pi-soly 1.9.3 → 1.11.0

package/mcp/mcp-callback-server.upstream-test.ts

@@ -0,0 +1,416 @@
+/**
+ * Tests for mcp-callback-server.ts - OAuth callback server
+ */
+
+import { describe, it, beforeEach, afterEach } from "node:test"
+import assert from "node:assert"
+import { createServer } from "node:http"
+import {
+  ensureCallbackServer,
+  waitForCallback,
+  cancelPendingCallback,
+  stopCallbackServer,
+  isCallbackServerRunning,
+  getPendingAuthCount,
+  releaseCallbackServer,
+} from "./mcp-callback-server.ts"
+import { getConfiguredOAuthCallbackPort, getOAuthCallbackPath, getOAuthCallbackPort } from "./mcp-oauth-provider.ts"
+
+async function getFreePort(): Promise<number> {
+  const probe = createServer()
+  await new Promise<void>((resolve, reject) => {
+    probe.once("error", reject)
+    probe.listen(0, "localhost", resolve)
+  })
+  const address = probe.address()
+  await new Promise<void>((resolve) => probe.close(() => resolve()))
+  if (!address || typeof address === "string") {
+    throw new Error("Failed to reserve a free test port")
+  }
+  return address.port
+}
+
+describe("mcp-callback-server", () => {
+  beforeEach(async () => {
+    // Stop any running server before each test
+    await stopCallbackServer().catch(() => {})
+  })
+
+  afterEach(async () => {
+    // Stop server after each test
+    await stopCallbackServer().catch(() => {})
+  })
+
+  describe("ensureCallbackServer", () => {
+    it("should start the callback server", async () => {
+      await ensureCallbackServer()
+      assert.strictEqual(isCallbackServerRunning(), true)
+    })
+
+    it("should be idempotent", async () => {
+      await ensureCallbackServer()
+      await ensureCallbackServer()
+      await ensureCallbackServer()
+      assert.strictEqual(isCallbackServerRunning(), true)
+    })
+
+    it("should reserve callback state atomically with the initial bind", async () => {
+      await ensureCallbackServer({ oauthState: "reserved-initial-state", reserveState: true })
+
+      await assert.rejects(
+        async () => await ensureCallbackServer({ callbackHost: "127.0.0.1" }),
+        /cannot be switched while authorizations are pending/
+      )
+
+      releaseCallbackServer("reserved-initial-state")
+    })
+
+    it("should not switch callback hosts while callback state is reserved", async () => {
+      await ensureCallbackServer({ oauthState: "reserved-host-state", reserveState: true })
+
+      await assert.rejects(
+        async () => await ensureCallbackServer({ callbackHost: "127.0.0.1" }),
+        /cannot be switched while authorizations are pending/
+      )
+
+      releaseCallbackServer("reserved-host-state")
+    })
+
+    it("should not switch callback paths while callback state is reserved", async () => {
+      await ensureCallbackServer({ callbackPath: "/first/callback", oauthState: "reserved-path-state", reserveState: true })
+
+      await assert.rejects(
+        async () => await ensureCallbackServer({ callbackPath: "/second/callback" }),
+        /cannot be switched while authorizations are pending/
+      )
+      assert.strictEqual(getOAuthCallbackPath(), "/first/callback")
+
+      releaseCallbackServer("reserved-path-state")
+    })
+
+    it("should release reserved callback state when strict binding fails", async () => {
+      const port = await getFreePort()
+      const blocker = createServer((_req, res) => {
+        res.writeHead(200)
+        res.end("blocked")
+      })
+
+      await new Promise<void>((resolve, reject) => {
+        blocker.once("error", reject)
+        blocker.listen(port, "localhost", resolve)
+      })
+
+      try {
+        await assert.rejects(
+          async () => await ensureCallbackServer({ strictPort: true, port, oauthState: "failed-bind-state", reserveState: true }),
+          /already in use/
+        )
+      } finally {
+        await new Promise<void>((resolve) => blocker.close(() => resolve()))
+      }
+
+      await ensureCallbackServer({ callbackPath: "/after-failure" })
+      await ensureCallbackServer({ callbackPath: "/after-failure-switch" })
+      assert.strictEqual(getOAuthCallbackPath(), "/after-failure-switch")
+    })
+
+    it("should bind an explicit strict host, port, and custom callback path", async () => {
+      const port = await getFreePort()
+
+      await ensureCallbackServer({ strictPort: true, port, callbackHost: "127.0.0.1", callbackPath: "/custom/callback" })
+
+      assert.strictEqual(getOAuthCallbackPort(), port)
+      assert.strictEqual(getOAuthCallbackPath(), "/custom/callback")
+      assert.strictEqual((await fetch(`http://127.0.0.1:${port}/callback?code=nope&state=custom-state`)).status, 404)
+
+      const callbackPromise = waitForCallback("custom-state")
+      const response = await fetch(`http://127.0.0.1:${port}/custom/callback?code=ok&state=custom-state`)
+      assert.strictEqual(response.status, 200)
+      assert.strictEqual(await callbackPromise, "ok")
+    })
+
+    it("should reject an occupied explicit strict port", async () => {
+      const port = await getFreePort()
+      const blocker = createServer((_req, res) => {
+        res.writeHead(200)
+        res.end("blocked")
+      })
+
+      await new Promise<void>((resolve, reject) => {
+        blocker.once("error", reject)
+        blocker.listen(port, "localhost", resolve)
+      })
+
+      try {
+        await assert.rejects(
+          async () => await ensureCallbackServer({ strictPort: true, port }),
+          /already in use/
+        )
+      } finally {
+        await new Promise<void>((resolve) => blocker.close(() => resolve()))
+      }
+    })
+
+    it("should use an OS-assigned port when the configured non-strict port is occupied", async () => {
+      const configuredPort = getConfiguredOAuthCallbackPort()
+      const blocker = createServer((_req, res) => {
+        res.writeHead(200)
+        res.end("blocked")
+      })
+
+      try {
+        await new Promise<void>((resolve, reject) => {
+          blocker.once("error", reject)
+          blocker.listen(configuredPort, "localhost", resolve)
+        })
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "EADDRINUSE") return
+        throw error
+      }
+
+      try {
+        await ensureCallbackServer()
+        const callbackPort = getOAuthCallbackPort()
+        assert.notStrictEqual(callbackPort, configuredPort)
+
+        const state = "occupied-port-state"
+        const callbackPromise = waitForCallback(state)
+        const response = await fetch(`http://localhost:${callbackPort}/callback?code=ok&state=${state}`)
+        assert.strictEqual(response.status, 200)
+        assert.strictEqual(await callbackPromise, "ok")
+
+        await assert.rejects(
+          async () => await ensureCallbackServer({ strictPort: true }),
+          /already in use/
+        )
+      } finally {
+        await new Promise<void>((resolve) => blocker.close(() => resolve()))
+      }
+    })
+  })
+
+  describe("waitForCallback / callback handling", () => {
+    it("should resolve with code on successful callback", async () => {
+      await ensureCallbackServer()
+
+      const state = "test-state-123"
+      const expectedCode = "auth-code-abc"
+
+      // Start waiting for callback
+      const callbackPromise = waitForCallback(state)
+
+      // Simulate callback by making HTTP request
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?code=${expectedCode}&state=${state}`
+      )
+
+      // Should get HTML success response
+      assert.strictEqual(response.status, 200)
+      const html = await response.text()
+      assert.ok(html.includes("Authorization Successful"))
+
+      // Callback promise should resolve
+      const code = await callbackPromise
+      assert.strictEqual(code, expectedCode)
+    })
+
+    it("should reject on error parameter", async () => {
+      await ensureCallbackServer()
+
+      const state = "test-state-error"
+      const errorMsg = "access_denied"
+
+      const callbackPromise = waitForCallback(state)
+
+      // Simulate error callback
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?error=${errorMsg}&state=${state}`
+      )
+
+      assert.strictEqual(response.status, 200)
+      const html = await response.text()
+      assert.ok(html.includes("Authorization Failed"))
+
+      // Callback promise should reject
+      await assert.rejects(callbackPromise, /access_denied/)
+    })
+
+    it("should escape provider-controlled OAuth error details", async () => {
+      await ensureCallbackServer()
+
+      const state = "test-state-error-escaping"
+      const callbackPromise = waitForCallback(state)
+      const callbackPort = getOAuthCallbackPort()
+      const description = `<script>alert("x")</script>&reason=bad`
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?error=access_denied&error_description=${encodeURIComponent(description)}&state=${state}`
+      )
+
+      assert.strictEqual(response.status, 200)
+      const html = await response.text()
+      assert.ok(!html.includes("<script>"))
+      assert.ok(html.includes("&lt;script&gt;alert(&quot;x&quot;)&lt;/script&gt;&amp;reason=bad"))
+      await assert.rejects(callbackPromise, /<script>alert\("x"\)<\/script>&reason=bad/)
+    })
+
+    it("should not reflect OAuth error details for invalid state", async () => {
+      await ensureCallbackServer()
+
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?error=access_denied&error_description=${encodeURIComponent("<script>bad()</script>")}&state=invalid-state`
+      )
+
+      assert.strictEqual(response.status, 400)
+      const html = await response.text()
+      assert.ok(html.includes("Invalid or expired state parameter"))
+      assert.ok(!html.includes("<script>"))
+      assert.ok(!html.includes("bad()"))
+    })
+
+    it("should return 400 for missing state", async () => {
+      await ensureCallbackServer()
+
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?code=abc123`
+      )
+
+      assert.strictEqual(response.status, 400)
+      const html = await response.text()
+      assert.ok(html.includes("Missing required state parameter"))
+    })
+
+    it("should return 400 for invalid state", async () => {
+      await ensureCallbackServer()
+
+      // Register a different state
+      const pendingCallback = waitForCallback("valid-state")
+
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?code=abc123&state=invalid-state`
+      )
+
+      assert.strictEqual(response.status, 400)
+      const html = await response.text()
+      assert.ok(html.includes("Invalid or expired state parameter"))
+
+      cancelPendingCallback("valid-state")
+      await assert.rejects(pendingCallback, /Authorization cancelled/)
+    })
+
+    it("should return 400 for missing code", async () => {
+      await ensureCallbackServer()
+
+      const state = "test-state-no-code"
+      const pendingCallback = waitForCallback(state)
+
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/callback?state=${state}`
+      )
+
+      assert.strictEqual(response.status, 400)
+      const html = await response.text()
+      assert.ok(html.includes("No authorization code provided"))
+
+      cancelPendingCallback(state)
+      await assert.rejects(pendingCallback, /Authorization cancelled/)
+    })
+
+    it("should not switch callback paths while callbacks are pending", async () => {
+      await ensureCallbackServer({ callbackPath: "/first/callback" })
+
+      const state = "pending-path-state"
+      const callbackPromise = waitForCallback(state)
+
+      await assert.rejects(
+        async () => await ensureCallbackServer({ callbackPath: "/second/callback" }),
+        /cannot be switched while authorizations are pending/
+      )
+      assert.strictEqual(getOAuthCallbackPath(), "/first/callback")
+
+      cancelPendingCallback(state)
+      await assert.rejects(callbackPromise, /Authorization cancelled/)
+    })
+
+    it("should return 404 for wrong path", async () => {
+      await ensureCallbackServer()
+
+      const callbackPort = getOAuthCallbackPort()
+      const response = await fetch(
+        `http://localhost:${callbackPort}/wrong/path`
+      )
+
+      assert.strictEqual(response.status, 404)
+    })
+  })
+
+  describe("cancelPendingCallback", () => {
+    it("should reject pending callback", async () => {
+      await ensureCallbackServer()
+
+      const state = "test-state-cancel"
+      const callbackPromise = waitForCallback(state)
+
+      cancelPendingCallback(state)
+
+      await assert.rejects(callbackPromise, /Authorization cancelled/)
+    })
+  })
+
+  describe("stopCallbackServer", () => {
+    it("should stop the server", async () => {
+      await ensureCallbackServer()
+      assert.strictEqual(isCallbackServerRunning(), true)
+
+      await stopCallbackServer()
+      assert.strictEqual(isCallbackServerRunning(), false)
+    })
+
+    it("should reject all pending callbacks", async () => {
+      await ensureCallbackServer()
+
+      const state1 = "state-1"
+      const state2 = "state-2"
+
+      const promise1 = waitForCallback(state1)
+      const promise2 = waitForCallback(state2)
+
+      await stopCallbackServer()
+
+      await assert.rejects(promise1, /OAuth callback server stopped/)
+      await assert.rejects(promise2, /OAuth callback server stopped/)
+    })
+  })
+
+  describe("getPendingAuthCount", () => {
+    it("should return 0 when no pending auths", async () => {
+      await ensureCallbackServer()
+      assert.strictEqual(getPendingAuthCount(), 0)
+    })
+
+    it("should return count of pending auths", async () => {
+      await ensureCallbackServer()
+
+      const promise1 = waitForCallback("state-1")
+      assert.strictEqual(getPendingAuthCount(), 1)
+
+      const promise2 = waitForCallback("state-2")
+      assert.strictEqual(getPendingAuthCount(), 2)
+
+      const promise3 = waitForCallback("state-3")
+      assert.strictEqual(getPendingAuthCount(), 3)
+
+      cancelPendingCallback("state-1")
+      cancelPendingCallback("state-2")
+      cancelPendingCallback("state-3")
+      await assert.rejects(promise1, /Authorization cancelled/)
+      await assert.rejects(promise2, /Authorization cancelled/)
+      await assert.rejects(promise3, /Authorization cancelled/)
+    })
+  })
+})