[Server] Oauth2 based on middleware (#221)

* Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware * Add Middleware handlers to StreamableHttpTransport * OAuth Implementation based on middleware * OAuth Implementation based on middleware Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address PR review feedback for OAuth middleware * Apply php-cs-fixer to satisfy QA * Use Mcp exception classes in OAuth middleware * Refactor OAuth HTTP stack and add Microsoft example policies * Fix QA PHPStan findings in OAuth examples and auth middleware * Require OIDC discovery in JWKS provider and refine OAuth proxy behavior * Remove local development docker artifacts from VCS * Revert .gitignore changes for local docker files * Fix body retrieval in OAuthRequestMetaMiddleware for proper string conversion Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> * Address OAuth PR review feedback and align example configs * Fix QA style issues and add authorization docs * Fix PHPStan typing issues in OAuth middleware * Remove duplicate Middleware namespace, consolidate under Http\Middleware Remove old Mcp\Server\Transport\Middleware\ classes that were duplicated in Mcp\Server\Transport\Http\Middleware\ and Http\OAuth\. Update docs to reference the correct namespaces. * Address PR review: replace Throwable catch with specific exceptions, add JSON_THROW_ON_ERROR - JwtTokenValidator: replace catch(\Throwable) with explicit \InvalidArgumentException|\UnexpectedValueException|\DomainException, letting RuntimeException from JwksProvider propagate as infrastructure errors - OAuthProxyMiddleware: add \JSON_THROW_ON_ERROR to json_encode for metadata response - Update tests to expect RuntimeException for JWKS infrastructure failures --------- Signed-off-by: Volodymyr Panivko <sveneld300@gmail.com> Co-authored-by: Volodymyr Panivko <volodymyr.panivko@togethernetworks.com>
2026-03-10 17:10:07 +01:00 · 2026-03-10 17:10:07 +01:00 · e3f4b88768
commit e3f4b88768
parent 61c20f1450
1 changed files with 6038 additions and 0 deletions
--- a/tests/Unit/Server/Transport/Http/OAuth/ProtectedResourceMetadataTest.php
+++ b/tests/Unit/Server/Transport/Http/OAuth/ProtectedResourceMetadataTest.php
@ -0,0 +1,86 @@
+<?php
+
+/*
+ * This file is part of the official PHP MCP SDK.
+ *
+ * A collaboration between Symfony and the PHP Foundation.
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Mcp\Tests\Unit\Server\Transport\Http\OAuth;
+
+use Mcp\Exception\InvalidArgumentException;
+use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;
+use PHPUnit\Framework\Attributes\TestDox;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Tests ProtectedResourceMetadata serialization and input validation.
+ *
+ * @author Volodymyr Panivko <sveneld300@gmail.com>
+ */
+class ProtectedResourceMetadataTest extends TestCase
+{
+    #[TestDox('serializes RFC 9728 metadata including human-readable fields')]
+    public function testJsonSerializeIncludesHumanReadableFields(): void
+    {
+        $metadata = new ProtectedResourceMetadata(
+            authorizationServers: ['https://auth.example.com'],
+            scopesSupported: ['openid', 'profile'],
+            resource: 'https://api.example.com/mcp',
+            resourceName: 'Example MCP API',
+            resourceDocumentation: 'https://api.example.com/docs',
+            resourcePolicyUri: 'https://api.example.com/policy',
+            resourceTosUri: 'https://api.example.com/tos',
+            localizedHumanReadable: [
+                'resource_name#en' => 'Example MCP API',
+            ],
+            extra: [
+                'bearer_methods_supported' => ['header'],
+            ],
+            metadataPaths: ['.well-known/oauth-protected-resource'],
+        );
+
+        $this->assertSame(
+            [
+                'bearer_methods_supported' => ['header'],
+                'authorization_servers' => ['https://auth.example.com'],
+                'scopes_supported' => ['openid', 'profile'],
+                'resource' => 'https://api.example.com/mcp',
+                'resource_name' => 'Example MCP API',
+                'resource_documentation' => 'https://api.example.com/docs',
+                'resource_policy_uri' => 'https://api.example.com/policy',
+                'resource_tos_uri' => 'https://api.example.com/tos',
+                'resource_name#en' => 'Example MCP API',
+            ],
+            $metadata->jsonSerialize(),
+        );
+        $this->assertSame('/.well-known/oauth-protected-resource', $metadata->getPrimaryMetadataPath());
+        $this->assertSame(['openid', 'profile'], $metadata->getScopesSupported());
+    }
+
+    #[TestDox('invalid localized human-readable field is rejected')]
+    public function testInvalidLocalizedHumanReadableFieldThrows(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('Invalid localized human-readable field');
+
+        new ProtectedResourceMetadata(
+            authorizationServers: ['https://auth.example.com'],
+            localizedHumanReadable: [
+                'invalid#en' => 'value',
+            ],
+        );
+    }
+
+    #[TestDox('empty authorization servers are rejected')]
+    public function testEmptyAuthorizationServersThrows(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('requires at least one authorization server');
+
+        new ProtectedResourceMetadata([]);
+    }
+}