memory-journal-mcp 6.1.2 → 6.2.1

package/tests/auth/authorization-server-discovery.test.ts

@@ -1,265 +0,0 @@
-/**
- * memory-journal-mcp — Authorization Server Discovery Unit Tests
- *
- * Tests for RFC 8414 authorization server metadata discovery.
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
-import {
-    AuthorizationServerDiscovery,
-    createAuthServerDiscovery,
-} from '../../src/auth/authorization-server-discovery.js'
-
-describe('AuthorizationServerDiscovery', () => {
-    const authServerUrl = 'https://auth.example.com'
-
-    beforeEach(() => {
-        vi.clearAllMocks()
-    })
-
-    afterEach(() => {
-        vi.restoreAllMocks()
-    })
-
-    describe('construction', () => {
-        it('should create instance with URL', () => {
-            const discovery = new AuthorizationServerDiscovery({
-                authServerUrl,
-            })
-            expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery)
-        })
-
-        it('should normalize URL (remove trailing slash)', () => {
-            const discovery = new AuthorizationServerDiscovery({
-                authServerUrl: 'https://auth.example.com/',
-            })
-            expect(discovery.getAuthServerUrl()).toBe('https://auth.example.com')
-        })
-    })
-
-    describe('createAuthServerDiscovery factory', () => {
-        it('should create instance', () => {
-            const discovery = createAuthServerDiscovery(authServerUrl)
-            expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery)
-        })
-
-        it('should accept options', () => {
-            const discovery = createAuthServerDiscovery(authServerUrl, {
-                cacheTtl: 600,
-                timeout: 10000,
-            })
-            expect(discovery).toBeDefined()
-        })
-    })
-
-    describe('discover', () => {
-        it('should fetch metadata from well-known endpoint', async () => {
-            const mockMetadata = {
-                issuer: authServerUrl,
-                token_endpoint: `${authServerUrl}/oauth/token`,
-                jwks_uri: `${authServerUrl}/.well-known/jwks.json`,
-                scopes_supported: ['read', 'write', 'admin'],
-            }
-
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            const metadata = await discovery.discover()
-
-            expect(metadata.issuer).toBe(authServerUrl)
-            expect(metadata.token_endpoint).toBe(`${authServerUrl}/oauth/token`)
-        })
-
-        it('should cache metadata', async () => {
-            const mockMetadata = {
-                issuer: authServerUrl,
-                token_endpoint: `${authServerUrl}/oauth/token`,
-            }
-
-            const fetchSpy = vi.spyOn(globalThis, 'fetch').mockResolvedValue({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-            await discovery.discover()
-
-            // Should only be called once due to caching
-            expect(fetchSpy).toHaveBeenCalledTimes(1)
-        })
-
-        it('should throw on HTTP error', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: false,
-                status: 404,
-                statusText: 'Not Found',
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-
-            await expect(discovery.discover()).rejects.toThrow()
-        })
-
-        it('should throw on missing issuer field', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => ({
-                    token_endpoint: `${authServerUrl}/oauth/token`,
-                }),
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-
-            await expect(discovery.discover()).rejects.toThrow()
-        })
-
-        it('should throw on missing token_endpoint', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => ({
-                    issuer: authServerUrl,
-                }),
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-
-            await expect(discovery.discover()).rejects.toThrow()
-        })
-    })
-
-    describe('getMetadata', () => {
-        it('should throw if not yet discovered', () => {
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            expect(() => discovery.getMetadata()).toThrow('not yet discovered')
-        })
-    })
-
-    describe('getJwksUri', () => {
-        it('should return jwks_uri from metadata', async () => {
-            const mockMetadata = {
-                issuer: authServerUrl,
-                token_endpoint: `${authServerUrl}/oauth/token`,
-                jwks_uri: `${authServerUrl}/.well-known/jwks.json`,
-            }
-
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(discovery.getJwksUri()).toBe(`${authServerUrl}/.well-known/jwks.json`)
-        })
-
-        it('should throw if jwks_uri not in metadata', async () => {
-            const mockMetadata = {
-                issuer: authServerUrl,
-                token_endpoint: `${authServerUrl}/oauth/token`,
-            }
-
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(() => discovery.getJwksUri()).toThrow('does not provide jwks_uri')
-        })
-    })
-
-    describe('cache management', () => {
-        it('should clear cache', () => {
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            expect(() => discovery.clearCache()).not.toThrow()
-        })
-
-        it('should report cache validity', () => {
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            expect(discovery.isCacheValid()).toBe(false)
-        })
-
-        it('should report valid cache after discover', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => ({
-                    issuer: authServerUrl,
-                    token_endpoint: `${authServerUrl}/oauth/token`,
-                }),
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(discovery.isCacheValid()).toBe(true)
-        })
-    })
-
-    describe('accessor methods', () => {
-        const mockMetadata = {
-            issuer: authServerUrl,
-            token_endpoint: `${authServerUrl}/oauth/token`,
-            jwks_uri: `${authServerUrl}/.well-known/jwks.json`,
-            scopes_supported: ['read', 'write'],
-            registration_endpoint: `${authServerUrl}/oauth/register`,
-        }
-
-        it('should return token endpoint', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(discovery.getTokenEndpoint()).toBe(`${authServerUrl}/oauth/token`)
-        })
-
-        it('should return issuer', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(discovery.getIssuer()).toBe(authServerUrl)
-        })
-
-        it('should return registration endpoint', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(discovery.getRegistrationEndpoint()).toBe(`${authServerUrl}/oauth/register`)
-            expect(discovery.supportsClientRegistration()).toBe(true)
-        })
-
-        it('should return supported scopes', async () => {
-            vi.spyOn(globalThis, 'fetch').mockResolvedValueOnce({
-                ok: true,
-                json: async () => mockMetadata,
-            } as Response)
-
-            const discovery = new AuthorizationServerDiscovery({ authServerUrl })
-            await discovery.discover()
-
-            expect(discovery.getSupportedScopes()).toEqual(['read', 'write'])
-            expect(discovery.isScopeSupported('read')).toBe(true)
-            expect(discovery.isScopeSupported('unknown')).toBe(false)
-        })
-    })
-})

package/tests/auth/errors.test.ts

@@ -1,170 +0,0 @@
-/**
- * memory-journal-mcp — OAuth Errors Unit Tests
- *
- * Tests for OAuth-specific error classes.
- */
-
-import { describe, it, expect } from 'vitest'
-import {
-    OAuthError,
-    TokenMissingError,
-    InvalidTokenError,
-    InsufficientScopeError,
-    AuthServerDiscoveryError,
-    JwksFetchError,
-    ClientRegistrationError,
-    isOAuthError,
-    getWWWAuthenticateHeader,
-} from '../../src/auth/errors.js'
-import { MemoryJournalMcpError } from '../../src/types/errors.js'
-import { ErrorCategory } from '../../src/types/error-types.js'
-
-describe('OAuthError hierarchy', () => {
-    it('should extend MemoryJournalMcpError and Error', () => {
-        const error = new TokenMissingError()
-        expect(error).toBeInstanceOf(OAuthError)
-        expect(error).toBeInstanceOf(MemoryJournalMcpError)
-        expect(error).toBeInstanceOf(Error)
-    })
-
-    it('should have correct category for 401 errors', () => {
-        const error = new TokenMissingError()
-        expect(error.category).toBe(ErrorCategory.AUTHENTICATION)
-    })
-
-    it('should have correct category for 403 errors', () => {
-        const error = new InsufficientScopeError('admin')
-        expect(error.category).toBe(ErrorCategory.AUTHORIZATION)
-    })
-
-    it('should produce valid ErrorResponse via toResponse()', () => {
-        const error = new TokenMissingError()
-        const response = error.toResponse()
-        expect(response.success).toBe(false)
-        expect(response.code).toBe('AUTH_TOKEN_MISSING')
-        expect(response.category).toBe(ErrorCategory.AUTHENTICATION)
-        expect(response.recoverable).toBe(true)
-    })
-})
-
-describe('TokenMissingError', () => {
-    it('should have 401 status', () => {
-        const error = new TokenMissingError()
-        expect(error.httpStatus).toBe(401)
-    })
-
-    it('should include WWW-Authenticate header', () => {
-        const error = new TokenMissingError('https://mj.example.com')
-        expect(error.wwwAuthenticate).toContain('Bearer')
-        expect(error.wwwAuthenticate).toContain('https://mj.example.com')
-    })
-
-    it('should have correct name', () => {
-        const error = new TokenMissingError()
-        expect(error.name).toBe('TokenMissingError')
-    })
-
-    it('should work without resource parameter', () => {
-        const error = new TokenMissingError()
-        expect(error.wwwAuthenticate).toContain('Bearer')
-    })
-})
-
-describe('InvalidTokenError', () => {
-    it('should have 401 status', () => {
-        const error = new InvalidTokenError()
-        expect(error.httpStatus).toBe(401)
-    })
-
-    it('should accept custom message', () => {
-        const error = new InvalidTokenError('Token is malformed')
-        expect(error.message).toBe('Token is malformed')
-    })
-
-    it('should include WWW-Authenticate header', () => {
-        const error = new InvalidTokenError()
-        expect(error.wwwAuthenticate).toContain('invalid_token')
-    })
-})
-
-describe('InsufficientScopeError', () => {
-    it('should have 403 status', () => {
-        const error = new InsufficientScopeError('admin')
-        expect(error.httpStatus).toBe(403)
-    })
-
-    it('should accept string scope', () => {
-        const error = new InsufficientScopeError('write')
-        expect(error.message).toContain('write')
-    })
-
-    it('should accept array of scopes', () => {
-        const error = new InsufficientScopeError(['read', 'write'])
-        expect(error.message).toContain('read write')
-    })
-
-    it('should include WWW-Authenticate with scope', () => {
-        const error = new InsufficientScopeError('admin')
-        expect(error.wwwAuthenticate).toContain('scope="admin"')
-    })
-
-    it('should store required scope in details', () => {
-        const error = new InsufficientScopeError(['admin'], ['read'])
-        expect(error.details?.requiredScope).toEqual(['admin'])
-        expect(error.details?.providedScopes).toEqual(['read'])
-    })
-})
-
-describe('AuthServerDiscoveryError', () => {
-    it('should have 500 status', () => {
-        const error = new AuthServerDiscoveryError('https://auth.example.com')
-        expect(error.httpStatus).toBe(500)
-    })
-
-    it('should include server URL in message', () => {
-        const error = new AuthServerDiscoveryError('https://auth.example.com')
-        expect(error.message).toContain('https://auth.example.com')
-    })
-})
-
-describe('JwksFetchError', () => {
-    it('should have 500 status', () => {
-        const error = new JwksFetchError('https://auth.example.com/.well-known/jwks.json')
-        expect(error.httpStatus).toBe(500)
-    })
-})
-
-describe('ClientRegistrationError', () => {
-    it('should have 500 status', () => {
-        const error = new ClientRegistrationError('Registration failed')
-        expect(error.httpStatus).toBe(500)
-    })
-})
-
-describe('isOAuthError', () => {
-    it('should return true for OAuthError subclasses', () => {
-        expect(isOAuthError(new TokenMissingError())).toBe(true)
-        expect(isOAuthError(new InvalidTokenError())).toBe(true)
-        expect(isOAuthError(new InsufficientScopeError('admin'))).toBe(true)
-    })
-
-    it('should return false for non-OAuthError', () => {
-        expect(isOAuthError(new Error('generic'))).toBe(false)
-        expect(isOAuthError('string')).toBe(false)
-        expect(isOAuthError(null)).toBe(false)
-    })
-})
-
-describe('getWWWAuthenticateHeader', () => {
-    it('should return error WWW-Authenticate when available', () => {
-        const error = new TokenMissingError()
-        const header = getWWWAuthenticateHeader(error)
-        expect(header).toContain('Bearer')
-    })
-
-    it('should fall back to realm when no WWW-Authenticate', () => {
-        const error = new AuthServerDiscoveryError('https://auth.example.com')
-        const header = getWWWAuthenticateHeader(error, 'test-realm')
-        expect(header).toContain('test-realm')
-    })
-})