aaronrene / knowtation public
durable-mcp-oauth-e2e.test.mjs
42 lines 1.5 KB
Raw
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ breaking 10 days ago
1 /**
2 * Phase A — durable MCP OAuth: e2e tier (scripted OAuth client against provider fixture).
3 */
4
5 import { describe, it, afterEach } from 'node:test';
6 import assert from 'node:assert/strict';
7 import jwt from 'jsonwebtoken';
8 import {
9 createDurableMcpProvider,
10 mintMcpTokens,
11 TEST_SECRET,
12 } from './helpers/durable-mcp-oauth-harness.mjs';
13
14 const cleanups = [];
15 afterEach(async () => {
16 while (cleanups.length) await cleanups.pop()();
17 });
18
19 describe('Phase A e2e — scripted MCP OAuth client', () => {
20 it('full code flow → refresh → tool-shaped access token still verifies', async () => {
21 const { provider, cleanup } = await createDurableMcpProvider();
22 cleanups.push(cleanup);
23 const { client, tokens } = await mintMcpTokens(provider, {
24 scopes: ['vault:read', 'vault:write'],
25 userId: 'github:e2e',
26 clientName: 'e2e-client',
27 });
28
29 const authInfo = await provider.verifyAccessToken(tokens.access_token);
30 assert.equal(authInfo.extra.sub, 'github:e2e');
31 assert.ok(authInfo.scopes.includes('vault:write'));
32
33 const next = await provider.exchangeRefreshToken(client, tokens.refresh_token, ['vault:read']);
34 const payload = jwt.verify(next.access_token, TEST_SECRET);
35 assert.equal(payload.type, 'mcp_access');
36 assert.deepEqual(payload.scopes, ['vault:read']);
37 assert.ok(next.refresh_token);
38
39 const again = await provider.verifyAccessToken(next.access_token);
40 assert.equal(again.extra.sub, 'github:e2e');
41 });
42 });
File History 1 commit
sha256:b5f647cb9c409f563d4671fe3fc05ddea01fabfed9b41fc11cb923588e1c1baf mirror: GitHub Phase A durable MCP OAuth (#270) Human minor ⚠ 10 days ago