Aiden Cline
61 lines
2.2 KiB
TypeScript
61 lines
2.2 KiB
TypeScript
import { test, expect, describe, afterEach } from "bun:test"
|
|
import { McpOAuthCallback } from "../../src/mcp/oauth-callback"
|
|
import { parseRedirectUri } from "../../src/mcp/oauth-provider"
|
|
|
|
describe("parseRedirectUri", () => {
|
|
test("returns defaults when no URI provided", () => {
|
|
const result = parseRedirectUri()
|
|
expect(result.port).toBe(19876)
|
|
expect(result.path).toBe("/mcp/oauth/callback")
|
|
})
|
|
|
|
test("parses port and path from URI", () => {
|
|
const result = parseRedirectUri("http://127.0.0.1:8080/oauth/callback")
|
|
expect(result.port).toBe(8080)
|
|
expect(result.path).toBe("/oauth/callback")
|
|
})
|
|
|
|
test("returns defaults for invalid URI", () => {
|
|
const result = parseRedirectUri("not-a-valid-url")
|
|
expect(result.port).toBe(19876)
|
|
expect(result.path).toBe("/mcp/oauth/callback")
|
|
})
|
|
})
|
|
|
|
describe("McpOAuthCallback.ensureRunning", () => {
|
|
afterEach(async () => {
|
|
await McpOAuthCallback.stop()
|
|
})
|
|
|
|
test("starts server with custom redirectUri port and path", async () => {
|
|
await McpOAuthCallback.ensureRunning("http://127.0.0.1:18000/custom/callback")
|
|
expect(McpOAuthCallback.isRunning()).toBe(true)
|
|
})
|
|
|
|
test("escapes provider error markup in callback HTML", async () => {
|
|
const redirectUri = "http://127.0.0.1:18001/custom/callback"
|
|
await McpOAuthCallback.ensureRunning(redirectUri)
|
|
|
|
const error = `<script>alert("xss" & 'more')</script>`
|
|
const response = await fetch(
|
|
`${redirectUri}?state=test&error=access_denied&error_description=${encodeURIComponent(error)}`,
|
|
)
|
|
const body = await response.text()
|
|
|
|
expect(response.headers.get("content-type")).toBe("text/html; charset=utf-8")
|
|
expect(body).toContain("<script>alert("xss" & 'more')</script>")
|
|
expect(body).not.toContain(error)
|
|
})
|
|
|
|
test("keeps normal provider errors readable", async () => {
|
|
const redirectUri = "http://127.0.0.1:18002/custom/callback"
|
|
await McpOAuthCallback.ensureRunning(redirectUri)
|
|
|
|
const response = await fetch(
|
|
`${redirectUri}?state=test&error=access_denied&error_description=${encodeURIComponent("The user denied access")}`,
|
|
)
|
|
|
|
expect(await response.text()).toContain('<div class="error">The user denied access</div>')
|
|
})
|
|
})
|