@mcpfn/testing 0.0.1

package/dist/playwright.js

@@ -0,0 +1,545 @@
+// src/playwright.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import {
+  expect,
+  test as base
+} from "@playwright/test";
+
+// src/mock-oauth-server.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { createServer } from "http";
+
+// src/auth-core.ts
+var McpFnAuthAssertionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "McpFnAuthAssertionError";
+  }
+};
+var MCPFN_OAUTH_EXTENSION_GRANTS = {
+  jwtBearer: "urn:ietf:params:oauth:grant-type:jwt-bearer",
+  deviceCode: "urn:ietf:params:oauth:grant-type:device_code",
+  generic: "urn:example:params:oauth:grant-type:extension"
+};
+function createOAuthClientMetadataFixture(options) {
+  return {
+    ...options.extraMetadata,
+    client_id: new URL(options.clientId).toString(),
+    client_name: options.clientName ?? "McpFn OAuth test client",
+    redirect_uris: [...new Set(options.redirectUris.map((uri) => new URL(uri).toString()))],
+    response_types: ["code"],
+    grant_types: [
+      "authorization_code",
+      "refresh_token",
+      ...new Set(options.extraGrantTypes ?? [])
+    ],
+    token_endpoint_auth_method: "none"
+  };
+}
+function createOAuthClientMetadataVariants(baseUrl, redirectUri = new URL("/callback", baseUrl).toString()) {
+  const base2 = new URL(baseUrl);
+  const fixture = (name, extraGrantTypes = []) => createOAuthClientMetadataFixture({
+    clientId: new URL(`/client-metadata/${name}`, base2).toString(),
+    redirectUris: [redirectUri],
+    clientName: `McpFn ${name} client`,
+    extraGrantTypes
+  });
+  return {
+    basic: fixture("basic"),
+    jwtBearerExtension: fixture("jwt-bearer-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.jwtBearer]),
+    deviceCodeExtension: fixture("device-code-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.deviceCode]),
+    genericExtension: fixture("generic-extension", [MCPFN_OAUTH_EXTENSION_GRANTS.generic])
+  };
+}
+function assertAuthorizationCodeClientMetadata(metadata, expectedClientId) {
+  if (expectedClientId && metadata.client_id !== new URL(expectedClientId).toString()) {
+    throw new McpFnAuthAssertionError("OAuth client metadata client_id does not match its document URL");
+  }
+  if (!metadata.response_types.includes("code")) {
+    throw new McpFnAuthAssertionError("OAuth client metadata does not support response_type=code");
+  }
+  if (!metadata.grant_types.includes("authorization_code")) {
+    throw new McpFnAuthAssertionError("OAuth client metadata does not support authorization_code");
+  }
+  if (!metadata.redirect_uris.length) {
+    throw new McpFnAuthAssertionError("OAuth client metadata must declare at least one redirect URI");
+  }
+  return metadata;
+}
+
+// src/mock-oauth-server.ts
+function base64Url(value) {
+  return value.toString("base64url");
+}
+function createPkcePair() {
+  const verifier = base64Url(randomBytes(48));
+  return {
+    verifier,
+    challenge: createHash("sha256").update(verifier).digest("base64url"),
+    method: "S256"
+  };
+}
+function uniqueScopes(value) {
+  return [...new Set((value ?? "").split(/\s+/).filter(Boolean))].sort();
+}
+function json(status, body) {
+  return Response.json(body, {
+    status,
+    headers: { "cache-control": "no-store" }
+  });
+}
+function oauthError(status, error, description) {
+  return json(status, { error, error_description: description });
+}
+function escapeHtml(value) {
+  return value.replaceAll("&", "&amp;").replaceAll('"', "&quot;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}
+function formValue(form, name) {
+  const value = form.get(name);
+  return value === null || value === "" ? void 0 : value;
+}
+var McpFnMockOAuthAuthorizationServer = class {
+  issuer;
+  clientId;
+  redirectUris;
+  scopesSupported;
+  clientMetadata;
+  codes = /* @__PURE__ */ new Map();
+  accessTokens = /* @__PURE__ */ new Map();
+  refreshTokens = /* @__PURE__ */ new Map();
+  callbacks = [];
+  clock;
+  accessTokenLifetimeSeconds;
+  authorizationCodeLifetimeSeconds;
+  refreshTokenLifetimeSeconds;
+  constructor(options) {
+    this.issuer = new URL(options.issuer);
+    this.issuer.pathname = this.issuer.pathname.replace(/\/?$/, "/");
+    this.clientId = options.clientId ?? "mcpfn-playwright";
+    this.redirectUris = options.redirectUris?.map((uri) => new URL(uri).toString()) ?? [
+      new URL("callback", this.issuer).toString()
+    ];
+    this.scopesSupported = [...new Set(options.scopesSupported ?? ["mcp:read", "mcp:write"])].sort();
+    this.clock = options.clock ?? Date.now;
+    this.accessTokenLifetimeSeconds = options.accessTokenLifetimeSeconds ?? 300;
+    this.authorizationCodeLifetimeSeconds = options.authorizationCodeLifetimeSeconds ?? 120;
+    this.refreshTokenLifetimeSeconds = options.refreshTokenLifetimeSeconds ?? 3600;
+    this.clientMetadata = createOAuthClientMetadataVariants(
+      this.issuer,
+      this.redirectUris[0]
+    );
+  }
+  get metadataUrl() {
+    return new URL(".well-known/oauth-authorization-server", this.issuer).toString();
+  }
+  get authorizationEndpoint() {
+    return new URL("authorize", this.issuer).toString();
+  }
+  get tokenEndpoint() {
+    return new URL("token", this.issuer).toString();
+  }
+  get revocationEndpoint() {
+    return new URL("revoke", this.issuer).toString();
+  }
+  get callbackUrl() {
+    return this.redirectUris[0];
+  }
+  clientMetadataUrl(variant) {
+    return this.clientMetadata[variant].client_id;
+  }
+  authorizationUrl(input) {
+    const url = new URL(this.authorizationEndpoint);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", input.clientId ?? this.clientId);
+    url.searchParams.set("redirect_uri", input.redirectUri ?? this.callbackUrl);
+    url.searchParams.set("code_challenge", input.codeChallenge);
+    url.searchParams.set("code_challenge_method", "S256");
+    url.searchParams.set("scope", (input.scopes ?? ["mcp:read"]).join(" "));
+    if (input.state) url.searchParams.set("state", input.state);
+    if (input.resource) url.searchParams.set("resource", input.resource);
+    for (const [name, value] of Object.entries(input.extraParameters ?? {})) {
+      url.searchParams.set(name, value);
+    }
+    return url.toString();
+  }
+  latestCallback() {
+    return this.callbacks.at(-1);
+  }
+  expireAccessToken(token) {
+    const record = this.accessTokens.get(token);
+    if (record) record.expiresAt = this.nowSeconds() - 1;
+  }
+  revokeToken(token) {
+    const access = this.accessTokens.get(token);
+    if (access) access.revoked = true;
+    const refresh = this.refreshTokens.get(token);
+    if (refresh) refresh.revoked = true;
+  }
+  async verifyAccessToken(token) {
+    const record = this.accessTokens.get(token);
+    if (!record || record.revoked || record.expiresAt <= this.nowSeconds()) {
+      throw new Error("Invalid access token");
+    }
+    return {
+      token,
+      clientId: record.clientId,
+      scopes: record.scopes,
+      expiresAt: record.expiresAt,
+      ...record.resource ? { resource: new URL(record.resource) } : {}
+    };
+  }
+  async handle(request) {
+    const url = new URL(request.url);
+    const path = url.pathname.replace(this.issuer.pathname.replace(/\/$/, ""), "") || "/";
+    if (request.method === "GET" && path === "/.well-known/oauth-authorization-server") {
+      return json(200, {
+        issuer: this.issuer.toString(),
+        authorization_endpoint: this.authorizationEndpoint,
+        token_endpoint: this.tokenEndpoint,
+        revocation_endpoint: this.revocationEndpoint,
+        response_types_supported: ["code"],
+        grant_types_supported: ["authorization_code", "refresh_token"],
+        code_challenge_methods_supported: ["S256"],
+        token_endpoint_auth_methods_supported: ["none"],
+        scopes_supported: this.scopesSupported
+      });
+    }
+    if (request.method === "GET" && path.startsWith("/client-metadata/")) {
+      const metadata = Object.values(this.clientMetadata).find((candidate) => new URL(candidate.client_id).pathname === url.pathname);
+      return metadata ? json(200, metadata) : json(404, { error: "not_found" });
+    }
+    if (request.method === "GET" && path === "/authorize") {
+      return this.authorize(url);
+    }
+    if (request.method === "POST" && path === "/token") {
+      return this.token(await request.text());
+    }
+    if (request.method === "POST" && path === "/revoke") {
+      return this.revoke(await request.text());
+    }
+    if (request.method === "GET" && path === "/callback") {
+      const parameters = Object.fromEntries(url.searchParams);
+      this.callbacks.push({ url: url.toString(), parameters });
+      return new Response(
+        `<!doctype html><html><body><main><h1>OAuth callback received</h1><pre>${escapeHtml(JSON.stringify(parameters, null, 2))}</pre></main></body></html>`,
+        { headers: { "content-type": "text/html; charset=utf-8" } }
+      );
+    }
+    return json(404, { error: "not_found" });
+  }
+  nowSeconds() {
+    return Math.floor(this.clock() / 1e3);
+  }
+  resolveClient(clientId) {
+    if (clientId === this.clientId) {
+      return { clientId, redirectUris: this.redirectUris };
+    }
+    const metadata = Object.values(this.clientMetadata).find((candidate) => candidate.client_id === clientId);
+    if (!metadata) return void 0;
+    assertAuthorizationCodeClientMetadata(metadata, clientId);
+    return { clientId, redirectUris: metadata.redirect_uris };
+  }
+  authorize(url) {
+    const clientId = url.searchParams.get("client_id") ?? "";
+    const redirectUri = url.searchParams.get("redirect_uri") ?? "";
+    const client = this.resolveClient(clientId);
+    if (!client) return oauthError(400, "invalid_client", "Unknown OAuth client");
+    if (!client.redirectUris.includes(redirectUri)) {
+      return oauthError(400, "invalid_request", "redirect_uri is not registered");
+    }
+    if (url.searchParams.get("response_type") !== "code") {
+      return this.authorizationRedirect(url, redirectUri, "unsupported_response_type");
+    }
+    const codeChallenge = url.searchParams.get("code_challenge");
+    if (!codeChallenge || url.searchParams.get("code_challenge_method") !== "S256") {
+      return this.authorizationRedirect(url, redirectUri, "invalid_request", "PKCE S256 is required");
+    }
+    const requestedScopes = uniqueScopes(url.searchParams.get("scope"));
+    if (requestedScopes.some((scope) => !this.scopesSupported.includes(scope))) {
+      return this.authorizationRedirect(url, redirectUri, "invalid_scope");
+    }
+    const decision = url.searchParams.get("decision");
+    if (!decision) {
+      const hidden = [...url.searchParams].filter(([name]) => name !== "decision").map(([name, value]) => `<input type="hidden" name="${escapeHtml(name)}" value="${escapeHtml(value)}">`).join("");
+      return new Response(
+        `<!doctype html><html><body><main><h1>Authorize MCP client</h1><p>${escapeHtml(clientId)}</p><form method="get" action="${escapeHtml(this.authorizationEndpoint)}">${hidden}<button name="decision" value="approve">Approve</button><button name="decision" value="deny">Deny</button></form></main></body></html>`,
+        { headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } }
+      );
+    }
+    if (decision === "deny") {
+      return this.authorizationRedirect(url, redirectUri, "access_denied");
+    }
+    if (decision !== "approve") {
+      return oauthError(400, "invalid_request", "Unknown authorization decision");
+    }
+    const code = `mcpfn_code_${randomUUID()}`;
+    this.codes.set(code, {
+      clientId,
+      redirectUri,
+      codeChallenge,
+      scopes: requestedScopes,
+      resource: url.searchParams.get("resource") ?? void 0,
+      expiresAt: this.nowSeconds() + this.authorizationCodeLifetimeSeconds,
+      used: false
+    });
+    const callback = new URL(redirectUri);
+    callback.searchParams.set("code", code);
+    const state = url.searchParams.get("state");
+    if (state) callback.searchParams.set("state", state);
+    return Response.redirect(callback, 302);
+  }
+  authorizationRedirect(requestUrl, redirectUri, error, description) {
+    const callback = new URL(redirectUri);
+    callback.searchParams.set("error", error);
+    if (description) callback.searchParams.set("error_description", description);
+    const state = requestUrl.searchParams.get("state");
+    if (state) callback.searchParams.set("state", state);
+    return Response.redirect(callback, 302);
+  }
+  token(source) {
+    const form = new URLSearchParams(source);
+    const grantType = formValue(form, "grant_type");
+    if (grantType === "authorization_code") return this.exchangeAuthorizationCode(form);
+    if (grantType === "refresh_token") return this.exchangeRefreshToken(form);
+    return oauthError(400, "unsupported_grant_type", "The grant type is not supported");
+  }
+  exchangeAuthorizationCode(form) {
+    const code = formValue(form, "code");
+    const record = code ? this.codes.get(code) : void 0;
+    if (!record || record.used || record.expiresAt <= this.nowSeconds()) {
+      return oauthError(400, "invalid_grant", "Authorization code is invalid or expired");
+    }
+    if (formValue(form, "client_id") !== record.clientId || formValue(form, "redirect_uri") !== record.redirectUri) {
+      return oauthError(400, "invalid_grant", "Authorization code binding does not match");
+    }
+    const verifier = formValue(form, "code_verifier");
+    const challenge = verifier ? createHash("sha256").update(verifier).digest("base64url") : void 0;
+    if (challenge !== record.codeChallenge) {
+      return oauthError(400, "invalid_grant", "PKCE verification failed");
+    }
+    record.used = true;
+    return json(200, this.issueTokenSet(record));
+  }
+  exchangeRefreshToken(form) {
+    const refreshToken = formValue(form, "refresh_token");
+    const record = refreshToken ? this.refreshTokens.get(refreshToken) : void 0;
+    if (!record || record.revoked || record.expiresAt <= this.nowSeconds()) {
+      return oauthError(400, "invalid_grant", "Refresh token is invalid or expired");
+    }
+    if (formValue(form, "client_id") !== record.clientId) {
+      return oauthError(400, "invalid_grant", "Refresh token client binding does not match");
+    }
+    const requestedScopes = form.has("scope") ? uniqueScopes(form.get("scope")) : record.scopes;
+    if (requestedScopes.some((scope) => !record.scopes.includes(scope))) {
+      return oauthError(400, "invalid_scope", "Refresh cannot increase granted scopes");
+    }
+    record.revoked = true;
+    return json(200, this.issueTokenSet({ ...record, scopes: requestedScopes }));
+  }
+  issueTokenSet(input) {
+    const accessToken = `mcpfn_access_${randomUUID()}`;
+    const refreshToken = `mcpfn_refresh_${randomUUID()}`;
+    this.accessTokens.set(accessToken, {
+      ...input,
+      expiresAt: this.nowSeconds() + this.accessTokenLifetimeSeconds,
+      revoked: false
+    });
+    this.refreshTokens.set(refreshToken, {
+      ...input,
+      expiresAt: this.nowSeconds() + this.refreshTokenLifetimeSeconds,
+      revoked: false
+    });
+    return {
+      access_token: accessToken,
+      token_type: "Bearer",
+      expires_in: this.accessTokenLifetimeSeconds,
+      refresh_token: refreshToken,
+      scope: input.scopes.join(" "),
+      ...input.resource ? { resource: input.resource } : {}
+    };
+  }
+  revoke(source) {
+    const token = new URLSearchParams(source).get("token");
+    if (token) this.revokeToken(token);
+    return new Response(null, { status: 200 });
+  }
+};
+async function toRequest(req, origin) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(Buffer.from(chunk));
+  const headers = new Headers();
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (Array.isArray(value)) {
+      for (const entry of value) headers.append(name, entry);
+    } else if (value !== void 0) {
+      headers.set(name, value);
+    }
+  }
+  const body = chunks.length ? Buffer.concat(chunks) : void 0;
+  const init = {
+    method: req.method,
+    headers,
+    ...body ? { body, duplex: "half" } : {}
+  };
+  return new Request(new URL(req.url ?? "/", origin), init);
+}
+async function writeResponse(res, response) {
+  res.statusCode = response.status;
+  response.headers.forEach((value, name) => res.setHeader(name, value));
+  res.end(Buffer.from(await response.arrayBuffer()));
+}
+async function startMockOAuthAuthorizationServer(options = {}) {
+  let oauth;
+  let origin = "";
+  const server = createServer(async (req, res) => {
+    try {
+      if (!oauth) throw new Error("Mock OAuth server is not initialized");
+      await writeResponse(res, await oauth.handle(await toRequest(req, origin)));
+    } catch {
+      res.statusCode = 500;
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify({
+        error: "server_error",
+        error_description: "Internal Server Error"
+      }));
+    }
+  });
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(options.port ?? 0, options.hostname ?? "127.0.0.1", () => {
+      server.off("error", reject);
+      resolve();
+    });
+  });
+  const address = server.address();
+  origin = `http://${address.address.includes(":") ? `[${address.address}]` : address.address}:${address.port}`;
+  oauth = new McpFnMockOAuthAuthorizationServer({ ...options, issuer: origin });
+  return {
+    origin,
+    oauth,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    })
+  };
+}
+
+// src/playwright.ts
+function createOAuthAuthorizationRequestUrl(options) {
+  const pkce = options.pkce ?? createPkcePair();
+  const state = options.state ?? `mcpfn_state_${randomUUID2()}`;
+  const url = new URL(options.authorizationEndpoint);
+  for (const [name, value] of Object.entries(options.extraParameters ?? {})) {
+    url.searchParams.set(name, value);
+  }
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", options.clientId);
+  url.searchParams.set("redirect_uri", options.redirectUri);
+  url.searchParams.set("code_challenge", pkce.challenge);
+  url.searchParams.set("code_challenge_method", pkce.method);
+  url.searchParams.set("state", state);
+  if (options.scopes?.length) url.searchParams.set("scope", options.scopes.join(" "));
+  if (options.resource) url.searchParams.set("resource", options.resource);
+  return { url: url.toString(), pkce, state };
+}
+function parseOAuthCallback(url) {
+  const callback = new URL(url);
+  return {
+    url: callback.toString(),
+    parameters: Object.fromEntries(callback.searchParams)
+  };
+}
+async function authorizeWithBrowser(page, options) {
+  const request = createOAuthAuthorizationRequestUrl(options);
+  await page.goto(request.url);
+  await options.beforeDecision?.(page);
+  const decision = options.decision ?? "approve";
+  const buttonName = decision === "approve" ? options.approveButtonName ?? /^approve$/i : options.denyButtonName ?? /^deny$/i;
+  await page.getByRole("button", { name: buttonName }).click();
+  const redirect = new URL(options.redirectUri);
+  await page.waitForURL((candidate) => candidate.origin === redirect.origin && candidate.pathname === redirect.pathname);
+  const callback = parseOAuthCallback(page.url());
+  if (callback.parameters.state !== request.state) {
+    throw new Error("OAuth callback state does not match the authorization request");
+  }
+  return {
+    authorizationUrl: request.url,
+    callback,
+    pkce: request.pkce,
+    state: request.state
+  };
+}
+async function exchangeAuthorizationCode(options) {
+  const response = await (options.fetch ?? globalThis.fetch)(options.tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      grant_type: "authorization_code",
+      client_id: options.clientId,
+      redirect_uri: options.redirectUri,
+      code: options.code,
+      code_verifier: options.codeVerifier
+    })
+  });
+  const body = await response.json();
+  if (!response.ok) {
+    throw new Error(body.error_description ?? body.error ?? `Token exchange failed with ${response.status}`);
+  }
+  return body;
+}
+async function refreshOAuthAccessToken(options) {
+  const form = new URLSearchParams({
+    grant_type: "refresh_token",
+    client_id: options.clientId,
+    refresh_token: options.refreshToken
+  });
+  if (options.scopes?.length) form.set("scope", options.scopes.join(" "));
+  const response = await (options.fetch ?? globalThis.fetch)(options.tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: form
+  });
+  const body = await response.json();
+  if (!response.ok) {
+    throw new Error(body.error_description ?? body.error ?? `Token refresh failed with ${response.status}`);
+  }
+  return body;
+}
+async function revokeOAuthToken(options) {
+  const response = await (options.fetch ?? globalThis.fetch)(options.revocationEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ token: options.token })
+  });
+  if (!response.ok) throw new Error(`Token revocation failed with ${response.status}`);
+}
+var test = base.extend({
+  mcpfnOAuth: async ({}, use) => {
+    const started = await startMockOAuthAuthorizationServer();
+    const fixture = {
+      started,
+      server: started.oauth,
+      authorize: (page, options = {}) => authorizeWithBrowser(page, {
+        ...options,
+        authorizationEndpoint: options.authorizationEndpoint ?? started.oauth.authorizationEndpoint,
+        clientId: options.clientId ?? started.oauth.clientId,
+        redirectUri: options.redirectUri ?? started.oauth.callbackUrl
+      })
+    };
+    try {
+      await use(fixture);
+    } finally {
+      await started.close();
+    }
+  }
+});
+export {
+  authorizeWithBrowser,
+  createOAuthAuthorizationRequestUrl,
+  exchangeAuthorizationCode,
+  expect,
+  parseOAuthCallback,
+  refreshOAuthAccessToken,
+  revokeOAuthToken,
+  test
+};
+//# sourceMappingURL=playwright.js.map