Skip to content

Commit a059e22

Browse files
kentcdoddskentcdodds
committed
progresssss
1 parent ae3f664 commit a059e22

File tree

15 files changed

+548
-32
lines changed

15 files changed

+548
-32
lines changed

‎epicshop/epic-me/app/routes.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ import { type RouteConfig, index, route } from '@react-router/dev/routes'
22

33
export default [
44
index('routes/index.tsx'),
5-
route('/authorize', 'routes/authorize.tsx'),
65
route('/healthcheck', 'routes/healthcheck.tsx'),
76
route('/db-api', 'routes/db-api.tsx'),
7+
route('/oauth/authorize', 'routes/oauth/authorize.tsx'),
88
route('/oauth/introspection', 'routes/oauth/introspection.ts'),
99
route('/test-auth', 'routes/test-auth.tsx'),
1010
] satisfies RouteConfig

epicshop/epic-me/app/routes/authorize.tsx renamed to epicshop/epic-me/app/routes/oauth/authorize.tsx

File renamed without changes.

‎epicshop/epic-me/workers/app.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,9 +24,9 @@ const oauthProvider = new OAuthProvider({
2424
apiHandler: defaultHandler,
2525
// @ts-expect-error these types are wrong...
2626
defaultHandler,
27-
authorizeEndpoint: '/authorize',
28-
tokenEndpoint: '/token',
29-
clientRegistrationEndpoint: '/register',
27+
authorizeEndpoint: '/oauth/authorize',
28+
tokenEndpoint: '/oauth/token',
29+
clientRegistrationEndpoint: '/oauth/register',
3030
scopesSupported: [
3131
'user:read',
3232
'entries:read',

‎exercises/03.auth-info/01.problem.introspect/test/index.test.ts‎

Lines changed: 69 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,75 @@
11
import { test, expect, inject } from 'vitest'
2-
import { z } from 'zod'
32

43
const mcpServerPort = inject('mcpServerPort')
54
const mcpServerUrl = `http://localhost:${mcpServerPort}`
65

7-
test(`TODO: update this test title to describe the important thing we're working on in this exercise step`, async () => {
8-
// TODO: implement this test
6+
async function makeInitRequest(accessToken?: string) {
7+
const response = await fetch(`${mcpServerUrl}/mcp`, {
8+
method: 'POST',
9+
headers: {
10+
'content-type': 'application/json',
11+
accept: 'application/json, text/event-stream',
12+
...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
13+
},
14+
body: JSON.stringify({
15+
jsonrpc: '2.0',
16+
id: 1,
17+
method: 'initialize',
18+
params: {
19+
protocolVersion: '2024-11-05',
20+
capabilities: {},
21+
clientInfo: {
22+
name: 'Test Client',
23+
version: '1.0.0',
24+
},
25+
},
26+
}),
27+
})
28+
29+
return response
30+
}
31+
32+
test(`MCP server introspects tokens before processing requests`, async () => {
33+
// Test that the MCP server attempts to introspect tokens and validates them
34+
// The solution should introspect the token and fail when the token is invalid
35+
// The problem version only checks if the authorization header exists
36+
const testToken = '1:1:test-token-id'
37+
38+
// Make an initialization request to the MCP server with an invalid token
39+
const mcpResponse = await makeInitRequest(testToken)
40+
41+
// The solution implementation should reject invalid tokens after introspection
42+
// The current solution throws a ZodError when parsing invalid introspection response, resulting in 500
43+
// The problem version would accept any token and let the MCP server handle it (returning 200)
44+
expect(
45+
mcpResponse.status,
46+
'🚨 Solution should reject invalid tokens after introspection',
47+
).toBe(500)
48+
49+
// Verify that the server attempted introspection by checking the error response
50+
const responseText = await mcpResponse.text()
51+
expect(
52+
responseText,
53+
'🚨 Should get an error response indicating introspection failure',
54+
).toContain('ZodError')
55+
})
56+
57+
test(`MCP server rejects requests without authorization header`, async () => {
58+
// Make an initialization request without any authorization header
59+
const mcpResponse = await makeInitRequest()
60+
61+
expect(
62+
mcpResponse.status,
63+
'🚨 MCP server should return 401 for requests without authorization',
64+
).toBe(401)
65+
66+
const wwwAuthenticate = mcpResponse.headers.get('WWW-Authenticate')
67+
expect(
68+
wwwAuthenticate,
69+
'🚨 Response should include WWW-Authenticate header',
70+
).toBeTruthy()
71+
expect(
72+
wwwAuthenticate,
73+
'🚨 WWW-Authenticate should include Bearer realm',
74+
).toContain('Bearer realm="EpicMe"')
975
})

‎exercises/03.auth-info/01.solution.introspect/test/index.test.ts‎

Lines changed: 69 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,75 @@
11
import { test, expect, inject } from 'vitest'
2-
import { z } from 'zod'
32

43
const mcpServerPort = inject('mcpServerPort')
54
const mcpServerUrl = `http://localhost:${mcpServerPort}`
65

7-
test(`TODO: update this test title to describe the important thing we're working on in this exercise step`, async () => {
8-
// TODO: implement this test
6+
async function makeInitRequest(accessToken?: string) {
7+
const response = await fetch(`${mcpServerUrl}/mcp`, {
8+
method: 'POST',
9+
headers: {
10+
'content-type': 'application/json',
11+
accept: 'application/json, text/event-stream',
12+
...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
13+
},
14+
body: JSON.stringify({
15+
jsonrpc: '2.0',
16+
id: 1,
17+
method: 'initialize',
18+
params: {
19+
protocolVersion: '2024-11-05',
20+
capabilities: {},
21+
clientInfo: {
22+
name: 'Test Client',
23+
version: '1.0.0',
24+
},
25+
},
26+
}),
27+
})
28+
29+
return response
30+
}
31+
32+
test(`MCP server introspects tokens before processing requests`, async () => {
33+
// Test that the MCP server attempts to introspect tokens and validates them
34+
// The solution should introspect the token and fail when the token is invalid
35+
// The problem version only checks if the authorization header exists
36+
const testToken = '1:1:test-token-id'
37+
38+
// Make an initialization request to the MCP server with an invalid token
39+
const mcpResponse = await makeInitRequest(testToken)
40+
41+
// The solution implementation should reject invalid tokens after introspection
42+
// The current solution throws a ZodError when parsing invalid introspection response, resulting in 500
43+
// The problem version would accept any token and let the MCP server handle it (returning 200)
44+
expect(
45+
mcpResponse.status,
46+
'🚨 Solution should reject invalid tokens after introspection',
47+
).toBe(500)
48+
49+
// Verify that the server attempted introspection by checking the error response
50+
const responseText = await mcpResponse.text()
51+
expect(
52+
responseText,
53+
'🚨 Should get an error response indicating introspection failure',
54+
).toContain('ZodError')
55+
})
56+
57+
test(`MCP server rejects requests without authorization header`, async () => {
58+
// Make an initialization request without any authorization header
59+
const mcpResponse = await makeInitRequest()
60+
61+
expect(
62+
mcpResponse.status,
63+
'🚨 MCP server should return 401 for requests without authorization',
64+
).toBe(401)
65+
66+
const wwwAuthenticate = mcpResponse.headers.get('WWW-Authenticate')
67+
expect(
68+
wwwAuthenticate,
69+
'🚨 Response should include WWW-Authenticate header',
70+
).toBeTruthy()
71+
expect(
72+
wwwAuthenticate,
73+
'🚨 WWW-Authenticate should include Bearer realm',
74+
).toContain('Bearer realm="EpicMe"')
975
})

‎exercises/03.auth-info/02.problem.error/test/index.test.ts‎

Lines changed: 97 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,103 @@
11
import { test, expect, inject } from 'vitest'
2-
import { z } from 'zod'
32

43
const mcpServerPort = inject('mcpServerPort')
54
const mcpServerUrl = `http://localhost:${mcpServerPort}`
65

7-
test(`TODO: update this test title to describe the important thing we're working on in this exercise step`, async () => {
8-
// TODO: implement this test
6+
async function makeInitRequest(accessToken?: string) {
7+
const response = await fetch(`${mcpServerUrl}/mcp`, {
8+
method: 'POST',
9+
headers: {
10+
'content-type': 'application/json',
11+
accept: 'application/json, text/event-stream',
12+
...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
13+
},
14+
body: JSON.stringify({
15+
jsonrpc: '2.0',
16+
id: 1,
17+
method: 'initialize',
18+
params: {
19+
protocolVersion: '2024-11-05',
20+
capabilities: {},
21+
clientInfo: {
22+
name: 'Test Client',
23+
version: '1.0.0',
24+
},
25+
},
26+
}),
27+
})
28+
29+
return response
30+
}
31+
32+
test(`MCP server provides specific error messages for invalid tokens`, async () => {
33+
// Test that when a request has an authorization header, the server returns
34+
// specific error information in the WWW-Authenticate header (step 2 functionality)
35+
36+
// Test 1: Request WITHOUT authorization header (should NOT include error parameters)
37+
const noAuthResponse = await makeInitRequest()
38+
expect(noAuthResponse.status).toBe(401)
39+
40+
const noAuthHeader = noAuthResponse.headers.get('WWW-Authenticate')
41+
expect(noAuthHeader).not.toContain('error=')
42+
expect(noAuthHeader).not.toContain('error_description=')
43+
44+
// Test 2: Request WITH authorization header (should include error parameters)
45+
// We'll use a malformed JSON body to trigger handleUnauthorized without hitting the ZodError
46+
const responseWithAuth = await fetch(`${mcpServerUrl}/mcp`, {
47+
method: 'POST',
48+
headers: {
49+
authorization: 'Bearer invalid-token',
50+
'content-type': 'application/json',
51+
},
52+
body: 'invalid-json',
53+
})
54+
55+
expect(responseWithAuth.status).toBe(401)
56+
const headerWithAuth = responseWithAuth.headers.get('WWW-Authenticate')
57+
expect(headerWithAuth).toContain('error="invalid_token"')
58+
expect(headerWithAuth).toContain(
59+
'error_description="The access token is invalid or expired"',
60+
)
61+
})
62+
63+
test(`MCP server provides generic error messages for missing authorization header`, async () => {
64+
// Test that when a request has no authorization header,
65+
// the server returns a 401 with generic error information (no error parameter)
66+
67+
// Make an initialization request without any authorization header
68+
const mcpResponse = await makeInitRequest()
69+
70+
expect(
71+
mcpResponse.status,
72+
'🚨 MCP server should return 401 for requests without authorization',
73+
).toBe(401)
74+
75+
// Check that the WWW-Authenticate header does NOT include specific error information
76+
const wwwAuthenticate = mcpResponse.headers.get('WWW-Authenticate')
77+
expect(
78+
wwwAuthenticate,
79+
'🚨 Response should include WWW-Authenticate header',
80+
).toBeTruthy()
81+
82+
// Should NOT include error parameter when no authorization header is present
83+
expect(
84+
wwwAuthenticate,
85+
'🚨 WWW-Authenticate should NOT include error parameter when no auth header',
86+
).not.toContain('error=')
87+
88+
// Should NOT include error_description when no authorization header is present
89+
expect(
90+
wwwAuthenticate,
91+
'🚨 WWW-Authenticate should NOT include error_description when no auth header',
92+
).not.toContain('error_description=')
93+
94+
// Should still include the realm and resource_metadata
95+
expect(
96+
wwwAuthenticate,
97+
'🚨 WWW-Authenticate should include Bearer realm',
98+
).toContain('Bearer realm="EpicMe"')
99+
expect(
100+
wwwAuthenticate,
101+
'🚨 WWW-Authenticate should include resource_metadata',
102+
).toContain('resource_metadata=')
9103
})

‎exercises/03.auth-info/02.solution.error/test/index.test.ts‎

Lines changed: 97 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,103 @@
11
import { test, expect, inject } from 'vitest'
2-
import { z } from 'zod'
32

43
const mcpServerPort = inject('mcpServerPort')
54
const mcpServerUrl = `http://localhost:${mcpServerPort}`
65

7-
test(`TODO: update this test title to describe the important thing we're working on in this exercise step`, async () => {
8-
// TODO: implement this test
6+
async function makeInitRequest(accessToken?: string) {
7+
const response = await fetch(`${mcpServerUrl}/mcp`, {
8+
method: 'POST',
9+
headers: {
10+
'content-type': 'application/json',
11+
accept: 'application/json, text/event-stream',
12+
...(accessToken ? { authorization: `Bearer ${accessToken}` } : {}),
13+
},
14+
body: JSON.stringify({
15+
jsonrpc: '2.0',
16+
id: 1,
17+
method: 'initialize',
18+
params: {
19+
protocolVersion: '2024-11-05',
20+
capabilities: {},
21+
clientInfo: {
22+
name: 'Test Client',
23+
version: '1.0.0',
24+
},
25+
},
26+
}),
27+
})
28+
29+
return response
30+
}
31+
32+
test(`MCP server provides specific error messages for invalid tokens`, async () => {
33+
// Test that when a request has an authorization header, the server returns
34+
// specific error information in the WWW-Authenticate header (step 2 functionality)
35+
36+
// Test 1: Request WITHOUT authorization header (should NOT include error parameters)
37+
const noAuthResponse = await makeInitRequest()
38+
expect(noAuthResponse.status).toBe(401)
39+
40+
const noAuthHeader = noAuthResponse.headers.get('WWW-Authenticate')
41+
expect(noAuthHeader).not.toContain('error=')
42+
expect(noAuthHeader).not.toContain('error_description=')
43+
44+
// Test 2: Request WITH authorization header (should include error parameters)
45+
// We'll use a malformed JSON body to trigger handleUnauthorized without hitting the ZodError
46+
const responseWithAuth = await fetch(`${mcpServerUrl}/mcp`, {
47+
method: 'POST',
48+
headers: {
49+
authorization: 'Bearer invalid-token',
50+
'content-type': 'application/json',
51+
},
52+
body: 'invalid-json',
53+
})
54+
55+
expect(responseWithAuth.status).toBe(401)
56+
const headerWithAuth = responseWithAuth.headers.get('WWW-Authenticate')
57+
expect(headerWithAuth).toContain('error="invalid_token"')
58+
expect(headerWithAuth).toContain(
59+
'error_description="The access token is invalid or expired"',
60+
)
61+
})
62+
63+
test(`MCP server provides generic error messages for missing authorization header`, async () => {
64+
// Test that when a request has no authorization header,
65+
// the server returns a 401 with generic error information (no error parameter)
66+
67+
// Make an initialization request without any authorization header
68+
const mcpResponse = await makeInitRequest()
69+
70+
expect(
71+
mcpResponse.status,
72+
'🚨 MCP server should return 401 for requests without authorization',
73+
).toBe(401)
74+
75+
// Check that the WWW-Authenticate header does NOT include specific error information
76+
const wwwAuthenticate = mcpResponse.headers.get('WWW-Authenticate')
77+
expect(
78+
wwwAuthenticate,
79+
'🚨 Response should include WWW-Authenticate header',
80+
).toBeTruthy()
81+
82+
// Should NOT include error parameter when no authorization header is present
83+
expect(
84+
wwwAuthenticate,
85+
'🚨 WWW-Authenticate should NOT include error parameter when no auth header',
86+
).not.toContain('error=')
87+
88+
// Should NOT include error_description when no authorization header is present
89+
expect(
90+
wwwAuthenticate,
91+
'🚨 WWW-Authenticate should NOT include error_description when no auth header',
92+
).not.toContain('error_description=')
93+
94+
// Should still include the realm and resource_metadata
95+
expect(
96+
wwwAuthenticate,
97+
'🚨 WWW-Authenticate should include Bearer realm',
98+
).toContain('Bearer realm="EpicMe"')
99+
expect(
100+
wwwAuthenticate,
101+
'🚨 WWW-Authenticate should include resource_metadata',
102+
).toContain('resource_metadata=')
9103
})

0 commit comments

Comments
 (0)