[Server] Oauth2 based on middleware (#221)
* Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware * Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address PR review feedback for OAuth middleware * Apply php-cs-fixer to satisfy QA * Use Mcp exception classes in OAuth middleware * Refactor OAuth HTTP stack and add Microsoft example policies * Fix QA PHPStan findings in OAuth examples and auth middleware * Require OIDC discovery in JWKS provider and refine OAuth proxy behavior * Remove local development docker artifacts from VCS * Revert .gitignore changes for local docker files * Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address OAuth PR review feedback and align example configs * Fix QA style issues and add authorization docs * Fix PHPStan typing issues in OAuth middleware * Remove duplicate Middleware namespace, consolidate under Http\Middleware Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces. * Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures --------- Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>
This commit is contained in:
Volodymyr Panivko
GitHub
parent
61c20f1450
commit
e3f4b88768
1 changed files with 6038 additions and 0 deletions
168
tests/Unit/Server/Transport/Http/OAuth/JwksProviderTest.php
Normal file
168
tests/Unit/Server/Transport/Http/OAuth/JwksProviderTest.php
Normal file
|
|
@ -0,0 +1,168 @@
|
|||
<?php
|
||||
|
||||
/*
|
||||
* This file is part of the official PHP MCP SDK.
|
||||
*
|
||||
* A collaboration between Symfony and the PHP Foundation.
|
||||
*
|
||||
* For the full copyright and license information, please view the LICENSE
|
||||
* file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Mcp\Tests\Unit\Server\Transport\Http\OAuth;
|
||||
|
||||
use Mcp\Exception\RuntimeException;
|
||||
use Mcp\Server\Transport\Http\OAuth\JwksProvider;
|
||||
use Mcp\Server\Transport\Http\OAuth\OidcDiscoveryInterface;
|
||||
use Nyholm\Psr7\Factory\Psr17Factory;
|
||||
use PHPUnit\Framework\Attributes\TestDox;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Psr\Http\Client\ClientInterface;
|
||||
use Psr\SimpleCache\CacheInterface;
|
||||
|
||||
/**
|
||||
* Tests JwksProvider loading, validation, and caching behavior.
|
||||
*
|
||||
* @author Volodymyr Panivko <sveneld300@gmail.com>
|
||||
*/
|
||||
class JwksProviderTest extends TestCase
|
||||
{
|
||||
#[TestDox('JWKS are loaded from explicit URI')]
|
||||
public function testGetJwksFromExplicitUri(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$jwksUri = 'https://auth.example.com/jwks';
|
||||
$jwks = [
|
||||
'keys' => [
|
||||
['kty' => 'RSA', 'kid' => 'kid-1', 'n' => 'abc', 'e' => 'AQAB'],
|
||||
],
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->once())
|
||||
->method('sendRequest')
|
||||
->willReturn(
|
||||
$factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($jwks, \JSON_THROW_ON_ERROR)),
|
||||
),
|
||||
);
|
||||
|
||||
$provider = new JwksProvider(
|
||||
discovery: $this->createDiscoveryStub(),
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$result = $provider->getJwks('https://auth.example.com', $jwksUri);
|
||||
|
||||
$this->assertSame($jwks, $result);
|
||||
}
|
||||
|
||||
#[TestDox('invalid cached JWKS are ignored and replaced by fetched values')]
|
||||
public function testInvalidCachedJwksAreIgnored(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$jwksUri = 'https://auth.example.com/jwks';
|
||||
$jwks = [
|
||||
'keys' => [
|
||||
['kty' => 'RSA', 'kid' => 'kid-1', 'n' => 'abc', 'e' => 'AQAB'],
|
||||
],
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->once())
|
||||
->method('sendRequest')
|
||||
->willReturn(
|
||||
$factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($jwks, \JSON_THROW_ON_ERROR)),
|
||||
),
|
||||
);
|
||||
|
||||
$cache = $this->createMock(CacheInterface::class);
|
||||
$cache->expects($this->once())
|
||||
->method('get')
|
||||
->willReturn(['keys' => []]);
|
||||
$cache->expects($this->once())
|
||||
->method('set');
|
||||
|
||||
$provider = new JwksProvider(
|
||||
discovery: $this->createDiscoveryStub(),
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
cache: $cache,
|
||||
);
|
||||
|
||||
$result = $provider->getJwks('https://auth.example.com', $jwksUri);
|
||||
|
||||
$this->assertSame($jwks, $result);
|
||||
}
|
||||
|
||||
#[TestDox('discovery is used when explicit JWKS URI is not provided')]
|
||||
public function testDiscoveryIsUsedWhenUriIsMissing(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$jwksUri = 'https://auth.example.com/jwks';
|
||||
$jwks = [
|
||||
'keys' => [
|
||||
['kty' => 'RSA', 'kid' => 'kid-1', 'n' => 'abc', 'e' => 'AQAB'],
|
||||
],
|
||||
];
|
||||
|
||||
$discovery = $this->createMock(OidcDiscoveryInterface::class);
|
||||
$discovery->expects($this->once())
|
||||
->method('getJwksUri')
|
||||
->with('https://auth.example.com')
|
||||
->willReturn($jwksUri);
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->once())
|
||||
->method('sendRequest')
|
||||
->willReturn(
|
||||
$factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($jwks, \JSON_THROW_ON_ERROR)),
|
||||
),
|
||||
);
|
||||
|
||||
$provider = new JwksProvider(
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
discovery: $discovery,
|
||||
);
|
||||
|
||||
$result = $provider->getJwks('https://auth.example.com');
|
||||
|
||||
$this->assertSame($jwks, $result);
|
||||
}
|
||||
|
||||
#[TestDox('empty keys in fetched JWKS throw RuntimeException')]
|
||||
public function testEmptyKeysThrow(): void
|
||||
{
|
||||
$factory = new Psr17Factory();
|
||||
$jwksUri = 'https://auth.example.com/jwks';
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->once())
|
||||
->method('sendRequest')
|
||||
->willReturn(
|
||||
$factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode(['keys' => []], \JSON_THROW_ON_ERROR)),
|
||||
),
|
||||
);
|
||||
|
||||
$provider = new JwksProvider(
|
||||
discovery: $this->createDiscoveryStub(),
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$this->expectException(RuntimeException::class);
|
||||
$this->expectExceptionMessage('expected non-empty "keys" array');
|
||||
|
||||
$provider->getJwks('https://auth.example.com', $jwksUri);
|
||||
}
|
||||
|
||||
private function createDiscoveryStub(): OidcDiscoveryInterface
|
||||
{
|
||||
return $this->createStub(OidcDiscoveryInterface::class);
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue