@lightsage/mcp 0.4.14 → 0.4.16

package/test/mcp-auth.test.js

@@ -6,11 +6,27 @@ process.env.MCP_OAUTH_ENABLED = "true";
 
 const { default: handler } = await import("../api/mcp.js");
 const {
+  exchangeFailureResponse,
+  exchangeForLightsageIdentity,
   exchangeForLightsageKey,
+  KeyExchangeError,
   MCP_SUPPORTED_SCOPES,
   oauthAuthenticationOptions,
   protectedResourceMetadata,
+  tokenAudienceAllowed,
 } = await import("../lib/oauth.js");
+const { profileToolResult, registerProfileTool } = await import(
+  "../lib/profile.js"
+);
+const { Client } = await import(
+  "@modelcontextprotocol/sdk/client/index.js"
+);
+const { InMemoryTransport } = await import(
+  "@modelcontextprotocol/sdk/inMemory.js"
+);
+const { McpServer } = await import(
+  "@modelcontextprotocol/sdk/server/mcp.js"
+);
 const { resolveMCPServerAPIKey } = await import(
   "../esm/mcp-server/flags.js"
 );
@@ -219,3 +235,190 @@ test("OAuth key exchange forwards the Clerk user and client IDs", async (t) => {
     "ls_cli_test",
   );
 });
+
+function unsignedJwt(payload) {
+  const encode = (value) =>
+    Buffer.from(JSON.stringify(value)).toString("base64url");
+  return `${encode({ alg: "RS256", typ: "at+jwt" })}.${encode(payload)}.sig`;
+}
+
+test("OAuth tokens bound to another resource are rejected", () => {
+  const req = {
+    headers: { host: "mcp.lightsage.com", "x-forwarded-proto": "https" },
+  };
+  const allowed = (payload) => tokenAudienceAllowed(unsignedJwt(payload), req);
+
+  // Clerk copies the client's `resource` parameter into `aud` unchanged, so
+  // these are the same server as different clients may name it.
+  for (const aud of [
+    "https://mcp.lightsage.com/mcp",
+    "https://mcp.lightsage.com/mcp/",
+    "https://mcp.lightsage.com",
+    "https://mcp.lightsage.com/",
+    "https://mcp.lightsage.com:443/mcp",
+    "https://mcp.lightsage.com/mcp?x=1",
+    "https://mcp.usesapient.com/mcp",
+  ]) {
+    assert.equal(allowed({ aud }), true, aud);
+  }
+  assert.equal(allowed({ aud: ["https://mcp.usesapient.com/mcp/"] }), true);
+  assert.equal(allowed({ resource: "https://mcp.lightsage.com/mcp" }), true);
+
+  for (const aud of [
+    "https://other.example.com/mcp",
+    "https://other.example.com",
+    "https://mcp.lightsage.com.evil.example/mcp",
+    "https://mcp.lightsage.com/other",
+    "https://mcp.lightsage.com/mc",
+    "https://mcp.lightsage.com/mcp/other",
+    "http://mcp.lightsage.com/mcp",
+  ]) {
+    assert.equal(allowed({ aud }), false, aud);
+  }
+  assert.equal(
+    allowed({
+      aud: ["https://other.example.com/mcp"],
+      resource: "https://evil.example.com",
+    }),
+    false,
+  );
+
+  // Clerk does not bind every OAuth token to a resource.
+  assert.equal(allowed({ sub: "user_1" }), true);
+  assert.equal(tokenAudienceAllowed("oat_opaque_token", req), true);
+});
+
+test("OAuth key exchange returns the connected profile and typed refusals", async (t) => {
+  process.env.LIGHTSAGE_EXCHANGE_URL = "https://api.example.test/mcp/exchange";
+  process.env.MCP_EXCHANGE_SECRET = "exchange-secret";
+  const profile = { id: "prf_1", email: "a@example.com", nickname: "Acme" };
+
+  const fetchMock = t.mock.method(globalThis, "fetch", async () =>
+    Response.json({ api_key: "ls_cli_test", profile }));
+  assert.deepEqual(
+    await exchangeForLightsageIdentity("user_123", "client_123"),
+    { apiKey: "ls_cli_test", profile },
+  );
+
+  fetchMock.mock.mockImplementation(async () =>
+    Response.json(
+      { detail: "Organization selection is required" },
+      {
+        status: 409,
+        headers: { "x-mcp-exchange-error": "organization_selection_required" },
+      },
+    ));
+  await assert.rejects(
+    exchangeForLightsageIdentity("user_123", "client_123"),
+    (error) =>
+      error instanceof KeyExchangeError
+      && error.status === 409
+      && error.code === "organization_selection_required",
+  );
+});
+
+test("exchange refusals become re-authorization or access-denied responses", () => {
+  const req = {
+    headers: { host: "mcp.lightsage.com", "x-forwarded-proto": "https" },
+  };
+
+  for (
+    const code of [
+      "organization_selection_required",
+      "not_an_organization_member",
+    ]
+  ) {
+    const response = exchangeFailureResponse(
+      req,
+      new KeyExchangeError("refused", { status: 409, code }),
+    );
+    assert.equal(response.status, 401);
+    assert.match(response.headers["WWW-Authenticate"], /resource_metadata="/);
+    assert.match(response.headers["WWW-Authenticate"], /error="invalid_token"/);
+    assert.match(response.headers["WWW-Authenticate"], /error_description="/);
+  }
+
+  for (const code of ["user_not_provisioned", "no_organization"]) {
+    const response = exchangeFailureResponse(
+      req,
+      new KeyExchangeError("refused", { status: 404, code }),
+    );
+    assert.equal(response.status, 403);
+    assert.equal(response.body.error, "access_denied");
+  }
+
+  assert.deepEqual(
+    exchangeFailureResponse(req, new Error("network down")),
+    { status: 502, headers: {}, body: { error: "key_exchange_failed" } },
+  );
+  // An unconfigured exchange endpoint also answers 404, without a code.
+  assert.equal(
+    exchangeFailureResponse(
+      req,
+      new KeyExchangeError("disabled", { status: 404 }),
+    ).status,
+    502,
+  );
+});
+
+test("profile tool is declared for OpenAI hosts and returns the profile", async () => {
+  const server = new McpServer({ name: "profile-test", version: "1.0.0" });
+  registerProfileTool(server, {
+    id: "prf_8d7e4b19",
+    email: "alex@example.com",
+    nickname: "Acme",
+  });
+  const client = new Client({ name: "profile-client", version: "1.0.0" });
+  const [clientTransport, serverTransport] = InMemoryTransport
+    .createLinkedPair();
+  await Promise.all([
+    server.connect(serverTransport),
+    client.connect(clientTransport),
+  ]);
+
+  try {
+    const { tools } = await client.listTools();
+    assert.equal(tools.length, 1);
+    const [tool] = tools;
+    assert.equal(tool.name, "get_profile");
+    assert.equal(tool._meta["openai/profile"], true);
+    assert.deepEqual(tool._meta.securitySchemes, [
+      { type: "oauth2", scopes: [] },
+    ]);
+    assert.equal(tool.annotations.readOnlyHint, true);
+    assert.equal(tool.annotations.destructiveHint, false);
+    assert.equal(tool.annotations.openWorldHint, false);
+    assert.deepEqual(tool.inputSchema.properties, {});
+    assert.equal(tool.inputSchema.additionalProperties, false);
+    assert.deepEqual(tool.outputSchema.required, ["id"]);
+    assert.equal(tool.outputSchema.additionalProperties, false);
+    assert.deepEqual(Object.keys(tool.outputSchema.properties), [
+      "id",
+      "email",
+      "nickname",
+    ]);
+
+    const result = await client.callTool({ name: "get_profile", arguments: {} });
+    const expected = {
+      id: "prf_8d7e4b19",
+      email: "alex@example.com",
+      nickname: "Acme",
+    };
+    assert.equal(result.isError, false);
+    assert.deepEqual(result.structuredContent, expected);
+    assert.deepEqual(JSON.parse(result.content[0].text), expected);
+  } finally {
+    await client.close();
+  }
+});
+
+test("profile tool never invents an identity", () => {
+  assert.deepEqual(profileToolResult({ id: "prf_1", email: "" }).structuredContent, {
+    id: "prf_1",
+  });
+  for (const profile of [null, {}, { id: "   " }, { id: 42 }]) {
+    const result = profileToolResult(profile);
+    assert.equal(result.isError, true);
+    assert.equal(result.structuredContent, undefined);
+  }
+});