/**
* mysql-mcp - AuthorizationServerDiscovery Unit Tests
*
* Tests for RFC 8414 authorization server metadata discovery
* including caching behavior, error handling, and helper methods.
*/
import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
import { AuthorizationServerDiscovery, createAuthServerDiscovery } from '../AuthorizationServerDiscovery.js';
import { AuthServerDiscoveryError } from '../errors.js';
import type { AuthorizationServerMetadata } from '../types.js';
// Mock logger to avoid console output
vi.mock('../../utils/logger.js', () => ({
logger: {
info: vi.fn(),
error: vi.fn(),
warn: vi.fn(),
debug: vi.fn()
}
}));
// Mock global fetch
const mockFetch = vi.fn();
vi.stubGlobal('fetch', mockFetch);
describe('AuthorizationServerDiscovery', () => {
const mockMetadata: AuthorizationServerMetadata = {
issuer: 'https://auth.example.com',
token_endpoint: 'https://auth.example.com/token',
authorization_endpoint: 'https://auth.example.com/authorize',
jwks_uri: 'https://auth.example.com/.well-known/jwks.json',
registration_endpoint: 'https://auth.example.com/register',
grant_types_supported: ['authorization_code', 'client_credentials', 'refresh_token'],
scopes_supported: ['read', 'write', 'admin']
};
let discovery: AuthorizationServerDiscovery;
beforeEach(() => {
vi.clearAllMocks();
vi.useFakeTimers();
discovery = new AuthorizationServerDiscovery({
authServerUrl: 'https://auth.example.com'
});
});
afterEach(() => {
vi.useRealTimers();
});
describe('constructor', () => {
it('should create instance with config', () => {
expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery);
});
it('should use default cacheTtl when not provided', () => {
const disc = new AuthorizationServerDiscovery({
authServerUrl: 'https://auth.example.com'
});
expect(disc).toBeDefined();
});
it('should use custom cacheTtl when provided', () => {
const disc = new AuthorizationServerDiscovery({
authServerUrl: 'https://auth.example.com',
cacheTtl: 1800
});
expect(disc).toBeDefined();
});
it('should use custom timeout when provided', () => {
const disc = new AuthorizationServerDiscovery({
authServerUrl: 'https://auth.example.com',
timeout: 10000
});
expect(disc).toBeDefined();
});
});
describe('discover()', () => {
it('should fetch metadata from well-known endpoint', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
const result = await discovery.discover();
expect(mockFetch).toHaveBeenCalledWith(
'https://auth.example.com/.well-known/oauth-authorization-server',
expect.objectContaining({
method: 'GET',
headers: { 'Accept': 'application/json' }
})
);
expect(result).toEqual(mockMetadata);
});
it('should cache metadata within TTL', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
// First call - fetches from network
const result1 = await discovery.discover();
expect(mockFetch).toHaveBeenCalledTimes(1);
// Advance time by 30 minutes (within default 1 hour TTL)
vi.advanceTimersByTime(30 * 60 * 1000);
// Second call - should use cache
const result2 = await discovery.discover();
expect(mockFetch).toHaveBeenCalledTimes(1); // No additional fetch
expect(result2).toEqual(result1);
});
it('should refresh cache after TTL expires', async () => {
mockFetch.mockResolvedValue({
ok: true,
json: async () => mockMetadata
});
// First call
await discovery.discover();
expect(mockFetch).toHaveBeenCalledTimes(1);
// Advance time past TTL (default 3600 seconds)
vi.advanceTimersByTime(3601 * 1000);
// Second call - should refetch
await discovery.discover();
expect(mockFetch).toHaveBeenCalledTimes(2);
});
it('should throw AuthServerDiscoveryError on HTTP error', async () => {
mockFetch.mockResolvedValueOnce({
ok: false,
status: 404,
statusText: 'Not Found'
});
await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
});
it('should throw AuthServerDiscoveryError on network error', async () => {
mockFetch.mockRejectedValueOnce(new Error('Network error'));
await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
});
it('should throw AuthServerDiscoveryError when metadata missing required fields', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => ({ issuer: 'https://auth.example.com' }) // Missing token_endpoint
});
await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
});
it('should throw AuthServerDiscoveryError when issuer is missing', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => ({ token_endpoint: 'https://auth.example.com/token' }) // Missing issuer
});
await expect(discovery.discover()).rejects.toThrow(AuthServerDiscoveryError);
});
});
describe('getJwksUri()', () => {
it('should return JWKS URI from metadata', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
const jwksUri = await discovery.getJwksUri();
expect(jwksUri).toBe('https://auth.example.com/.well-known/jwks.json');
});
it('should throw when JWKS URI not in metadata', async () => {
const metadataWithoutJwks = {
issuer: 'https://auth.example.com',
token_endpoint: 'https://auth.example.com/token'
};
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => metadataWithoutJwks
});
await expect(discovery.getJwksUri()).rejects.toThrow(AuthServerDiscoveryError);
await expect(discovery.getJwksUri()).rejects.toThrow('does not include jwks_uri');
});
});
describe('getTokenEndpoint()', () => {
it('should return token endpoint from metadata', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
const tokenEndpoint = await discovery.getTokenEndpoint();
expect(tokenEndpoint).toBe('https://auth.example.com/token');
});
});
describe('getRegistrationEndpoint()', () => {
it('should return registration endpoint when available', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
const registrationEndpoint = await discovery.getRegistrationEndpoint();
expect(registrationEndpoint).toBe('https://auth.example.com/register');
});
it('should return undefined when registration endpoint not available', async () => {
const metadataWithoutRegistration = {
issuer: 'https://auth.example.com',
token_endpoint: 'https://auth.example.com/token'
};
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => metadataWithoutRegistration
});
const registrationEndpoint = await discovery.getRegistrationEndpoint();
expect(registrationEndpoint).toBeUndefined();
});
});
describe('supportsGrantType()', () => {
it('should return true for supported grant type', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
const supports = await discovery.supportsGrantType('client_credentials');
expect(supports).toBe(true);
});
it('should return false for unsupported grant type', async () => {
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => mockMetadata
});
const supports = await discovery.supportsGrantType('implicit');
expect(supports).toBe(false);
});
it('should return false when grant_types_supported not in metadata', async () => {
const metadataWithoutGrants = {
issuer: 'https://auth.example.com',
token_endpoint: 'https://auth.example.com/token'
};
mockFetch.mockResolvedValueOnce({
ok: true,
json: async () => metadataWithoutGrants
});
const supports = await discovery.supportsGrantType('authorization_code');
expect(supports).toBe(false);
});
});
describe('invalidateCache()', () => {
it('should clear cached metadata', async () => {
mockFetch.mockResolvedValue({
ok: true,
json: async () => mockMetadata
});
// First call populates cache
await discovery.discover();
expect(mockFetch).toHaveBeenCalledTimes(1);
// Invalidate cache
discovery.invalidateCache();
// Next call should refetch
await discovery.discover();
expect(mockFetch).toHaveBeenCalledTimes(2);
});
});
});
describe('createAuthServerDiscovery()', () => {
it('should create AuthorizationServerDiscovery instance', () => {
const discovery = createAuthServerDiscovery({
authServerUrl: 'https://auth.example.com'
});
expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery);
});
it('should pass all config options', () => {
const discovery = createAuthServerDiscovery({
authServerUrl: 'https://auth.example.com',
cacheTtl: 1800,
timeout: 10000
});
expect(discovery).toBeInstanceOf(AuthorizationServerDiscovery);
});
});
