| 1 | package main |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "path/filepath" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | |
| 9 | "reasonix/internal/config" |
| 10 | "reasonix/internal/control" |
| 11 | "reasonix/internal/plugin" |
| 12 | ) |
| 13 | |
| 14 | func TestAuthenticateMCPServerUsesPrivateStateAndReconnects(t *testing.T) { |
| 15 | isolateDesktopUserDirs(t) |
| 16 | dir := robustTempDir(t) |
| 17 | t.Chdir(dir) |
| 18 | srv := desktopMCPHTTPServer(t) |
| 19 | defer srv.Close() |
| 20 | entry := config.PluginEntry{Name: "oauth", Type: "http", URL: srv.URL, Source: config.MCPSourceUserConfig} |
| 21 | if _, err := config.InstallUserPluginForRoot(dir, entry, true); err != nil { |
| 22 | t.Fatal(err) |
| 23 | } |
| 24 | |
| 25 | previousAuthorize, previousOpen := desktopAuthorizeHTTPMCP, desktopOpenMCPAuthorizationURL |
| 26 | opened := "" |
| 27 | desktopAuthorizeHTTPMCP = func(_ context.Context, spec plugin.Spec, openURL func(string) error) error { |
| 28 | if spec.Name != "oauth" || spec.StateDir == "" || strings.HasPrefix(filepath.Clean(spec.StateDir), filepath.Clean(dir)+string(filepath.Separator)) { |
| 29 | t.Fatalf("OAuth spec must use private Reasonix state: %+v", spec) |
| 30 | } |
| 31 | if spec.OAuthHTTPClient == nil { |
| 32 | t.Fatal("desktop OAuth did not receive the configured proxy-aware HTTP client") |
| 33 | } |
| 34 | return openURL("https://auth.example.test/authorize") |
| 35 | } |
| 36 | desktopOpenMCPAuthorizationURL = func(_ *App, rawURL string) error { opened = rawURL; return nil } |
| 37 | t.Cleanup(func() { |
| 38 | desktopAuthorizeHTTPMCP, desktopOpenMCPAuthorizationURL = previousAuthorize, previousOpen |
| 39 | }) |
| 40 | |
| 41 | app := NewApp() |
| 42 | app.setTestCtrl(control.New(control.Options{Host: plugin.NewHost()}), "") |
| 43 | defer app.activeCtrl().Close() |
| 44 | if err := app.AuthenticateMCPServer("oauth"); err != nil { |
| 45 | t.Fatalf("AuthenticateMCPServer: %v", err) |
| 46 | } |
| 47 | if opened != "https://auth.example.test/authorize" { |
| 48 | t.Fatalf("opened URL = %q", opened) |
| 49 | } |
| 50 | for _, server := range app.MCPServers() { |
| 51 | if server.Name == "oauth" { |
| 52 | if server.Status != "connected" { |
| 53 | t.Fatalf("server after authorization = %+v", server) |
| 54 | } |
| 55 | return |
| 56 | } |
| 57 | } |
| 58 | t.Fatal("authorized server missing from desktop view") |
| 59 | } |
| 60 | |
| 61 | func TestAuthenticateMCPServerRejectsIneligibleConfigurations(t *testing.T) { |
| 62 | tests := []struct { |
| 63 | name string |
| 64 | entry config.PluginEntry |
| 65 | }{ |
| 66 | {name: "stdio", entry: config.PluginEntry{Name: "server", Type: "stdio", Command: "server-mcp"}}, |
| 67 | {name: "static authentication", entry: config.PluginEntry{ |
| 68 | Name: "server", Type: "http", URL: "https://mcp.example.test/mcp", |
| 69 | Headers: map[string]string{"Authorization": "Bearer configured"}, |
| 70 | }}, |
| 71 | } |
| 72 | for _, tc := range tests { |
| 73 | t.Run(tc.name, func(t *testing.T) { |
| 74 | isolateDesktopUserDirs(t) |
| 75 | dir := robustTempDir(t) |
| 76 | t.Chdir(dir) |
| 77 | tc.entry.Source = config.MCPSourceUserConfig |
| 78 | if _, err := config.InstallUserPluginForRoot(dir, tc.entry, true); err != nil { |
| 79 | t.Fatal(err) |
| 80 | } |
| 81 | |
| 82 | called := false |
| 83 | previous := desktopAuthorizeHTTPMCP |
| 84 | desktopAuthorizeHTTPMCP = func(context.Context, plugin.Spec, func(string) error) error { |
| 85 | called = true |
| 86 | return nil |
| 87 | } |
| 88 | t.Cleanup(func() { desktopAuthorizeHTTPMCP = previous }) |
| 89 | |
| 90 | app := NewApp() |
| 91 | app.setTestCtrl(control.New(control.Options{Host: plugin.NewHost()}), "") |
| 92 | defer app.activeCtrl().Close() |
| 93 | if err := app.AuthenticateMCPServer("server"); err == nil || !strings.Contains(err.Error(), "Streamable HTTP") { |
| 94 | t.Fatalf("AuthenticateMCPServer error = %v", err) |
| 95 | } |
| 96 | if called { |
| 97 | t.Fatal("ineligible server reached the OAuth implementation") |
| 98 | } |
| 99 | }) |
| 100 | } |
| 101 | } |
| 102 |