/**
* postgres-mcp - OAuth Resource Server Tests
*
* Tests for RFC 9728 Protected Resource Metadata implementation.
*/
import { describe, it, expect } from 'vitest';
import { OAuthResourceServer, createOAuthResourceServer } from '../OAuthResourceServer.js';
describe('OAuthResourceServer', () => {
const defaultConfig = {
resource: 'http://localhost:3000',
authorizationServers: ['http://localhost:8080/realms/postgres-mcp'],
scopesSupported: ['read', 'write', 'admin']
};
describe('constructor', () => {
it('should create instance with provided config', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.getResourceId()).toBe('http://localhost:3000');
});
it('should default bearerMethodsSupported to header', () => {
const server = new OAuthResourceServer(defaultConfig);
const metadata = server.getMetadata();
expect(metadata.bearer_methods_supported).toEqual(['header']);
});
it('should use provided bearerMethodsSupported', () => {
const server = new OAuthResourceServer({
...defaultConfig,
bearerMethodsSupported: ['header', 'body']
});
const metadata = server.getMetadata();
expect(metadata.bearer_methods_supported).toEqual(['header', 'body']);
});
});
describe('getMetadata', () => {
it('should return RFC 9728 compliant metadata', () => {
const server = new OAuthResourceServer(defaultConfig);
const metadata = server.getMetadata();
expect(metadata.resource).toBe('http://localhost:3000');
expect(metadata.authorization_servers).toEqual(['http://localhost:8080/realms/postgres-mcp']);
expect(metadata.scopes_supported).toEqual(['read', 'write', 'admin']);
expect(metadata.resource_documentation).toBe('http://localhost:3000/docs');
expect(metadata.resource_signing_alg_values_supported).toEqual(['RS256', 'ES256']);
});
it('should include all required RFC 9728 fields', () => {
const server = new OAuthResourceServer(defaultConfig);
const metadata = server.getMetadata();
// RFC 9728 required fields
expect(metadata).toHaveProperty('resource');
// RFC 9728 optional but important fields
expect(metadata).toHaveProperty('authorization_servers');
expect(metadata).toHaveProperty('scopes_supported');
});
});
describe('getWellKnownPath', () => {
it('should return the RFC 9728 well-known path', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.getWellKnownPath()).toBe('/.well-known/oauth-protected-resource');
});
});
describe('isScopeSupported', () => {
it('should return true for explicitly listed scopes', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.isScopeSupported('read')).toBe(true);
expect(server.isScopeSupported('write')).toBe(true);
expect(server.isScopeSupported('admin')).toBe(true);
});
it('should return false for unknown scopes', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.isScopeSupported('unknown')).toBe(false);
});
it('should support PostgreSQL db: pattern scopes', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.isScopeSupported('db:mydb')).toBe(true);
expect(server.isScopeSupported('db:production')).toBe(true);
});
it('should support PostgreSQL schema: pattern scopes', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.isScopeSupported('schema:public')).toBe(true);
expect(server.isScopeSupported('schema:analytics')).toBe(true);
});
it('should support PostgreSQL table: pattern scopes', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.isScopeSupported('table:public:users')).toBe(true);
expect(server.isScopeSupported('table:schema:table_name')).toBe(true);
});
});
describe('getResourceId', () => {
it('should return the resource identifier', () => {
const server = new OAuthResourceServer(defaultConfig);
expect(server.getResourceId()).toBe('http://localhost:3000');
});
});
describe('getSupportedScopes', () => {
it('should return copy of supported scopes', () => {
const server = new OAuthResourceServer(defaultConfig);
const scopes = server.getSupportedScopes();
expect(scopes).toEqual(['read', 'write', 'admin']);
// Verify it's a copy
scopes.push('modified');
expect(server.getSupportedScopes()).not.toContain('modified');
});
});
describe('getAuthorizationServers', () => {
it('should return copy of authorization servers', () => {
const server = new OAuthResourceServer(defaultConfig);
const servers = server.getAuthorizationServers();
expect(servers).toEqual(['http://localhost:8080/realms/postgres-mcp']);
// Verify it's a copy
servers.push('http://other-server');
expect(server.getAuthorizationServers()).toHaveLength(1);
});
it('should support multiple authorization servers', () => {
const server = new OAuthResourceServer({
...defaultConfig,
authorizationServers: [
'http://localhost:8080/realms/postgres-mcp',
'http://backup-auth.example.com'
]
});
expect(server.getAuthorizationServers()).toHaveLength(2);
});
});
describe('createOAuthResourceServer factory', () => {
it('should create an OAuthResourceServer instance', () => {
const server = createOAuthResourceServer(defaultConfig);
expect(server).toBeInstanceOf(OAuthResourceServer);
expect(server.getResourceId()).toBe('http://localhost:3000');
});
});
});
