[Server] Oauth2 based on middleware (#221)

* Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware * Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address PR review feedback for OAuth middleware * Apply php-cs-fixer to satisfy QA * Use Mcp exception classes in OAuth middleware * Refactor OAuth HTTP stack and add Microsoft example policies * Fix QA PHPStan findings in OAuth examples and auth middleware * Require OIDC discovery in JWKS provider and refine OAuth proxy behavior * Remove local development docker artifacts from VCS * Revert .gitignore changes for local docker files * Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address OAuth PR review feedback and align example configs * Fix QA style issues and add authorization docs * Fix PHPStan typing issues in OAuth middleware * Remove duplicate Middleware namespace, consolidate under Http\Middleware Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces. * Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures --------- Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>
2026-03-10 17:10:07 +01:00 · 2026-03-10 17:10:07 +01:00 · e3f4b88768
commit e3f4b88768
parent 61c20f1450
1 changed files with 6038 additions and 0 deletions
--- a/tests/Unit/Server/Transport/Http/Middleware/OAuthProxyMiddlewareTest.php
+++ b/tests/Unit/Server/Transport/Http/Middleware/OAuthProxyMiddlewareTest.php
@ -0,0 +1,299 @@
+<?php
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Mcp\Tests\Unit\Server\Transport\Http\Middleware;
+
+use Mcp\Server\Transport\Http\Middleware\OAuthProxyMiddleware;
+use Mcp\Server\Transport\Http\OAuth\OidcDiscoveryInterface;
+use Nyholm\Psr7\Factory\Psr17Factory;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+use Psr\Http\Client\ClientInterface;
+use Psr\Http\Message\RequestInterface;
+use Psr\Http\Message\ResponseFactoryInterface;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+use Psr\Http\Server\RequestHandlerInterface;
+
+/**
+ * Tests OAuthProxyMiddleware behavior for metadata, authorize, and token routes.
+ *
+ * @author Volodymyr Panivko <sveneld300@gmail.com>
+ */
+class OAuthProxyMiddlewareTest extends TestCase
+{
+    #[TestDox('metadata endpoint returns local oauth metadata with upstream capabilities')]
+    public function testMetadataEndpointReturnsLocalMetadata(): void
+    {
+        $factory = new Psr17Factory();
+        $discovery = $this->createMock(OidcDiscoveryInterface::class);
+        $discovery->expects($this->once())
+            ->method('discover')
+            ->with('https://login.example.com/tenant')
+            ->willReturn([
+                'authorization_endpoint' => 'https://login.example.com/oauth2/v2.0/authorize',
+                'token_endpoint' => 'https://login.example.com/oauth2/v2.0/token',
+                'jwks_uri' => 'https://login.example.com/discovery/v2.0/keys',
+                'response_types_supported' => ['code'],
+                'grant_types_supported' => ['authorization_code', 'refresh_token'],
+                'code_challenge_methods_supported' => ['S256'],
+                'scopes_supported' => ['openid', 'profile'],
+                'token_endpoint_auth_methods_supported' => ['client_secret_post'],
+            ]);
+
+        $middleware = new OAuthProxyMiddleware(
+            upstreamIssuer: 'https://login.example.com/tenant',
+            localBaseUrl: 'http://localhost:8000',
+            discovery: $discovery,
+            responseFactory: $factory,
+            streamFactory: $factory,
+        );
+
+        $request = $factory->createServerRequest('GET', 'http://localhost:8000/.well-known/oauth-authorization-server');
+        $handler = new class($factory) implements RequestHandlerInterface {
+            public function __construct(private ResponseFactoryInterface $factory)
+            {
+            }
+
+            public function handle(ServerRequestInterface $request): ResponseInterface
+            {
+                return $this->factory->createResponse(404);
+            }
+        };
+
+        $response = $middleware->process($request, $handler);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $payload = json_decode($response->getBody()->__toString(), true, 512, \JSON_THROW_ON_ERROR);
+        $this->assertSame('http://localhost:8000', $payload['issuer']);
+        $this->assertSame('http://localhost:8000/authorize', $payload['authorization_endpoint']);
+        $this->assertSame('http://localhost:8000/token', $payload['token_endpoint']);
+        $this->assertSame(['openid', 'profile'], $payload['scopes_supported']);
+        $this->assertSame('https://login.example.com/discovery/v2.0/keys', $payload['jwks_uri']);
+    }
+
+    #[TestDox('authorize endpoint redirects to upstream authorization endpoint preserving query')]
+    public function testAuthorizeEndpointRedirectsToUpstream(): void
+    {
+        $factory = new Psr17Factory();
+        $discovery = $this->createMock(OidcDiscoveryInterface::class);
+        $discovery->expects($this->once())
+            ->method('getAuthorizationEndpoint')
+            ->with('https://login.example.com/tenant')
+            ->willReturn('https://login.example.com/oauth2/v2.0/authorize');
+
+        $middleware = new OAuthProxyMiddleware(
+            upstreamIssuer: 'https://login.example.com/tenant',
+            localBaseUrl: 'http://localhost:8000',
+            discovery: $discovery,
+            responseFactory: $factory,
+            streamFactory: $factory,
+        );
+
+        $request = $factory->createServerRequest(
+            'GET',
+            'http://localhost:8000/authorize?client_id=test-client&scope=openid%20profile&code_challenge=abc',
+        );
+
+        $handler = new class($factory) implements RequestHandlerInterface {
+            public function __construct(private ResponseFactoryInterface $factory)
+            {
+            }
+
+            public function handle(ServerRequestInterface $request): ResponseInterface
+            {
+                return $this->factory->createResponse(404);
+            }
+        };
+
+        $response = $middleware->process($request, $handler);
+
+        $this->assertSame(302, $response->getStatusCode());
+        $this->assertSame(
+            'https://login.example.com/oauth2/v2.0/authorize?client_id=test-client&scope=openid%20profile&code_challenge=abc',
+            $response->getHeaderLine('Location'),
+        );
+    }
+
+    #[TestDox('token endpoint proxies request and injects client secret')]
+    public function testTokenEndpointProxiesRequestAndInjectsClientSecret(): void
+    {
+        $factory = new Psr17Factory();
+        $discovery = $this->createMock(OidcDiscoveryInterface::class);
+        $discovery->expects($this->once())
+            ->method('getTokenEndpoint')
+            ->with('https://login.example.com/tenant')
+            ->willReturn('https://login.example.com/oauth2/v2.0/token');
+        $discovery->expects($this->once())
+            ->method('discover')
+            ->with('https://login.example.com/tenant')
+            ->willReturn([
+                'authorization_endpoint' => 'https://login.example.com/oauth2/v2.0/authorize',
+                'token_endpoint' => 'https://login.example.com/oauth2/v2.0/token',
+                'jwks_uri' => 'https://login.example.com/discovery/v2.0/keys',
+                'token_endpoint_auth_methods_supported' => ['client_secret_post'],
+            ]);
+
+        $httpClient = $this->createMock(ClientInterface::class);
+        $httpClient->expects($this->once())
+            ->method('sendRequest')
+            ->willReturnCallback(function (RequestInterface $request) use ($factory): ResponseInterface {
+                $this->assertSame('POST', $request->getMethod());
+                $this->assertSame('https://login.example.com/oauth2/v2.0/token', (string) $request->getUri());
+                $this->assertSame('', $request->getHeaderLine('Authorization'));
+                $this->assertSame('application/x-www-form-urlencoded', $request->getHeaderLine('Content-Type'));
+
+                parse_str($request->getBody()->__toString(), $params);
+                $this->assertSame('authorization_code', $params['grant_type'] ?? null);
+                $this->assertSame('abc123', $params['code'] ?? null);
+                $this->assertSame('secret-value', $params['client_secret'] ?? null);
+
+                return $factory->createResponse(200)
+                    ->withHeader('Content-Type', 'application/json')
+                    ->withBody($factory->createStream('{"access_token":"token-1"}'));
+            });
+
+        $middleware = new OAuthProxyMiddleware(
+            upstreamIssuer: 'https://login.example.com/tenant',
+            localBaseUrl: 'http://localhost:8000',
+            clientSecret: 'secret-value',
+            discovery: $discovery,
+            httpClient: $httpClient,
+            requestFactory: $factory,
+            responseFactory: $factory,
+            streamFactory: $factory,
+        );
+
+        $request = $factory->createServerRequest('POST', 'http://localhost:8000/token')
+            ->withHeader('Content-Type', 'application/x-www-form-urlencoded')
+            ->withBody($factory->createStream('grant_type=authorization_code&code=abc123'));
+
+        $handler = new class($factory) implements RequestHandlerInterface {
+            public function __construct(private ResponseFactoryInterface $factory)
+            {
+            }
+
+            public function handle(ServerRequestInterface $request): ResponseInterface
+            {
+                return $this->factory->createResponse(404);
+            }
+        };
+
+        $response = $middleware->process($request, $handler);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertSame('application/json', $response->getHeaderLine('Content-Type'));
+        $this->assertSame('{"access_token":"token-1"}', $response->getBody()->__toString());
+    }
+
+    #[TestDox('token endpoint uses client_secret_basic when supported by upstream metadata')]
+    public function testTokenEndpointUsesClientSecretBasicWhenSupported(): void
+    {
+        $factory = new Psr17Factory();
+        $discovery = $this->createMock(OidcDiscoveryInterface::class);
+        $discovery->expects($this->once())
+            ->method('getTokenEndpoint')
+            ->with('https://login.example.com/tenant')
+            ->willReturn('https://login.example.com/oauth2/v2.0/token');
+        $discovery->expects($this->once())
+            ->method('discover')
+            ->with('https://login.example.com/tenant')
+            ->willReturn([
+                'authorization_endpoint' => 'https://login.example.com/oauth2/v2.0/authorize',
+                'token_endpoint' => 'https://login.example.com/oauth2/v2.0/token',
+                'jwks_uri' => 'https://login.example.com/discovery/v2.0/keys',
+                'token_endpoint_auth_methods_supported' => ['client_secret_basic'],
+            ]);
+
+        $httpClient = $this->createMock(ClientInterface::class);
+        $httpClient->expects($this->once())
+            ->method('sendRequest')
+            ->willReturnCallback(function (RequestInterface $request) use ($factory): ResponseInterface {
+                $this->assertSame('POST', $request->getMethod());
+                $this->assertSame('https://login.example.com/oauth2/v2.0/token', (string) $request->getUri());
+                $this->assertSame('Basic ZGVtby1jbGllbnQ6c2VjcmV0LXZhbHVl', $request->getHeaderLine('Authorization'));
+                $this->assertSame('application/x-www-form-urlencoded', $request->getHeaderLine('Content-Type'));
+
+                parse_str($request->getBody()->__toString(), $params);
+                $this->assertSame('authorization_code', $params['grant_type'] ?? null);
+                $this->assertSame('abc123', $params['code'] ?? null);
+                $this->assertArrayNotHasKey('client_secret', $params);
+
+                return $factory->createResponse(200)
+                    ->withHeader('Content-Type', 'application/json')
+                    ->withBody($factory->createStream('{"access_token":"token-1"}'));
+            });
+
+        $middleware = new OAuthProxyMiddleware(
+            upstreamIssuer: 'https://login.example.com/tenant',
+            localBaseUrl: 'http://localhost:8000',
+            clientSecret: 'secret-value',
+            discovery: $discovery,
+            httpClient: $httpClient,
+            requestFactory: $factory,
+            responseFactory: $factory,
+            streamFactory: $factory,
+        );
+
+        $request = $factory->createServerRequest('POST', 'http://localhost:8000/token')
+            ->withHeader('Content-Type', 'application/x-www-form-urlencoded')
+            ->withBody($factory->createStream('grant_type=authorization_code&client_id=demo-client&code=abc123'));
+
+        $handler = new class($factory) implements RequestHandlerInterface {
+            public function __construct(private ResponseFactoryInterface $factory)
+            {
+            }
+
+            public function handle(ServerRequestInterface $request): ResponseInterface
+            {
+                return $this->factory->createResponse(404);
+            }
+        };
+
+        $response = $middleware->process($request, $handler);
+
+        $this->assertSame(200, $response->getStatusCode());
+        $this->assertSame('application/json', $response->getHeaderLine('Content-Type'));
+        $this->assertSame('{"access_token":"token-1"}', $response->getBody()->__toString());
+    }
+
+    #[TestDox('non oauth proxy requests are delegated to next middleware')]
+    public function testNonOAuthRequestPassesThrough(): void
+    {
+        $factory = new Psr17Factory();
+        $discovery = $this->createMock(OidcDiscoveryInterface::class);
+        $discovery->expects($this->never())->method('discover');
+
+        $middleware = new OAuthProxyMiddleware(
+            upstreamIssuer: 'https://login.example.com/tenant',
+            localBaseUrl: 'http://localhost:8000',
+            discovery: $discovery,
+            responseFactory: $factory,
+            streamFactory: $factory,
+        );
+
+        $request = $factory->createServerRequest('GET', 'http://localhost:8000/mcp');
+        $handler = new class($factory) implements RequestHandlerInterface {
+            public function __construct(private ResponseFactoryInterface $factory)
+            {
+            }
+
+            public function handle(ServerRequestInterface $request): ResponseInterface
+            {
+                return $this->factory->createResponse(204);
+            }
+        };
+
+        $response = $middleware->process($request, $handler);
+
+        $this->assertSame(204, $response->getStatusCode());
+    }
+}