_CHART"})
     out = _run(
         custom_items.create_custom_item(
-            name="Chart", item_type="FITNESS_CHART", athlete_id="i1",
+            name="Chart", item_type="FITNESS_CHART", 
             description="desc", content={"a": 1}, visibility="PRIVATE",
         )
     )
@@ -78,7 +78,7 @@ def test_create_parses_json_string_content(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": 1, "name": "X", "type": "ZONES"})
     _run(
         custom_items.create_custom_item(
-            name="X", item_type="ZONES", athlete_id="i1", content='{"expression": "icu_training_load"}'
+            name="X", item_type="ZONES", content='{"expression": "icu_training_load"}'
         )
     )
     assert rec.calls[0]["data"]["content"] == {"expression": "icu_training_load"}  # parsed to dict
@@ -87,7 +87,7 @@ def test_create_parses_json_string_content(monkeypatch):
 def test_create_rejects_invalid_json_string(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": 1})
     out = _run(
-        custom_items.create_custom_item(name="X", item_type="ZONES", athlete_id="i1", content="{not json")
+        custom_items.create_custom_item(name="X", item_type="ZONES", content="{not json")
     )
     assert "content must be valid JSON" in out
     assert rec.calls == []  # bailed before any request
@@ -95,7 +95,7 @@ def test_create_rejects_invalid_json_string(monkeypatch):
 
 def test_create_error_surfaced(monkeypatch):
     _patch(monkeypatch, lambda _k: {"error": True, "message": "bad type"})
-    out = _run(custom_items.create_custom_item(name="X", item_type="NOPE", athlete_id="i1"))
+    out = _run(custom_items.create_custom_item(name="X", item_type="NOPE"))
     assert "Error creating custom item: bad type" in out
 
 
@@ -104,7 +104,7 @@ def test_create_error_surfaced(monkeypatch):
 # --------------------------------------------------------------------------- #
 def test_update_sends_only_provided_fields_via_put(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": 5, "name": "New", "type": "ZONES"})
-    _run(custom_items.update_custom_item(item_id=5, athlete_id="i1", name="New"))
+    _run(custom_items.update_custom_item(item_id=5, name="New"))
     call = rec.calls[0]
     assert call["method"] == "PUT"
     assert call["url"] == "/athlete/i1/custom-item/5"
@@ -113,7 +113,7 @@ def test_update_sends_only_provided_fields_via_put(monkeypatch):
 
 def test_update_invalid_json_string(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": 5})
-    out = _run(custom_items.update_custom_item(item_id=5, athlete_id="i1", content="{bad"))
+    out = _run(custom_items.update_custom_item(item_id=5, content="{bad"))
     assert "content must be valid JSON" in out
     assert rec.calls == []
 
@@ -123,7 +123,7 @@ def test_update_invalid_json_string(monkeypatch):
 # --------------------------------------------------------------------------- #
 def test_delete_uses_delete_method(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {})
-    out = _run(custom_items.delete_custom_item(item_id=3, athlete_id="i1"))
+    out = _run(custom_items.delete_custom_item(item_id=3))
     call = rec.calls[0]
     assert call["method"] == "DELETE"
     assert call["url"] == "/athlete/i1/custom-item/3"
@@ -132,4 +132,4 @@ def test_delete_uses_delete_method(monkeypatch):
 
 def test_delete_error(monkeypatch):
     _patch(monkeypatch, lambda _k: {"error": True, "message": "locked"})
-    assert "Error deleting custom item: locked" in _run(custom_items.delete_custom_item(item_id=3, athlete_id="i1"))
+    assert "Error deleting custom item: locked" in _run(custom_items.delete_custom_item(item_id=3))

tests/test_events.py

@@ -74,7 +74,7 @@ def test_handle_event_response_branches(result, action, needle):
 # --------------------------------------------------------------------------- #
 def test_get_events_sends_date_params_and_formats(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: [{"start_date_local": "2026-07-10", "id": "e1", "name": "Race", "race": True}])
-    out = _run(events.get_events(athlete_id="i1", start_date="2026-07-01", end_date="2026-07-31"))
+    out = _run(events.get_events(start_date="2026-07-01", end_date="2026-07-31"))
     call = rec.calls[0]
     assert call["url"] == "/athlete/i1/events"
     assert call["params"] == {"oldest": "2026-07-01", "newest": "2026-07-31"}
@@ -83,25 +83,25 @@ def test_get_events_sends_date_params_and_formats(monkeypatch):
 
 def test_get_events_error_surfaced(monkeypatch):
     _patch(monkeypatch, lambda _k: {"error": True, "message": "rate limited"})
-    out = _run(events.get_events(athlete_id="i1"))
+    out = _run(events.get_events())
     assert "Error fetching events: rate limited" in out
 
 
 def test_get_events_empty(monkeypatch):
     _patch(monkeypatch, lambda _k: [])
-    out = _run(events.get_events(athlete_id="i1"))
+    out = _run(events.get_events())
     assert "No events found" in out
 
 
 def test_get_event_by_id_invalid_format(monkeypatch):
     _patch(monkeypatch, lambda _k: [1, 2, 3])  # list, not a dict
-    out = _run(events.get_event_by_id("e1", athlete_id="i1"))
+    out = _run(events.get_event_by_id("e1"))
     assert "Invalid event format" in out
 
 
 def test_get_event_by_id_error(monkeypatch):
     _patch(monkeypatch, lambda _k: {"error": True, "message": "nope"})
-    out = _run(events.get_event_by_id("e1", athlete_id="i1"))
+    out = _run(events.get_event_by_id("e1"))
     assert "Error fetching event details: nope" in out
 
 
@@ -112,7 +112,7 @@ def test_add_event_posts_when_no_event_id(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": "e99"})
     out = _run(
         events.add_or_update_event(
-            workout_type="Ride", name="Threshold", athlete_id="i1",
+            workout_type="Ride", name="Threshold", 
             start_date="2026-07-10", moving_time=3600, distance=40000,
             workout_doc=WorkoutDoc(description="d", steps=[Step(duration=600)]),
         )
@@ -128,7 +128,7 @@ def test_update_event_puts_when_event_id(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": "e5"})
     _run(
         events.add_or_update_event(
-            workout_type="Ride", name="Threshold", athlete_id="i1",
+            workout_type="Ride", name="Threshold", 
             event_id="e5", start_date="2026-07-10",
         )
     )
@@ -139,13 +139,13 @@ def test_update_event_puts_when_event_id(monkeypatch):
 
 def test_add_event_invalid_date_returns_error(monkeypatch):
     _patch(monkeypatch, lambda _k: {"id": "e1"})
-    out = _run(events.add_or_update_event(workout_type="Ride", name="X", athlete_id="i1", start_date="07/10/2026"))
+    out = _run(events.add_or_update_event(workout_type="Ride", name="X", start_date="07/10/2026"))
     assert out.startswith("Error:")
 
 
 def test_add_note_uses_note_category_and_color(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"id": "n1"})
-    _run(events.add_or_update_note(name="Sick day", description="rest", athlete_id="i1", start_date="2026-07-10", color="red"))
+    _run(events.add_or_update_note(name="Sick day", description="rest", start_date="2026-07-10", color="red"))
     data = rec.calls[0]["data"]
     assert data["category"] == "NOTE"
     assert data["color"] == "red"
@@ -157,13 +157,13 @@ def test_add_note_uses_note_category_and_color(monkeypatch):
 # --------------------------------------------------------------------------- #
 def test_delete_event_requires_id(monkeypatch):
     _patch(monkeypatch, lambda _k: {})
-    out = _run(events.delete_event("", athlete_id="i1"))
+    out = _run(events.delete_event(""))
     assert "No event ID provided" in out
 
 
 def test_delete_event_uses_delete_method(monkeypatch):
     rec = _patch(monkeypatch, lambda _k: {"deleted": True})
-    _run(events.delete_event("e7", athlete_id="i1"))
+    _run(events.delete_event("e7"))
     call = rec.calls[0]
     assert call["method"] == "DELETE"
     assert call["url"] == "/athlete/i1/events/e7"
@@ -176,12 +176,12 @@ def test_delete_by_range_counts_successes_and_failures(monkeypatch):
         return [{"id": 1}, {"id": 2}]  # the GET listing
 
     _patch(monkeypatch, handler)
-    out = _run(events.delete_events_by_date_range("2026-07-01", "2026-07-31", athlete_id="i1"))
+    out = _run(events.delete_events_by_date_range("2026-07-01", "2026-07-31"))
     assert "Deleted 1 events" in out
     assert "Failed to delete 1 events: [2]" in out
 
 
 def test_delete_by_range_fetch_error(monkeypatch):
     _patch(monkeypatch, lambda _k: {"error": True, "message": "boom"})
-    out = _run(events.delete_events_by_date_range("2026-07-01", "2026-07-31", athlete_id="i1"))
+    out = _run(events.delete_events_by_date_range("2026-07-01", "2026-07-31"))
     assert "Error deleting events: boom" in out

tests/test_server.py

@@ -74,7 +74,7 @@ def test_get_activities(monkeypatch):
     monkeypatch.setattr(
         "intervals_mcp_server.tools.activities.make_intervals_request", fake_request
     )
-    result = asyncio.run(get_activities(athlete_id="1", limit=1, include_unnamed=True))
+    result = asyncio.run(get_activities(limit=1, include_unnamed=True))
     assert "Morning Ride" in result
     assert "Activities:" in result
 
@@ -122,7 +122,7 @@ def test_get_events(monkeypatch):
     # Patch in both api.client and tools modules to ensure it works
     monkeypatch.setattr("intervals_mcp_server.api.client.make_intervals_request", fake_request)
     monkeypatch.setattr("intervals_mcp_server.tools.events.make_intervals_request", fake_request)
-    result = asyncio.run(get_events(athlete_id="1", start_date="2024-01-01", end_date="2024-01-02"))
+    result = asyncio.run(get_events(start_date="2024-01-01", end_date="2024-01-02"))
     assert "Test Event" in result
     assert "Events:" in result
 
@@ -145,7 +145,7 @@ def test_get_event_by_id(monkeypatch):
     # Patch in both api.client and tools modules to ensure it works
     monkeypatch.setattr("intervals_mcp_server.api.client.make_intervals_request", fake_request)
     monkeypatch.setattr("intervals_mcp_server.tools.events.make_intervals_request", fake_request)
-    result = asyncio.run(get_event_by_id("e1", athlete_id="1"))
+    result = asyncio.run(get_event_by_id("e1"))
     assert "Event Details:" in result
     assert "Test Event" in result
 
@@ -168,7 +168,7 @@ def test_get_wellness_data(monkeypatch):
     # Patch in both api.client and tools modules to ensure it works
     monkeypatch.setattr("intervals_mcp_server.api.client.make_intervals_request", fake_request)
     monkeypatch.setattr("intervals_mcp_server.tools.wellness.make_intervals_request", fake_request)
-    result = asyncio.run(get_wellness_data(athlete_id="1"))
+    result = asyncio.run(get_wellness_data())
     assert "Wellness Data:" in result
     assert "2024-01-01" in result
 
@@ -193,7 +193,7 @@ def test_get_wellness_data_renders_macros(monkeypatch):
 
     monkeypatch.setattr("intervals_mcp_server.api.client.make_intervals_request", fake_request)
     monkeypatch.setattr("intervals_mcp_server.tools.wellness.make_intervals_request", fake_request)
-    result = asyncio.run(get_wellness_data(athlete_id="1"))
+    result = asyncio.run(get_wellness_data())
     assert "Wellness Data:" in result
     assert "2026-04-08" in result
     assert "Nutrition & Hydration:" in result
@@ -220,7 +220,7 @@ def test_get_wellness_data_include_all_fields(monkeypatch):
 
     monkeypatch.setattr("intervals_mcp_server.api.client.make_intervals_request", fake_request)
     monkeypatch.setattr("intervals_mcp_server.tools.wellness.make_intervals_request", fake_request)
-    result = asyncio.run(get_wellness_data(athlete_id="1", include_all_fields=True))
+    result = asyncio.run(get_wellness_data(include_all_fields=True))
     assert "Wellness Data:" in result
     assert "2024-01-01" in result
     assert "Fitness (CTL): 75" in result
@@ -321,7 +321,7 @@ def test_add_or_update_event(monkeypatch):
     )
     result = asyncio.run(
         add_or_update_event(
-            athlete_id="i1", start_date="2024-01-15", name="Test Workout", workout_type="Ride"
+            start_date="2024-01-15", name="Test Workout", workout_type="Ride"
         )
     )
     assert "Successfully created event id:" in result
@@ -465,7 +465,7 @@ def test_get_athlete_power_curves(monkeypatch):
     result = asyncio.run(
         get_athlete_power_curves(
             activity_type="Ride",
-            athlete_id="i1",
+            
         )
     )
     assert "Power Curves (Ride):" in result
@@ -492,7 +492,7 @@ def test_get_athlete_power_curves_custom_durations(monkeypatch):
         get_athlete_power_curves(
             activity_type="Ride",
             durations=[5, 60],
-            athlete_id="i1",
+            
         )
     )
     assert "5s:" in result
@@ -518,7 +518,7 @@ def test_get_athlete_power_curves_without_normalised(monkeypatch):
         get_athlete_power_curves(
             activity_type="Ride",
             include_normalised=False,
-            athlete_id="i1",
+            
         )
     )
     assert "W/kg" not in result
@@ -542,7 +542,7 @@ def test_get_athlete_power_curves_date_validation(monkeypatch):
         get_athlete_power_curves(
             activity_type="Ride",
             start_date="2026-01-01",
-            athlete_id="i1",
+            
         )
     )
     assert "Error" in result
@@ -566,7 +566,7 @@ def test_get_athlete_power_curves_no_curves_selected(monkeypatch):
             activity_type="Ride",
             this_season=False,
             last_season=False,
-            athlete_id="i1",
+            
         )
     )
     assert "Error" in result
@@ -590,7 +590,7 @@ def test_get_custom_items(monkeypatch):
     monkeypatch.setattr(
         "intervals_mcp_server.tools.custom_items.make_intervals_request", fake_request
     )
-    result = asyncio.run(get_custom_items(athlete_id="1"))
+    result = asyncio.run(get_custom_items())
     assert "Custom Items:" in result
     assert "HR Zones" in result
     assert "ZONES" in result
@@ -617,7 +617,7 @@ def test_get_custom_item_by_id(monkeypatch):
     monkeypatch.setattr(
         "intervals_mcp_server.tools.custom_items.make_intervals_request", fake_request
     )
-    result = asyncio.run(get_custom_item_by_id(item_id=1, athlete_id="1"))
+    result = asyncio.run(get_custom_item_by_id(item_id=1))
     assert "Custom Item Details:" in result
     assert "HR Zones" in result
     assert "ZONES" in result
@@ -645,7 +645,7 @@ def test_create_custom_item(monkeypatch):
         "intervals_mcp_server.tools.custom_items.make_intervals_request", fake_request
     )
     result = asyncio.run(
-        create_custom_item(name="New Chart", item_type="FITNESS_CHART", athlete_id="1")
+        create_custom_item(name="New Chart", item_type="FITNESS_CHART")
     )
     assert "Successfully created custom item:" in result
     assert "New Chart" in result
@@ -675,7 +675,7 @@ def test_create_custom_item_with_string_content(monkeypatch):
         create_custom_item(
             name="Activity Field",
             item_type="ACTIVITY_FIELD",
-            athlete_id="1",
+            
             content='{"expression": "icu_training_load"}',  # type: ignore[arg-type]
         )
     )
@@ -705,7 +705,7 @@ def test_update_custom_item(monkeypatch):
         "intervals_mcp_server.tools.custom_items.make_intervals_request", fake_request
     )
     result = asyncio.run(
-        update_custom_item(item_id=1, name="Updated Chart", athlete_id="1")
+        update_custom_item(item_id=1, name="Updated Chart")
     )
     assert "Successfully updated custom item:" in result
     assert "Updated Chart" in result
@@ -724,7 +724,7 @@ def test_delete_custom_item(monkeypatch):
     monkeypatch.setattr(
         "intervals_mcp_server.tools.custom_items.make_intervals_request", fake_request
     )
-    result = asyncio.run(delete_custom_item(item_id=1, athlete_id="1"))
+    result = asyncio.run(delete_custom_item(item_id=1))
     assert "Successfully deleted" in result
 
 
@@ -744,7 +744,7 @@ def test_create_custom_item_with_invalid_json_content(monkeypatch):
         create_custom_item(
             name="Bad Item",
             item_type="FITNESS_CHART",
-            athlete_id="1",
+            
             content="not valid json",  # type: ignore[arg-type]
         )
     )
@@ -790,7 +790,7 @@ def test_get_gear_list(monkeypatch):
         "intervals_mcp_server.tools.gear.make_intervals_request", fake_request
     )
 
-    result = asyncio.run(get_gear_list(athlete_id="i1"))
+    result = asyncio.run(get_gear_list())
 
     assert "Gear catalog for athlete i1:" in result
     assert "Litening Air" in result
@@ -814,7 +814,7 @@ def test_get_gear_list_empty(monkeypatch):
         "intervals_mcp_server.tools.gear.make_intervals_request", fake_request
     )
 
-    result = asyncio.run(get_gear_list(athlete_id="i1"))
+    result = asyncio.run(get_gear_list())
     assert "No gear found" in result
 
 
@@ -845,15 +845,15 @@ def test_get_gear_list_cache_and_refresh(monkeypatch):
     )
 
     # First call: cache cold, one API hit expected.
-    asyncio.run(get_gear_list(athlete_id="i1"))
+    asyncio.run(get_gear_list())
     assert call_count["n"] == 1
 
     # Second call: cache warm, no additional API hit.
-    asyncio.run(get_gear_list(athlete_id="i1"))
+    asyncio.run(get_gear_list())
     assert call_count["n"] == 1
 
     # refresh=True busts the cache and triggers a fresh fetch.
-    asyncio.run(get_gear_list(athlete_id="i1", refresh=True))
+    asyncio.run(get_gear_list(refresh=True))
     assert call_count["n"] == 2
 
 
@@ -944,7 +944,7 @@ def test_get_activities_resolves_gear_name(monkeypatch):
         "intervals_mcp_server.tools.gear.make_intervals_request", fake_request
     )
 
-    result = asyncio.run(get_activities(athlete_id="1", limit=2, include_unnamed=True))
+    result = asyncio.run(get_activities(limit=2, include_unnamed=True))
     assert "Ride 1" in result
     assert "Ride 2" in result
     assert "Name: Litening Air" in result

tests/test_tool_auth.py

@@ -0,0 +1,55 @@
+"""
+Every tool must refuse to act (and surface a helpful message) when the caller
+has no usable credentials — a disabled/unapproved user, or one who hasn't set up
+their Intervals.icu key. This guards the admin-approval gate: there is no tool
+parameter a caller can pass to bypass it.
+"""
+
+import asyncio
+
+import pytest
+
+from intervals_mcp_server import credentials
+from intervals_mcp_server.credentials import CredentialError
+from intervals_mcp_server.tools import activities, custom_items, events, gear, power_curves, wellness
+
+# (tool callable, minimal required positional args)
+TOOL_CALLS = [
+    (activities.get_activities, ()),
+    (activities.get_activity_details, ("1",)),
+    (activities.get_activity_intervals, ("1",)),
+    (activities.get_activity_streams, ("1",)),
+    (activities.get_activity_messages, ("1",)),
+    (activities.add_activity_message, ("1", "hi")),
+    (events.get_events, ()),
+    (events.get_event_by_id, ("e1",)),
+    (events.delete_event, ("e1",)),
+    (events.delete_events_by_date_range, ("2026-07-01", "2026-07-31")),
+    (events.add_or_update_event, ("Ride", "Name")),
+    (events.add_or_update_note, ("Name", "desc")),
+    (wellness.get_wellness_data, ()),
+    (power_curves.get_athlete_power_curves, ()),
+    (gear.get_gear_list, ()),
+    (custom_items.get_custom_items, ()),
+    (custom_items.get_custom_item_by_id, (1,)),
+    (custom_items.create_custom_item, ("N", "TYPE")),
+    (custom_items.update_custom_item, (1,)),
+    (custom_items.delete_custom_item, (1,)),
+]
+
+
+async def _deny():
+    raise CredentialError("ACCOUNT NOT APPROVED")
+
+
+@pytest.mark.parametrize("func,args", TOOL_CALLS, ids=[f.__name__ for f, _ in TOOL_CALLS])
+def test_tool_returns_message_when_unauthorized(monkeypatch, func, args):
+    # override the autouse fixture: the caller has no usable credentials
+    monkeypatch.setattr(credentials, "resolve_caller_credentials", _deny)
+    result = asyncio.run(func(*args))
+    assert result == "ACCOUNT NOT APPROVED"
+
+
+def test_all_20_tools_covered():
+    """Guard: if a tool is added, add it here so its auth gate is tested."""
+    assert len(TOOL_CALLS) == 20