@stigmer/server 3.14.0-dev.20260910084630

package/src/domain/github/__tests__/github.test.ts

@@ -0,0 +1,196 @@
+/**
+ * Pins the github broker against Go's controller behavior — the arms the
+ * conformance suite deliberately cannot assert (they dial github.com for
+ * real on a configured broker, and the OSS broker is ALWAYS configured):
+ * authorize-URL byte parity, the exchange request's exact wire shape, and
+ * the error-mapping contract (GitHub error → InvalidArgument, network →
+ * Unavailable, unparseable → Internal, config-missing →
+ * FailedPrecondition). Go keeps no in-package tests for these; this file
+ * is the reference-pinning the port adds.
+ *
+ * All arms run against an in-process router with an injected fetch — a
+ * test must never leave the host.
+ */
+import { createClient, createRouterTransport, Code, ConnectError } from "@connectrpc/connect";
+
+import { describe, expect, it } from "vitest";
+
+import { GitHubService } from "@stigmer/protos/ai/stigmer/platform/github/v1/service_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import { registerGitHubServices } from "../controller.js";
+import type { GitHubControllerDeps } from "../controller.js";
+
+const silentLogger = createLogger({ level: "error", pretty: false, write: () => {} });
+
+const REDIRECT = "https://app.example.com/oauth/callback";
+
+function makeClient(overrides: Partial<GitHubControllerDeps> = {}) {
+  const transport = createRouterTransport((router) => {
+    registerGitHubServices(router, {
+      clientId: "test-client-id",
+      clientSecret: "test-client-secret",
+      logger: silentLogger,
+      ...overrides,
+    });
+  });
+  return createClient(GitHubService, transport);
+}
+
+async function grpcError(run: () => Promise<unknown>): Promise<ConnectError> {
+  try {
+    await run();
+    throw new Error("expected the call to fail");
+  } catch (error) {
+    if (error instanceof ConnectError) {
+      return error;
+    }
+    throw error;
+  }
+}
+
+/** A fetch stub returning the given body (or failing), recording the request. */
+function fetchStub(result: { body?: string; reject?: Error }): {
+  fetchImpl: typeof fetch;
+  calls: Array<{ url: string; init: RequestInit }>;
+} {
+  const calls: Array<{ url: string; init: RequestInit }> = [];
+  const fetchImpl = (async (
+    input: Parameters<typeof fetch>[0],
+    init?: Parameters<typeof fetch>[1],
+  ) => {
+    calls.push({ url: String(input), init: init ?? {} });
+    if (result.reject !== undefined) {
+      throw result.reject;
+    }
+    return new Response(result.body ?? "", { status: 200 });
+  }) as typeof fetch;
+  return { fetchImpl, calls };
+}
+
+describe("github broker — getOAuthAuthorizeUrl", () => {
+  it("builds the authorize URL with Go url.Values.Encode byte parity", async () => {
+    const client = makeClient();
+    const out = await client.getOAuthAuthorizeUrl({ redirectUri: REDIRECT });
+
+    // 16 random bytes, hex-encoded (Go generateState).
+    expect(out.state).toMatch(/^[0-9a-f]{32}$/);
+
+    // Keys sorted (client_id, redirect_uri, scope, state), values
+    // QueryEscape'd: ':' → %3A, ',' → %2C, '/' → %2F — the exact bytes Go
+    // produces.
+    expect(out.authorizeUrl).toBe(
+      "https://github.com/login/oauth/authorize" +
+        "?client_id=test-client-id" +
+        "&redirect_uri=https%3A%2F%2Fapp.example.com%2Foauth%2Fcallback" +
+        "&scope=repo%2Cread%3Auser" +
+        `&state=${out.state}`,
+    );
+  });
+
+  it("generates a fresh state per call", async () => {
+    const client = makeClient();
+    const first = await client.getOAuthAuthorizeUrl({ redirectUri: REDIRECT });
+    const second = await client.getOAuthAuthorizeUrl({ redirectUri: REDIRECT });
+    expect(first.state).not.toBe(second.state);
+  });
+
+  it("answers FailedPrecondition without a client id (the cloud-live guard)", async () => {
+    const client = makeClient({ clientId: "" });
+    const err = await grpcError(() =>
+      client.getOAuthAuthorizeUrl({ redirectUri: REDIRECT }),
+    );
+    expect(err.code).toBe(Code.FailedPrecondition);
+    expect(err.rawMessage).toBe(
+      "GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)",
+    );
+  });
+});
+
+describe("github broker — exchangeOAuthCode", () => {
+  it("POSTs the Go-encoded form and relays the token response", async () => {
+    const { fetchImpl, calls } = fetchStub({
+      body: JSON.stringify({
+        access_token: "gho_testtoken",
+        token_type: "bearer",
+        scope: "repo,read:user",
+      }),
+    });
+    const client = makeClient({ fetchImpl });
+
+    const out = await client.exchangeOAuthCode({
+      code: "authcode123",
+      state: "st",
+      redirectUri: REDIRECT,
+    });
+
+    expect(out.accessToken).toBe("gho_testtoken");
+    expect(out.tokenType).toBe("bearer");
+    expect(out.scope).toBe("repo,read:user");
+
+    expect(calls).toHaveLength(1);
+    expect(calls[0]?.url).toBe("https://github.com/login/oauth/access_token");
+    expect(calls[0]?.init.method).toBe("POST");
+    const headers = calls[0]?.init.headers as Record<string, string>;
+    expect(headers["Content-Type"]).toBe("application/x-www-form-urlencoded");
+    expect(headers["Accept"]).toBe("application/json");
+    // Sorted keys, QueryEscape'd values — Go url.Values.Encode bytes.
+    expect(calls[0]?.init.body).toBe(
+      "client_id=test-client-id" +
+        "&client_secret=test-client-secret" +
+        "&code=authcode123" +
+        "&redirect_uri=https%3A%2F%2Fapp.example.com%2Foauth%2Fcallback",
+    );
+  });
+
+  it("maps GitHub's OAuth error to InvalidArgument with the description", async () => {
+    const { fetchImpl } = fetchStub({
+      body: JSON.stringify({
+        error: "bad_verification_code",
+        error_description: "The code passed is incorrect or expired.",
+      }),
+    });
+    const client = makeClient({ fetchImpl });
+
+    const err = await grpcError(() =>
+      client.exchangeOAuthCode({ code: "bad", state: "st", redirectUri: REDIRECT }),
+    );
+    expect(err.code).toBe(Code.InvalidArgument);
+    expect(err.rawMessage).toBe(
+      "GitHub OAuth error: The code passed is incorrect or expired.",
+    );
+  });
+
+  it("maps a network failure to Unavailable", async () => {
+    const { fetchImpl } = fetchStub({ reject: new Error("connect ECONNREFUSED") });
+    const client = makeClient({ fetchImpl });
+
+    const err = await grpcError(() =>
+      client.exchangeOAuthCode({ code: "c", state: "st", redirectUri: REDIRECT }),
+    );
+    expect(err.code).toBe(Code.Unavailable);
+    expect(err.rawMessage).toBe("failed to reach GitHub for token exchange");
+  });
+
+  it("maps an unparseable response to Internal", async () => {
+    const { fetchImpl } = fetchStub({ body: "<html>not json</html>" });
+    const client = makeClient({ fetchImpl });
+
+    const err = await grpcError(() =>
+      client.exchangeOAuthCode({ code: "c", state: "st", redirectUri: REDIRECT }),
+    );
+    expect(err.code).toBe(Code.Internal);
+    expect(err.rawMessage).toBe("failed to parse GitHub response");
+  });
+
+  it("answers FailedPrecondition when either credential is missing", async () => {
+    for (const overrides of [{ clientId: "" }, { clientSecret: "" }]) {
+      const client = makeClient(overrides);
+      const err = await grpcError(() =>
+        client.exchangeOAuthCode({ code: "c", state: "st", redirectUri: REDIRECT }),
+      );
+      expect(err.code).toBe(Code.FailedPrecondition);
+      expect(err.rawMessage).toBe("GitHub OAuth is not configured");
+    }
+  });
+});

package/src/domain/github/controller.ts

@@ -0,0 +1,203 @@
+/**
+ * GitHub broker controller — ports pkg/domain/github: the stateless OAuth
+ * utility service for workspace repo selection (NOT a resource domain — no
+ * store, no persistence of state or tokens; the frontend never holds the
+ * client credentials).
+ *
+ * Proven by github.conformance.test.ts (the Layer-1 protovalidate arms —
+ * the only hermetic, cross-edition-true surface; see that suite's header
+ * for why the other arms are deliberately absent) and
+ * __tests__/github.test.ts (the broker mechanics against an injected
+ * fetch, mirroring where Go keeps these pins).
+ *
+ * The config-missing FailedPrecondition arms are STRUCTURALLY UNREACHABLE
+ * on OSS — the bundled "Stigmer Local" defaults (boot/config.ts) cannot be
+ * blanked — but they are ported and unit-tested: the guard is live on the
+ * cloud edition, and the error copy is cross-edition contract.
+ */
+import { randomBytes } from "node:crypto";
+
+import type { ConnectRouter } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+
+import {
+  ExchangeOAuthCodeResponseSchema,
+  GetOAuthAuthorizeUrlResponseSchema,
+  GitHubService,
+} from "@stigmer/protos/ai/stigmer/platform/github/v1/service_pb";
+import type {
+  ExchangeOAuthCodeRequest,
+  ExchangeOAuthCodeResponse,
+  GetOAuthAuthorizeUrlRequest,
+  GetOAuthAuthorizeUrlResponse,
+} from "@stigmer/protos/ai/stigmer/platform/github/v1/service_pb";
+
+import type { Logger } from "../../boot/logger.js";
+import { goUrlValuesEncode } from "../../gocompat/query-escape.js";
+import {
+  failedPreconditionError,
+  internalError,
+  invalidArgumentError,
+  unavailableError,
+} from "../../pipeline/errors.js";
+
+/** Go githubAuthorizeURL. */
+const GITHUB_AUTHORIZE_URL = "https://github.com/login/oauth/authorize";
+
+/** Go githubTokenURL. */
+const GITHUB_TOKEN_URL = "https://github.com/login/oauth/access_token";
+
+/** Go oauthScopes — repo access + user identity, the workspace needs. */
+const OAUTH_SCOPES = "repo,read:user";
+
+/**
+ * Go httpTimeout (10s): the exchange is a single interactive round-trip to
+ * github.com; anything slower should fail the RPC rather than hold the
+ * caller's OAuth callback open.
+ */
+const HTTP_TIMEOUT_MS = 10_000;
+
+export interface GitHubControllerDeps {
+  readonly clientId: string;
+  readonly clientSecret: string;
+  readonly logger: Logger;
+  /** Test seam for the token exchange; defaults to global fetch. */
+  readonly fetchImpl?: typeof fetch;
+}
+
+/** Registers the GitHub broker service on the router (routes stage). */
+export function registerGitHubServices(
+  router: ConnectRouter,
+  deps: GitHubControllerDeps,
+): void {
+  router.service(GitHubService, {
+    getOAuthAuthorizeUrl: (req) => getOAuthAuthorizeUrl(deps, req),
+    exchangeOAuthCode: (req) => exchangeOAuthCode(deps, req),
+  });
+}
+
+/**
+ * Go GetOAuthAuthorizeUrl: pure URL construction — client_id, the caller's
+ * redirect_uri, the pinned scopes, and a random 16-byte hex state, encoded
+ * with Go url.Values.Encode semantics (sorted keys, QueryEscape) so the
+ * URL is byte-identical across editions.
+ */
+function getOAuthAuthorizeUrl(
+  deps: GitHubControllerDeps,
+  req: GetOAuthAuthorizeUrlRequest,
+): GetOAuthAuthorizeUrlResponse {
+  if (deps.clientId === "") {
+    throw failedPreconditionError(
+      "GitHub OAuth is not configured (STIGMER_GITHUB_CLIENT_ID not set)",
+    );
+  }
+
+  let state: string;
+  try {
+    state = randomBytes(16).toString("hex");
+  } catch (error) {
+    deps.logger.error("failed to generate OAuth state", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    throw internalError(error, "failed to generate OAuth state");
+  }
+
+  const authorizeUrl =
+    GITHUB_AUTHORIZE_URL +
+    "?" +
+    goUrlValuesEncode({
+      client_id: deps.clientId,
+      redirect_uri: req.redirectUri,
+      scope: OAUTH_SCOPES,
+      state,
+    });
+
+  return create(GetOAuthAuthorizeUrlResponseSchema, { authorizeUrl, state });
+}
+
+/** The JSON shape of GitHub's token endpoint response (Go githubTokenResponse). */
+interface GitHubTokenResponse {
+  readonly access_token?: string;
+  readonly token_type?: string;
+  readonly scope?: string;
+  readonly error?: string;
+  readonly error_description?: string;
+}
+
+/**
+ * Go ExchangeOAuthCode: POSTs the code to github.com and relays the token
+ * to the caller — nothing stored. Error mapping is contract: GitHub's own
+ * OAuth error → InvalidArgument (the caller sent a bad/expired code);
+ * network failure → Unavailable; unreadable/unparseable response →
+ * Internal.
+ */
+async function exchangeOAuthCode(
+  deps: GitHubControllerDeps,
+  req: ExchangeOAuthCodeRequest,
+): Promise<ExchangeOAuthCodeResponse> {
+  if (deps.clientId === "" || deps.clientSecret === "") {
+    throw failedPreconditionError("GitHub OAuth is not configured");
+  }
+
+  const body = goUrlValuesEncode({
+    client_id: deps.clientId,
+    client_secret: deps.clientSecret,
+    code: req.code,
+    redirect_uri: req.redirectUri,
+  });
+
+  const fetchImpl = deps.fetchImpl ?? fetch;
+  let response: Response;
+  try {
+    response = await fetchImpl(GITHUB_TOKEN_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json",
+      },
+      body,
+      signal: AbortSignal.timeout(HTTP_TIMEOUT_MS),
+    });
+  } catch (error) {
+    deps.logger.error("GitHub token exchange failed", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    throw unavailableError("failed to reach GitHub for token exchange");
+  }
+
+  let raw: string;
+  try {
+    raw = await response.text();
+  } catch (error) {
+    deps.logger.error("failed to read GitHub token response", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    throw internalError(error, "failed to read GitHub response");
+  }
+
+  let tokenResponse: GitHubTokenResponse;
+  try {
+    tokenResponse = JSON.parse(raw) as GitHubTokenResponse;
+  } catch (error) {
+    deps.logger.error("failed to parse GitHub token response", {
+      error: error instanceof Error ? error.message : String(error),
+    });
+    throw internalError(error, "failed to parse GitHub response");
+  }
+
+  if (tokenResponse.error !== undefined && tokenResponse.error !== "") {
+    deps.logger.warn("GitHub OAuth error", {
+      error: tokenResponse.error,
+      description: tokenResponse.error_description ?? "",
+    });
+    throw invalidArgumentError(
+      `GitHub OAuth error: ${tokenResponse.error_description ?? ""}`,
+    );
+  }
+
+  return create(ExchangeOAuthCodeResponseSchema, {
+    accessToken: tokenResponse.access_token ?? "",
+    tokenType: tokenResponse.token_type ?? "",
+    scope: tokenResponse.scope ?? "",
+  });
+}

package/src/domain/mcpserver/__tests__/connect-authorization.test.ts

@@ -0,0 +1,261 @@
+/**
+ * Pins the C2 Stage-4 enforcement on the six config-annotated connect
+ * lanes (connect, startConnect, initiateOAuthConnect,
+ * completeOAuthConnect, disconnectOAuth, getOAuthGrantStatus): each
+ * evaluates its OWN annotation through authorizeDirect, and a denying
+ * authorizer answers PERMISSION_DENIED with the method's byte-pinned
+ * error_msg. Java-parity orders are asserted structurally:
+ *
+ *   - connect/startConnect/initiateOAuthConnect authorize AFTER the load
+ *     (stigmer#224 — a missing server answers NOT_FOUND even to a caller
+ *     the authorizer would deny);
+ *   - completeOAuthConnect authorizes against the PENDING RECORD's server
+ *     id, and the single-use state is burned before the denial lands (the
+ *     Java discipline — asserted via the consumed-state refusal on retry);
+ *   - disconnectOAuth/getOAuthGrantStatus authorize before any grant
+ *     lookup (the grant store is untouchable under denial).
+ */
+import { create } from "@bufbuild/protobuf";
+import { Code, ConnectError } from "@connectrpc/connect";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+import { McpServerSchema } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/api_pb";
+import {
+  CompleteOAuthConnectInputSchema,
+  ConnectInputSchema,
+  DisconnectOAuthInputSchema,
+  GetOAuthGrantStatusInputSchema,
+  InitiateOAuthConnectInputSchema,
+} from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/io_pb";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+
+import { createLogger } from "../../../boot/logger.js";
+import type { Authorizer, AuthzCheck } from "../../../extensions/authorizer.js";
+import { testCallerIdentity } from "../../../pipeline/__tests__/support.js";
+import { SqliteStore } from "../../../store/sqlite/store.js";
+
+import { connect } from "../connect.js";
+import type { McpServerConnectDeps } from "../connect.js";
+import { completeOAuthConnect } from "../complete-oauth-connect.js";
+import { disconnectOAuth } from "../disconnect-oauth.js";
+import { getOAuthGrantStatus } from "../get-oauth-grant-status.js";
+import { initiateOAuthConnect } from "../initiate-oauth-connect.js";
+import { startConnect } from "../start-connect.js";
+
+const silentLogger = createLogger({
+  level: "error",
+  pretty: false,
+  write: () => {},
+});
+
+const caller = testCallerIdentity();
+
+/** Records every check and denies — the arm + target assertions read it. */
+function denyingAuthorizer(): { authorizer: Authorizer; checks: AuthzCheck[] } {
+  const checks: AuthzCheck[] = [];
+  return {
+    checks,
+    authorizer: {
+      authorize(_caller, check) {
+        checks.push(check);
+        return Promise.resolve({ kind: "deny", reason: "" });
+      },
+    },
+  };
+}
+
+let dir: string;
+let store: SqliteStore;
+
+beforeEach(() => {
+  dir = mkdtempSync(path.join(tmpdir(), "mcps-authz-test-"));
+  store = SqliteStore.open(path.join(dir, "stigmer.db"));
+});
+
+afterEach(() => {
+  store.close();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+async function seedServer(id: string): Promise<void> {
+  await store.saveResource(
+    ApiResourceKind.mcp_server,
+    id,
+    McpServerSchema,
+    create(McpServerSchema, {
+      apiVersion: "agentic.stigmer.ai/v1",
+      kind: "McpServer",
+      metadata: { id, name: id, org: "test-org" },
+    }),
+  );
+}
+
+function deps(authorizer: Authorizer): McpServerConnectDeps {
+  // Only the members a lane touches BEFORE its authorize call are real;
+  // everything after the denial is unreachable and throws if touched.
+  const unreachable = <T extends object>(name: string): T =>
+    new Proxy({} as T, {
+      get(_target, prop) {
+        throw new Error(`${name}.${String(prop)} reached despite the denial`);
+      },
+    });
+  return {
+    store,
+    logger: silentLogger,
+    authorizer,
+    engineState: () => ({
+      connected: true,
+      engine: unreachable("engine"),
+    }),
+    environmentReader: unreachable("environmentReader"),
+    executionContext: unreachable("executionContext"),
+    runnerAuth: unreachable("runnerAuth"),
+    managedEnv: unreachable("managedEnv"),
+    oauthGrants: unreachable("oauthGrants"),
+    pendingOAuthStates: store.pendingOAuthStates,
+    secretService: unreachable("secretService"),
+    oauthRedirectUri: "http://localhost:7233/oauth/callback",
+  };
+}
+
+async function expectDenied(run: () => Promise<unknown>, copy: string) {
+  const error = await run().catch((e: unknown) => e);
+  expect(error).toBeInstanceOf(ConnectError);
+  expect((error as ConnectError).code).toBe(Code.PermissionDenied);
+  expect((error as ConnectError).rawMessage).toBe(copy);
+}
+
+describe("connect-lane authorization (C2 Stage 4)", () => {
+  it("connect: a missing server answers NOT_FOUND even under denial (load-first, #224); an existing one denies with the annotation copy", async () => {
+    const { authorizer } = denyingAuthorizer();
+    const missing = await connect(
+      deps(authorizer),
+      create(ConnectInputSchema, { mcpServerId: "mcps_missing", org: "o" }),
+      caller,
+    ).catch((e: unknown) => e);
+    expect((missing as ConnectError).code).toBe(Code.NotFound);
+
+    await seedServer("mcps_denied");
+    await expectDenied(
+      () =>
+        connect(
+          deps(authorizer),
+          create(ConnectInputSchema, { mcpServerId: "mcps_denied", org: "o" }),
+          caller,
+        ),
+      "unauthorized to connect to mcp server",
+    );
+  });
+
+  it("startConnect denies with the shared connect annotation copy after the load", async () => {
+    const { authorizer } = denyingAuthorizer();
+    await seedServer("mcps_denied");
+    await expectDenied(
+      () =>
+        startConnect(
+          deps(authorizer),
+          create(ConnectInputSchema, { mcpServerId: "mcps_denied", org: "o" }),
+          caller,
+        ),
+      "unauthorized to connect to mcp server",
+    );
+  });
+
+  it("initiateOAuthConnect denies with its annotation copy after the load", async () => {
+    const { authorizer } = denyingAuthorizer();
+    await seedServer("mcps_denied");
+    await expectDenied(
+      () =>
+        initiateOAuthConnect(
+          deps(authorizer),
+          create(InitiateOAuthConnectInputSchema, {
+            mcpServerId: "mcps_denied",
+          }),
+          caller,
+        ),
+      "unauthorized to initiate oauth connect for mcp server",
+    );
+  });
+
+  it("completeOAuthConnect authorizes the PENDING RECORD's id and burns the state before the denial", async () => {
+    const { authorizer, checks } = denyingAuthorizer();
+    await store.pendingOAuthStates.save({
+      state: "state-123",
+      codeVerifier: "",
+      clientId: "",
+      clientSecret: "",
+      tokenEndpoint: "",
+      mcpServerId: "mcps_pending",
+      identityAccountId: "",
+      targetEnvVar: "",
+      authMethod: "mcp_oauth",
+      tokenAuthMethod: "",
+      redirectUri: "",
+      org: "test-org",
+      createdAt: 0,
+    });
+
+    await expectDenied(
+      () =>
+        completeOAuthConnect(
+          deps(authorizer),
+          create(CompleteOAuthConnectInputSchema, {
+            mcpServerId: "mcps_pending",
+            state: "state-123",
+            authorizationCode: "code",
+          }),
+          caller,
+        ),
+      "unauthorized to complete oauth connect for mcp server",
+    );
+    // The target of record is the server-side pending state's id.
+    expect(checks[0].resourceId).toBe("mcps_pending");
+    // The single-use state was consumed before the denial (Java parity):
+    // a retry refuses on the missing state, not on authorization.
+    const retry = await completeOAuthConnect(
+      deps(authorizer),
+      create(CompleteOAuthConnectInputSchema, {
+        mcpServerId: "mcps_pending",
+        state: "state-123",
+        authorizationCode: "code",
+      }),
+      caller,
+    ).catch((e: unknown) => e);
+    expect((retry as ConnectError).code).toBe(Code.FailedPrecondition);
+  });
+
+  it("disconnectOAuth denies with its annotation copy before any grant lookup", async () => {
+    const { authorizer } = denyingAuthorizer();
+    await expectDenied(
+      () =>
+        disconnectOAuth(
+          deps(authorizer),
+          create(DisconnectOAuthInputSchema, {
+            resourceId: "mcps_denied",
+            org: "o",
+          }),
+          caller,
+        ),
+      "unauthorized to disconnect oauth for mcp server",
+    );
+  });
+
+  it("getOAuthGrantStatus denies with its annotation copy before any grant lookup", async () => {
+    const { authorizer } = denyingAuthorizer();
+    await expectDenied(
+      () =>
+        getOAuthGrantStatus(
+          deps(authorizer),
+          create(GetOAuthGrantStatusInputSchema, {
+            resourceId: "mcps_denied",
+            org: "o",
+          }),
+          caller,
+        ),
+      "unauthorized to view oauth status for mcp server",
+    );
+  });
+});