@stigmer/server 3.14.0-dev.20260910084630

package/src/domain/mcpserver/oauth/__tests__/discovery.test.ts

@@ -0,0 +1,150 @@
+/**
+ * Pins RFC 8414 discovery against Go oauth/discovery.go: the well-known
+ * URI lives at the URL ORIGIN (not under the server's path), S256 support
+ * is mandatory when advertised, and every error message is text initiate
+ * embeds in its FailedPrecondition copy — asserted verbatim.
+ */
+import { describe, expect, it } from "vitest";
+
+import { buildWellKnownUrl, discoverAuthorizationServer } from "../discovery.js";
+
+function jsonResponse(status: number, body: unknown): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+const VALID_METADATA = {
+  issuer: "https://auth.example.com",
+  authorization_endpoint: "https://auth.example.com/authorize",
+  token_endpoint: "https://auth.example.com/token",
+  registration_endpoint: "https://auth.example.com/register",
+  scopes_supported: ["read", "write"],
+  code_challenge_methods_supported: ["S256"],
+};
+
+describe("buildWellKnownUrl", () => {
+  it("builds at the origin, dropping the server path (Linear-style URL)", () => {
+    expect(buildWellKnownUrl("https://mcp.linear.app/mcp")).toBe(
+      "https://mcp.linear.app/.well-known/oauth-authorization-server",
+    );
+  });
+
+  it("preserves a non-default port in the origin", () => {
+    expect(buildWellKnownUrl("http://127.0.0.1:8931/api/v2")).toBe(
+      "http://127.0.0.1:8931/.well-known/oauth-authorization-server",
+    );
+  });
+
+  const invalid: Array<[string, string, string]> = [
+    [
+      "a non-http(s) scheme",
+      "ftp://example.com",
+      'invalid server URL for discovery: unsupported scheme "ftp": only http and https are supported',
+    ],
+  ];
+  it.each(invalid)("rejects %s", (_label, url, message) => {
+    expect(() => buildWellKnownUrl(url)).toThrow(message);
+  });
+
+  it("rejects an unparseable URL with the Go prefix", () => {
+    expect(() => buildWellKnownUrl("::::")).toThrow(
+      /^invalid server URL for discovery: /,
+    );
+  });
+});
+
+describe("discoverAuthorizationServer", () => {
+  it("parses valid metadata and sends Accept: application/json to the origin well-known URI", async () => {
+    let requestedUrl = "";
+    let accept = "";
+    const metadata = await discoverAuthorizationServer(
+      "https://mcp.example.com/mcp",
+      async (url, init) => {
+        requestedUrl = String(url);
+        accept = (init?.headers as Record<string, string>)["Accept"] ?? "";
+        return jsonResponse(200, VALID_METADATA);
+      },
+    );
+    expect(requestedUrl).toBe(
+      "https://mcp.example.com/.well-known/oauth-authorization-server",
+    );
+    expect(accept).toBe("application/json");
+    expect(metadata.authorizationEndpoint).toBe(
+      "https://auth.example.com/authorize",
+    );
+    expect(metadata.tokenEndpoint).toBe("https://auth.example.com/token");
+    expect(metadata.registrationEndpoint).toBe(
+      "https://auth.example.com/register",
+    );
+    expect(metadata.scopesSupported).toEqual(["read", "write"]);
+  });
+
+  it("refuses a non-200 with the MCP Authorization hint (Go copy, verbatim)", async () => {
+    await expect(
+      discoverAuthorizationServer("https://mcp.example.com/mcp", async () =>
+        jsonResponse(404, {}),
+      ),
+    ).rejects.toThrow(
+      "authorization server discovery failed: https://mcp.example.com/.well-known/oauth-authorization-server returned HTTP 404 (expected 200). " +
+        "This MCP server may not support the MCP Authorization specification",
+    );
+  });
+
+  const missingEndpoint: Array<[string, Record<string, unknown>, string]> = [
+    [
+      "authorization_endpoint",
+      { ...VALID_METADATA, authorization_endpoint: undefined },
+      "is missing authorization_endpoint",
+    ],
+    [
+      "token_endpoint",
+      { ...VALID_METADATA, token_endpoint: undefined },
+      "is missing token_endpoint",
+    ],
+  ];
+  it.each(missingEndpoint)(
+    "refuses metadata without %s",
+    async (_label, body, fragment) => {
+      await expect(
+        discoverAuthorizationServer("https://mcp.example.com/mcp", async () =>
+          jsonResponse(200, body),
+        ),
+      ).rejects.toThrow(fragment);
+    },
+  );
+
+  it("refuses a server that advertises methods without S256 (Go %v list rendering)", async () => {
+    await expect(
+      discoverAuthorizationServer("https://mcp.example.com/mcp", async () =>
+        jsonResponse(200, {
+          ...VALID_METADATA,
+          code_challenge_methods_supported: ["plain"],
+        }),
+      ),
+    ).rejects.toThrow(
+      "does not support S256 PKCE (supports: [plain]). S256 is required by the MCP Authorization specification",
+    );
+  });
+
+  it("accepts a server that advertises NO methods (list absent = unconstrained)", async () => {
+    const metadata = await discoverAuthorizationServer(
+      "https://mcp.example.com/mcp",
+      async () =>
+        jsonResponse(200, {
+          ...VALID_METADATA,
+          code_challenge_methods_supported: undefined,
+        }),
+    );
+    expect(metadata.codeChallengeMethodsSupported).toEqual([]);
+  });
+
+  it("wraps a network failure with the discovery-request prefix", async () => {
+    await expect(
+      discoverAuthorizationServer("https://mcp.example.com/mcp", async () => {
+        throw new Error("connect ECONNREFUSED");
+      }),
+    ).rejects.toThrow(/^discovery request to .* failed: connect ECONNREFUSED$/);
+  });
+});

package/src/domain/mcpserver/oauth/__tests__/pkce.test.ts

@@ -0,0 +1,34 @@
+/**
+ * Pins PKCE pair generation against Go oauth/pkce.go: 32-byte base64url
+ * verifier (no padding), S256 challenge = base64url(SHA-256(verifier)) —
+ * RFC 7636 / OAuth 2.1 shape the mock authorization server verifies at
+ * the token exchange.
+ */
+import { createHash } from "node:crypto";
+import { describe, expect, it } from "vitest";
+
+import { generatePkce } from "../pkce.js";
+
+describe("generatePkce", () => {
+  it("produces a 43-char base64url verifier (32 bytes, no padding)", () => {
+    const pair = generatePkce();
+    expect(pair.codeVerifier).toHaveLength(43);
+    expect(pair.codeVerifier).toMatch(/^[A-Za-z0-9_-]+$/);
+  });
+
+  it("derives the challenge as base64url(SHA-256(verifier)) — S256", () => {
+    const pair = generatePkce();
+    const expected = createHash("sha256")
+      .update(pair.codeVerifier)
+      .digest()
+      .toString("base64url");
+    expect(pair.codeChallenge).toBe(expected);
+  });
+
+  it("generates a fresh pair on every call", () => {
+    const a = generatePkce();
+    const b = generatePkce();
+    expect(a.codeVerifier).not.toBe(b.codeVerifier);
+    expect(a.codeChallenge).not.toBe(b.codeChallenge);
+  });
+});

package/src/domain/mcpserver/oauth/__tests__/preflight.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Pins the authorize pre-flight probe against Go oauth/preflight.go
+ * (stigmer/stigmer#235): ONLY HTTP 400 classifies as blocked (RFC 6749
+ * §4.1.2.1's no-redirect rejection); 2xx/3xx/403/503 fail open (bot walls
+ * answer server-side GETs while real browsers pass); redirects are never
+ * followed; vendor detail comes from an RFC-shaped JSON body only.
+ */
+import { describe, expect, it } from "vitest";
+
+import { preflightAuthorize } from "../preflight.js";
+
+describe("preflightAuthorize", () => {
+  it("classifies HTTP 400 with an RFC-shaped body as a rejection with vendor detail", async () => {
+    const rejection = await preflightAuthorize(
+      "https://auth.example.com/authorize?x=1",
+      async () =>
+        new Response(
+          JSON.stringify({
+            error: "invalid_request",
+            error_description: "redirect_uri not allowed",
+          }),
+          { status: 400 },
+        ),
+    );
+    expect(rejection).toBeDefined();
+    expect(rejection?.statusCode).toBe(400);
+    expect(rejection?.vendorDetail).toBe("redirect_uri not allowed");
+  });
+
+  it("falls back to the RFC error field when error_description is absent", async () => {
+    const rejection = await preflightAuthorize(
+      "https://auth.example.com/authorize",
+      async () =>
+        new Response(JSON.stringify({ error: "invalid_request" }), {
+          status: 400,
+        }),
+    );
+    expect(rejection?.vendorDetail).toBe("invalid_request");
+  });
+
+  it("yields empty vendor detail for an HTML error page (the Canva case) but keeps the snippet", async () => {
+    const rejection = await preflightAuthorize(
+      "https://auth.example.com/authorize",
+      async () => new Response("<html>Nope</html>", { status: 400 }),
+    );
+    expect(rejection?.vendorDetail).toBe("");
+    expect(rejection?.bodySnippet).toBe("<html>Nope</html>");
+  });
+
+  const failOpen: Array<[number]> = [[200], [302], [403], [503]];
+  it.each(failOpen)("fails open on HTTP %d", async (status) => {
+    const rejection = await preflightAuthorize(
+      "https://auth.example.com/authorize",
+      async () => new Response("whatever", { status }),
+    );
+    expect(rejection).toBeUndefined();
+  });
+
+  it("requests with redirect: manual — the first response alone classifies", async () => {
+    let redirectMode = "";
+    await preflightAuthorize("https://auth.example.com/authorize", async (_url, init) => {
+      redirectMode = init?.redirect ?? "";
+      return new Response("", { status: 302 });
+    });
+    expect(redirectMode).toBe("manual");
+  });
+
+  it("propagates network errors to the caller (Go's (nil, err) fail-open diagnostics)", async () => {
+    await expect(
+      preflightAuthorize("https://auth.example.com/authorize", async () => {
+        throw new Error("ETIMEDOUT");
+      }),
+    ).rejects.toThrow("ETIMEDOUT");
+  });
+});

package/src/domain/mcpserver/oauth/__tests__/token-exchange.test.ts

@@ -0,0 +1,167 @@
+/**
+ * Pins the authorization-code exchange against Go oauth/token.go
+ * (token_test.go): the grant parameter set, EXACTLY ONE secret channel
+ * per request (RFC 6749 §2.3 — Basic default, form-body for
+ * client_secret_post, neither for public clients), the Slack V2
+ * authed_user promotion, the 256-byte error truncation, and the
+ * missing-access_token refusal. The refresh half is pinned by
+ * token-refresh.test.ts (#17).
+ */
+import { describe, expect, it } from "vitest";
+
+import { exchangeCode } from "../token.js";
+
+interface CapturedRequest {
+  body: URLSearchParams;
+  authorization: string;
+}
+
+function capturingFetch(
+  responseBody: unknown,
+  captured: CapturedRequest[],
+  status = 200,
+): typeof fetch {
+  return async (_url, init) => {
+    captured.push({
+      body: new URLSearchParams(String(init?.body)),
+      authorization:
+        (init?.headers as Record<string, string>)["Authorization"] ?? "",
+    });
+    return new Response(JSON.stringify(responseBody), { status });
+  };
+}
+
+const TOKENS = { access_token: "at-1", token_type: "bearer", expires_in: 3600 };
+
+describe("exchangeCode", () => {
+  it("sends the authorization_code grant with PKCE parameters", async () => {
+    const captured: CapturedRequest[] = [];
+    await exchangeCode(
+      "https://auth.example.com/token",
+      "code-1",
+      "http://cb",
+      "verifier-1",
+      "client-1",
+      "",
+      "",
+      capturingFetch(TOKENS, captured),
+    );
+    const body = captured[0]?.body;
+    expect(body?.get("grant_type")).toBe("authorization_code");
+    expect(body?.get("code")).toBe("code-1");
+    expect(body?.get("redirect_uri")).toBe("http://cb");
+    expect(body?.get("code_verifier")).toBe("verifier-1");
+    expect(body?.get("client_id")).toBe("client-1");
+  });
+
+  it("public client (DCR): no Authorization header, no client_secret in the body", async () => {
+    const captured: CapturedRequest[] = [];
+    await exchangeCode(
+      "https://auth.example.com/token",
+      "c",
+      "http://cb",
+      "v",
+      "client-1",
+      "",
+      "",
+      capturingFetch(TOKENS, captured),
+    );
+    expect(captured[0]?.authorization).toBe("");
+    expect(captured[0]?.body.has("client_secret")).toBe(false);
+  });
+
+  it("confidential client, default method: secret rides Basic ONLY", async () => {
+    const captured: CapturedRequest[] = [];
+    await exchangeCode(
+      "https://auth.example.com/token",
+      "c",
+      "http://cb",
+      "v",
+      "client-1",
+      "s3cret",
+      "",
+      capturingFetch(TOKENS, captured),
+    );
+    expect(captured[0]?.authorization).toBe(
+      `Basic ${Buffer.from("client-1:s3cret").toString("base64")}`,
+    );
+    expect(captured[0]?.body.has("client_secret")).toBe(false);
+  });
+
+  it("client_secret_post: secret rides the form body ONLY", async () => {
+    const captured: CapturedRequest[] = [];
+    await exchangeCode(
+      "https://auth.example.com/token",
+      "c",
+      "http://cb",
+      "v",
+      "client-1",
+      "s3cret",
+      "client_secret_post",
+      capturingFetch(TOKENS, captured),
+    );
+    expect(captured[0]?.authorization).toBe("");
+    expect(captured[0]?.body.get("client_secret")).toBe("s3cret");
+  });
+
+  it("promotes Slack's authed_user token over the top-level bot token", async () => {
+    const response = await exchangeCode(
+      "https://auth.example.com/token",
+      "c",
+      "http://cb",
+      "v",
+      "client-1",
+      "",
+      "",
+      capturingFetch(
+        {
+          access_token: "xoxb-bot",
+          token_type: "bot",
+          authed_user: {
+            access_token: "xoxp-user",
+            token_type: "user",
+            scope: "chat:write",
+          },
+        },
+        [],
+      ),
+    );
+    expect(response.accessToken).toBe("xoxp-user");
+    expect(response.tokenType).toBe("user");
+    expect(response.scope).toBe("chat:write");
+  });
+
+  it("refuses a non-200 with the truncated body", async () => {
+    await expect(
+      exchangeCode(
+        "https://auth.example.com/token",
+        "c",
+        "http://cb",
+        "v",
+        "client-1",
+        "",
+        "",
+        capturingFetch({ error: "invalid_grant" }, [], 400),
+      ),
+    ).rejects.toThrow(
+      'token endpoint https://auth.example.com/token returned HTTP 400: {"error":"invalid_grant"}',
+    );
+  });
+
+  it("refuses a 200 whose body has no access_token", async () => {
+    await expect(
+      exchangeCode(
+        "https://auth.example.com/token",
+        "c",
+        "http://cb",
+        "v",
+        "client-1",
+        "",
+        "",
+        capturingFetch({ token_type: "bearer" }, []),
+      ),
+    ).rejects.toThrow(
+      "token response from https://auth.example.com/token is missing access_token",
+    );
+  });
+});