modelcontextprotocol/inspector
Watch
1
0
Fork
You've already forked inspector
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

test: switch integration project to folder-based manifest (#1314) (#1318)

Browse source 
* test: switch integration project to folder-based manifest (#1314)

Replace the `integrationTests` enumeration in vite.config.ts with a
folder glob (`src/test/integration/**/*.test.ts`). Files under that
folder run in the integration vitest project (node env, 30s timeouts);
everything else runs in the unit project (happy-dom).

This removes the silent misclassification trap from #1307: a new
integration-style test no longer falls into the unit project (and
happy-dom) just because someone forgot to add it to the array.

The 13 ported v1.5 tests + their helpers move under src/test/integration/
in a strict mirror of core/ source layout (mcp/, auth/, auth/node/,
storage/). Renames use git mv so history is preserved.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test: address PR review on #1318 (glob extensions + AGENTS doc)

- vite.config.ts: widen integrationGlob from `*.test.ts` to
  `*.test.{ts,tsx}` so the integration folder fully owns its contents.
  Without this, a `.test.tsx` placed under src/test/integration/ would
  match the unit project's `{ts,tsx}` include, fail the unit `.ts`-only
  exclude, and silently land under happy-dom — the exact misclassification
  trap this PR set out to close.
- AGENTS.md: update the line describing where integration tests live;
  it still pointed at the old `src/test/core/` location and the removed
  `integrationTests` enumeration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall 2026-05-18 11:54:49 -04:00 • committed by GitHub
commit 8bb389c8e3
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 18 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

553
clients/web/src/test/core/inspectorClient-oauth.test.ts
View file

@ -1,553 +0,0 @@
import {
describe,
it,
expect,
beforeEach,
afterEach,
afterAll,
vi,
} from "vitest";
import * as path from "node:path";
import * as os from "node:os";
import * as fs from "node:fs/promises";
import { InspectorClient } from "@inspector/core/mcp/inspectorClient.js";
import { FetchRequestLogState } from "@inspector/core/mcp/state/index.js";
import { createTransportNode } from "@inspector/core/mcp/node/transport.js";
import type { MCPServerConfig } from "@inspector/core/mcp/types.js";
import { NodeOAuthStorage } from "@inspector/core/auth/node/storage-node.js";
import {
TestServerHttp,
waitForEvent,
getDefaultServerConfig,
createOAuthTestServerConfig,
clearOAuthTestData,
} from "@modelcontextprotocol/inspector-test-server";
import {
createOAuthClientConfig,
completeOAuthAuthorization,
} from "./helpers/oauth-client-fixtures.js";
import type { InspectorClientOptions } from "@inspector/core/mcp/inspectorClient.js";
const oauthTestStatePath = path.join(
os.tmpdir(),
`mcp-oauth-${process.pid}-inspectorClient-oauth.json`,
);
function createTestOAuthConfig(
options: Parameters<typeof createOAuthClientConfig>[0],
) {
return {
...createOAuthClientConfig(options),
storage: new NodeOAuthStorage(oauthTestStatePath),
};
}
describe("InspectorClient OAuth", () => {
let client: InspectorClient;
afterAll(async () => {
try {
await fs.unlink(oauthTestStatePath);
} catch {
// Ignore if file does not exist or already removed
}
});
beforeEach(() => {
vi.spyOn(console, "log").mockImplementation(() => {});
// Create client with HTTP transport (OAuth only works with HTTP transports)
const config: MCPServerConfig = {
type: "sse",
url: "http://localhost:3000/sse",
};
client = new InspectorClient(config, {
environment: { transport: createTransportNode },
});
});
afterEach(async () => {
if (client) {
try {
await client.disconnect();
} catch {
// Ignore disconnect errors
}
}
vi.restoreAllMocks();
});
describe("OAuth Configuration", () => {
it("should set OAuth configuration", () => {
const oauthConfig = createTestOAuthConfig({
mode: "static",
clientId: "test-client-id",
clientSecret: "test-secret",
redirectUrl: "http://localhost:3000/callback",
scope: "read write",
});
client = new InspectorClient(
{ type: "sse", url: "http://localhost:3000/sse" },
{
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
},
);
// Configuration should be set (no error thrown)
expect(client).toBeDefined();
});
it("should set OAuth configuration with clientMetadataUrl for CIMD", () => {
const oauthConfig = createTestOAuthConfig({
mode: "cimd",
clientMetadataUrl: "https://example.com/client-metadata.json",
redirectUrl: "http://localhost:3000/callback",
scope: "read write",
});
client = new InspectorClient(
{ type: "sse", url: "http://localhost:3000/sse" },
{
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
},
);
expect(client).toBeDefined();
});
});
describe("OAuth Token Management", () => {
beforeEach(() => {
const oauthConfig = createTestOAuthConfig({
mode: "static",
clientId: "test-client-id",
redirectUrl: "http://localhost:3000/callback",
});
client = new InspectorClient(
{ type: "sse", url: "http://localhost:3000/sse" },
{
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
},
);
});
it("should return undefined tokens when not authorized", async () => {
const tokens = await client.getOAuthTokens();
expect(tokens).toBeUndefined();
});
it("should clear OAuth tokens", () => {
client.clearOAuthTokens();
// Should not throw
expect(client).toBeDefined();
});
it("should return false for isOAuthAuthorized when not authorized", async () => {
const isAuthorized = await client.isOAuthAuthorized();
expect(isAuthorized).toBe(false);
});
});
describe("OAuth fetch tracking", () => {
let testServer: TestServerHttp;
const testRedirectUrl = "http://localhost:3001/oauth/callback";
beforeEach(() => {
clearOAuthTestData();
});
afterEach(async () => {
if (testServer) {
await testServer.stop();
}
});
it("should track auth fetches with category 'auth' during guided auth", async () => {
const staticClientId = "test-auth-fetch-client";
const staticClientSecret = "test-auth-fetch-secret";
const serverConfig = {
...getDefaultServerConfig(),
serverType: "sse" as const,
...createOAuthTestServerConfig({
requireAuth: false,
supportDCR: true,
staticClients: [
{
clientId: staticClientId,
clientSecret: staticClientSecret,
redirectUris: [testRedirectUrl],
},
],
}),
};
testServer = new TestServerHttp(serverConfig);
const port = await testServer.start();
const serverUrl = `http://localhost:${port}`;
const oauthConfig = createTestOAuthConfig({
mode: "static",
clientId: staticClientId,
clientSecret: staticClientSecret,
redirectUrl: testRedirectUrl,
});
const testClient = new InspectorClient(
{
type: "sse",
url: `${serverUrl}/sse`,
} as MCPServerConfig,
{
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
},
);
const fetchRequestLogState = new FetchRequestLogState(testClient);
// beginGuidedAuth runs metadata_discovery, client_registration, authorization_redirect
// (stops at authorization_code awaiting user). Produces auth fetches only (no connect yet).
await testClient.beginGuidedAuth();
const fetchRequests = fetchRequestLogState.getFetchRequests();
const authFetches = fetchRequests.filter(
(req) => req.category === "auth",
);
expect(authFetches.length).toBeGreaterThan(0);
const hasOAuthUrls = authFetches.some(
(req) =>
req.url.includes("well-known") ||
req.url.includes("/oauth/") ||
req.url.includes("token"),
);
expect(hasOAuthUrls).toBe(true);
fetchRequestLogState.destroy();
await testClient.disconnect();
});
});
describe("OAuth Events", () => {
let testServer: TestServerHttp;
const testRedirectUrl = "http://localhost:3001/oauth/callback";
beforeEach(() => {
clearOAuthTestData();
});
afterEach(async () => {
if (testServer) {
await testServer.stop();
}
});
it("should dispatch oauthAuthorizationRequired event", async () => {
const staticClientId = "test-event-client";
const staticClientSecret = "test-event-secret";
// Create test server with OAuth enabled and DCR support (for authenticate() normal mode)
const serverConfig = {
...getDefaultServerConfig(),
serverType: "sse" as const,
...createOAuthTestServerConfig({
requireAuth: false, // Don't require auth for this test
supportDCR: true, // Enable DCR so authenticate() can work
staticClients: [
{
clientId: staticClientId,
clientSecret: staticClientSecret,
redirectUris: [testRedirectUrl],
},
],
}),
};
testServer = new TestServerHttp(serverConfig);
const port = await testServer.start();
const serverUrl = `http://localhost:${port}`;
// Create client with OAuth config pointing to test server
const oauthConfig = createTestOAuthConfig({
mode: "static",
clientId: staticClientId,
clientSecret: staticClientSecret,
redirectUrl: testRedirectUrl,
});
const clientConfig: InspectorClientOptions = {
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
};
const testClient = new InspectorClient(
{
type: "sse",
url: `${serverUrl}/sse`,
} as MCPServerConfig,
clientConfig,
);
testClient.authenticate().catch(() => {});
const detail = await waitForEvent<{ url: URL }>(
testClient,
"oauthAuthorizationRequired",
{ timeout: 5000 },
);
expect(detail).toHaveProperty("url");
expect(detail.url).toBeInstanceOf(URL);
expect(detail.url.href).toContain("/oauth/authorize");
await testClient.disconnect();
});
it("should dispatch oauthError event when OAuth flow fails", async () => {
// Create a minimal test server just for metadata discovery
const serverConfig = {
...getDefaultServerConfig(),
serverType: "sse" as const,
...createOAuthTestServerConfig({
requireAuth: false,
supportDCR: true,
}),
};
testServer = new TestServerHttp(serverConfig);
const port = await testServer.start();
const serverUrl = `http://localhost:${port}`;
const oauthConfig = createTestOAuthConfig({
mode: "static",
clientId: "test-error-client",
clientSecret: "test-error-secret",
redirectUrl: testRedirectUrl,
});
const clientConfig: InspectorClientOptions = {
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
};
const testClient = new InspectorClient(
{
type: "sse",
url: `${serverUrl}/sse`,
} as MCPServerConfig,
clientConfig,
);
testClient.completeOAuthFlow("invalid-test-code").catch(() => {});
const detail = await waitForEvent<{ error: Error }>(
testClient,
"oauthError",
{
timeout: 3000,
},
);
expect(detail).toHaveProperty("error");
expect(detail.error).toBeInstanceOf(Error);
await testClient.disconnect();
});
});
describe("Token Injection in HTTP Transports", () => {
let testServer: TestServerHttp;
const testRedirectUrl = "http://localhost:3001/oauth/callback";
beforeEach(() => {
clearOAuthTestData();
});
afterEach(async () => {
if (testServer) {
await testServer.stop();
}
});
it("should inject Bearer token in HTTP requests when OAuth is configured", async () => {
const staticClientId = "test-token-injection-client";
const staticClientSecret = "test-token-injection-secret";
// Create test server with OAuth enabled and auth required
const serverConfig = {
...getDefaultServerConfig(),
serverType: "sse" as const,
...createOAuthTestServerConfig({
requireAuth: true,
supportDCR: true,
staticClients: [
{
clientId: staticClientId,
clientSecret: staticClientSecret,
redirectUris: [testRedirectUrl],
},
],
}),
};
testServer = new TestServerHttp(serverConfig);
const port = await testServer.start();
const serverUrl = `http://localhost:${port}`;
const oauthConfig = createTestOAuthConfig({
mode: "static",
clientId: staticClientId,
clientSecret: staticClientSecret,
redirectUrl: testRedirectUrl,
});
const clientConfig: InspectorClientOptions = {
environment: {
transport: createTransportNode,
oauth: {
storage: oauthConfig.storage,
navigation: oauthConfig.navigation,
redirectUrlProvider: oauthConfig.redirectUrlProvider,
},
},
oauth: {
clientId: oauthConfig.clientId,
clientSecret: oauthConfig.clientSecret,
clientMetadataUrl: oauthConfig.clientMetadataUrl,
scope: oauthConfig.scope,
},
};
const testClient = new InspectorClient(
{
type: "sse",
url: `${serverUrl}/sse`,
} as MCPServerConfig,
clientConfig,
);
const fetchRequestLogState = new FetchRequestLogState(testClient);
// Auth-provider flow: authenticate first, complete OAuth, then connect.
// connect() creates transport with authProvider; tokens are already in storage.
const authorizationUrl = await testClient.authenticate();
const authCode = await completeOAuthAuthorization(authorizationUrl);
await testClient.completeOAuthFlow(authCode);
await testClient.connect();
const tokens = await testClient.getOAuthTokens();
expect(tokens).toBeDefined();
expect(tokens?.access_token).toBeDefined();
// listTools() succeeds only if authProvider injects Bearer token
const toolsResult = await testClient.listTools();
expect(toolsResult).toBeDefined();
const fetchRequests = fetchRequestLogState.getFetchRequests();
expect(fetchRequests.length).toBeGreaterThan(0);
// Auth fetches (discovery, token exchange) should have category 'auth'
const authFetches = fetchRequests.filter(
(req) => req.category === "auth",
);
expect(authFetches.length).toBeGreaterThan(0);
const oauthFetches = authFetches.filter(
(req) =>
req.url.includes("well-known") ||
req.url.includes("/oauth/") ||
req.url.includes("/token"),
);
expect(oauthFetches.length).toBeGreaterThan(0);
// Transport fetches (SSE, MCP) should have category 'transport'
const transportFetches = fetchRequests.filter(
(req) => req.category === "transport",
);
expect(transportFetches.length).toBeGreaterThan(0);
const mcpPostRequests = transportFetches.filter(
(req) =>
req.method === "POST" &&
(req.url.includes("/sse") || req.url.includes("/mcp")) &&
!req.url.includes("/oauth"),
);
if (mcpPostRequests.length > 0) {
const hasAuthHeader = mcpPostRequests.some((req) => {
const authHeader =
req.requestHeaders?.["Authorization"] ||
req.requestHeaders?.["authorization"];
return authHeader && authHeader.startsWith("Bearer ");
});
if (hasAuthHeader) {
expect(hasAuthHeader).toBe(true);
}
}
await testClient.disconnect();
});
});
});