okengine 0.17.2 → 0.18.3

package/src/auth/oauth-as/http.test.ts

@@ -0,0 +1,419 @@
+/**
+ * End-to-end AS endpoint tests — CIMD resolution, authorize validation,
+ * PKCE, DPoP, resource binding, refresh rotation. Uses an injected CIMD
+ * loader and a fixed clock; no network.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { createDpopSigner } from "./crypto.ts";
+import { OAuthError } from "./errors.ts";
+import { hashSecret } from "./stores.ts";
+import {
+  buildAuthorizationServerMetadata,
+  buildProtectedResourceMetadata,
+  createOauthAs,
+  upsertConsent,
+  type OauthAsOptions,
+} from "./http.ts";
+import { createAsStores } from "./stores.ts";
+
+const T0 = 1_700_000_000_000;
+const now = () => T0;
+
+const CLIENT_ID = "https://app.example.com/oauth-client-metadata.json";
+const RESOURCE = "https://mcp.example.com/mcp";
+const REDIRECT = "https://app.example.com/callback";
+
+function makeCimdDoc(): Record<string, unknown> {
+  return {
+    client_id: CLIENT_ID,
+    client_name: "Test Agent",
+    redirect_uris: [REDIRECT],
+    scope: "mcp:tools openid",
+  };
+}
+
+function makeOptions(): OauthAsOptions & { stores: ReturnType<typeof createAsStores> } {
+  return {
+    issuer: "https://as.example.com",
+    resource: RESOURCE,
+    stores: createAsStores(),
+    now,
+    fetchDoc: async (url) => (url === CLIENT_ID ? makeCimdDoc() : {}),
+    userFromRequest: async () => "user-1",
+  };
+}
+
+/** Pre-seed a covering consent row so authorize issues a code directly. */
+function seedConsent(options: ReturnType<typeof makeOptions>, scope: string): void {
+  upsertConsent(options.stores, {
+    userId: "user-1",
+    clientId: CLIENT_ID,
+    clientName: "Test Agent",
+    resource: RESOURCE,
+    scope: scope.split(" "),
+    now: T0,
+  });
+}
+
+/** Drive GET /oauth/authorize and pull the code out of the Location. */
+async function authorize(
+  options: typeof makeOptions extends () => infer O ? O : never,
+  query: Record<string, string>,
+): Promise<{ status: number; location?: string; body: unknown }> {
+  const url = new URL("https://as.example.com/oauth/authorize");
+  for (const [k, v] of Object.entries(query)) url.searchParams.set(k, v);
+  const facade = createOauthAs(options);
+  const response = await facade.edge(new Request(url.toString()), {
+    method: "GET",
+    path: "/oauth/authorize",
+  });
+  if (!response) throw new Error("authorize not handled");
+  const location = response.headers.get("location") ?? undefined;
+  return {
+    status: response.status,
+    location,
+    body: response.status === 302 ? undefined : await response.json(),
+  };
+}
+
+async function pkcePair(): Promise<{ verifier: string; challenge: string }> {
+  const verifier = `v-${crypto.randomUUID()}`;
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  const bytes = new Uint8Array(digest);
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  const challenge = btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  return { verifier, challenge };
+}
+
+async function postToken(
+  options: ReturnType<typeof makeOptions>,
+  form: Record<string, string>,
+  proof?: string,
+): Promise<Response> {
+  const headers: Record<string, string> = { "content-type": "application/x-www-form-urlencoded" };
+  if (proof !== undefined) headers.dpop = proof;
+  const request = new Request("https://as.example.com/oauth/token", {
+    method: "POST",
+    headers,
+    body: new URLSearchParams(form),
+  });
+  const facade = createOauthAs(options);
+  const response = await facade.edge(request, { method: "POST", path: "/oauth/token" });
+  if (!response) throw new Error("token endpoint not handled");
+  return response;
+}
+
+describe("oauth-as endpoints", () => {
+  test("metadata documents advertise DPoP + S256 + resource", async () => {
+    expect(buildAuthorizationServerMetadata("https://as.example.com/")).toMatchObject({
+      issuer: "https://as.example.com",
+      token_endpoint: "https://as.example.com/oauth/token",
+      dpop_signing_alg_values_supported: ["ES256"],
+      code_challenge_methods_supported: ["S256"],
+    });
+    expect(buildProtectedResourceMetadata(RESOURCE, "https://as.example.com")).toMatchObject({
+      resource: RESOURCE,
+      authorization_servers: ["https://as.example.com"],
+    });
+  });
+
+  test("full happy path: CIMD authorize → code → DPoP token", async () => {
+    const options = makeOptions();
+    seedConsent(options, "mcp:tools");
+    const { verifier, challenge } = await pkcePair();
+    const authRes = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      scope: "mcp:tools",
+      state: "xyz",
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    expect(authRes.status).toBe(302);
+    const location = authRes.location ?? "";
+    expect(location.startsWith(`${REDIRECT}?`)).toBe(true);
+    const params = new URL(location);
+    const code = params.searchParams.get("code");
+    expect(code).toBeTruthy();
+    expect(params.searchParams.get("state")).toBe("xyz");
+    expect(params.searchParams.get("iss")).toBe("https://as.example.com");
+
+    // Code must be single-use and stored hashed.
+    const codeHash = await hashSecret(code ?? "");
+    const rows = [...options.stores.authCodes.values()];
+    expect(rows.some((r) => r.codeHash === codeHash)).toBe(true);
+
+    const signer = await createDpopSigner();
+    const proof = await signer.prove({
+      htm: "POST",
+      htu: "https://as.example.com/oauth/token",
+      now: T0,
+    });
+    const tokenRes = await postToken(
+      options,
+      {
+        grant_type: "authorization_code",
+        code: code ?? "",
+        client_id: CLIENT_ID,
+        redirect_uri: REDIRECT,
+        code_verifier: verifier,
+        resource: RESOURCE,
+      },
+      proof,
+    );
+    expect(tokenRes.status).toBe(200);
+    const body = (await tokenRes.json()) as Record<string, unknown>;
+    expect(body.token_type).toBe("DPoP");
+    expect(body.refresh_token).toBeTruthy();
+
+    // Access token carries cnf.jkt bound to the signer key.
+    const access = body.access_token as string;
+    const payload = JSON.parse(
+      atob(access.split(".")[1]!.replace(/-/g, "+").replace(/_/g, "/")),
+    ) as Record<string, unknown>;
+    expect(payload.aud).toBe(RESOURCE);
+    expect(payload.client_id).toBe(CLIENT_ID);
+    expect((payload.cnf as Record<string, string>).jkt).toBeTruthy();
+  });
+
+  test("missing / mismatched resource is rejected with invalid_target", async () => {
+    const options = makeOptions();
+    const { challenge } = await pkcePair();
+    const res = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      resource: "https://other.example.com/mcp",
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    expect(res.status).toBe(302);
+    expect(new URL(res.location ?? "").searchParams.get("error")).toBe("invalid_target");
+  });
+
+  test("PKCE is mandatory and wrong verifier fails the grant", async () => {
+    const options = makeOptions();
+    const res = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      resource: RESOURCE,
+    });
+    expect(res.status).toBe(302);
+    expect(new URL(res.location ?? "").searchParams.get("error")).toBe("invalid_request");
+
+    // Now a valid authorize but bad verifier at token time.
+    const { verifier, challenge } = await pkcePair();
+    seedConsent(options, "mcp:tools");
+    const ok = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    const code = new URL(ok.location ?? "").searchParams.get("code") ?? "";
+    const signer = await createDpopSigner();
+    const proof = await signer.prove({
+      htm: "POST",
+      htu: "https://as.example.com/oauth/token",
+      now: T0,
+    });
+    const tokenRes = await postToken(
+      options,
+      {
+        grant_type: "authorization_code",
+        code,
+        client_id: CLIENT_ID,
+        redirect_uri: REDIRECT,
+        code_verifier: `${verifier}-tampered`,
+        resource: RESOURCE,
+      },
+      proof,
+    );
+    expect(tokenRes.status).toBe(400);
+    expect(((await tokenRes.json()) as Record<string, string>).error).toBe("invalid_grant");
+  });
+
+  test("token without DPoP proof is rejected", async () => {
+    const options = makeOptions();
+    const { verifier, challenge } = await pkcePair();
+    const ok = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    const code = new URL(ok.location ?? "").searchParams.get("code") ?? "";
+    const res = await postToken(options, {
+      grant_type: "authorization_code",
+      code,
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      code_verifier: verifier,
+      resource: RESOURCE,
+    });
+    expect(res.status).toBe(400);
+    expect(((await res.json()) as Record<string, string>).error).toBe("invalid_request");
+  });
+
+  test("authorization code is single-use (replay → invalid_grant)", async () => {
+    const options = makeOptions();
+    seedConsent(options, "mcp:tools");
+    const { verifier, challenge } = await pkcePair();
+    const ok = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    const code = new URL(ok.location ?? "").searchParams.get("code") ?? "";
+    const signer = await createDpopSigner();
+    const form = {
+      grant_type: "authorization_code",
+      code,
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      code_verifier: verifier,
+      resource: RESOURCE,
+    };
+    const first = await postToken(
+      options,
+      form,
+      await signer.prove({ htm: "POST", htu: "https://as.example.com/oauth/token", now: T0 }),
+    );
+    expect(first.status).toBe(200);
+    const second = await postToken(
+      options,
+      form,
+      await signer.prove({ htm: "POST", htu: "https://as.example.com/oauth/token", now: T0 }),
+    );
+    expect(second.status).toBe(400);
+    expect(((await second.json()) as Record<string, string>).error).toBe("invalid_grant");
+  });
+
+  test("unconsented user is parked to consent screen; approve mints code", async () => {
+    const options = makeOptions();
+    const facade = createOauthAs(options);
+    const { verifier, challenge } = await pkcePair();
+    const authRes = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      scope: "mcp:tools profile",
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    // First run has no consent row → parked at consent screen.
+    const pendingId = new URL(authRes.location ?? "").searchParams.get("consent");
+    expect(pendingId).toBeTruthy();
+
+    const description = facade.describeConsent(pendingId ?? "");
+    expect(description.clientName).toBe("Test Agent");
+    expect([...description.scope]).toEqual(["mcp:tools", "profile"]);
+
+    const approved = await facade.approveConsent(pendingId ?? "", "user-1");
+    const code = new URL(approved.redirectTo).searchParams.get("code");
+    expect(code).toBeTruthy();
+
+    // Wrong user cannot approve someone else's consent.
+    const auth2 = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      scope: "openid",
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    const pending2 = new URL(auth2.location ?? "").searchParams.get("consent") ?? "";
+    expect(() => facade.approveConsent(pending2, "attacker-1")).toThrow(OAuthError);
+
+    void verifier;
+  });
+
+  test("refresh rotation: reuse burns the whole family", async () => {
+    const options = makeOptions();
+    seedConsent(options, "mcp:tools");
+    const { verifier, challenge } = await pkcePair();
+    const ok = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: REDIRECT,
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    const code = new URL(ok.location ?? "").searchParams.get("code") ?? "";
+    const signer = await createDpopSigner();
+    const prove = () =>
+      signer.prove({ htm: "POST", htu: "https://as.example.com/oauth/token", now: T0 });
+    const first = (await (
+      await postToken(
+        options,
+        {
+          grant_type: "authorization_code",
+          code,
+          client_id: CLIENT_ID,
+          redirect_uri: REDIRECT,
+          code_verifier: verifier,
+          resource: RESOURCE,
+        },
+        await prove(),
+      )
+    ).json()) as Record<string, string>;
+
+    const refreshForm = {
+      grant_type: "refresh_token",
+      refresh_token: first.refresh_token!,
+      client_id: CLIENT_ID,
+      resource: RESOURCE,
+    };
+    const rotated = await postToken(options, refreshForm, await prove());
+    expect(rotated.status).toBe(200);
+    const rotatedBody = (await rotated.json()) as Record<string, string>;
+    expect(rotatedBody.refresh_token).not.toBe(first.refresh_token);
+
+    // Replaying the OLD refresh token revokes the family.
+    const replay = await postToken(options, refreshForm, await prove());
+    expect(replay.status).toBe(400);
+    const afterRevoke = await postToken(
+      options,
+      {
+        grant_type: "refresh_token",
+        refresh_token: rotatedBody.refresh_token!,
+        client_id: CLIENT_ID,
+        resource: RESOURCE,
+      },
+      await prove(),
+    );
+    expect(afterRevoke.status).toBe(400);
+    expect(((await afterRevoke.json()) as Record<string, string>).error).toBe("invalid_grant");
+  });
+
+  test("redirect_uri must be exactly registered", async () => {
+    const options = makeOptions();
+    const { challenge } = await pkcePair();
+    const res = await authorize(options, {
+      response_type: "code",
+      client_id: CLIENT_ID,
+      redirect_uri: "https://app.example.com/callback/",
+      resource: RESOURCE,
+      code_challenge: challenge,
+      code_challenge_method: "S256",
+    });
+    // Not a registered exact match → generic 400 JSON (no redirect).
+    expect(res.status).toBe(400);
+    expect(res.body).toBeDefined();
+  });
+});