[Server] Oauth2 based on middleware (#221)
* Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware * Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address PR review feedback for OAuth middleware * Apply php-cs-fixer to satisfy QA * Use Mcp exception classes in OAuth middleware * Refactor OAuth HTTP stack and add Microsoft example policies * Fix QA PHPStan findings in OAuth examples and auth middleware * Require OIDC discovery in JWKS provider and refine OAuth proxy behavior * Remove local development docker artifacts from VCS * Revert .gitignore changes for local docker files * Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address OAuth PR review feedback and align example configs * Fix QA style issues and add authorization docs * Fix PHPStan typing issues in OAuth middleware * Remove duplicate Middleware namespace, consolidate under Http\Middleware Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces. * Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures --------- Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>
This commit is contained in:
Volodymyr Panivko
GitHub
parent
61c20f1450
commit
e3f4b88768
1 changed files with 6038 additions and 0 deletions
268
tests/Unit/Server/Transport/Http/OAuth/OidcDiscoveryTest.php
Normal file
268
tests/Unit/Server/Transport/Http/OAuth/OidcDiscoveryTest.php
Normal file
|
|
@ -0,0 +1,268 @@
|
|||
<?php
|
||||
|
||||
/*
|
||||
* This file is part of the official PHP MCP SDK.
|
||||
*
|
||||
* A collaboration between Symfony and the PHP Foundation.
|
||||
*
|
||||
* For the full copyright and license information, please view the LICENSE
|
||||
* file that was distributed with this source code.
|
||||
*/
|
||||
|
||||
namespace Mcp\Tests\Unit\Server\Transport\Http\OAuth;
|
||||
|
||||
use Mcp\Exception\RuntimeException;
|
||||
use Mcp\Server\Transport\Http\OAuth\OidcDiscovery;
|
||||
use Nyholm\Psr7\Factory\Psr17Factory;
|
||||
use PHPUnit\Framework\Attributes\TestDox;
|
||||
use PHPUnit\Framework\TestCase;
|
||||
use Psr\Http\Client\ClientInterface;
|
||||
use Psr\Http\Message\RequestInterface;
|
||||
use Psr\Http\Message\ResponseInterface;
|
||||
use Psr\SimpleCache\CacheInterface;
|
||||
|
||||
/**
|
||||
* Tests OidcDiscovery metadata resolution, validation, and caching behavior.
|
||||
*
|
||||
* @author Volodymyr Panivko <sveneld300@gmail.com>
|
||||
*/
|
||||
class OidcDiscoveryTest extends TestCase
|
||||
{
|
||||
#[TestDox('invalid issuer URL throws RuntimeException')]
|
||||
public function testInvalidIssuerUrlThrows(): void
|
||||
{
|
||||
$this->skipIfPsrHttpClientIsMissing();
|
||||
|
||||
$factory = new Psr17Factory();
|
||||
$discovery = new OidcDiscovery(
|
||||
httpClient: $this->createMock(ClientInterface::class),
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$this->expectException(RuntimeException::class);
|
||||
$this->expectExceptionMessage('Invalid issuer URL');
|
||||
$discovery->discover('invalid-issuer');
|
||||
}
|
||||
|
||||
#[TestDox('strict discovery rejects metadata without code challenge methods')]
|
||||
public function testDiscoverRejectsMetadataWithoutCodeChallengeMethodsSupported(): void
|
||||
{
|
||||
$this->skipIfPsrHttpClientIsMissing();
|
||||
|
||||
$factory = new Psr17Factory();
|
||||
$issuer = 'https://auth.example.com';
|
||||
$metadataWithoutCodeChallengeMethods = [
|
||||
'issuer' => $issuer,
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/oauth2/v2.0/token',
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->exactly(2))
|
||||
->method('sendRequest')
|
||||
->willReturn($factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($metadataWithoutCodeChallengeMethods, \JSON_THROW_ON_ERROR)),
|
||||
));
|
||||
|
||||
$discovery = new OidcDiscovery(
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$this->expectException(RuntimeException::class);
|
||||
$this->expectExceptionMessage('Failed to discover authorization server metadata');
|
||||
$discovery->discover($issuer);
|
||||
}
|
||||
|
||||
#[TestDox('discover falls back to the next metadata URL when first response is invalid')]
|
||||
public function testDiscoverFallsBackOnInvalidMetadataResponse(): void
|
||||
{
|
||||
$this->skipIfPsrHttpClientIsMissing();
|
||||
|
||||
$factory = new Psr17Factory();
|
||||
$requestedUrls = [];
|
||||
|
||||
$invalidMetadata = [
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
// token_endpoint is intentionally missing
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
];
|
||||
$validMetadata = [
|
||||
'issuer' => 'https://auth.example.com/tenant',
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/oauth2/v2.0/token',
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
'code_challenge_methods_supported' => ['S256'],
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->exactly(2))
|
||||
->method('sendRequest')
|
||||
->willReturnCallback(static function (RequestInterface $request) use ($factory, &$requestedUrls, $invalidMetadata, $validMetadata): ResponseInterface {
|
||||
$requestedUrls[] = (string) $request->getUri();
|
||||
|
||||
$payload = 1 === \count($requestedUrls) ? $invalidMetadata : $validMetadata;
|
||||
|
||||
return $factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($payload, \JSON_THROW_ON_ERROR)),
|
||||
);
|
||||
});
|
||||
|
||||
$discovery = new OidcDiscovery(
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$metadata = $discovery->discover('https://auth.example.com/tenant');
|
||||
|
||||
$this->assertSame($validMetadata['authorization_endpoint'], $metadata['authorization_endpoint']);
|
||||
$this->assertSame($validMetadata['token_endpoint'], $metadata['token_endpoint']);
|
||||
$this->assertSame($validMetadata['jwks_uri'], $metadata['jwks_uri']);
|
||||
$this->assertSame(
|
||||
'https://auth.example.com/.well-known/oauth-authorization-server/tenant',
|
||||
$requestedUrls[0],
|
||||
);
|
||||
$this->assertSame(
|
||||
'https://auth.example.com/.well-known/openid-configuration/tenant',
|
||||
$requestedUrls[1],
|
||||
);
|
||||
}
|
||||
|
||||
#[TestDox('valid metadata from cache is returned without HTTP call')]
|
||||
public function testDiscoverUsesValidCacheWithoutHttpCall(): void
|
||||
{
|
||||
$this->skipIfPsrHttpClientIsMissing();
|
||||
|
||||
$factory = new Psr17Factory();
|
||||
$cachedMetadata = [
|
||||
'issuer' => 'https://auth.example.com/tenant',
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/oauth2/v2.0/token',
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
'code_challenge_methods_supported' => ['S256'],
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->never())->method('sendRequest');
|
||||
|
||||
$cache = $this->createMock(CacheInterface::class);
|
||||
$cache->expects($this->once())
|
||||
->method('get')
|
||||
->willReturn($cachedMetadata);
|
||||
$cache->expects($this->never())->method('set');
|
||||
|
||||
$discovery = new OidcDiscovery(
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
cache: $cache,
|
||||
);
|
||||
|
||||
$metadata = $discovery->discover('https://auth.example.com/tenant');
|
||||
|
||||
$this->assertSame($cachedMetadata, $metadata);
|
||||
}
|
||||
|
||||
#[TestDox('discover skips metadata when issuer claim does not match requested issuer')]
|
||||
public function testDiscoverSkipsIssuerMismatch(): void
|
||||
{
|
||||
$this->skipIfPsrHttpClientIsMissing();
|
||||
|
||||
$factory = new Psr17Factory();
|
||||
$requestedUrls = [];
|
||||
|
||||
$issuerMismatch = [
|
||||
'issuer' => 'https://auth.example.com/other-tenant',
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/oauth2/v2.0/token',
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
'code_challenge_methods_supported' => ['S256'],
|
||||
];
|
||||
$validMetadata = [
|
||||
'issuer' => 'https://auth.example.com/tenant',
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/oauth2/v2.0/token',
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
'code_challenge_methods_supported' => ['S256'],
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->exactly(2))
|
||||
->method('sendRequest')
|
||||
->willReturnCallback(static function (RequestInterface $request) use ($factory, &$requestedUrls, $issuerMismatch, $validMetadata): ResponseInterface {
|
||||
$requestedUrls[] = (string) $request->getUri();
|
||||
|
||||
$payload = 1 === \count($requestedUrls) ? $issuerMismatch : $validMetadata;
|
||||
|
||||
return $factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($payload, \JSON_THROW_ON_ERROR)),
|
||||
);
|
||||
});
|
||||
|
||||
$discovery = new OidcDiscovery(
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$metadata = $discovery->discover('https://auth.example.com/tenant');
|
||||
|
||||
$this->assertSame($validMetadata['issuer'], $metadata['issuer']);
|
||||
$this->assertSame(
|
||||
'https://auth.example.com/.well-known/oauth-authorization-server/tenant',
|
||||
$requestedUrls[0],
|
||||
);
|
||||
$this->assertSame(
|
||||
'https://auth.example.com/.well-known/openid-configuration/tenant',
|
||||
$requestedUrls[1],
|
||||
);
|
||||
}
|
||||
|
||||
#[TestDox('issuer without path uses standard well-known endpoints')]
|
||||
public function testIssuerWithoutPathUsesStandardWellKnownEndpoints(): void
|
||||
{
|
||||
$this->skipIfPsrHttpClientIsMissing();
|
||||
|
||||
$factory = new Psr17Factory();
|
||||
$requestedUrls = [];
|
||||
$validMetadata = [
|
||||
'issuer' => 'https://auth.example.com',
|
||||
'authorization_endpoint' => 'https://auth.example.com/oauth2/v2.0/authorize',
|
||||
'token_endpoint' => 'https://auth.example.com/oauth2/v2.0/token',
|
||||
'jwks_uri' => 'https://auth.example.com/discovery/v2.0/keys',
|
||||
'code_challenge_methods_supported' => ['S256'],
|
||||
];
|
||||
|
||||
$httpClient = $this->createMock(ClientInterface::class);
|
||||
$httpClient->expects($this->exactly(2))
|
||||
->method('sendRequest')
|
||||
->willReturnCallback(static function (RequestInterface $request) use ($factory, &$requestedUrls, $validMetadata): ResponseInterface {
|
||||
$requestedUrls[] = (string) $request->getUri();
|
||||
|
||||
if (1 === \count($requestedUrls)) {
|
||||
return $factory->createResponse(404);
|
||||
}
|
||||
|
||||
return $factory->createResponse(200)->withBody(
|
||||
$factory->createStream(json_encode($validMetadata, \JSON_THROW_ON_ERROR)),
|
||||
);
|
||||
});
|
||||
|
||||
$discovery = new OidcDiscovery(
|
||||
httpClient: $httpClient,
|
||||
requestFactory: $factory,
|
||||
);
|
||||
|
||||
$metadata = $discovery->discover('https://auth.example.com');
|
||||
|
||||
$this->assertSame($validMetadata['jwks_uri'], $metadata['jwks_uri']);
|
||||
$this->assertSame('https://auth.example.com/.well-known/oauth-authorization-server', $requestedUrls[0]);
|
||||
$this->assertSame('https://auth.example.com/.well-known/openid-configuration', $requestedUrls[1]);
|
||||
}
|
||||
|
||||
private function skipIfPsrHttpClientIsMissing(): void
|
||||
{
|
||||
if (!interface_exists(ClientInterface::class)) {
|
||||
$this->markTestSkipped('psr/http-client is not available in this runtime.');
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue