| 1 | import { describe, expect, it } from 'vitest';
|
| 2 | import { POST as mcpHandler } from '../api/mcp.js';
|
| 3 | import { GET as metadataHandler } from '../api/oauth-protected-resource.js';
|
| 4 | import { dashboardTokenFromCookie } from '../api/auth0.js';
|
| 5 |
|
| 6 | describe('hosted MCP authorization', () => {
|
| 7 | it('reads only the named dashboard session cookie', () => {
|
| 8 | expect(dashboardTokenFromCookie('other=x; openclasp_session=token%2Evalue; last=y')).toBe(
|
| 9 | 'token.value',
|
| 10 | );
|
| 11 | expect(dashboardTokenFromCookie('other=x')).toBeUndefined();
|
| 12 | });
|
| 13 | it('challenges unauthenticated remote MCP requests', async () => {
|
| 14 | const response = await mcpHandler(
|
| 15 | new Request('https://openclasp.example/mcp', {
|
| 16 | method: 'POST',
|
| 17 | headers: { 'content-type': 'application/json' },
|
| 18 | body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
|
| 19 | }),
|
| 20 | );
|
| 21 | expect(response.status).toBe(401);
|
| 22 | expect(response.headers.get('www-authenticate')).toBe(
|
| 23 | 'Bearer resource_metadata="https://openclasp.example/.well-known/oauth-protected-resource/mcp", scope="mcp:access"',
|
| 24 | );
|
| 25 | expect(response.headers.get('www-authenticate')).not.toContain('invalid_token');
|
| 26 | expect(response.headers.get('cache-control')).toBe('no-store');
|
| 27 | expect(await response.text()).toBe('');
|
| 28 | });
|
| 29 |
|
| 30 | it('publishes Auth0 protected-resource metadata', async () => {
|
| 31 | const response = metadataHandler(
|
| 32 | new Request('https://openclasp.example/.well-known/oauth-protected-resource'),
|
| 33 | );
|
| 34 | expect(response.status).toBe(200);
|
| 35 | await expect(response.json()).resolves.toMatchObject({
|
| 36 | resource: 'https://openclasp.example/mcp',
|
| 37 | authorization_servers: ['https://openclasp.example'],
|
| 38 | scopes_supported: ['mcp:access'],
|
| 39 | });
|
| 40 | });
|
| 41 | });
|