| 1 | import { describe, expect, it } from 'vitest';
|
| 2 | import { POST as mcpHandler } from '../api/mcp.js';
|
| 3 | import { GET as metadataHandler } from '../api/oauth-protected-resource.js';
|
| 4 |
|
| 5 | describe('hosted MCP authorization', () => {
|
| 6 | it('challenges unauthenticated remote MCP requests', async () => {
|
| 7 | const response = await mcpHandler(
|
| 8 | new Request('https://openclasp.example/mcp', {
|
| 9 | method: 'POST',
|
| 10 | headers: { 'content-type': 'application/json' },
|
| 11 | body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
|
| 12 | }),
|
| 13 | );
|
| 14 | expect(response.status).toBe(401);
|
| 15 | expect(response.headers.get('www-authenticate')).toContain(
|
| 16 | 'resource_metadata="https://openclasp.example/.well-known/oauth-protected-resource"',
|
| 17 | );
|
| 18 | });
|
| 19 |
|
| 20 | it('publishes Auth0 protected-resource metadata', async () => {
|
| 21 | const response = metadataHandler(
|
| 22 | new Request('https://openclasp.example/.well-known/oauth-protected-resource'),
|
| 23 | );
|
| 24 | expect(response.status).toBe(200);
|
| 25 | await expect(response.json()).resolves.toMatchObject({
|
| 26 | resource: 'https://openclasp.example/mcp',
|
| 27 | authorization_servers: ['https://icfg-0ua6bab8d4omtfolx72mrhzo.us.auth0.com/'],
|
| 28 | scopes_supported: ['mcp:access'],
|
| 29 | });
|
| 30 | });
|
| 31 | });
|