Validate tool edits before touching the connection; scope kept MCP connections

- Editing a connection-backed tool validates the config before writing
  new credentials, so a rejected edit no longer rotates the connection's
  key and resumes its sources.
- An MCP edit keeps its previous connection only when the caller owns it
  and it signs in the way the tool now does.

tests/connectors/test_runtime.py

@@ -326,7 +326,11 @@ class TestMcpServerMismatch:
 
         cid = _connection(pg_conn, provider="custom_mcp", server_url="https://old.example.com")
         existing = {"connection_id": cid}
+        same = {"server_url": "https://old.example.com/mcp", "auth_type": "bearer"}
         with patch("docsgpt.api.user.tools.mcp.db_readonly", _yield):
-            assert _previous_connection(existing, {"server_url": "https://old.example.com/mcp"}) == cid
-            assert _previous_connection(existing, {"server_url": "https://new.example.com/mcp"}) is None
-            assert _previous_connection(None, {"server_url": "https://old.example.com/mcp"}) is None
+            assert _previous_connection(existing, same, "alice") == cid
+            assert _previous_connection(existing, {**same, "server_url": "https://new.example.com/mcp"}, "alice") is None
+            assert _previous_connection(None, same, "alice") is None
+            # Someone else's connection, or one that signs in another way, is not kept.
+            assert _previous_connection(existing, same, "bob") is None
+            assert _previous_connection(existing, {**same, "auth_type": "oauth"}, "alice") is None

tests/connectors/test_tool_routes.py

@@ -183,3 +183,14 @@ class TestUpdateConnectedTool:
         assert resp.status_code == 200
         row = _connection_row(pg_conn, created["connection_id"])
         assert service.read_secrets(row)["credentials"]["token"] == "123456:SECRETTOKEN"
+
+    def test_rejected_edit_leaves_the_connection_untouched(self, app, pg_conn):
+        from docsgpt.api.user.tools.routes import UpdateTool
+
+        created = self._create(app, pg_conn)
+        with _db(pg_conn), patch("docsgpt.api.user.tools.routes._validate_config",
+                                 return_value={"timeout": "Timeout must be between 1 and 300"}):
+            resp = _call(app, UpdateTool, {"id": created["id"], "config": {"token": "999999:ROTATED"}})
+        assert resp.status_code == 400
+        row = _connection_row(pg_conn, created["connection_id"])
+        assert service.read_secrets(row)["credentials"]["token"] == "123456:SECRETTOKEN"