|
| 1 | +import { mkdtemp, rm } from 'node:fs/promises'; |
| 2 | +import { tmpdir } from 'node:os'; |
| 3 | +import { join } from 'node:path'; |
| 4 | +import { afterEach, beforeEach, describe, expect, it } from 'vitest'; |
| 5 | +import { |
| 6 | + createMcpOAuthProvider, |
| 7 | + mcpAuthPath, |
| 8 | + McpAuthStore, |
| 9 | + startLoopbackReceiver, |
| 10 | +} from './oauth.js'; |
| 11 | +import type { OAuthTokens } from '@modelcontextprotocol/sdk/shared/auth.js'; |
| 12 | + |
| 13 | +const TOKENS: OAuthTokens = { access_token: 'at-123', token_type: 'Bearer', refresh_token: 'rt-9' }; |
| 14 | + |
| 15 | +describe('McpAuthStore', () => { |
| 16 | + let home: string; |
| 17 | + beforeEach(async () => { |
| 18 | + home = await mkdtemp(join(tmpdir(), 'dc-oauth-')); |
| 19 | + }); |
| 20 | + afterEach(async () => { |
| 21 | + await rm(home, { recursive: true, force: true }); |
| 22 | + }); |
| 23 | + |
| 24 | + it('path is under ~/.deepcode/mcp-auth and sanitizes the server name', () => { |
| 25 | + expect(mcpAuthPath('git/hub', home)).toBe(join(home, '.deepcode', 'mcp-auth', 'git_hub.json')); |
| 26 | + }); |
| 27 | + |
| 28 | + it('read() returns {} when absent; patch persists + merges', async () => { |
| 29 | + const s = new McpAuthStore('srv', home); |
| 30 | + expect(await s.read()).toEqual({}); |
| 31 | + await s.patch({ tokens: TOKENS }); |
| 32 | + await s.patch({ codeVerifier: 'verifier-abc' }); |
| 33 | + const rec = await s.read(); |
| 34 | + expect(rec.tokens).toEqual(TOKENS); |
| 35 | + expect(rec.codeVerifier).toBe('verifier-abc'); |
| 36 | + }); |
| 37 | + |
| 38 | + it('clear(scope) drops only the targeted slice; clear(all) removes the file', async () => { |
| 39 | + const s = new McpAuthStore('srv', home); |
| 40 | + await s.patch({ tokens: TOKENS, codeVerifier: 'v' }); |
| 41 | + await s.clear('tokens'); |
| 42 | + expect((await s.read()).tokens).toBeUndefined(); |
| 43 | + expect((await s.read()).codeVerifier).toBe('v'); |
| 44 | + await s.clear('all'); |
| 45 | + expect(await s.read()).toEqual({}); |
| 46 | + }); |
| 47 | +}); |
| 48 | + |
| 49 | +describe('startLoopbackReceiver', () => { |
| 50 | + it('captures the authorization code from the redirect', async () => { |
| 51 | + const r = await startLoopbackReceiver(); |
| 52 | + try { |
| 53 | + expect(r.redirectUrl).toMatch(/^http:\/\/127\.0\.0\.1:\d+\/callback$/); |
| 54 | + const codeP = r.waitForCode(); |
| 55 | + const res = await fetch(`${r.redirectUrl}?code=THE_CODE&state=s1`); |
| 56 | + expect(res.status).toBe(200); |
| 57 | + expect(await codeP).toBe('THE_CODE'); |
| 58 | + } finally { |
| 59 | + r.close(); |
| 60 | + } |
| 61 | + }); |
| 62 | + |
| 63 | + it('rejects on an error redirect', async () => { |
| 64 | + const r = await startLoopbackReceiver(); |
| 65 | + try { |
| 66 | + // Attach the rejection expectation BEFORE triggering it, so the rejection |
| 67 | + // never lands without a handler (avoids an unhandled-rejection warning). |
| 68 | + const assertion = expect(r.waitForCode()).rejects.toThrow(/access_denied/); |
| 69 | + await fetch(`${r.redirectUrl}?error=access_denied`); |
| 70 | + await assertion; |
| 71 | + } finally { |
| 72 | + r.close(); |
| 73 | + } |
| 74 | + }); |
| 75 | + |
| 76 | + it('rejects on a state mismatch', async () => { |
| 77 | + const r = await startLoopbackReceiver({ expectedState: 'expected' }); |
| 78 | + try { |
| 79 | + const assertion = expect(r.waitForCode()).rejects.toThrow(/state mismatch/i); |
| 80 | + await fetch(`${r.redirectUrl}?code=x&state=wrong`); |
| 81 | + await assertion; |
| 82 | + } finally { |
| 83 | + r.close(); |
| 84 | + } |
| 85 | + }); |
| 86 | +}); |
| 87 | + |
| 88 | +describe('DeepCodeOAuthProvider', () => { |
| 89 | + let home: string; |
| 90 | + beforeEach(async () => { |
| 91 | + home = await mkdtemp(join(tmpdir(), 'dc-oauthp-')); |
| 92 | + }); |
| 93 | + afterEach(async () => { |
| 94 | + await rm(home, { recursive: true, force: true }); |
| 95 | + }); |
| 96 | + |
| 97 | + it('builds PKCE client metadata pointing at the loopback redirect', async () => { |
| 98 | + const p = await createMcpOAuthProvider('srv', { home, scopes: ['read', 'write'] }); |
| 99 | + try { |
| 100 | + const meta = p.clientMetadata; |
| 101 | + expect(meta.redirect_uris[0]).toBe(p.redirectUrl); |
| 102 | + expect(meta.redirect_uris[0]).toMatch(/127\.0\.0\.1/); |
| 103 | + expect(meta.grant_types).toContain('authorization_code'); |
| 104 | + expect(meta.response_types).toContain('code'); |
| 105 | + expect(meta.token_endpoint_auth_method).toBe('none'); |
| 106 | + expect(meta.scope).toBe('read write'); |
| 107 | + } finally { |
| 108 | + p.closeReceiver(); |
| 109 | + } |
| 110 | + }); |
| 111 | + |
| 112 | + it('persists tokens + verifier through the store', async () => { |
| 113 | + const p = await createMcpOAuthProvider('srv', { home }); |
| 114 | + try { |
| 115 | + expect(await p.tokens()).toBeUndefined(); |
| 116 | + await p.saveTokens(TOKENS); |
| 117 | + await p.saveCodeVerifier('pkce-verifier'); |
| 118 | + expect(await p.tokens()).toEqual(TOKENS); |
| 119 | + expect(await p.codeVerifier()).toBe('pkce-verifier'); |
| 120 | + // a fresh provider (new receiver) still reads persisted state |
| 121 | + const p2 = await createMcpOAuthProvider('srv', { home }); |
| 122 | + try { |
| 123 | + expect(await p2.tokens()).toEqual(TOKENS); |
| 124 | + } finally { |
| 125 | + p2.closeReceiver(); |
| 126 | + } |
| 127 | + } finally { |
| 128 | + p.closeReceiver(); |
| 129 | + } |
| 130 | + }); |
| 131 | + |
| 132 | + it('codeVerifier() throws if none saved; redirectToAuthorization opens the URL', async () => { |
| 133 | + const opened: string[] = []; |
| 134 | + const p = await createMcpOAuthProvider('srv', { home, openBrowser: (u) => opened.push(u) }); |
| 135 | + try { |
| 136 | + await expect(p.codeVerifier()).rejects.toThrow(/code_verifier/); |
| 137 | + await p.redirectToAuthorization(new URL('https://auth.example.com/authorize?x=1')); |
| 138 | + expect(opened).toEqual(['https://auth.example.com/authorize?x=1']); |
| 139 | + } finally { |
| 140 | + p.closeReceiver(); |
| 141 | + } |
| 142 | + }); |
| 143 | +}); |
0 commit comments