|
1 | 1 | import { describe, it, expect, vi, beforeEach } from "vitest"; |
2 | 2 | import { |
| 3 | + discoverAuthorizationServerMetadataForServer, |
3 | 4 | discoverScopes, |
4 | 5 | getAuthorizationServerUrl, |
| 6 | + getAuthorizationServerUrlCandidates, |
5 | 7 | } from "@inspector/core/auth/discovery.js"; |
6 | 8 | import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/client"; |
7 | 9 |
|
@@ -335,3 +337,172 @@ describe("getAuthorizationServerUrl", () => { |
335 | 337 | expect(captured?.message).toMatch(/Invalid MCP server URL: "" \(.+\)/); |
336 | 338 | }); |
337 | 339 | }); |
| 340 | + |
| 341 | +// #2110: an MCP server hosted under a path (Moodle, a WordPress plugin, any |
| 342 | +// PHP endpoint) publishes its OAuth metadata under that same path. Reducing the |
| 343 | +// fallback authorization-server URL to the origin threw that path away, so |
| 344 | +// discovery could only ever probe the domain root and 404'd. |
| 345 | +describe("path-hosted MCP servers (#2110)", () => { |
| 346 | + const pathServerUrl = "https://misc.example.com/mod/minilesson/mcp.php"; |
| 347 | + |
| 348 | + describe("getAuthorizationServerUrl", () => { |
| 349 | + it("keeps the server's path in the fallback URL", () => { |
| 350 | + expect(getAuthorizationServerUrl(pathServerUrl)).toEqual( |
| 351 | + new URL(pathServerUrl), |
| 352 | + ); |
| 353 | + }); |
| 354 | + |
| 355 | + it("strips query and fragment, which an RFC 8414 issuer never carries", () => { |
| 356 | + expect( |
| 357 | + getAuthorizationServerUrl(`${pathServerUrl}?session=abc#frag`), |
| 358 | + ).toEqual(new URL(pathServerUrl)); |
| 359 | + }); |
| 360 | + }); |
| 361 | + |
| 362 | + describe("getAuthorizationServerUrlCandidates", () => { |
| 363 | + it("tries the path-scoped URL before the bare origin", () => { |
| 364 | + expect(getAuthorizationServerUrlCandidates(pathServerUrl)).toEqual([ |
| 365 | + new URL(pathServerUrl), |
| 366 | + new URL("https://misc.example.com/"), |
| 367 | + ]); |
| 368 | + }); |
| 369 | + |
| 370 | + it("offers a single candidate for a root-hosted server", () => { |
| 371 | + expect( |
| 372 | + getAuthorizationServerUrlCandidates("https://mcp.example.com"), |
| 373 | + ).toEqual([new URL("https://mcp.example.com/")]); |
| 374 | + }); |
| 375 | + |
| 376 | + it("does not probe past an authorization server named by resource metadata", () => { |
| 377 | + const resourceMetadata: OAuthProtectedResourceMetadata = { |
| 378 | + resource: pathServerUrl, |
| 379 | + authorization_servers: ["https://auth.example.com/realms/r"], |
| 380 | + }; |
| 381 | + expect( |
| 382 | + getAuthorizationServerUrlCandidates(pathServerUrl, resourceMetadata), |
| 383 | + ).toEqual([new URL("https://auth.example.com/realms/r")]); |
| 384 | + }); |
| 385 | + }); |
| 386 | + |
| 387 | + describe("discoverAuthorizationServerMetadataForServer", () => { |
| 388 | + const metadata = { |
| 389 | + issuer: pathServerUrl, |
| 390 | + authorization_endpoint: "https://misc.example.com/mod/authorize.php", |
| 391 | + token_endpoint: "https://misc.example.com/mod/token.php", |
| 392 | + response_types_supported: ["code"], |
| 393 | + }; |
| 394 | + |
| 395 | + beforeEach(() => { |
| 396 | + vi.clearAllMocks(); |
| 397 | + }); |
| 398 | + |
| 399 | + it("returns the path-scoped result without probing the origin", async () => { |
| 400 | + const { discoverAuthorizationServerMetadata } = |
| 401 | + await import("@modelcontextprotocol/client"); |
| 402 | + vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue( |
| 403 | + metadata, |
| 404 | + ); |
| 405 | + |
| 406 | + await expect( |
| 407 | + discoverAuthorizationServerMetadataForServer(pathServerUrl), |
| 408 | + ).resolves.toEqual(metadata); |
| 409 | + expect(discoverAuthorizationServerMetadata).toHaveBeenCalledTimes(1); |
| 410 | + expect(discoverAuthorizationServerMetadata).toHaveBeenCalledWith( |
| 411 | + new URL(pathServerUrl), |
| 412 | + { fetchFn: undefined }, |
| 413 | + ); |
| 414 | + }); |
| 415 | + |
| 416 | + it("falls back to the origin when the path-scoped candidate has no metadata", async () => { |
| 417 | + const { discoverAuthorizationServerMetadata } = |
| 418 | + await import("@modelcontextprotocol/client"); |
| 419 | + vi.mocked(discoverAuthorizationServerMetadata) |
| 420 | + .mockResolvedValueOnce(undefined) |
| 421 | + .mockResolvedValueOnce(metadata); |
| 422 | + |
| 423 | + await expect( |
| 424 | + discoverAuthorizationServerMetadataForServer(pathServerUrl), |
| 425 | + ).resolves.toEqual(metadata); |
| 426 | + expect(discoverAuthorizationServerMetadata).toHaveBeenNthCalledWith( |
| 427 | + 2, |
| 428 | + new URL("https://misc.example.com/"), |
| 429 | + { fetchFn: undefined }, |
| 430 | + ); |
| 431 | + }); |
| 432 | + |
| 433 | + it("survives a throwing candidate while another remains", async () => { |
| 434 | + const { discoverAuthorizationServerMetadata } = |
| 435 | + await import("@modelcontextprotocol/client"); |
| 436 | + vi.mocked(discoverAuthorizationServerMetadata) |
| 437 | + .mockRejectedValueOnce(new Error("issuer mismatch")) |
| 438 | + .mockResolvedValueOnce(metadata); |
| 439 | + |
| 440 | + await expect( |
| 441 | + discoverAuthorizationServerMetadataForServer(pathServerUrl), |
| 442 | + ).resolves.toEqual(metadata); |
| 443 | + }); |
| 444 | + |
| 445 | + it("rethrows the first error when every candidate fails", async () => { |
| 446 | + const { discoverAuthorizationServerMetadata } = |
| 447 | + await import("@modelcontextprotocol/client"); |
| 448 | + vi.mocked(discoverAuthorizationServerMetadata) |
| 449 | + .mockRejectedValueOnce(new Error("path-scoped failed")) |
| 450 | + .mockRejectedValueOnce(new Error("origin failed")); |
| 451 | + |
| 452 | + await expect( |
| 453 | + discoverAuthorizationServerMetadataForServer(pathServerUrl), |
| 454 | + ).rejects.toThrow("path-scoped failed"); |
| 455 | + }); |
| 456 | + |
| 457 | + it("resolves undefined when every candidate answers with no metadata", async () => { |
| 458 | + const { discoverAuthorizationServerMetadata } = |
| 459 | + await import("@modelcontextprotocol/client"); |
| 460 | + vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue( |
| 461 | + undefined, |
| 462 | + ); |
| 463 | + |
| 464 | + await expect( |
| 465 | + discoverAuthorizationServerMetadataForServer(pathServerUrl), |
| 466 | + ).resolves.toBeUndefined(); |
| 467 | + expect(discoverAuthorizationServerMetadata).toHaveBeenCalledTimes(2); |
| 468 | + }); |
| 469 | + |
| 470 | + it("passes the caller's fetch through to every candidate", async () => { |
| 471 | + const { discoverAuthorizationServerMetadata } = |
| 472 | + await import("@modelcontextprotocol/client"); |
| 473 | + vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue( |
| 474 | + undefined, |
| 475 | + ); |
| 476 | + const fetchFn = vi.fn<typeof fetch>(); |
| 477 | + |
| 478 | + await discoverAuthorizationServerMetadataForServer( |
| 479 | + pathServerUrl, |
| 480 | + undefined, |
| 481 | + fetchFn, |
| 482 | + ); |
| 483 | + |
| 484 | + expect(discoverAuthorizationServerMetadata).toHaveBeenCalledWith( |
| 485 | + new URL(pathServerUrl), |
| 486 | + { fetchFn }, |
| 487 | + ); |
| 488 | + }); |
| 489 | + }); |
| 490 | + |
| 491 | + it("discoverScopes reaches a path-hosted authorization server", async () => { |
| 492 | + const { discoverAuthorizationServerMetadata } = |
| 493 | + await import("@modelcontextprotocol/client"); |
| 494 | + vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue({ |
| 495 | + issuer: pathServerUrl, |
| 496 | + authorization_endpoint: "https://misc.example.com/mod/authorize.php", |
| 497 | + token_endpoint: "https://misc.example.com/mod/token.php", |
| 498 | + response_types_supported: ["code"], |
| 499 | + scopes_supported: ["read"], |
| 500 | + }); |
| 501 | + |
| 502 | + await expect(discoverScopes(pathServerUrl)).resolves.toBe("read"); |
| 503 | + expect(discoverAuthorizationServerMetadata).toHaveBeenCalledWith( |
| 504 | + new URL(pathServerUrl), |
| 505 | + { fetchFn: undefined }, |
| 506 | + ); |
| 507 | + }); |
| 508 | +}); |
0 commit comments