/**
* postgres-mcp - OAuth Middleware Tests
*
* Tests for authentication middleware, bearer token extraction,
* scope validation, and error formatting.
*/
import { describe, it, expect, vi } from "vitest";
import {
extractBearerToken,
createAuthContext,
validateAuth,
requireScope,
requireAnyScope,
requireToolScope,
formatOAuthError,
type AuthenticatedContext,
} from "../middleware.js";
import {
TokenMissingError,
InvalidTokenError,
InsufficientScopeError,
} from "../errors.js";
import type { TokenValidator } from "../TokenValidator.js";
import type { TokenValidationResult } from "../types.js";
// Mock token validator
function createMockTokenValidator(
result: TokenValidationResult,
): TokenValidator {
return {
validate: vi.fn().mockResolvedValue(result),
invalidateCache: vi.fn(),
} as unknown as TokenValidator;
}
describe("OAuth Middleware", () => {
describe("extractBearerToken", () => {
it("should extract token from valid Bearer header", () => {
const token = extractBearerToken("Bearer abc123xyz");
expect(token).toBe("abc123xyz");
});
it("should return null for missing header", () => {
expect(extractBearerToken(undefined)).toBeNull();
});
it("should return null for empty header", () => {
expect(extractBearerToken("")).toBeNull();
});
it("should return null for non-Bearer header", () => {
expect(extractBearerToken("Basic abc123")).toBeNull();
});
it("should handle case-insensitive Bearer prefix", () => {
const token = extractBearerToken("bearer abc123xyz");
expect(token).toBe("abc123xyz");
});
it("should return empty string for malformed header (missing token)", () => {
// 'Bearer ' splits into ["Bearer", ""] which has 2 parts
// Implementation returns empty string which is falsy
expect(extractBearerToken("Bearer ")).toBe("");
});
it("should return null for malformed header (extra parts)", () => {
// 'Bearer token extra' splits into 3 parts, so returns null
expect(extractBearerToken("Bearer token extra")).toBeNull();
});
});
describe("createAuthContext", () => {
it("should return unauthenticated context when no token", async () => {
const mockValidator = createMockTokenValidator({ valid: true });
const context = await createAuthContext(undefined, mockValidator);
expect(context.authenticated).toBe(false);
expect(context.scopes).toEqual([]);
expect(context.claims).toBeUndefined();
});
it("should return authenticated context with valid token", async () => {
const mockValidator = createMockTokenValidator({
valid: true,
claims: {
sub: "user123",
scopes: ["read", "write"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
});
const context = await createAuthContext(
"Bearer valid-token",
mockValidator,
);
expect(context.authenticated).toBe(true);
expect(context.scopes).toEqual(["read", "write"]);
expect(context.claims?.sub).toBe("user123");
});
it("should return unauthenticated context with invalid token", async () => {
const mockValidator = createMockTokenValidator({
valid: false,
error: "Invalid signature",
});
const context = await createAuthContext(
"Bearer invalid-token",
mockValidator,
);
expect(context.authenticated).toBe(false);
expect(context.scopes).toEqual([]);
});
});
describe("validateAuth", () => {
it("should throw TokenMissingError when required and no token", async () => {
const mockValidator = createMockTokenValidator({ valid: true });
await expect(
validateAuth(undefined, {
tokenValidator: mockValidator,
required: true,
}),
).rejects.toThrow(TokenMissingError);
});
it("should return unauthenticated when not required and no token", async () => {
const mockValidator = createMockTokenValidator({ valid: true });
const context = await validateAuth(undefined, {
tokenValidator: mockValidator,
required: false,
});
expect(context.authenticated).toBe(false);
});
it("should throw InvalidTokenError for invalid tokens", async () => {
const mockValidator = createMockTokenValidator({
valid: false,
error: "Token expired",
});
await expect(
validateAuth("Bearer expired-token", {
tokenValidator: mockValidator,
required: true,
}),
).rejects.toThrow(InvalidTokenError);
});
it("should throw InsufficientScopeError when missing required scopes", async () => {
const mockValidator = createMockTokenValidator({
valid: true,
claims: {
sub: "user123",
scopes: ["read"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
});
await expect(
validateAuth("Bearer token", {
tokenValidator: mockValidator,
required: true,
requiredScopes: ["admin"],
}),
).rejects.toThrow(InsufficientScopeError);
});
it("should succeed when token has required scope", async () => {
const mockValidator = createMockTokenValidator({
valid: true,
claims: {
sub: "user123",
scopes: ["admin"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
});
const context = await validateAuth("Bearer token", {
tokenValidator: mockValidator,
required: true,
requiredScopes: ["admin"],
});
expect(context.authenticated).toBe(true);
expect(context.scopes).toContain("admin");
});
});
describe("requireScope", () => {
const authenticatedContext: AuthenticatedContext = {
authenticated: true,
claims: {
sub: "user123",
scopes: ["read", "write"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
scopes: ["read", "write"],
};
const unauthenticatedContext: AuthenticatedContext = {
authenticated: false,
scopes: [],
};
it("should pass when scope is present", () => {
expect(() => requireScope(authenticatedContext, "read")).not.toThrow();
});
it("should throw InsufficientScopeError when scope missing", () => {
expect(() => requireScope(authenticatedContext, "admin")).toThrow(
InsufficientScopeError,
);
});
it("should throw TokenMissingError when not authenticated", () => {
expect(() => requireScope(unauthenticatedContext, "read")).toThrow(
TokenMissingError,
);
});
});
describe("requireAnyScope", () => {
const context: AuthenticatedContext = {
authenticated: true,
claims: {
sub: "user123",
scopes: ["read"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
scopes: ["read"],
};
it("should pass when any scope matches", () => {
expect(() => requireAnyScope(context, ["read", "write"])).not.toThrow();
});
it("should throw when no scopes match", () => {
expect(() => requireAnyScope(context, ["admin", "write"])).toThrow(
InsufficientScopeError,
);
});
it("should throw TokenMissingError when not authenticated (line 140)", () => {
const unauthenticatedContext: AuthenticatedContext = {
authenticated: false,
scopes: [],
};
expect(() => requireAnyScope(unauthenticatedContext, ["read"])).toThrow(
TokenMissingError,
);
});
});
describe("requireToolScope", () => {
const readContext: AuthenticatedContext = {
authenticated: true,
claims: {
sub: "user123",
scopes: ["read"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
scopes: ["read"],
};
const writeContext: AuthenticatedContext = {
authenticated: true,
claims: {
sub: "user123",
scopes: ["write"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
scopes: ["write"],
};
const customScopeContext: AuthenticatedContext = {
authenticated: true,
claims: {
sub: "user123",
scopes: ["db:production", "schema:public"],
exp: Date.now() / 1000 + 3600,
iat: Date.now() / 1000,
},
scopes: ["db:production", "schema:public"],
};
it("should map tool scope names to OAuth scopes", () => {
expect(() => requireToolScope(readContext, ["read"])).not.toThrow();
});
it("should throw for missing tool scopes", () => {
expect(() => requireToolScope(readContext, ["admin"])).toThrow(
InsufficientScopeError,
);
});
it("should throw TokenMissingError when not authenticated (line 153)", () => {
const unauthenticatedContext: AuthenticatedContext = {
authenticated: false,
scopes: [],
};
expect(() => requireToolScope(unauthenticatedContext, ["read"])).toThrow(
TokenMissingError,
);
});
it('should map "write" scope correctly (line 160)', () => {
expect(() => requireToolScope(writeContext, ["write"])).not.toThrow();
});
it("should pass custom/unknown scopes through unchanged (line 162)", () => {
expect(() =>
requireToolScope(customScopeContext, ["db:production"]),
).not.toThrow();
expect(() =>
requireToolScope(customScopeContext, ["schema:public"]),
).not.toThrow();
});
it("should throw for custom scopes not present", () => {
expect(() =>
requireToolScope(customScopeContext, ["db:staging"]),
).toThrow(InsufficientScopeError);
});
});
describe("formatOAuthError", () => {
it("should format TokenMissingError as 401", () => {
const error = new TokenMissingError();
const { status, body } = formatOAuthError(error);
expect(status).toBe(401);
expect(body).toHaveProperty("error", "invalid_token");
});
it("should format InvalidTokenError as 401", () => {
const error = new InvalidTokenError("Token is malformed");
const { status, body } = formatOAuthError(error);
expect(status).toBe(401);
expect(body).toHaveProperty("error", "invalid_token");
expect(body).toHaveProperty("error_description", "Token is malformed");
});
it("should format InsufficientScopeError as 403", () => {
const error = new InsufficientScopeError(["admin", "write"]);
const { status, body } = formatOAuthError(error);
expect(status).toBe(403);
expect(body).toHaveProperty("error", "insufficient_scope");
expect(body).toHaveProperty("scope", "admin write");
});
it("should format unknown errors as 500", () => {
const error = new Error("Something unexpected");
const { status, body } = formatOAuthError(error);
expect(status).toBe(500);
expect(body).toHaveProperty("error", "server_error");
});
});
});
