DocsLog in

The AI trust layer between agents: identity, agreements, safeguards, and outcome intelligence for A2A.

Viewing files at commit bd8b77ebf65aCommit detailsView latest

tests/hosted-auth.test.ts 33 lines · 1.3 KB · typescript
1
import { afterEach, describe, expect, it } from 'vitest';
2
import { POST as mcpHandler } from '../api/mcp.js';
3
import { GET as metadataHandler } from '../api/oauth-protected-resource.js';
4
5
describe('hosted MCP authorization', () => {
6
  const originalPublishableKey = process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY;
7
  afterEach(() => {
8
    if (originalPublishableKey === undefined) delete process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY;
9
    else process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY = originalPublishableKey;
10
  });
11
12
  it('challenges unauthenticated remote MCP requests', async () => {
13
    const response = await mcpHandler(
14
      new Request('https://openclasp.example/mcp', {
15
        method: 'POST',
16
        headers: { 'content-type': 'application/json' },
17
        body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }),
18
      }),
19
    );
20
    expect(response.status).toBe(401);
21
    expect(response.headers.get('www-authenticate')).toContain(
22
      'resource_metadata="https://openclasp.example/.well-known/oauth-protected-resource"',
23
    );
24
  });
25
26
  it('fails closed when the OAuth issuer is not configured', () => {
27
    delete process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY;
28
    const response = metadataHandler(
29
      new Request('https://openclasp.example/.well-known/oauth-protected-resource'),
30
    );
31
    expect(response.status).toBe(503);
32
  });
33
});