[Server] Oauth2 based on middleware (#221)
* Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware * Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address PR review feedback for OAuth middleware * Apply php-cs-fixer to satisfy QA * Use Mcp exception classes in OAuth middleware * Refactor OAuth HTTP stack and add Microsoft example policies * Fix QA PHPStan findings in OAuth examples and auth middleware * Require OIDC discovery in JWKS provider and refine OAuth proxy behavior * Remove local development docker artifacts from VCS * Revert .gitignore changes for local docker files * Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address OAuth PR review feedback and align example configs * Fix QA style issues and add authorization docs * Fix PHPStan typing issues in OAuth middleware * Remove duplicate Middleware namespace, consolidate under Http\Middleware Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces. * Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures --------- Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>
This commit is contained in:
Volodymyr Panivko
GitHub
parent
61c20f1450
commit
e3f4b88768
1 changed files with 6038 additions and 0 deletions
|
|
@ -0,0 +1,179 @@
|
|||
<?php
|
||||
|
||||
/*
|
||||
* This file is part of the official PHP MCP SDK.
|
||||
*
|
||||
* A collaboration between Symfony and the PHP Foundation.
|
||||
*
|
||||
* For the full copyright and license information, please view the LICENSE
|
||||
* file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Mcp\Tests\Unit\Server\Transport\Http\Middleware;
|
||||
|
||||
use Mcp\Server\Transport\Http\Middleware\OAuthRequestMetaMiddleware;
|
||||
use Nyholm\Psr7\Factory\Psr17Factory;
|
||||
use PHPUnit\Framework\Attributes\TestDox;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Psr\Http\Message\ResponseInterface;
|
||||
use Psr\Http\Message\ServerRequestInterface;
|
||||
use Psr\Http\Server\RequestHandlerInterface;
|
||||
|
||||
/**
|
||||
* Tests OAuthRequestMetaMiddleware propagation of OAuth attributes to JSON-RPC meta.
|
||||
*
|
||||
* @author Volodymyr Panivko <sveneld300@gmail.com>
|
||||
*/
|
||||
class OAuthRequestMetaMiddlewareTest extends TestCase
|
||||
{
|
||||
#[TestDox('oauth request attributes are copied to json-rpc params _meta')]
|
||||
public function testInjectsOauthAttributesIntoSingleRequest(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$middleware = new OAuthRequestMetaMiddleware($factory);
|
||||
|
||||
$payload = [
|
||||
'jsonrpc' => '2.0',
|
||||
'id' => 1,
|
||||
'method' => 'initialize',
|
||||
'params' => [
|
||||
'protocolVersion' => '2024-11-05',
|
||||
],
|
||||
];
|
||||
|
||||
$request = $factory
|
||||
->createServerRequest('POST', 'https://mcp.example.com/mcp')
|
||||
->withBody($factory->createStream(json_encode($payload, \JSON_THROW_ON_ERROR)))
|
||||
->withAttribute('oauth.claims', ['sub' => 'user-1'])
|
||||
->withAttribute('oauth.scopes', ['openid', 'profile'])
|
||||
->withAttribute('oauth.subject', 'user-1')
|
||||
->withAttribute('not_oauth', 'ignored');
|
||||
|
||||
$response = $middleware->process($request, $this->createEchoHandler($factory));
|
||||
$decoded = json_decode($response->getBody()->__toString(), true, 512, \JSON_THROW_ON_ERROR);
|
||||
|
||||
$this->assertSame(['sub' => 'user-1'], $decoded['params']['_meta']['oauth']['oauth.claims']);
|
||||
$this->assertSame(['openid', 'profile'], $decoded['params']['_meta']['oauth']['oauth.scopes']);
|
||||
$this->assertSame('user-1', $decoded['params']['_meta']['oauth']['oauth.subject']);
|
||||
$this->assertArrayNotHasKey('not_oauth', $decoded['params']['_meta']['oauth']);
|
||||
}
|
||||
|
||||
#[TestDox('existing _meta is preserved and oauth keys are merged')]
|
||||
public function testMergesWithExistingMeta(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$middleware = new OAuthRequestMetaMiddleware($factory);
|
||||
|
||||
$payload = [
|
||||
'jsonrpc' => '2.0',
|
||||
'id' => 1,
|
||||
'method' => 'tools/list',
|
||||
'params' => [
|
||||
'_meta' => [
|
||||
'trace_id' => 'trace-1',
|
||||
'oauth' => [
|
||||
'client_hint' => 'web',
|
||||
'oauth.subject' => 'spoofed',
|
||||
],
|
||||
],
|
||||
],
|
||||
];
|
||||
|
||||
$request = $factory
|
||||
->createServerRequest('POST', 'https://mcp.example.com/mcp')
|
||||
->withBody($factory->createStream(json_encode($payload, \JSON_THROW_ON_ERROR)))
|
||||
->withAttribute('oauth.subject', 'trusted-user')
|
||||
->withAttribute('oauth.scopes', ['mcp.read']);
|
||||
|
||||
$response = $middleware->process($request, $this->createEchoHandler($factory));
|
||||
$decoded = json_decode($response->getBody()->__toString(), true, 512, \JSON_THROW_ON_ERROR);
|
||||
|
||||
$this->assertSame('trace-1', $decoded['params']['_meta']['trace_id']);
|
||||
$this->assertSame('web', $decoded['params']['_meta']['oauth']['client_hint']);
|
||||
$this->assertSame('trusted-user', $decoded['params']['_meta']['oauth']['oauth.subject']);
|
||||
$this->assertSame(['mcp.read'], $decoded['params']['_meta']['oauth']['oauth.scopes']);
|
||||
}
|
||||
|
||||
#[TestDox('oauth request attributes are copied for each batch entry')]
|
||||
public function testInjectsOauthAttributesIntoBatchRequest(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$middleware = new OAuthRequestMetaMiddleware($factory);
|
||||
|
||||
$payload = [
|
||||
[
|
||||
'jsonrpc' => '2.0',
|
||||
'id' => 1,
|
||||
'method' => 'initialize',
|
||||
'params' => [],
|
||||
],
|
||||
[
|
||||
'jsonrpc' => '2.0',
|
||||
'id' => 2,
|
||||
'method' => 'tools/list',
|
||||
],
|
||||
];
|
||||
|
||||
$request = $factory
|
||||
->createServerRequest('POST', 'https://mcp.example.com/mcp')
|
||||
->withBody($factory->createStream(json_encode($payload, \JSON_THROW_ON_ERROR)))
|
||||
->withAttribute('oauth.subject', 'batch-user');
|
||||
|
||||
$response = $middleware->process($request, $this->createEchoHandler($factory));
|
||||
$decoded = json_decode($response->getBody()->__toString(), true, 512, \JSON_THROW_ON_ERROR);
|
||||
|
||||
$this->assertSame('batch-user', $decoded[0]['params']['_meta']['oauth']['oauth.subject']);
|
||||
$this->assertSame('batch-user', $decoded[1]['params']['_meta']['oauth']['oauth.subject']);
|
||||
}
|
||||
|
||||
#[TestDox('request without oauth attributes passes through unchanged')]
|
||||
public function testNoOauthAttributesPassThrough(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$middleware = new OAuthRequestMetaMiddleware($factory);
|
||||
|
||||
$body = '{"jsonrpc":"2.0","id":1,"method":"ping","params":{}}';
|
||||
|
||||
$request = $factory
|
||||
->createServerRequest('POST', 'https://mcp.example.com/mcp')
|
||||
->withBody($factory->createStream($body));
|
||||
|
||||
$response = $middleware->process($request, $this->createEchoHandler($factory));
|
||||
|
||||
$this->assertSame($body, $response->getBody()->__toString());
|
||||
}
|
||||
|
||||
#[TestDox('non post requests pass through unchanged')]
|
||||
public function testNonPostPassesThrough(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$middleware = new OAuthRequestMetaMiddleware($factory);
|
||||
|
||||
$body = '{"jsonrpc":"2.0","id":1,"method":"ping"}';
|
||||
|
||||
$request = $factory
|
||||
->createServerRequest('GET', 'https://mcp.example.com/mcp')
|
||||
->withBody($factory->createStream($body))
|
||||
->withAttribute('oauth.subject', 'user-1');
|
||||
|
||||
$response = $middleware->process($request, $this->createEchoHandler($factory));
|
||||
|
||||
$this->assertSame($body, $response->getBody()->__toString());
|
||||
}
|
||||
|
||||
private function createEchoHandler(Psr17Factory $factory): RequestHandlerInterface
|
||||
{
|
||||
return new class($factory) implements RequestHandlerInterface {
|
||||
public function __construct(private readonly Psr17Factory $factory)
|
||||
{
|
||||
}
|
||||
|
||||
public function handle(ServerRequestInterface $request): ResponseInterface
|
||||
{
|
||||
return $this->factory
|
||||
->createResponse(200)
|
||||
->withBody($this->factory->createStream($request->getBody()->__toString()));
|
||||
}
|
||||
};
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue