@neverinfamous/mysql-mcp 2.1.0

package/src/auth/__tests__/AuthorizationServerDiscovery.test.ts

@@ -0,0 +1,312 @@
+/**
+ * mysql-mcp - AuthorizationServerDiscovery Unit Tests
+ * 
+ * Tests for RFC 8414 authorization server metadata discovery
+ * including caching behavior, error handling, and helper methods.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { AuthorizationServerDiscovery, createAuthServerDiscovery } from '../AuthorizationServerDiscovery.js';
+import { AuthServerDiscoveryError } from '../errors.js';
+import type { AuthorizationServerMetadata } from '../types.js';
+
+// Mock logger to avoid console output
+vi.mock('../../utils/logger.js', () => ({
+    logger: {
+        info: vi.fn(),
+        error: vi.fn(),
+        warn: vi.fn(),
+        debug: vi.fn()
+    }
+}));
+
+// Mock global fetch
+const mockFetch = vi.fn();
+vi.stubGlobal('fetch', mockFetch);
+
+describe('AuthorizationServerDiscovery', () => {
+    const mockMetadata: AuthorizationServerMetadata = {
+        issuer: 'https://auth.example.com',
+        token_endpoint: 'https://auth.example.com/token',
+        authorization_endpoint: 'https://auth.example.com/authorize',
+        jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
+        registration_endpoint: 'https://auth.example.com/register',
+        grant_types_supported: ['authorization_code', 'client_credentials', 'refresh_token'],
+        scopes_supported: ['read', 'write', 'admin']
+    };
+
+    let discovery: AuthorizationServerDiscovery;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.useFakeTimers();
+        discovery = new AuthorizationServerDiscovery({
+            authServerUrl: 'https://auth.example.com'
+        });
+    });
+
+    afterEach(() => {
+        vi.useRealTimers();
+    });
+
+    describe('constructor', () => {
+        it('should create instance with config', () => {
+            expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery);
+        });
+
+        it('should use default cacheTtl when not provided', () => {
+            const disc = new AuthorizationServerDiscovery({
+                authServerUrl: 'https://auth.example.com'
+            });
+            expect(disc).toBeDefined();
+        });
+
+        it('should use custom cacheTtl when provided', () => {
+            const disc = new AuthorizationServerDiscovery({
+                authServerUrl: 'https://auth.example.com',
+                cacheTtl: 1800
+            });
+            expect(disc).toBeDefined();
+        });
+
+        it('should use custom timeout when provided', () => {
+            const disc = new AuthorizationServerDiscovery({
+                authServerUrl: 'https://auth.example.com',
+                timeout: 10000
+            });
+            expect(disc).toBeDefined();
+        });
+    });
+
+    describe('discover()', () => {
+        it('should fetch metadata from well-known endpoint', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            const result = await discovery.discover();
+
+            expect(mockFetch).toHaveBeenCalledWith(
+                'https://auth.example.com/.well-known/oauth-authorization-server',
+                expect.objectContaining({
+                    method: 'GET',
+                    headers: { 'Accept': 'application/json' }
+                })
+            );
+            expect(result).toEqual(mockMetadata);
+        });
+
+        it('should cache metadata within TTL', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            // First call - fetches from network
+            const result1 = await discovery.discover();
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+
+            // Advance time by 30 minutes (within default 1 hour TTL)
+            vi.advanceTimersByTime(30 * 60 * 1000);
+
+            // Second call - should use cache
+            const result2 = await discovery.discover();
+            expect(mockFetch).toHaveBeenCalledTimes(1); // No additional fetch
+            expect(result2).toEqual(result1);
+        });
+
+        it('should refresh cache after TTL expires', async () => {
+            mockFetch.mockResolvedValue({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            // First call
+            await discovery.discover();
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+
+            // Advance time past TTL (default 3600 seconds)
+            vi.advanceTimersByTime(3601 * 1000);
+
+            // Second call - should refetch
+            await discovery.discover();
+            expect(mockFetch).toHaveBeenCalledTimes(2);
+        });
+
+        it('should throw AuthServerDiscoveryError on HTTP error', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: false,
+                status: 404,
+                statusText: 'Not Found'
+            });
+
+            await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
+        });
+
+        it('should throw AuthServerDiscoveryError on network error', async () => {
+            mockFetch.mockRejectedValueOnce(new Error('Network error'));
+
+            await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
+        });
+
+        it('should throw AuthServerDiscoveryError when metadata missing required fields', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({ issuer: 'https://auth.example.com' }) // Missing token_endpoint
+            });
+
+            await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
+        });
+
+        it('should throw AuthServerDiscoveryError when issuer is missing', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => ({ token_endpoint: 'https://auth.example.com/token' }) // Missing issuer
+            });
+
+            await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
+        });
+    });
+
+    describe('getJwksUri()', () => {
+        it('should return JWKS URI from metadata', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            const jwksUri = await discovery.getJwksUri();
+            expect(jwksUri).toBe('https://auth.example.com/.well-known/jwks.json');
+        });
+
+        it('should throw when JWKS URI not in metadata', async () => {
+            const metadataWithoutJwks = {
+                issuer: 'https://auth.example.com',
+                token_endpoint: 'https://auth.example.com/token'
+            };
+
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => metadataWithoutJwks
+            });
+
+            await expect(discovery.getJwksUri()).rejects.toThrow(AuthServerDiscoveryError);
+            await expect(discovery.getJwksUri()).rejects.toThrow('does not include jwks_uri');
+        });
+    });
+
+    describe('getTokenEndpoint()', () => {
+        it('should return token endpoint from metadata', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            const tokenEndpoint = await discovery.getTokenEndpoint();
+            expect(tokenEndpoint).toBe('https://auth.example.com/token');
+        });
+    });
+
+    describe('getRegistrationEndpoint()', () => {
+        it('should return registration endpoint when available', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            const registrationEndpoint = await discovery.getRegistrationEndpoint();
+            expect(registrationEndpoint).toBe('https://auth.example.com/register');
+        });
+
+        it('should return undefined when registration endpoint not available', async () => {
+            const metadataWithoutRegistration = {
+                issuer: 'https://auth.example.com',
+                token_endpoint: 'https://auth.example.com/token'
+            };
+
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => metadataWithoutRegistration
+            });
+
+            const registrationEndpoint = await discovery.getRegistrationEndpoint();
+            expect(registrationEndpoint).toBeUndefined();
+        });
+    });
+
+    describe('supportsGrantType()', () => {
+        it('should return true for supported grant type', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            const supports = await discovery.supportsGrantType('client_credentials');
+            expect(supports).toBe(true);
+        });
+
+        it('should return false for unsupported grant type', async () => {
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            const supports = await discovery.supportsGrantType('implicit');
+            expect(supports).toBe(false);
+        });
+
+        it('should return false when grant_types_supported not in metadata', async () => {
+            const metadataWithoutGrants = {
+                issuer: 'https://auth.example.com',
+                token_endpoint: 'https://auth.example.com/token'
+            };
+
+            mockFetch.mockResolvedValueOnce({
+                ok: true,
+                json: async () => metadataWithoutGrants
+            });
+
+            const supports = await discovery.supportsGrantType('authorization_code');
+            expect(supports).toBe(false);
+        });
+    });
+
+    describe('invalidateCache()', () => {
+        it('should clear cached metadata', async () => {
+            mockFetch.mockResolvedValue({
+                ok: true,
+                json: async () => mockMetadata
+            });
+
+            // First call populates cache
+            await discovery.discover();
+            expect(mockFetch).toHaveBeenCalledTimes(1);
+
+            // Invalidate cache
+            discovery.invalidateCache();
+
+            // Next call should refetch
+            await discovery.discover();
+            expect(mockFetch).toHaveBeenCalledTimes(2);
+        });
+    });
+});
+
+describe('createAuthServerDiscovery()', () => {
+    it('should create AuthorizationServerDiscovery instance', () => {
+        const discovery = createAuthServerDiscovery({
+            authServerUrl: 'https://auth.example.com'
+        });
+        expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery);
+    });
+
+    it('should pass all config options', () => {
+        const discovery = createAuthServerDiscovery({
+            authServerUrl: 'https://auth.example.com',
+            cacheTtl: 1800,
+            timeout: 10000
+        });
+        expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery);
+    });
+});

package/src/auth/__tests__/OAuthResourceServer.test.ts

@@ -0,0 +1,183 @@
+/**
+ * mysql-mcp - OAuth Resource Server Unit Tests
+ * 
+ * Tests for OAuthResourceServer RFC 9728 compliance including
+ * metadata generation, scope validation, and configuration.
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest';
+import { OAuthResourceServer, createOAuthResourceServer } from '../OAuthResourceServer.js';
+import type { ResourceServerConfig } from '../types.js';
+
+describe('OAuthResourceServer', () => {
+    let config: ResourceServerConfig;
+    let server: OAuthResourceServer;
+
+    beforeEach(() => {
+        config = {
+            resource: 'https://mysql-mcp.example.com',
+            authorizationServers: ['https://auth.example.com'],
+            scopesSupported: ['read', 'write', 'admin']
+        };
+        server = new OAuthResourceServer(config);
+    });
+
+    describe('Construction', () => {
+        it('should create server with config', () => {
+            expect(server).toBeInstanceOf(OAuthResourceServer);
+        });
+
+        it('should set default bearer methods when not provided', () => {
+            const metadata = server.getMetadata();
+            expect(metadata.bearer_methods_supported).toEqual(['header']);
+        });
+
+        it('should use provided bearer methods', () => {
+            const customServer = new OAuthResourceServer({
+                ...config,
+                bearerMethodsSupported: ['header', 'body']
+            });
+            const metadata = customServer.getMetadata();
+            expect(metadata.bearer_methods_supported).toEqual(['header', 'body']);
+        });
+    });
+
+    describe('getMetadata()', () => {
+        it('should return RFC 9728 compliant structure', () => {
+            const metadata = server.getMetadata();
+
+            expect(metadata).toHaveProperty('resource');
+            expect(metadata).toHaveProperty('authorization_servers');
+            expect(metadata).toHaveProperty('scopes_supported');
+            expect(metadata).toHaveProperty('bearer_methods_supported');
+            expect(metadata).toHaveProperty('resource_documentation');
+            expect(metadata).toHaveProperty('resource_signing_alg_values_supported');
+        });
+
+        it('should include correct resource identifier', () => {
+            const metadata = server.getMetadata();
+            expect(metadata.resource).toBe('https://mysql-mcp.example.com');
+        });
+
+        it('should include authorization servers', () => {
+            const metadata = server.getMetadata();
+            expect(metadata.authorization_servers).toEqual(['https://auth.example.com']);
+        });
+
+        it('should include supported scopes', () => {
+            const metadata = server.getMetadata();
+            expect(metadata.scopes_supported).toEqual(['read', 'write', 'admin']);
+        });
+
+        it('should generate documentation URL', () => {
+            const metadata = server.getMetadata();
+            expect(metadata.resource_documentation).toBe('https://mysql-mcp.example.com/docs');
+        });
+
+        it('should include signing algorithms', () => {
+            const metadata = server.getMetadata();
+            expect(metadata.resource_signing_alg_values_supported).toContain('RS256');
+            expect(metadata.resource_signing_alg_values_supported).toContain('ES256');
+        });
+    });
+
+    describe('getWellKnownPath()', () => {
+        it('should return correct well-known path', () => {
+            expect(server.getWellKnownPath()).toBe('/.well-known/oauth-protected-resource');
+        });
+    });
+
+    describe('isScopeSupported()', () => {
+        it('should return true for explicitly supported scopes', () => {
+            expect(server.isScopeSupported('read')).toBe(true);
+            expect(server.isScopeSupported('write')).toBe(true);
+            expect(server.isScopeSupported('admin')).toBe(true);
+        });
+
+        it('should return false for unsupported scopes', () => {
+            expect(server.isScopeSupported('delete')).toBe(false);
+            expect(server.isScopeSupported('unknown')).toBe(false);
+        });
+
+        it('should accept db: prefixed scopes', () => {
+            expect(server.isScopeSupported('db:mydb')).toBe(true);
+            expect(server.isScopeSupported('db:testdb:read')).toBe(true);
+        });
+
+        it('should accept table: prefixed scopes', () => {
+            expect(server.isScopeSupported('table:users')).toBe(true);
+            expect(server.isScopeSupported('table:orders:write')).toBe(true);
+        });
+
+        it('should reject invalid scope patterns', () => {
+            expect(server.isScopeSupported('database:mydb')).toBe(false);
+            expect(server.isScopeSupported('TB:users')).toBe(false);
+        });
+    });
+
+    describe('getResourceId()', () => {
+        it('should return resource identifier', () => {
+            expect(server.getResourceId()).toBe('https://mysql-mcp.example.com');
+        });
+    });
+
+    describe('getSupportedScopes()', () => {
+        it('should return copy of scopes array', () => {
+            const scopes = server.getSupportedScopes();
+            expect(scopes).toEqual(['read', 'write', 'admin']);
+
+            // Verify it's a copy
+            scopes.push('modified');
+            expect(server.getSupportedScopes()).toEqual(['read', 'write', 'admin']);
+        });
+    });
+
+    describe('getAuthorizationServers()', () => {
+        it('should return copy of authorization servers', () => {
+            const servers = server.getAuthorizationServers();
+            expect(servers).toEqual(['https://auth.example.com']);
+
+            // Verify it's a copy
+            servers.push('https://auth2.example.com');
+            expect(server.getAuthorizationServers()).toEqual(['https://auth.example.com']);
+        });
+
+        it('should support multiple authorization servers', () => {
+            const multiServer = new OAuthResourceServer({
+                ...config,
+                authorizationServers: [
+                    'https://auth1.example.com',
+                    'https://auth2.example.com'
+                ]
+            });
+
+            expect(multiServer.getAuthorizationServers()).toEqual([
+                'https://auth1.example.com',
+                'https://auth2.example.com'
+            ]);
+        });
+    });
+});
+
+describe('createOAuthResourceServer()', () => {
+    it('should create OAuthResourceServer instance', () => {
+        const server = createOAuthResourceServer({
+            resource: 'https://test.example.com',
+            authorizationServers: ['https://auth.example.com'],
+            scopesSupported: ['read']
+        });
+
+        expect(server).toBeInstanceOf(OAuthResourceServer);
+    });
+
+    it('should pass config to server', () => {
+        const server = createOAuthResourceServer({
+            resource: 'https://custom.example.com',
+            authorizationServers: ['https://auth.example.com'],
+            scopesSupported: ['custom-scope']
+        });
+
+        expect(server.getResourceId()).toBe('https://custom.example.com');
+        expect(server.getSupportedScopes()).toContain('custom-scope');
+    });
+});