aaronrene / knowtation public
durable-mcp-oauth-e2e.test.mjs
42 lines 1.5 KB
Raw
sha256:c2dbf04d56308f3bbf2d06e6d2eb022b8948b1e827195fe525a44e5e18d5f9c0 feat(auth): Phase B Connect cloud agent (RFC 8628) + Hermes… Human minor ⚠ breaking 11 days ago
1 /**
2 * Phase A — durable MCP OAuth: e2e tier (scripted OAuth client against provider fixture).
3 */
4
5 import { describe, it, afterEach } from 'node:test';
6 import assert from 'node:assert/strict';
7 import jwt from 'jsonwebtoken';
8 import {
9 createDurableMcpProvider,
10 mintMcpTokens,
11 TEST_SECRET,
12 } from './helpers/durable-mcp-oauth-harness.mjs';
13
14 const cleanups = [];
15 afterEach(async () => {
16 while (cleanups.length) await cleanups.pop()();
17 });
18
19 describe('Phase A e2e — scripted MCP OAuth client', () => {
20 it('full code flow → refresh → tool-shaped access token still verifies', async () => {
21 const { provider, cleanup } = await createDurableMcpProvider();
22 cleanups.push(cleanup);
23 const { client, tokens } = await mintMcpTokens(provider, {
24 scopes: ['vault:read', 'vault:write'],
25 userId: 'github:e2e',
26 clientName: 'e2e-client',
27 });
28
29 const authInfo = await provider.verifyAccessToken(tokens.access_token);
30 assert.equal(authInfo.extra.sub, 'github:e2e');
31 assert.ok(authInfo.scopes.includes('vault:write'));
32
33 const next = await provider.exchangeRefreshToken(client, tokens.refresh_token, ['vault:read']);
34 const payload = jwt.verify(next.access_token, TEST_SECRET);
35 assert.equal(payload.type, 'mcp_access');
36 assert.deepEqual(payload.scopes, ['vault:read']);
37 assert.ok(next.refresh_token);
38
39 const again = await provider.verifyAccessToken(next.access_token);
40 assert.equal(again.extra.sub, 'github:e2e');
41 });
42 });
File History 1 commit
sha256:93bcf8f9bd56d8c5b9339f4ec73b9ebd66571398d56262d38eedc2cfa9db9882 fix(test): align Band B landing assertion with desktop MCP … Human 11 days ago