refactor(models): pass session to tools.py @property accessors

[morning-verlu]

Summary

Refactor @property accessors in api/models/tools.py that internally call db.session into plain methods accepting session: Session as an explicit parameter, following the pattern established in #40370.

Changes

• ApiToolProvider.user and ApiToolProvider.tenant — removed @property, added session: Session parameter
• WorkflowToolProvider.user, WorkflowToolProvider.tenant, and WorkflowToolProvider.app — same treatment
• MCPToolProvider.load_user — added session: Session parameter
• Updated all call sites in custom_tool/provider.py, tools_transform_service.py, and mcp_tools_manage_service.py to pass session explicitly

Checklist

• Code follows the pattern from chore: example to rm db.session #40370
• All call sites updated to pass session explicitly
• No behavioral changes — session is passed explicitly instead of accessed implicitly
• I have read the contribution guidelines

Fixes #40372 (tools.py portion)

---

This PR was prepared with AI assistance. All changes have been manually reviewed and verified.

[github-actions]

Pyrefly Type Coverage

Metric	Base	PR	Delta
Type coverage	59.69%	59.69%	-0.01%
Strict coverage	59.28%	59.27%	-0.01%
Typed symbols	39,917	39,904	-13
Untyped symbols	27,142	27,142	0
Modules	3181	3181	0

[github-actions]

Pyrefly Diff

base → PR

--- /tmp/pyrefly_base.txt	2026-08-18 15:20:27.505019422 +0000
+++ /tmp/pyrefly_pr.txt	2026-08-18 15:20:19.877983837 +0000
@@ -5473,11 +5473,11 @@
 ERROR `SimpleNamespace` is not assignable to upper bound `AppGenerateEntity` of type variable `AppGenerateEntityT` [bad-specialization]
   --> tests/unit_tests/core/app/task_pipeline/test_based_generate_task_pipeline.py:62:41
 ERROR Class member `_FakeQueueManager.listen` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
-   --> tests/unit_tests/core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline_core.py:111:9
+   --> tests/unit_tests/core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline_core.py:109:9
 ERROR Class member `_FakeQueueManager.publish` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
-   --> tests/unit_tests/core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline_core.py:114:9
+   --> tests/unit_tests/core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline_core.py:112:9
 ERROR Class member `_FakeQueueManager._publish` overrides a member in a parent class but is missing an `@override` decorator [missing-override-decorator]
-   --> tests/unit_tests/core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline_core.py:117:9
+   --> tests/unit_tests/core/app/task_pipeline/test_easy_ui_based_generate_task_pipeline_core.py:115:9
 ERROR Argument `list[FromClause]` is not assignable to parameter `tables` with type `Sequence[Table] | None` in function `sqlalchemy.sql.schema.MetaData.create_all` [bad-argument-type]
   --> tests/unit_tests/core/app/task_pipeline/test_message_cycle_manager_optimization.py:37:16
 ERROR `None` is not subscriptable [unsupported-operation]

[wylswz]

The autofix failed.

[Copilot]

Pull request overview

Refactors tool-provider model accessors in api/models/tools.py to remove implicit db.session access by converting @property accessors into explicit methods that accept session: Session, and updates affected service/controller call sites to pass a session explicitly.

Changes:

• Converted ApiToolProvider.user/tenant and WorkflowToolProvider.user/tenant/app from @property to methods requiring session: Session.
• Updated MCP provider user loading to require an explicit session (MCPToolProvider.load_user(session=...)) and adjusted service call sites.
• Updated unit test stubs to match the new callable user(session=...) interface.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
api/models/tools.py	Replaces implicit DB session usage in provider accessors with explicit Session parameters.
api/services/tools/tools_transform_service.py	Passes an explicit session when resolving provider user details during API transforms.
api/services/tools/mcp_tools_manage_service.py	Passes service session into MCP provider user loading for API responses.
api/core/tools/custom_tool/provider.py	Updates custom tool provider controller construction to fetch user via explicit session.
api/tests/unit_tests/core/tools/test_custom_tool_provider.py	Updates test double to provide user(session=...) callable consistent with the new interface.

Suppressed comments (1)

api/services/tools/mcp_tools_manage_service.py:699

• _build_tool_provider_response() loads the user with self._session, but ToolTransformService.mcp_tool_to_user_tool() will load the user again (via db.session()) when user_name is not provided. Reuse the already-loaded user_name to avoid an extra query and avoid mixing sessions.

        user = db_provider.load_user(session=self._session)
        response = provider_entity.to_api_response(
            user_name=user.name if user else None,
        )
        response["tools"] = ToolTransformService.mcp_tool_to_user_tool(db_provider, tools)

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.