Skip to content

Commit 9e2a565

Browse files
ochafikochafik
committed
minimize changes
1 parent 68424ef commit 9e2a565

File tree

2 files changed

+11
-116
lines changed

2 files changed

+11
-116
lines changed

‎src/server/auth/handlers/authorize.test.ts

Lines changed: 1 addition & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -277,7 +277,7 @@ describe('Authorization Handler', () => {
277277
});
278278

279279
describe('Resource parameter validation', () => {
280-
it('accepts valid resource parameter', async () => {
280+
it('propagates resource parameter', async () => {
281281
const mockProviderWithResource = jest.spyOn(mockProvider, 'authorize');
282282

283283
const response = await supertest(app)
@@ -302,100 +302,6 @@ describe('Authorization Handler', () => {
302302
expect.any(Object)
303303
);
304304
});
305-
306-
it('rejects invalid resource parameter (non-URL)', async () => {
307-
const response = await supertest(app)
308-
.get('/authorize')
309-
.query({
310-
client_id: 'valid-client',
311-
redirect_uri: 'https://example.com/callback',
312-
response_type: 'code',
313-
code_challenge: 'challenge123',
314-
code_challenge_method: 'S256',
315-
resource: 'not-a-url'
316-
});
317-
318-
expect(response.status).toBe(302);
319-
const location = new URL(response.header.location);
320-
expect(location.searchParams.get('error')).toBe('invalid_request');
321-
expect(location.searchParams.get('error_description')).toContain('resource');
322-
});
323-
324-
it('handles authorization without resource parameter', async () => {
325-
const mockProviderWithoutResource = jest.spyOn(mockProvider, 'authorize');
326-
327-
const response = await supertest(app)
328-
.get('/authorize')
329-
.query({
330-
client_id: 'valid-client',
331-
redirect_uri: 'https://example.com/callback',
332-
response_type: 'code',
333-
code_challenge: 'challenge123',
334-
code_challenge_method: 'S256'
335-
});
336-
337-
expect(response.status).toBe(302);
338-
expect(mockProviderWithoutResource).toHaveBeenCalledWith(
339-
validClient,
340-
expect.objectContaining({
341-
resource: undefined,
342-
redirectUri: 'https://example.com/callback',
343-
codeChallenge: 'challenge123'
344-
}),
345-
expect.any(Object)
346-
);
347-
});
348-
349-
it('passes multiple resources if provided', async () => {
350-
const mockProviderWithResources = jest.spyOn(mockProvider, 'authorize');
351-
352-
const response = await supertest(app)
353-
.get('/authorize')
354-
.query({
355-
client_id: 'valid-client',
356-
redirect_uri: 'https://example.com/callback',
357-
response_type: 'code',
358-
code_challenge: 'challenge123',
359-
code_challenge_method: 'S256',
360-
resource: 'https://api1.example.com/resource',
361-
state: 'test-state'
362-
});
363-
364-
expect(response.status).toBe(302);
365-
expect(mockProviderWithResources).toHaveBeenCalledWith(
366-
validClient,
367-
expect.objectContaining({
368-
resource: new URL('https://api1.example.com/resource'),
369-
state: 'test-state'
370-
}),
371-
expect.any(Object)
372-
);
373-
});
374-
375-
it('validates resource parameter in POST requests', async () => {
376-
const mockProviderPost = jest.spyOn(mockProvider, 'authorize');
377-
378-
const response = await supertest(app)
379-
.post('/authorize')
380-
.type('form')
381-
.send({
382-
client_id: 'valid-client',
383-
redirect_uri: 'https://example.com/callback',
384-
response_type: 'code',
385-
code_challenge: 'challenge123',
386-
code_challenge_method: 'S256',
387-
resource: 'https://api.example.com/resource'
388-
});
389-
390-
expect(response.status).toBe(302);
391-
expect(mockProviderPost).toHaveBeenCalledWith(
392-
validClient,
393-
expect.objectContaining({
394-
resource: new URL('https://api.example.com/resource')
395-
}),
396-
expect.any(Object)
397-
);
398-
});
399305
});
400306

401307
describe('Successful authorization', () => {

‎src/server/auth/middleware/bearerAuth.test.ts

Lines changed: 10 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ import { requireBearerAuth } from "./bearerAuth.js";
33
import { AuthInfo } from "../types.js";
44
import { InsufficientScopeError, InvalidTokenError, OAuthError, ServerError } from "../errors.js";
55
import { OAuthTokenVerifier } from "../provider.js";
6-
import { LATEST_PROTOCOL_VERSION, DEFAULT_NEGOTIATED_PROTOCOL_VERSION } from '../../../types.js';
76

87
// Mock verifier
98
const mockVerifyAccessToken = jest.fn();
@@ -43,13 +42,12 @@ describe("requireBearerAuth middleware", () => {
4342

4443
mockRequest.headers = {
4544
authorization: "Bearer valid-token",
46-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
4745
};
4846

4947
const middleware = requireBearerAuth({ verifier: mockVerifier });
5048
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
5149

52-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
50+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
5351
expect(mockRequest.auth).toEqual(validAuthInfo);
5452
expect(nextFunction).toHaveBeenCalled();
5553
expect(mockResponse.status).not.toHaveBeenCalled();
@@ -89,13 +87,12 @@ describe("requireBearerAuth middleware", () => {
8987

9088
mockRequest.headers = {
9189
authorization: "Bearer expired-token",
92-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
9390
};
9491

9592
const middleware = requireBearerAuth({ verifier: mockVerifier });
9693
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
9794

98-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("expired-token", LATEST_PROTOCOL_VERSION);
95+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("expired-token");
9996
expect(mockResponse.status).toHaveBeenCalledWith(401);
10097
expect(mockResponse.set).toHaveBeenCalledWith(
10198
"WWW-Authenticate",
@@ -118,13 +115,12 @@ describe("requireBearerAuth middleware", () => {
118115

119116
mockRequest.headers = {
120117
authorization: "Bearer valid-token",
121-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
122118
};
123119

124120
const middleware = requireBearerAuth({ verifier: mockVerifier });
125121
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
126122

127-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
123+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
128124
expect(mockRequest.auth).toEqual(nonExpiredAuthInfo);
129125
expect(nextFunction).toHaveBeenCalled();
130126
expect(mockResponse.status).not.toHaveBeenCalled();
@@ -141,7 +137,6 @@ describe("requireBearerAuth middleware", () => {
141137

142138
mockRequest.headers = {
143139
authorization: "Bearer valid-token",
144-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
145140
};
146141

147142
const middleware = requireBearerAuth({
@@ -151,7 +146,7 @@ describe("requireBearerAuth middleware", () => {
151146

152147
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
153148

154-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
149+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
155150
expect(mockResponse.status).toHaveBeenCalledWith(403);
156151
expect(mockResponse.set).toHaveBeenCalledWith(
157152
"WWW-Authenticate",
@@ -173,7 +168,6 @@ describe("requireBearerAuth middleware", () => {
173168

174169
mockRequest.headers = {
175170
authorization: "Bearer valid-token",
176-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
177171
};
178172

179173
const middleware = requireBearerAuth({
@@ -183,7 +177,7 @@ describe("requireBearerAuth middleware", () => {
183177

184178
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
185179

186-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
180+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
187181
expect(mockRequest.auth).toEqual(authInfo);
188182
expect(nextFunction).toHaveBeenCalled();
189183
expect(mockResponse.status).not.toHaveBeenCalled();
@@ -232,15 +226,14 @@ describe("requireBearerAuth middleware", () => {
232226
it("should return 401 when token verification fails with InvalidTokenError", async () => {
233227
mockRequest.headers = {
234228
authorization: "Bearer invalid-token",
235-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
236229
};
237230

238231
mockVerifyAccessToken.mockRejectedValue(new InvalidTokenError("Token expired"));
239232

240233
const middleware = requireBearerAuth({ verifier: mockVerifier });
241234
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
242235

243-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("invalid-token", LATEST_PROTOCOL_VERSION);
236+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("invalid-token");
244237
expect(mockResponse.status).toHaveBeenCalledWith(401);
245238
expect(mockResponse.set).toHaveBeenCalledWith(
246239
"WWW-Authenticate",
@@ -255,15 +248,14 @@ describe("requireBearerAuth middleware", () => {
255248
it("should return 403 when access token has insufficient scopes", async () => {
256249
mockRequest.headers = {
257250
authorization: "Bearer valid-token",
258-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
259251
};
260252

261253
mockVerifyAccessToken.mockRejectedValue(new InsufficientScopeError("Required scopes: read, write"));
262254

263255
const middleware = requireBearerAuth({ verifier: mockVerifier });
264256
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
265257

266-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
258+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
267259
expect(mockResponse.status).toHaveBeenCalledWith(403);
268260
expect(mockResponse.set).toHaveBeenCalledWith(
269261
"WWW-Authenticate",
@@ -278,15 +270,14 @@ describe("requireBearerAuth middleware", () => {
278270
it("should return 500 when a ServerError occurs", async () => {
279271
mockRequest.headers = {
280272
authorization: "Bearer valid-token",
281-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
282273
};
283274

284275
mockVerifyAccessToken.mockRejectedValue(new ServerError("Internal server issue"));
285276

286277
const middleware = requireBearerAuth({ verifier: mockVerifier });
287278
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
288279

289-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
280+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
290281
expect(mockResponse.status).toHaveBeenCalledWith(500);
291282
expect(mockResponse.json).toHaveBeenCalledWith(
292283
expect.objectContaining({ error: "server_error", error_description: "Internal server issue" })
@@ -297,15 +288,14 @@ describe("requireBearerAuth middleware", () => {
297288
it("should return 400 for generic OAuthError", async () => {
298289
mockRequest.headers = {
299290
authorization: "Bearer valid-token",
300-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
301291
};
302292

303293
mockVerifyAccessToken.mockRejectedValue(new OAuthError("custom_error", "Some OAuth error"));
304294

305295
const middleware = requireBearerAuth({ verifier: mockVerifier });
306296
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
307297

308-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
298+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
309299
expect(mockResponse.status).toHaveBeenCalledWith(400);
310300
expect(mockResponse.json).toHaveBeenCalledWith(
311301
expect.objectContaining({ error: "custom_error", error_description: "Some OAuth error" })
@@ -316,15 +306,14 @@ describe("requireBearerAuth middleware", () => {
316306
it("should return 500 when unexpected error occurs", async () => {
317307
mockRequest.headers = {
318308
authorization: "Bearer valid-token",
319-
'mcp-protocol-version': LATEST_PROTOCOL_VERSION,
320309
};
321310

322311
mockVerifyAccessToken.mockRejectedValue(new Error("Unexpected error"));
323312

324313
const middleware = requireBearerAuth({ verifier: mockVerifier });
325314
await middleware(mockRequest as Request, mockResponse as Response, nextFunction);
326315

327-
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token", LATEST_PROTOCOL_VERSION);
316+
expect(mockVerifyAccessToken).toHaveBeenCalledWith("valid-token");
328317
expect(mockResponse.status).toHaveBeenCalledWith(500);
329318
expect(mockResponse.json).toHaveBeenCalledWith(
330319
expect.objectContaining({ error: "server_error", error_description: "Internal Server Error" })

0 commit comments

Comments
 (0)