| 1 | import { createHash } from 'node:crypto';
|
| 2 | import { afterEach, describe, expect, it, vi } from 'vitest';
|
| 3 | import { GET as authorizationMetadata } from '../api/oauth-authorization-server.js';
|
| 4 | import { authorize } from '../api/oauth-authorize.js';
|
| 5 | import { register } from '../api/oauth-register.js';
|
| 6 | import type { OAuthStore, OAuthTransaction } from '../api/oauth-store.js';
|
| 7 | import { exchange } from '../api/oauth-token.js';
|
| 8 |
|
| 9 | afterEach(() => vi.restoreAllMocks());
|
| 10 |
|
| 11 | describe('OpenClasp OAuth broker', () => {
|
| 12 | it('publishes OpenClasp-owned OAuth endpoints', async () => {
|
| 13 | const response = await authorizationMetadata(
|
| 14 | new Request('https://openclasp.example/.well-known/oauth-authorization-server'),
|
| 15 | );
|
| 16 | await expect(response.json()).resolves.toMatchObject({
|
| 17 | issuer: 'https://openclasp.example',
|
| 18 | authorization_endpoint: 'https://openclasp.example/oauth/authorize',
|
| 19 | token_endpoint: 'https://openclasp.example/oauth/token',
|
| 20 | registration_endpoint: 'https://openclasp.example/oauth/register',
|
| 21 | scopes_supported: ['mcp:access'],
|
| 22 | code_challenge_methods_supported: ['S256'],
|
| 23 | token_endpoint_auth_methods_supported: ['none'],
|
| 24 | });
|
| 25 | });
|
| 26 |
|
| 27 | it('registers public clients in OpenClasp instead of Auth0', async () => {
|
| 28 | const registerClient = vi.fn().mockResolvedValue({
|
| 29 | clientId: 'oc_client',
|
| 30 | redirectUris: ['http://localhost:8787/callback'],
|
| 31 | });
|
| 32 | const input = {
|
| 33 | client_name: 'MCP client',
|
| 34 | redirect_uris: ['http://localhost:8787/callback'],
|
| 35 | token_endpoint_auth_method: 'none',
|
| 36 | };
|
| 37 | vi.spyOn(console, 'info').mockImplementation(() => undefined);
|
| 38 | const response = await register(
|
| 39 | new Request('https://openclasp.example/oauth/register', {
|
| 40 | method: 'POST',
|
| 41 | body: JSON.stringify(input),
|
| 42 | }),
|
| 43 | { registerClient } as unknown as OAuthStore,
|
| 44 | );
|
| 45 | expect(response.status).toBe(201);
|
| 46 | expect(registerClient).toHaveBeenCalledOnce();
|
| 47 | await expect(response.json()).resolves.toMatchObject({
|
| 48 | client_id: 'oc_client',
|
| 49 | token_endpoint_auth_method: 'none',
|
| 50 | grant_types: ['authorization_code', 'refresh_token'],
|
| 51 | });
|
| 52 | });
|
| 53 |
|
| 54 | it('rejects unsafe web redirect URIs', async () => {
|
| 55 | const registerClient = vi.fn();
|
| 56 | const response = await register(
|
| 57 | new Request('https://openclasp.example/oauth/register', {
|
| 58 | method: 'POST',
|
| 59 | body: JSON.stringify({ redirect_uris: ['http://attacker.example/callback'] }),
|
| 60 | }),
|
| 61 | { registerClient } as unknown as OAuthStore,
|
| 62 | );
|
| 63 | expect(response.status).toBe(400);
|
| 64 | expect(registerClient).not.toHaveBeenCalled();
|
| 65 | });
|
| 66 |
|
| 67 | it('brokers authorization through the existing Auth0 application', async () => {
|
| 68 | const createTransaction = vi.fn().mockResolvedValue(undefined);
|
| 69 | const store = {
|
| 70 | getClient: vi.fn().mockResolvedValue({
|
| 71 | clientId: 'oc_client',
|
| 72 | redirectUris: ['http://127.0.0.1:4567/callback'],
|
| 73 | }),
|
| 74 | createTransaction,
|
| 75 | } as unknown as OAuthStore;
|
| 76 | const challenge = createHash('sha256').update('downstream-verifier').digest('base64url');
|
| 77 | const request = new Request(
|
| 78 | `https://openclasp.example/oauth/authorize?${new URLSearchParams({
|
| 79 | client_id: 'oc_client',
|
| 80 | redirect_uri: 'http://127.0.0.1:4567/callback',
|
| 81 | response_type: 'code',
|
| 82 | scope: 'mcp:access',
|
| 83 | state: 'client-state',
|
| 84 | code_challenge: challenge,
|
| 85 | code_challenge_method: 'S256',
|
| 86 | })}`,
|
| 87 | );
|
| 88 | const response = await authorize(request, store);
|
| 89 | expect(response.status).toBe(302);
|
| 90 | const destination = new URL(response.headers.get('location')!);
|
| 91 | expect(destination.origin).toBe('https://icfg-0ua6bab8d4omtfolx72mrhzo.us.auth0.com');
|
| 92 | expect(destination.searchParams.get('client_id')).toBe('vGxzZd4LiO7TqH4U61QblwH96YcimpcA');
|
| 93 | expect(destination.searchParams.get('redirect_uri')).toBe(
|
| 94 | 'https://openclasp.vercel.app/sso-callback',
|
| 95 | );
|
| 96 | const saved = createTransaction.mock.calls[0]?.[0] as OAuthTransaction;
|
| 97 | expect(saved.clientId).toBe('oc_client');
|
| 98 | expect(saved.downstreamState).toBe('client-state');
|
| 99 | expect(saved.codeChallenge).toBe(challenge);
|
| 100 | });
|
| 101 |
|
| 102 | it('exchanges a PKCE code for OpenClasp opaque tokens', async () => {
|
| 103 | const verifier = 'a-secure-downstream-verifier';
|
| 104 | const codeChallenge = createHash('sha256').update(verifier).digest('base64url');
|
| 105 | const issueTokens = vi.fn().mockResolvedValue({
|
| 106 | accessToken: 'oc_oat_access',
|
| 107 | refreshToken: 'oc_rt_refresh',
|
| 108 | expiresIn: 3600,
|
| 109 | });
|
| 110 | const store = {
|
| 111 | takeAuthorizationCode: vi.fn().mockResolvedValue({
|
| 112 | clientId: 'oc_client',
|
| 113 | operatorId: 'auth0|user',
|
| 114 | redirectUri: 'http://localhost:8787/callback',
|
| 115 | scope: 'mcp:access',
|
| 116 | codeChallenge,
|
| 117 | }),
|
| 118 | issueTokens,
|
| 119 | } as unknown as OAuthStore;
|
| 120 | const response = await exchange(
|
| 121 | new Request('https://openclasp.example/oauth/token', {
|
| 122 | method: 'POST',
|
| 123 | body: new URLSearchParams({
|
| 124 | grant_type: 'authorization_code',
|
| 125 | client_id: 'oc_client',
|
| 126 | code: 'oc_code_value',
|
| 127 | redirect_uri: 'http://localhost:8787/callback',
|
| 128 | code_verifier: verifier,
|
| 129 | }),
|
| 130 | }),
|
| 131 | store,
|
| 132 | );
|
| 133 | expect(response.status).toBe(200);
|
| 134 | await expect(response.json()).resolves.toEqual({
|
| 135 | access_token: 'oc_oat_access',
|
| 136 | token_type: 'Bearer',
|
| 137 | expires_in: 3600,
|
| 138 | refresh_token: 'oc_rt_refresh',
|
| 139 | scope: 'mcp:access',
|
| 140 | });
|
| 141 | expect(issueTokens).toHaveBeenCalledWith('oc_client', 'auth0|user', ['mcp:access']);
|
| 142 | });
|
| 143 |
|
| 144 | it('rejects an incorrect PKCE verifier', async () => {
|
| 145 | const issueTokens = vi.fn();
|
| 146 | const store = {
|
| 147 | takeAuthorizationCode: vi.fn().mockResolvedValue({
|
| 148 | clientId: 'oc_client',
|
| 149 | operatorId: 'auth0|user',
|
| 150 | redirectUri: 'http://localhost:8787/callback',
|
| 151 | scope: 'mcp:access',
|
| 152 | codeChallenge: createHash('sha256').update('correct-verifier').digest('base64url'),
|
| 153 | }),
|
| 154 | issueTokens,
|
| 155 | } as unknown as OAuthStore;
|
| 156 | const response = await exchange(
|
| 157 | new Request('https://openclasp.example/oauth/token', {
|
| 158 | method: 'POST',
|
| 159 | body: new URLSearchParams({
|
| 160 | grant_type: 'authorization_code',
|
| 161 | client_id: 'oc_client',
|
| 162 | code: 'oc_code_value',
|
| 163 | redirect_uri: 'http://localhost:8787/callback',
|
| 164 | code_verifier: 'wrong-verifier',
|
| 165 | }),
|
| 166 | }),
|
| 167 | store,
|
| 168 | );
|
| 169 | expect(response.status).toBe(400);
|
| 170 | await expect(response.json()).resolves.toMatchObject({ error: 'invalid_grant' });
|
| 171 | expect(issueTokens).not.toHaveBeenCalled();
|
| 172 | });
|
| 173 | });
|