feat: access tab with allowed roles and connection revocation

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7

tests/Unit/Server/RequestContextTest.php

@@ -18,6 +18,7 @@ final class RequestContextTest extends TestCase
     protected function tearDown(): void
     {
         RequestContext::reset();
+        \WP_Application_Passwords::$items = [];
         parent::tearDown();
     }
 
@@ -99,6 +100,28 @@ final class RequestContextTest extends TestCase
         self::assertSame('https://claude.ai/oauth/mcp-oauth-client-metadata', RequestContext::clientName());
     }
 
+    public function testClientNameUsesTheApplicationPasswordName(): void
+    {
+        Functions\when('get_option')->justReturn('test-secret');
+        \WP_Application_Passwords::$items = [
+            3 => ['uuid-1' => ['uuid' => 'uuid-1', 'name' => 'Claude', 'app_id' => 'https://claude.ai/x']],
+        ];
+        $token = JWT::encode([
+            'sub' => '3',
+            'app_pass_id' => 'uuid-1',
+            'client_id' => 'https://claude.ai/oauth/mcp-oauth-client-metadata',
+            'exp' => time() + 60,
+        ], 'test-secret');
+
+        RequestContext::recordRoute(
+            null,
+            [],
+            new WP_REST_Request(self::ROUTE, ['authorization' => 'Bearer ' . $token])
+        );
+
+        self::assertSame('Claude', RequestContext::clientName());
+    }
+
     public function testClientNameMatchesTheBearerSchemeCaseInsensitively(): void
     {
         Functions\when('get_option')->justReturn('test-secret');