@zereight/mcp-gitlab 2.1.69 → 2.2.0

package/build/test/remote-auth-simple-test.js

@@ -1,277 +0,0 @@
-/**
- * Remote Authorization Test Suite
- * Tests remote auth functionality with mock GitLab server
- */
-import { describe, test, after, before } from 'node:test';
-import assert from 'node:assert';
-import { launchServer, findAvailablePort, cleanupServers, TransportMode, HOST } from './utils/server-launcher.js';
-import { MockGitLabServer, findMockServerPort } from './utils/mock-gitlab-server.js';
-import { CustomHeaderClient } from './clients/custom-header-client.js';
-// Test constants
-const MOCK_TOKEN = 'glpat-mock-token-12345';
-const MOCK_JOB_TOKEN = 'glcbt-mock-job-token-9876';
-// Port ranges to avoid collisions
-const MOCK_GITLAB_PORT_BASE = 9000;
-const MOCK_GITLAB_PORT_OFFSET = 500; // Offset for timeout test suite
-const MCP_SERVER_PORT_BASE = 3000;
-const MCP_SERVER_PORT_OFFSET = 500; // Offset for timeout test suite
-// Timeout settings
-const SESSION_TIMEOUT_SECONDS = 3;
-const TIMEOUT_BUFFER_MS = 1000; // Extra time beyond timeout to ensure expiration
-const TIMEOUT_TEST_WAIT_MS = SESSION_TIMEOUT_SECONDS * 1000 + TIMEOUT_BUFFER_MS;
-const KEEPALIVE_INTERVAL_MS = 2000; // Must be less than SESSION_TIMEOUT_SECONDS
-const KEEPALIVE_REQUEST_COUNT = 3; // Number of keepalive requests to test
-async function getMetrics(mcpUrl) {
-    const metricsUrl = mcpUrl.replace(/\/mcp$/, '/metrics.json');
-    const response = await fetch(metricsUrl);
-    assert.strictEqual(response.status, 200, 'metrics JSON endpoint should be available');
-    return (await response.json());
-}
-async function waitForSessionDecrease(mcpUrl, beforeTimeout, timeoutMs = 3000) {
-    const startedAt = Date.now();
-    let last = await getMetrics(mcpUrl);
-    while (Date.now() - startedAt < timeoutMs) {
-        if (last.activeSessions < beforeTimeout.activeSessions &&
-            last.authenticatedSessions < beforeTimeout.authenticatedSessions) {
-            return;
-        }
-        await new Promise(resolve => setTimeout(resolve, 100));
-        last = await getMetrics(mcpUrl);
-    }
-    assert.ok(last.activeSessions < beforeTimeout.activeSessions, `activeSessions should decrease after timeout (${last.activeSessions} !< ${beforeTimeout.activeSessions})`);
-    assert.ok(last.authenticatedSessions < beforeTimeout.authenticatedSessions, `authenticatedSessions should decrease after timeout (${last.authenticatedSessions} !< ${beforeTimeout.authenticatedSessions})`);
-}
-console.log('🔐 Remote Authorization Test Suite');
-console.log('');
-describe('Remote Authorization', { concurrency: 1 }, () => {
-    describe('Remote Authorization - Basic Functionality', () => {
-        let mcpUrl;
-        let mockGitLab;
-        let servers = [];
-        before(async () => {
-            // Start mock GitLab server
-            const mockPort = await findMockServerPort();
-            mockGitLab = new MockGitLabServer({
-                port: mockPort,
-                validTokens: [MOCK_TOKEN, MOCK_JOB_TOKEN],
-            });
-            await mockGitLab.start();
-            const mockGitLabUrl = mockGitLab.getUrl();
-            // Start MCP server with remote auth
-            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE);
-            const server = await launchServer({
-                mode: TransportMode.STREAMABLE_HTTP,
-                port: mcpPort,
-                timeout: 5000,
-                env: {
-                    STREAMABLE_HTTP: 'true',
-                    REMOTE_AUTHORIZATION: 'true',
-                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-                    GITLAB_READ_ONLY_MODE: 'true',
-                }
-            });
-            servers.push(server);
-            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-            console.log(`Mock GitLab: ${mockGitLabUrl}`);
-            console.log(`MCP Server: ${mcpUrl}`);
-        });
-        after(async () => {
-            cleanupServers(servers);
-            if (mockGitLab) {
-                await mockGitLab.stop();
-            }
-        });
-        test('should reject invalid tokens before creating a session', async () => {
-            const before = await getMetrics(mcpUrl);
-            const response = await fetch(mcpUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Accept: 'application/json, text/event-stream',
-                    'Private-Token': 'aaaaaaaaaaaaaaaaaaaaaaaa',
-                },
-                body: JSON.stringify({
-                    jsonrpc: '2.0',
-                    id: 1,
-                    method: 'initialize',
-                    params: {
-                        protocolVersion: '2025-03-26',
-                        capabilities: {},
-                        clientInfo: { name: 'invalid-token-test', version: '1.0.0' },
-                    },
-                }),
-            });
-            assert.strictEqual(response.status, 401);
-            const after = await getMetrics(mcpUrl);
-            assert.strictEqual(after.activeSessions, before.activeSessions);
-            assert.strictEqual(after.authenticatedSessions, before.authenticatedSessions);
-        });
-        test('should connect with Authorization Bearer header', async () => {
-            const client = new CustomHeaderClient({
-                'authorization': `Bearer ${MOCK_TOKEN}`
-            });
-            await client.connect(mcpUrl);
-            const tools = await client.listTools();
-            assert.ok(tools.tools.length > 0, 'Should have tools');
-            console.log(`  ✓ Connected successfully, got ${tools.tools.length} tools`);
-            await client.disconnect();
-        });
-        test('should connect with Private-Token header', async () => {
-            const client = new CustomHeaderClient({
-                'private-token': MOCK_TOKEN
-            });
-            await client.connect(mcpUrl);
-            const tools = await client.listTools();
-            assert.ok(tools.tools.length > 0, 'Should have tools');
-            console.log(`  ✓ Connected with Private-Token, got ${tools.tools.length} tools`);
-            await client.disconnect();
-        });
-        test('should connect with JOB-TOKEN header', async () => {
-            const client = new CustomHeaderClient({
-                'job-token': MOCK_JOB_TOKEN,
-            });
-            await client.connect(mcpUrl);
-            const tools = await client.listTools();
-            assert.ok(tools.tools.length > 0, 'Should have tools');
-            console.log(`  ✓ Connected with JOB-TOKEN, got ${tools.tools.length} tools`);
-            await client.disconnect();
-        });
-        test('should successfully call listTools with auth', async () => {
-            const client = new CustomHeaderClient({
-                'authorization': `Bearer ${MOCK_TOKEN}`
-            });
-            await client.connect(mcpUrl);
-            // List tools multiple times to verify auth persists
-            const tools1 = await client.listTools();
-            const tools2 = await client.listTools();
-            const tools3 = await client.listTools();
-            assert.ok(tools1.tools.length > 0, 'Should have tools');
-            assert.strictEqual(tools1.tools.length, tools2.tools.length, 'Tool count should be consistent');
-            assert.strictEqual(tools2.tools.length, tools3.tools.length, 'Tool count should be consistent');
-            console.log('  ✓ Multiple tool list calls successful with persistent auth');
-            await client.disconnect();
-        });
-        test('should expose Prometheus metrics at /metrics', async () => {
-            const metricsUrl = mcpUrl.replace(/\/mcp$/, '/metrics');
-            const response = await fetch(metricsUrl);
-            assert.strictEqual(response.status, 200, 'metrics endpoint should be available');
-            assert.match(response.headers.get('content-type') || '', /^text\/plain/);
-            const body = await response.text();
-            assert.match(body, /# HELP gitlab_mcp_requests_processed_total/);
-            assert.match(body, /# TYPE gitlab_mcp_active_sessions gauge/);
-            assert.match(body, /gitlab_mcp_config_info\{[^}]*remote_auth_enabled="true"/);
-            console.log('  ✓ Prometheus metrics available');
-        });
-        test('should reject connection without auth header', async () => {
-            const client = new CustomHeaderClient({});
-            try {
-                await client.connect(mcpUrl);
-                await client.listTools();
-                await client.disconnect();
-                assert.fail('Should have rejected connection without auth');
-            }
-            catch (error) {
-                assert.ok(error instanceof Error);
-                console.log('  ✓ Correctly rejected connection without auth');
-            }
-        });
-    });
-    describe('Remote Authorization - Session Timeout', () => {
-        let mcpUrl;
-        let mockGitLab;
-        let servers = [];
-        before(async () => {
-            // Use different port ranges to avoid collisions with basic tests
-            const mockPort = await findMockServerPort();
-            mockGitLab = new MockGitLabServer({
-                port: mockPort,
-                validTokens: [MOCK_TOKEN]
-            });
-            await mockGitLab.start();
-            const mockGitLabUrl = mockGitLab.getUrl();
-            const mcpPort = await findAvailablePort(MCP_SERVER_PORT_BASE + MCP_SERVER_PORT_OFFSET);
-            const server = await launchServer({
-                mode: TransportMode.STREAMABLE_HTTP,
-                port: mcpPort,
-                timeout: 5000,
-                env: {
-                    STREAMABLE_HTTP: 'true',
-                    REMOTE_AUTHORIZATION: 'true',
-                    GITLAB_API_URL: `${mockGitLabUrl}/api/v4`,
-                    SESSION_TIMEOUT_SECONDS: String(SESSION_TIMEOUT_SECONDS),
-                }
-            });
-            servers.push(server);
-            mcpUrl = `http://${HOST}:${mcpPort}/mcp`;
-            console.log(`Session timeout: ${SESSION_TIMEOUT_SECONDS} seconds`);
-        });
-        after(async () => {
-            cleanupServers(servers);
-            if (mockGitLab) {
-                await mockGitLab.stop();
-            }
-        });
-        test('session timeout verification - activity keeps session alive', async () => {
-            const client = new CustomHeaderClient({
-                'authorization': `Bearer ${MOCK_TOKEN}`
-            });
-            // Connect and verify it works
-            await client.connect(mcpUrl);
-            const tools1 = await client.listTools();
-            assert.ok(tools1.tools.length > 0, 'Initial connection should work');
-            console.log('  ✓ Initial connection successful');
-            // Keep connection alive with periodic requests
-            console.log('  Keeping session alive with requests...');
-            for (let i = 0; i < KEEPALIVE_REQUEST_COUNT; i++) {
-                await new Promise(resolve => setTimeout(resolve, KEEPALIVE_INTERVAL_MS));
-                const tools = await client.listTools();
-                assert.ok(tools.tools.length > 0, `Request ${i + 1} should succeed`);
-                console.log(`  ✓ Request ${i + 1} succeeded (session still alive)`);
-            }
-            await client.disconnect();
-            console.log('  ✓ Session remained active with periodic requests');
-        });
-        test('session timeout expiration - inactivity expires auth', async () => {
-            // Add a small delay to ensure server is ready/clean from previous test
-            await new Promise(resolve => setTimeout(resolve, 1000));
-            const baseline = await getMetrics(mcpUrl);
-            // Step 1: Connect WITH auth header to establish session
-            const clientWithAuth = new CustomHeaderClient({
-                'authorization': `Bearer ${MOCK_TOKEN}`
-            });
-            await clientWithAuth.connect(mcpUrl);
-            const tools1 = await clientWithAuth.listTools();
-            assert.ok(tools1.tools.length > 0, 'Initial connection should work');
-            console.log('  ✓ Initial connection successful with auth');
-            // Extract session ID using proper API
-            const sessionId = clientWithAuth.getSessionId();
-            assert.ok(sessionId, 'Session ID should exist');
-            console.log(`  ℹ️  Session ID: ${sessionId}`);
-            const beforeTimeout = await getMetrics(mcpUrl);
-            assert.strictEqual(beforeTimeout.activeSessions, baseline.activeSessions + 1, 'Session should occupy one additional active slot');
-            assert.strictEqual(beforeTimeout.authenticatedSessions, baseline.authenticatedSessions + 1, 'Session should add one authenticated session');
-            // Step 2: Wait for timeout WITHOUT making any requests
-            console.log(`  ⏳ Waiting ${TIMEOUT_TEST_WAIT_MS / 1000}s for timeout without activity...`);
-            await new Promise(resolve => setTimeout(resolve, TIMEOUT_TEST_WAIT_MS));
-            await waitForSessionDecrease(mcpUrl, beforeTimeout);
-            console.log('  ✓ Timeout closed transport and released active session slot');
-            // Step 3: A stale stateful session must return the MCP re-initialization signal.
-            const response = await fetch(mcpUrl, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    'mcp-session-id': sessionId,
-                },
-                body: JSON.stringify({
-                    jsonrpc: '2.0',
-                    id: 1,
-                    method: 'tools/list'
-                })
-            });
-            assert.strictEqual(response.status, 404, 'Should return 404 Session Not Found');
-            assert.deepStrictEqual(await response.json(), { error: 'Session not found' });
-            console.log('  ✓ Expired session returned 404 so the client can re-initialize');
-            await clientWithAuth.disconnect();
-        });
-    });
-});

package/build/test/remote-auth-tests.js

@@ -1,314 +0,0 @@
-/**
- * Remote Authorization Tests
- * Tests for per-session HTTP header-based authorization
- */
-import { describe, test, after, before } from 'node:test';
-import assert from 'node:assert';
-import { launchServer, findAvailablePort, cleanupServers, TransportMode, checkHealthEndpoint, HOST } from './utils/server-launcher.js';
-console.log('🔐 Remote Authorization Tests');
-console.log('');
-// Configuration check
-const GITLAB_API_URL = process.env.GITLAB_API_URL || "https://gitlab.com";
-const GITLAB_TOKEN = process.env.GITLAB_TOKEN_TEST || process.env.GITLAB_TOKEN;
-const TEST_PROJECT_ID = process.env.TEST_PROJECT_ID;
-console.log('🔧 Test Configuration:');
-console.log(`  GitLab URL: ${GITLAB_API_URL}`);
-console.log(`  Token: ${GITLAB_TOKEN ? '✅ Provided' : '❌ Missing'}`);
-console.log(`  Project ID: ${TEST_PROJECT_ID || '❌ Missing'}`);
-// Validate required configuration
-if (!GITLAB_TOKEN) {
-    console.error('❌ Error: GITLAB_TOKEN_TEST or GITLAB_TOKEN environment variable is required for testing');
-    console.error('   Set one of these variables to your GitLab API token');
-    process.exit(1);
-}
-if (!TEST_PROJECT_ID) {
-    console.error('❌ Error: TEST_PROJECT_ID environment variable is required for testing');
-    console.error('   Set this variable to a valid GitLab project ID (e.g., "123" or "group/project")');
-    process.exit(1);
-}
-console.log('✅ Configuration validated');
-console.log('');
-let servers = [];
-// Cleanup function for all tests
-const cleanup = () => {
-    cleanupServers(servers);
-    servers = [];
-};
-// Handle process termination
-process.on('SIGINT', cleanup);
-process.on('SIGTERM', cleanup);
-process.on('exit', cleanup);
-/**
- * Helper to send MCP request with custom headers
- */
-async function sendMCPRequest(url, method, headers = {}) {
-    const response = await fetch(url, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-            ...headers,
-        },
-        body: JSON.stringify(method),
-    });
-    if (!response.ok) {
-        const text = await response.text();
-        throw new Error(`HTTP ${response.status}: ${text}`);
-    }
-    return response.json();
-}
-describe('Remote Authorization - Streamable HTTP with Authorization header', () => {
-    let server;
-    let port;
-    let mcpUrl;
-    before(async () => {
-        port = await findAvailablePort();
-        server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port,
-            timeout: 3000,
-            env: {
-                STREAMABLE_HTTP: 'true',
-                REMOTE_AUTHORIZATION: 'true',
-                GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
-                GITLAB_PROJECT_ID: TEST_PROJECT_ID,
-                GITLAB_READ_ONLY_MODE: 'true',
-                // Explicitly no GITLAB_PERSONAL_ACCESS_TOKEN
-            }
-        });
-        servers.push(server);
-        mcpUrl = `http://${HOST}:${port}/mcp`;
-        // Verify server started successfully
-        assert.ok(server.process.pid !== undefined, 'Server process should have PID');
-        // Verify health check
-        if (server.port) {
-            const health = await checkHealthEndpoint(server.port);
-            assert.strictEqual(health.status, 'healthy', 'Health status should be healthy');
-        }
-        console.log('Server started with remote authorization enabled');
-    });
-    after(async () => {
-        cleanup();
-        console.log('Server stopped');
-    });
-    test('should reject request without Authorization header', async () => {
-        const initRequest = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2024-11-05',
-                capabilities: {},
-                clientInfo: { name: 'test-client', version: '1.0.0' }
-            }
-        };
-        try {
-            await sendMCPRequest(mcpUrl, initRequest, {
-                'mcp-session-id': 'test-session-no-auth'
-            });
-            assert.fail('Should have rejected request without auth header');
-        }
-        catch (error) {
-            assert.ok(error instanceof Error);
-            assert.ok(error.message.includes('401'), 'Should get 401 Unauthorized');
-        }
-    });
-    test('should accept request with Authorization Bearer header', async () => {
-        const sessionId = `test-session-bearer-${Date.now()}`;
-        const initRequest = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2024-11-05',
-                capabilities: {},
-                clientInfo: { name: 'test-client', version: '1.0.0' }
-            }
-        };
-        const response = await sendMCPRequest(mcpUrl, initRequest, {
-            'mcp-session-id': sessionId,
-            'authorization': `Bearer ${GITLAB_TOKEN}`
-        });
-        assert.ok(response, 'Should get response');
-        assert.ok(response.result, 'Should have result');
-        assert.strictEqual(response.result.protocolVersion, '2024-11-05', 'Protocol version should match');
-    });
-    test('should reuse auth from first request in subsequent requests', async () => {
-        const sessionId = `test-session-reuse-${Date.now()}`;
-        // First request with auth
-        const initRequest = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2024-11-05',
-                capabilities: {},
-                clientInfo: { name: 'test-client', version: '1.0.0' }
-            }
-        };
-        const initResponse = await sendMCPRequest(mcpUrl, initRequest, {
-            'mcp-session-id': sessionId,
-            'authorization': `Bearer ${GITLAB_TOKEN}`
-        });
-        assert.ok(initResponse.result, 'Init should succeed');
-        // Second request without auth header (should reuse)
-        const listToolsRequest = {
-            jsonrpc: '2.0',
-            id: 2,
-            method: 'tools/list',
-            params: {}
-        };
-        const listResponse = await sendMCPRequest(mcpUrl, listToolsRequest, {
-            'mcp-session-id': sessionId
-            // No authorization header
-        });
-        assert.ok(listResponse.result, 'List tools should succeed with reused auth');
-        assert.ok(Array.isArray(listResponse.result.tools), 'Should return tools array');
-        assert.ok(listResponse.result.tools.length > 0, 'Should have at least one tool');
-    });
-    test('should call tool with Bearer token', async () => {
-        const sessionId = `test-session-tool-${Date.now()}`;
-        // Initialize
-        const initRequest = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2024-11-05',
-                capabilities: {},
-                clientInfo: { name: 'test-client', version: '1.0.0' }
-            }
-        };
-        await sendMCPRequest(mcpUrl, initRequest, {
-            'mcp-session-id': sessionId,
-            'authorization': `Bearer ${GITLAB_TOKEN}`
-        });
-        // Call tool
-        const callToolRequest = {
-            jsonrpc: '2.0',
-            id: 2,
-            method: 'tools/call',
-            params: {
-                name: 'get_project',
-                arguments: {
-                    project_id: TEST_PROJECT_ID
-                }
-            }
-        };
-        const toolResponse = await sendMCPRequest(mcpUrl, callToolRequest, {
-            'mcp-session-id': sessionId
-        });
-        assert.ok(toolResponse.result, 'Tool call should succeed');
-        assert.ok(toolResponse.result.content, 'Should have content');
-        assert.ok(Array.isArray(toolResponse.result.content), 'Content should be array');
-        assert.ok(toolResponse.result.content.length > 0, 'Should have content items');
-        const projectData = JSON.parse(toolResponse.result.content[0].text);
-        assert.ok(projectData.id, 'Should have project id');
-        assert.ok(projectData.name, 'Should have project name');
-    });
-});
-describe('Remote Authorization - Streamable HTTP with Private-Token header', () => {
-    let server;
-    let port;
-    let mcpUrl;
-    before(async () => {
-        port = await findAvailablePort();
-        server = await launchServer({
-            mode: TransportMode.STREAMABLE_HTTP,
-            port,
-            timeout: 3000,
-            env: {
-                STREAMABLE_HTTP: 'true',
-                REMOTE_AUTHORIZATION: 'true',
-                GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
-                GITLAB_PROJECT_ID: TEST_PROJECT_ID,
-                GITLAB_READ_ONLY_MODE: 'true',
-            }
-        });
-        servers.push(server);
-        mcpUrl = `http://${HOST}:${port}/mcp`;
-        console.log('Server started for Private-Token tests');
-    });
-    after(async () => {
-        cleanup();
-        console.log('Server stopped');
-    });
-    test('should accept request with Private-Token header', async () => {
-        const sessionId = `test-session-private-${Date.now()}`;
-        const initRequest = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2024-11-05',
-                capabilities: {},
-                clientInfo: { name: 'test-client', version: '1.0.0' }
-            }
-        };
-        const response = await sendMCPRequest(mcpUrl, initRequest, {
-            'mcp-session-id': sessionId,
-            'private-token': GITLAB_TOKEN
-        });
-        assert.ok(response.result, 'Should succeed with Private-Token');
-        assert.strictEqual(response.result.protocolVersion, '2024-11-05', 'Protocol version should match');
-    });
-    test('should call tool with Private-Token', async () => {
-        const sessionId = `test-session-private-tool-${Date.now()}`;
-        // Initialize
-        const initRequest = {
-            jsonrpc: '2.0',
-            id: 1,
-            method: 'initialize',
-            params: {
-                protocolVersion: '2024-11-05',
-                capabilities: {},
-                clientInfo: { name: 'test-client', version: '1.0.0' }
-            }
-        };
-        await sendMCPRequest(mcpUrl, initRequest, {
-            'mcp-session-id': sessionId,
-            'private-token': GITLAB_TOKEN
-        });
-        // Call tool
-        const callToolRequest = {
-            jsonrpc: '2.0',
-            id: 2,
-            method: 'tools/call',
-            params: {
-                name: 'list_merge_requests',
-                arguments: {
-                    project_id: TEST_PROJECT_ID
-                }
-            }
-        };
-        const toolResponse = await sendMCPRequest(mcpUrl, callToolRequest, {
-            'mcp-session-id': sessionId
-        });
-        assert.ok(toolResponse.result, 'Tool call should succeed with Private-Token');
-        assert.ok(toolResponse.result.content, 'Should have content');
-    });
-});
-describe('Remote Authorization - SSE mode should be disabled', () => {
-    test('should fail to start with SSE and REMOTE_AUTHORIZATION', async () => {
-        const port = await findAvailablePort();
-        try {
-            const server = await launchServer({
-                mode: TransportMode.SSE,
-                port,
-                timeout: 3000,
-                env: {
-                    SSE: 'true',
-                    REMOTE_AUTHORIZATION: 'true',
-                    GITLAB_API_URL: `${GITLAB_API_URL}/api/v4`,
-                }
-            });
-            // If we get here, the server started when it shouldn't have
-            servers.push(server);
-            assert.fail('Server should not start with SSE and REMOTE_AUTHORIZATION=true');
-        }
-        catch (error) {
-            // Expected: server should fail to start
-            assert.ok(error instanceof Error, 'Should throw an error');
-            console.log('✅ Server correctly rejected SSE mode with remote authorization');
-        }
-    });
-});