/**
* mysql-mcp - Middleware Unit Tests
*
* Tests for OAuth middleware utilities.
*/
import { describe, it, expect, vi, beforeEach } from 'vitest';
import {
extractBearerToken,
formatOAuthError,
validateAuth,
createAuthContext,
requireScope,
requireAnyScope,
requireToolScope,
type AuthenticatedContext
} from '../middleware.js';
import { TokenMissingError, InvalidTokenError, InsufficientScopeError } from '../errors.js';
import type { TokenValidator } from '../TokenValidator.js';
// Create mock token validator
function createMockTokenValidator(overrides: Partial<TokenValidator> = {}): TokenValidator {
return {
validate: vi.fn().mockResolvedValue({ valid: true, claims: { sub: 'user1', scopes: ['read', 'write'], exp: 0, iat: 0 } }),
invalidateCache: vi.fn(),
...overrides
} as unknown as TokenValidator;
}
describe('extractBearerToken', () => {
it('should extract token from valid Bearer header', () => {
expect(extractBearerToken('Bearer abc123')).toBe('abc123');
});
it('should return null for undefined header', () => {
expect(extractBearerToken(undefined)).toBeNull();
});
it('should return null for empty header', () => {
expect(extractBearerToken('')).toBeNull();
});
it('should return null for non-Bearer auth', () => {
expect(extractBearerToken('Basic abc123')).toBeNull();
});
it('should return null for malformed Bearer header', () => {
expect(extractBearerToken('Bearer')).toBeNull();
});
it('should return empty string for Bearer with trailing space only', () => {
// Note: 'Bearer ' (with trailing space) splits to ['bearer', ''] which returns ''
expect(extractBearerToken('Bearer ')).toBe('');
});
it('should be case-insensitive for Bearer keyword', () => {
expect(extractBearerToken('bearer abc123')).toBe('abc123');
expect(extractBearerToken('BEARER abc123')).toBe('abc123');
});
});
describe('formatOAuthError', () => {
it('should format TokenMissingError as 401', () => {
const result = formatOAuthError(new TokenMissingError());
expect(result.status).toBe(401);
expect(result.body).toHaveProperty('error', 'invalid_token');
});
it('should format InvalidTokenError as 401', () => {
const result = formatOAuthError(new InvalidTokenError('Token expired'));
expect(result.status).toBe(401);
expect(result.body).toHaveProperty('error', 'invalid_token');
});
it('should format InsufficientScopeError as 403', () => {
const result = formatOAuthError(new InsufficientScopeError(['admin', 'write']));
expect(result.status).toBe(403);
expect(result.body).toHaveProperty('error', 'insufficient_scope');
expect(result.body).toHaveProperty('scope', 'admin write');
});
it('should format unknown errors as 500', () => {
const result = formatOAuthError(new Error('Something went wrong'));
expect(result.status).toBe(500);
expect(result.body).toHaveProperty('error', 'server_error');
});
});
describe('createAuthContext', () => {
let mockValidator: TokenValidator;
beforeEach(() => {
mockValidator = createMockTokenValidator();
});
it('should return unauthenticated context when no token', async () => {
const context = await createAuthContext(undefined, mockValidator);
expect(context.authenticated).toBe(false);
expect(context.scopes).toEqual([]);
});
it('should return authenticated context for valid token', async () => {
const context = await createAuthContext('Bearer validtoken', mockValidator);
expect(context.authenticated).toBe(true);
expect(context.scopes).toEqual(['read', 'write']);
expect(context.claims).toBeDefined();
});
it('should return unauthenticated context for invalid token', async () => {
const invalidValidator = createMockTokenValidator({
validate: vi.fn().mockResolvedValue({ valid: false, error: 'Invalid token' })
});
const context = await createAuthContext('Bearer invalidtoken', invalidValidator);
expect(context.authenticated).toBe(false);
expect(context.scopes).toEqual([]);
});
});
describe('validateAuth', () => {
let mockValidator: TokenValidator;
beforeEach(() => {
mockValidator = createMockTokenValidator();
});
it('should throw TokenMissingError when no token and required', async () => {
await expect(validateAuth(undefined, {
tokenValidator: mockValidator,
required: true
})).rejects.toThrow(TokenMissingError);
});
it('should return unauthenticated context when no token and not required', async () => {
const context = await validateAuth(undefined, {
tokenValidator: mockValidator,
required: false
});
expect(context.authenticated).toBe(false);
});
it('should throw InvalidTokenError for invalid token', async () => {
const invalidValidator = createMockTokenValidator({
validate: vi.fn().mockResolvedValue({ valid: false, error: 'Token expired' })
});
await expect(validateAuth('Bearer expired', {
tokenValidator: invalidValidator
})).rejects.toThrow(InvalidTokenError);
});
it('should return authenticated context for valid token', async () => {
const context = await validateAuth('Bearer validtoken', {
tokenValidator: mockValidator
});
expect(context.authenticated).toBe(true);
expect(context.scopes).toEqual(['read', 'write']);
});
it('should throw InsufficientScopeError when missing required scope', async () => {
await expect(validateAuth('Bearer validtoken', {
tokenValidator: mockValidator,
requiredScopes: ['admin'] // User has read, write but not admin
})).rejects.toThrow(InsufficientScopeError);
});
it('should pass when user has any of required scopes', async () => {
const context = await validateAuth('Bearer validtoken', {
tokenValidator: mockValidator,
requiredScopes: ['read', 'admin'] // User has read
});
expect(context.authenticated).toBe(true);
});
});
describe('requireScope', () => {
it('should throw TokenMissingError when not authenticated', () => {
const context: AuthenticatedContext = { authenticated: false, scopes: [] };
expect(() => requireScope(context, 'read')).toThrow(TokenMissingError);
});
it('should throw InsufficientScopeError when scope missing', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['read'],
claims: { sub: 'user1', scopes: ['read'], exp: 0, iat: 0 }
};
expect(() => requireScope(context, 'admin')).toThrow(InsufficientScopeError);
});
it('should pass when scope is present', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['read', 'write'],
claims: { sub: 'user1', scopes: ['read', 'write'], exp: 0, iat: 0 }
};
expect(() => requireScope(context, 'read')).not.toThrow();
});
});
describe('requireAnyScope', () => {
it('should throw TokenMissingError when not authenticated', () => {
const context: AuthenticatedContext = { authenticated: false, scopes: [] };
expect(() => requireAnyScope(context, ['read', 'write'])).toThrow(TokenMissingError);
});
it('should throw InsufficientScopeError when none of scopes present', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['read'],
claims: { sub: 'user1', scopes: ['read'], exp: 0, iat: 0 }
};
expect(() => requireAnyScope(context, ['admin', 'superadmin'])).toThrow(InsufficientScopeError);
});
it('should pass when any scope present', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['read', 'write'],
claims: { sub: 'user1', scopes: ['read', 'write'], exp: 0, iat: 0 }
};
expect(() => requireAnyScope(context, ['write', 'admin'])).not.toThrow();
});
});
describe('requireToolScope', () => {
it('should throw TokenMissingError when not authenticated', () => {
const context: AuthenticatedContext = { authenticated: false, scopes: [] };
expect(() => requireToolScope(context, ['read'])).toThrow(TokenMissingError);
});
it('should map read scope and pass', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['read'], // hasScope checks for 'read' directly
claims: { sub: 'user1', scopes: ['read'], exp: 0, iat: 0 }
};
expect(() => requireToolScope(context, ['read'])).not.toThrow();
});
it('should map write scope and pass', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['write'],
claims: { sub: 'user1', scopes: ['write'], exp: 0, iat: 0 }
};
expect(() => requireToolScope(context, ['write'])).not.toThrow();
});
it('should map admin scope and pass', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['admin'],
claims: { sub: 'user1', scopes: ['admin'], exp: 0, iat: 0 }
};
expect(() => requireToolScope(context, ['admin'])).not.toThrow();
});
it('should throw InsufficientScopeError when mapped scope missing', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['read'],
claims: { sub: 'user1', scopes: ['read'], exp: 0, iat: 0 }
};
expect(() => requireToolScope(context, ['admin'])).toThrow(InsufficientScopeError);
});
it('should pass when user has admin scope and read is required', () => {
const context: AuthenticatedContext = {
authenticated: true,
scopes: ['admin'], // admin includes read and write scopes
claims: { sub: 'user1', scopes: ['admin'], exp: 0, iat: 0 }
};
expect(() => requireToolScope(context, ['read'])).not.toThrow();
});
});
