Tokens can be cached beyond the lifetime of the (http) transport. (#834)
This commit is contained in:
Manuel Naujoks
GitHub
parent
e6db415940
commit
820821fa0c
4 changed files with 538 additions and 373 deletions
|
|
@ -0,0 +1,280 @@
|
|||
using Microsoft.Extensions.DependencyInjection;
|
||||
using ModelContextProtocol.AspNetCore.Authentication;
|
||||
using ModelContextProtocol.Authentication;
|
||||
using ModelContextProtocol.Client;
|
||||
using System.Net;
|
||||
using System.Net.Http.Json;
|
||||
|
||||
namespace ModelContextProtocol.AspNetCore.Tests.OAuth;
|
||||
|
||||
/// <summary>
|
||||
/// Tests for MCP authentication when resource metadata is provided via events rather than static configuration.
|
||||
/// </summary>
|
||||
public class AuthEventTests : OAuthTestBase
|
||||
{
|
||||
public AuthEventTests(ITestOutputHelper outputHelper)
|
||||
: base(outputHelper, configureMcpMetadata: false)
|
||||
{
|
||||
Builder.Services.Configure<McpAuthenticationOptions>(McpAuthenticationDefaults.AuthenticationScheme, options =>
|
||||
{
|
||||
// Note: ResourceMetadata is NOT set here - it will be provided via events
|
||||
options.ResourceMetadata = null;
|
||||
|
||||
options.Events.OnResourceMetadataRequest = async context =>
|
||||
{
|
||||
// Dynamically provide the resource metadata
|
||||
context.ResourceMetadata = new ProtectedResourceMetadata
|
||||
{
|
||||
Resource = new Uri(McpServerUrl),
|
||||
AuthorizationServers = { new Uri(OAuthServerUrl) },
|
||||
ScopesSupported = ["mcp:tools"],
|
||||
};
|
||||
await Task.CompletedTask;
|
||||
};
|
||||
});
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CanAuthenticate_WithResourceMetadataFromEvent()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(
|
||||
new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
},
|
||||
},
|
||||
HttpClient,
|
||||
LoggerFactory
|
||||
);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(
|
||||
transport,
|
||||
loggerFactory: LoggerFactory,
|
||||
cancellationToken: TestContext.Current.CancellationToken
|
||||
);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CanAuthenticate_WithDynamicClientRegistration_FromEvent()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
DynamicClientRegistrationResponse? dcrResponse = null;
|
||||
|
||||
await using var transport = new HttpClientTransport(
|
||||
new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new ClientOAuthOptions()
|
||||
{
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
Scopes = ["mcp:tools"],
|
||||
DynamicClientRegistration = new()
|
||||
{
|
||||
ClientName = "Test MCP Client",
|
||||
ClientUri = new Uri("https://example.com"),
|
||||
ResponseDelegate = (response, cancellationToken) =>
|
||||
{
|
||||
dcrResponse = response;
|
||||
return Task.CompletedTask;
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
HttpClient,
|
||||
LoggerFactory
|
||||
);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(
|
||||
transport,
|
||||
loggerFactory: LoggerFactory,
|
||||
cancellationToken: TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
Assert.NotNull(dcrResponse);
|
||||
Assert.False(string.IsNullOrEmpty(dcrResponse.ClientId));
|
||||
Assert.False(string.IsNullOrEmpty(dcrResponse.ClientSecret));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ResourceMetadataEndpoint_ReturnsCorrectMetadata_FromEvent()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
// Make a direct request to the resource metadata endpoint
|
||||
using var response = await HttpClient.GetAsync(
|
||||
"/.well-known/oauth-protected-resource",
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
||||
|
||||
var metadata = await response.Content.ReadFromJsonAsync<ProtectedResourceMetadata>(
|
||||
McpJsonUtilities.DefaultOptions,
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
Assert.NotNull(metadata);
|
||||
Assert.Equal(new Uri(McpServerUrl), metadata.Resource);
|
||||
Assert.Contains(new Uri(OAuthServerUrl), metadata.AuthorizationServers);
|
||||
Assert.Contains("mcp:tools", metadata.ScopesSupported);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ResourceMetadataEndpoint_CanModifyExistingMetadata_InEvent()
|
||||
{
|
||||
// Override the configuration to test modification of existing metadata
|
||||
Builder.Services.Configure<McpAuthenticationOptions>(
|
||||
McpAuthenticationDefaults.AuthenticationScheme,
|
||||
options =>
|
||||
{
|
||||
// Set initial metadata
|
||||
options.ResourceMetadata = new ProtectedResourceMetadata
|
||||
{
|
||||
Resource = new Uri(McpServerUrl),
|
||||
AuthorizationServers = { new Uri(OAuthServerUrl) },
|
||||
ScopesSupported = ["mcp:basic"],
|
||||
};
|
||||
|
||||
// Override the event to modify the metadata
|
||||
options.Events.OnResourceMetadataRequest = async context =>
|
||||
{
|
||||
// Start with the existing metadata and modify it
|
||||
if (context.ResourceMetadata != null)
|
||||
{
|
||||
context.ResourceMetadata.ScopesSupported.Add("mcp:tools");
|
||||
context.ResourceMetadata.ResourceName = "Dynamic Test Resource";
|
||||
}
|
||||
await Task.CompletedTask;
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
// Make a direct request to the resource metadata endpoint
|
||||
using var response = await HttpClient.GetAsync(
|
||||
"/.well-known/oauth-protected-resource",
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
||||
|
||||
var metadata = await response.Content.ReadFromJsonAsync<ProtectedResourceMetadata>(
|
||||
McpJsonUtilities.DefaultOptions,
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
Assert.NotNull(metadata);
|
||||
Assert.Equal(new Uri(McpServerUrl), metadata.Resource);
|
||||
Assert.Contains(new Uri(OAuthServerUrl), metadata.AuthorizationServers);
|
||||
Assert.Contains("mcp:basic", metadata.ScopesSupported);
|
||||
Assert.Contains("mcp:tools", metadata.ScopesSupported);
|
||||
Assert.Equal("Dynamic Test Resource", metadata.ResourceName);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ResourceMetadataEndpoint_ThrowsException_WhenNoMetadataProvided()
|
||||
{
|
||||
// Override the configuration to test the error case where no metadata is provided
|
||||
Builder.Services.Configure<McpAuthenticationOptions>(
|
||||
McpAuthenticationDefaults.AuthenticationScheme,
|
||||
options =>
|
||||
{
|
||||
// Don't set ResourceMetadata and provide an event that doesn't set it either
|
||||
options.Events.OnResourceMetadataRequest = async context =>
|
||||
{
|
||||
// Intentionally don't set context.ResourceMetadata to test error handling
|
||||
await Task.CompletedTask;
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
// Make a direct request to the resource metadata endpoint - this should fail
|
||||
using var response = await HttpClient.GetAsync(
|
||||
"/.well-known/oauth-protected-resource",
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
// The request should fail with an internal server error due to the InvalidOperationException
|
||||
Assert.Equal(HttpStatusCode.InternalServerError, response.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ResourceMetadataEndpoint_HandlesResponse_WhenHandleResponseCalled()
|
||||
{
|
||||
// Override the configuration to test HandleResponse behavior
|
||||
Builder.Services.Configure<McpAuthenticationOptions>(
|
||||
McpAuthenticationDefaults.AuthenticationScheme,
|
||||
options =>
|
||||
{
|
||||
options.Events.OnResourceMetadataRequest = async context =>
|
||||
{
|
||||
// Call HandleResponse() to discontinue processing and return to client
|
||||
context.HandleResponse();
|
||||
await Task.CompletedTask;
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
// Make a direct request to the resource metadata endpoint
|
||||
using var response = await HttpClient.GetAsync(
|
||||
"/.well-known/oauth-protected-resource",
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
// The request should be handled by the event handler without returning metadata
|
||||
// Since HandleResponse() was called, the handler should have taken responsibility
|
||||
// for generating the response, which in this case means an empty response
|
||||
Assert.Equal(HttpStatusCode.OK, response.StatusCode);
|
||||
|
||||
// The response should be empty since the event handler called HandleResponse()
|
||||
// but didn't write any content to the response
|
||||
var content = await response.Content.ReadAsStringAsync(TestContext.Current.CancellationToken);
|
||||
Assert.Empty(content);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ResourceMetadataEndpoint_SkipsHandler_WhenSkipHandlerCalled()
|
||||
{
|
||||
// Override the configuration to test SkipHandler behavior
|
||||
Builder.Services.Configure<McpAuthenticationOptions>(
|
||||
McpAuthenticationDefaults.AuthenticationScheme,
|
||||
options =>
|
||||
{
|
||||
options.Events.OnResourceMetadataRequest = async context =>
|
||||
{
|
||||
// Call SkipHandler() to discontinue processing in the current handler
|
||||
context.SkipHandler();
|
||||
await Task.CompletedTask;
|
||||
};
|
||||
}
|
||||
);
|
||||
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
// Make a direct request to the resource metadata endpoint
|
||||
using var response = await HttpClient.GetAsync(
|
||||
"/.well-known/oauth-protected-resource",
|
||||
TestContext.Current.CancellationToken
|
||||
);
|
||||
|
||||
// When SkipHandler() is called, the authentication handler should skip processing
|
||||
// and let other handlers in the pipeline handle the request. Since there are no
|
||||
// other handlers configured for this endpoint, this should result in a 404
|
||||
Assert.Equal(HttpStatusCode.NotFound, response.StatusCode);
|
||||
}
|
||||
}
|
||||
285
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/AuthTests.cs
Normal file
285
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/AuthTests.cs
Normal file
|
|
@ -0,0 +1,285 @@
|
|||
using ModelContextProtocol.AspNetCore.Authentication;
|
||||
using ModelContextProtocol.Authentication;
|
||||
using ModelContextProtocol.Client;
|
||||
using System.Net;
|
||||
using System.Reflection;
|
||||
using Xunit.Sdk;
|
||||
|
||||
namespace ModelContextProtocol.AspNetCore.Tests.OAuth;
|
||||
|
||||
public class AuthTests : OAuthTestBase
|
||||
{
|
||||
public AuthTests(ITestOutputHelper outputHelper)
|
||||
: base(outputHelper)
|
||||
{
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CanAuthenticate()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CannotAuthenticate_WithoutOAuthConfiguration()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
var httpEx = await Assert.ThrowsAsync<HttpRequestException>(async () => await McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken));
|
||||
|
||||
Assert.Equal(HttpStatusCode.Unauthorized, httpEx.StatusCode);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CannotAuthenticate_WithUnregisteredClient()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "unregistered-demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
// The EqualException is thrown by HandleAuthorizationUrlAsync when the /authorize request gets a 400
|
||||
var equalEx = await Assert.ThrowsAsync<EqualException>(async () => await McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CanAuthenticate_WithDynamicClientRegistration()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new ClientOAuthOptions()
|
||||
{
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
Scopes = ["mcp:tools"],
|
||||
DynamicClientRegistration = new()
|
||||
{
|
||||
ClientName = "Test MCP Client",
|
||||
ClientUri = new Uri("https://example.com"),
|
||||
},
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CanAuthenticate_WithTokenRefresh()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "test-refresh-client",
|
||||
ClientSecret = "test-refresh-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
// The test-refresh-client should get an expired token first,
|
||||
// then automatically refresh it to get a working token
|
||||
await using var client = await McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.True(TestOAuthServer.HasRefreshedToken);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CanAuthenticate_WithExtraParams()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
Uri? lastAuthorizationUri = null;
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = (uri, redirect, ct) =>
|
||||
{
|
||||
lastAuthorizationUri = uri;
|
||||
return HandleAuthorizationUrlAsync(uri, redirect, ct);
|
||||
},
|
||||
AdditionalAuthorizationParameters = new Dictionary<string, string>
|
||||
{
|
||||
["custom_param"] = "custom_value",
|
||||
}
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.NotNull(lastAuthorizationUri?.Query);
|
||||
Assert.Contains("custom_param=custom_value", lastAuthorizationUri?.Query);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task CannotOverrideExistingParameters_WithExtraParams()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
AdditionalAuthorizationParameters = new Dictionary<string, string>
|
||||
{
|
||||
["redirect_uri"] = "custom_value",
|
||||
}
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await Assert.ThrowsAsync<ArgumentException>(() => McpClient.CreateAsync(
|
||||
transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void CloneResourceMetadataClonesAllProperties()
|
||||
{
|
||||
var propertyNames = typeof(ProtectedResourceMetadata).GetProperties().Select(property => property.Name).ToList();
|
||||
|
||||
// Set metadata properties to non-default values to verify they're copied.
|
||||
var metadata = new ProtectedResourceMetadata
|
||||
{
|
||||
Resource = new Uri("https://example.com/resource"),
|
||||
AuthorizationServers = [new Uri("https://auth1.example.com"), new Uri("https://auth2.example.com")],
|
||||
BearerMethodsSupported = ["header", "body", "query"],
|
||||
ScopesSupported = ["read", "write", "admin"],
|
||||
JwksUri = new Uri("https://example.com/.well-known/jwks.json"),
|
||||
ResourceSigningAlgValuesSupported = ["RS256", "ES256"],
|
||||
ResourceName = "Test Resource",
|
||||
ResourceDocumentation = new Uri("https://docs.example.com"),
|
||||
ResourcePolicyUri = new Uri("https://example.com/policy"),
|
||||
ResourceTosUri = new Uri("https://example.com/terms"),
|
||||
TlsClientCertificateBoundAccessTokens = true,
|
||||
AuthorizationDetailsTypesSupported = ["payment_initiation", "account_information"],
|
||||
DpopSigningAlgValuesSupported = ["RS256", "PS256"],
|
||||
DpopBoundAccessTokensRequired = true
|
||||
};
|
||||
|
||||
// Use reflection to call the internal CloneResourceMetadata method
|
||||
var handlerType = typeof(McpAuthenticationHandler);
|
||||
var cloneMethod = handlerType.GetMethod("CloneResourceMetadata", BindingFlags.Static | BindingFlags.NonPublic);
|
||||
Assert.NotNull(cloneMethod);
|
||||
|
||||
var clonedMetadata = (ProtectedResourceMetadata?)cloneMethod.Invoke(null, [metadata]);
|
||||
Assert.NotNull(clonedMetadata);
|
||||
|
||||
// Ensure the cloned metadata is not the same instance
|
||||
Assert.NotSame(metadata, clonedMetadata);
|
||||
|
||||
// Verify Resource property
|
||||
Assert.Equal(metadata.Resource, clonedMetadata.Resource);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.Resource)));
|
||||
|
||||
// Verify AuthorizationServers list is cloned and contains the same values
|
||||
Assert.NotSame(metadata.AuthorizationServers, clonedMetadata.AuthorizationServers);
|
||||
Assert.Equal(metadata.AuthorizationServers, clonedMetadata.AuthorizationServers);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.AuthorizationServers)));
|
||||
|
||||
// Verify BearerMethodsSupported list is cloned and contains the same values
|
||||
Assert.NotSame(metadata.BearerMethodsSupported, clonedMetadata.BearerMethodsSupported);
|
||||
Assert.Equal(metadata.BearerMethodsSupported, clonedMetadata.BearerMethodsSupported);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.BearerMethodsSupported)));
|
||||
|
||||
// Verify ScopesSupported list is cloned and contains the same values
|
||||
Assert.NotSame(metadata.ScopesSupported, clonedMetadata.ScopesSupported);
|
||||
Assert.Equal(metadata.ScopesSupported, clonedMetadata.ScopesSupported);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.ScopesSupported)));
|
||||
|
||||
// Verify JwksUri property
|
||||
Assert.Equal(metadata.JwksUri, clonedMetadata.JwksUri);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.JwksUri)));
|
||||
|
||||
// Verify ResourceSigningAlgValuesSupported list is cloned (nullable list)
|
||||
Assert.NotSame(metadata.ResourceSigningAlgValuesSupported, clonedMetadata.ResourceSigningAlgValuesSupported);
|
||||
Assert.Equal(metadata.ResourceSigningAlgValuesSupported, clonedMetadata.ResourceSigningAlgValuesSupported);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.ResourceSigningAlgValuesSupported)));
|
||||
|
||||
// Verify ResourceName property
|
||||
Assert.Equal(metadata.ResourceName, clonedMetadata.ResourceName);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.ResourceName)));
|
||||
|
||||
// Verify ResourceDocumentation property
|
||||
Assert.Equal(metadata.ResourceDocumentation, clonedMetadata.ResourceDocumentation);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.ResourceDocumentation)));
|
||||
|
||||
// Verify ResourcePolicyUri property
|
||||
Assert.Equal(metadata.ResourcePolicyUri, clonedMetadata.ResourcePolicyUri);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.ResourcePolicyUri)));
|
||||
|
||||
// Verify ResourceTosUri property
|
||||
Assert.Equal(metadata.ResourceTosUri, clonedMetadata.ResourceTosUri);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.ResourceTosUri)));
|
||||
|
||||
// Verify TlsClientCertificateBoundAccessTokens property
|
||||
Assert.Equal(metadata.TlsClientCertificateBoundAccessTokens, clonedMetadata.TlsClientCertificateBoundAccessTokens);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.TlsClientCertificateBoundAccessTokens)));
|
||||
|
||||
// Verify AuthorizationDetailsTypesSupported list is cloned (nullable list)
|
||||
Assert.NotSame(metadata.AuthorizationDetailsTypesSupported, clonedMetadata.AuthorizationDetailsTypesSupported);
|
||||
Assert.Equal(metadata.AuthorizationDetailsTypesSupported, clonedMetadata.AuthorizationDetailsTypesSupported);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.AuthorizationDetailsTypesSupported)));
|
||||
|
||||
// Verify DpopSigningAlgValuesSupported list is cloned (nullable list)
|
||||
Assert.NotSame(metadata.DpopSigningAlgValuesSupported, clonedMetadata.DpopSigningAlgValuesSupported);
|
||||
Assert.Equal(metadata.DpopSigningAlgValuesSupported, clonedMetadata.DpopSigningAlgValuesSupported);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.DpopSigningAlgValuesSupported)));
|
||||
|
||||
// Verify DpopBoundAccessTokensRequired property
|
||||
Assert.Equal(metadata.DpopBoundAccessTokensRequired, clonedMetadata.DpopBoundAccessTokensRequired);
|
||||
Assert.True(propertyNames.Remove(nameof(metadata.DpopBoundAccessTokensRequired)));
|
||||
|
||||
// Ensure we've checked every property. When new properties get added, we'll have to update this test along with the CloneResourceMetadata implementation.
|
||||
Assert.Empty(propertyNames);
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
using Microsoft.AspNetCore.Authentication.JwtBearer;
|
||||
using Microsoft.AspNetCore.Builder;
|
||||
using Microsoft.AspNetCore.WebUtilities;
|
||||
using Microsoft.Extensions.DependencyInjection;
|
||||
using Microsoft.IdentityModel.Tokens;
|
||||
using ModelContextProtocol.AspNetCore.Authentication;
|
||||
using ModelContextProtocol.AspNetCore.Tests.Utils;
|
||||
using ModelContextProtocol.Authentication;
|
||||
using System.Net;
|
||||
using Xunit.Sdk;
|
||||
|
||||
namespace ModelContextProtocol.AspNetCore.Tests.OAuth;
|
||||
|
||||
public abstract class OAuthTestBase : KestrelInMemoryTest, IAsyncDisposable
|
||||
{
|
||||
protected const string McpServerUrl = "http://localhost:5000";
|
||||
protected const string OAuthServerUrl = "https://localhost:7029";
|
||||
|
||||
protected readonly CancellationTokenSource TestCts = new();
|
||||
protected readonly TestOAuthServer.Program TestOAuthServer;
|
||||
private readonly Task _testOAuthRunTask;
|
||||
|
||||
protected OAuthTestBase(ITestOutputHelper outputHelper, bool configureMcpMetadata = true)
|
||||
: base(outputHelper)
|
||||
{
|
||||
// Let the HandleAuthorizationUrlAsync take a look at the Location header
|
||||
SocketsHttpHandler.AllowAutoRedirect = false;
|
||||
// The dev cert may not be installed on the CI, but AddJwtBearer requires an HTTPS backchannel by default.
|
||||
// The easiest workaround is to disable cert validation for testing purposes.
|
||||
SocketsHttpHandler.SslOptions.RemoteCertificateValidationCallback = (_, _, _, _) => true;
|
||||
|
||||
TestOAuthServer = new TestOAuthServer.Program(XunitLoggerProvider, KestrelInMemoryTransport);
|
||||
_testOAuthRunTask = TestOAuthServer.RunServerAsync(cancellationToken: TestCts.Token);
|
||||
|
||||
Builder.Services.AddAuthentication(options =>
|
||||
{
|
||||
options.DefaultChallengeScheme = McpAuthenticationDefaults.AuthenticationScheme;
|
||||
options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
|
||||
})
|
||||
.AddJwtBearer(options =>
|
||||
{
|
||||
options.Backchannel = HttpClient;
|
||||
options.Authority = OAuthServerUrl;
|
||||
options.TokenValidationParameters = new TokenValidationParameters
|
||||
{
|
||||
ValidAudience = McpServerUrl,
|
||||
ValidIssuer = OAuthServerUrl,
|
||||
NameClaimType = "name",
|
||||
RoleClaimType = "roles"
|
||||
};
|
||||
})
|
||||
.AddMcp(options =>
|
||||
{
|
||||
if (configureMcpMetadata)
|
||||
{
|
||||
options.ResourceMetadata = new ProtectedResourceMetadata
|
||||
{
|
||||
Resource = new Uri(McpServerUrl),
|
||||
AuthorizationServers = { new Uri(OAuthServerUrl) },
|
||||
ScopesSupported = ["mcp:tools"]
|
||||
};
|
||||
}
|
||||
});
|
||||
|
||||
Builder.Services.AddAuthorization();
|
||||
Builder.Services.AddMcpServer().WithHttpTransport();
|
||||
}
|
||||
|
||||
public async ValueTask DisposeAsync()
|
||||
{
|
||||
TestCts.Cancel();
|
||||
try
|
||||
{
|
||||
await _testOAuthRunTask;
|
||||
}
|
||||
catch (OperationCanceledException)
|
||||
{
|
||||
}
|
||||
finally
|
||||
{
|
||||
TestCts.Dispose();
|
||||
}
|
||||
}
|
||||
|
||||
protected async Task<WebApplication> StartMcpServerAsync()
|
||||
{
|
||||
var app = Builder.Build();
|
||||
app.MapMcp().RequireAuthorization();
|
||||
await app.StartAsync(TestContext.Current.CancellationToken);
|
||||
return app;
|
||||
}
|
||||
|
||||
protected async Task<string?> HandleAuthorizationUrlAsync(Uri authorizationUri, Uri redirectUri, CancellationToken cancellationToken)
|
||||
{
|
||||
using var redirectResponse = await HttpClient.GetAsync(authorizationUri, cancellationToken);
|
||||
Assert.Equal(HttpStatusCode.Redirect, redirectResponse.StatusCode);
|
||||
var location = redirectResponse.Headers.Location;
|
||||
|
||||
if (location is not null && !string.IsNullOrEmpty(location.Query))
|
||||
{
|
||||
var queryParams = QueryHelpers.ParseQuery(location.Query);
|
||||
return queryParams["code"];
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,215 @@
|
|||
using ModelContextProtocol.Authentication;
|
||||
using ModelContextProtocol.Client;
|
||||
|
||||
namespace ModelContextProtocol.AspNetCore.Tests.OAuth;
|
||||
|
||||
public class TokenCacheTests : OAuthTestBase
|
||||
{
|
||||
public TokenCacheTests(ITestOutputHelper outputHelper)
|
||||
: base(outputHelper)
|
||||
{
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task GetTokenAsync_CachedAccessTokenIsUsedForOutgoingRequests()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
var tokenCache = new TestTokenCache();
|
||||
bool authDelegateCalledInitially = false;
|
||||
|
||||
await using var setupTransport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = (uri, redirect, ct) =>
|
||||
{
|
||||
authDelegateCalledInitially = true;
|
||||
return HandleAuthorizationUrlAsync(uri, redirect, ct);
|
||||
},
|
||||
TokenCache = tokenCache,
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using (var setupClient = await McpClient.CreateAsync(setupTransport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken))
|
||||
{
|
||||
// Just connecting should trigger auth and storage.
|
||||
}
|
||||
|
||||
Assert.True(authDelegateCalledInitially, "AuthorizationRedirectDelegate should be called to get initial token");
|
||||
Assert.NotNull(tokenCache.LastStoredToken);
|
||||
|
||||
var authDelegateCalledAgain = false;
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = (uri, redirect, ct) =>
|
||||
{
|
||||
authDelegateCalledAgain = true;
|
||||
return HandleAuthorizationUrlAsync(uri, redirect, ct);
|
||||
},
|
||||
TokenCache = tokenCache
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.False(authDelegateCalledAgain, "AuthorizationRedirectDelegate should not be called when token is valid");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task StoreTokenAsync_NewlyAcquiredAccessTokenIsCached()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
var tokenCache = new TestTokenCache();
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = HandleAuthorizationUrlAsync,
|
||||
TokenCache = tokenCache
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.NotNull(tokenCache.LastStoredToken);
|
||||
Assert.False(string.IsNullOrEmpty(tokenCache.LastStoredToken.AccessToken));
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task GetTokenAsync_InvalidCachedTokenTriggersAuthDelegate()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
var tokenCache = new TestTokenCache(CreateInvalidToken());
|
||||
bool authDelegateCalled = false;
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = (uri, redirect, ct) =>
|
||||
{
|
||||
authDelegateCalled = true;
|
||||
return HandleAuthorizationUrlAsync(uri, redirect, ct);
|
||||
},
|
||||
TokenCache = tokenCache,
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.True(authDelegateCalled, "AuthorizationRedirectDelegate should be called when cached token is invalid");
|
||||
Assert.NotNull(tokenCache.LastStoredToken);
|
||||
Assert.NotEqual("invalid-token", tokenCache.LastStoredToken.AccessToken);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task GetTokenAsync_InvalidAccessTokenTriggersRefresh()
|
||||
{
|
||||
await using var app = await StartMcpServerAsync();
|
||||
|
||||
var tokenCache = new TestTokenCache();
|
||||
bool authDelegateCalledInitially = false;
|
||||
|
||||
await using var setupTransport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = (uri, redirect, ct) =>
|
||||
{
|
||||
authDelegateCalledInitially = true;
|
||||
return HandleAuthorizationUrlAsync(uri, redirect, ct);
|
||||
},
|
||||
TokenCache = tokenCache,
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using (var setupClient = await McpClient.CreateAsync(setupTransport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken))
|
||||
{
|
||||
// Just connecting should trigger auth and storage.
|
||||
}
|
||||
|
||||
Assert.True(authDelegateCalledInitially, "AuthorizationRedirectDelegate should be called to get initial token");
|
||||
Assert.False(TestOAuthServer.HasRefreshedToken, "Token should not have been refreshed yet");
|
||||
Assert.NotNull(tokenCache.LastStoredToken);
|
||||
|
||||
// Invalidate the access token but keep the refresh token valid (if any)
|
||||
tokenCache.LastStoredToken.AccessToken = "invalid-token";
|
||||
var authDelegateCalledAgain = false;
|
||||
|
||||
await using var transport = new HttpClientTransport(new()
|
||||
{
|
||||
Endpoint = new(McpServerUrl),
|
||||
OAuth = new()
|
||||
{
|
||||
ClientId = "demo-client",
|
||||
ClientSecret = "demo-secret",
|
||||
RedirectUri = new Uri("http://localhost:1179/callback"),
|
||||
AuthorizationRedirectDelegate = (uri, redirect, ct) =>
|
||||
{
|
||||
authDelegateCalledAgain = true;
|
||||
return HandleAuthorizationUrlAsync(uri, redirect, ct);
|
||||
},
|
||||
TokenCache = tokenCache
|
||||
},
|
||||
}, HttpClient, LoggerFactory);
|
||||
|
||||
await using var client = await McpClient.CreateAsync(transport, loggerFactory: LoggerFactory, cancellationToken: TestContext.Current.CancellationToken);
|
||||
|
||||
Assert.False(authDelegateCalledAgain, "AuthorizationRedirectDelegate should not be called when refresh token is valid");
|
||||
Assert.True(TestOAuthServer.HasRefreshedToken, "Token should have been refreshed");
|
||||
Assert.NotEqual("invalid-token", tokenCache.LastStoredToken.AccessToken);
|
||||
}
|
||||
|
||||
private TokenContainer CreateInvalidToken()
|
||||
{
|
||||
return new TokenContainer
|
||||
{
|
||||
TokenType = "Bearer",
|
||||
AccessToken = "invalid-token",
|
||||
ObtainedAt = DateTimeOffset.UtcNow,
|
||||
};
|
||||
}
|
||||
|
||||
private class TestTokenCache(TokenContainer? initialToken = null) : ITokenCache
|
||||
{
|
||||
public TokenContainer? LastStoredToken { get; private set; } = initialToken;
|
||||
|
||||
public ValueTask<TokenContainer?> GetTokensAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
return new ValueTask<TokenContainer?>(LastStoredToken);
|
||||
}
|
||||
|
||||
public ValueTask StoreTokensAsync(TokenContainer tokens, CancellationToken cancellationToken)
|
||||
{
|
||||
LastStoredToken = tokens;
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue