5e3e69acc4SEP-2207 says a resource server must not advertise `offline_access` as a required scope. Nothing in src/ writes it - `scopesSupported` is entirely operator-supplied - so there was nothing to fix, but also nothing stopping a future default from quietly starting to advertise one.
115 lines
4.5 KiB
PHP
115 lines
4.5 KiB
PHP
<?php
|
|
|
|
/*
|
|
* This file is part of the official PHP MCP SDK.
|
|
*
|
|
* A collaboration between Symfony and the PHP Foundation.
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Mcp\Tests\Unit\Server\Transport\Http\OAuth;
|
|
|
|
use Mcp\Exception\InvalidArgumentException;
|
|
use Mcp\Server\Transport\Http\OAuth\ProtectedResourceMetadata;
|
|
use PHPUnit\Framework\Attributes\TestDox;
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
/**
|
|
* Tests ProtectedResourceMetadata serialization and input validation.
|
|
*
|
|
* @author Volodymyr Panivko <sveneld300@gmail.com>
|
|
*/
|
|
class ProtectedResourceMetadataTest extends TestCase
|
|
{
|
|
#[TestDox('serializes RFC 9728 metadata including human-readable fields')]
|
|
public function testJsonSerializeIncludesHumanReadableFields(): void
|
|
{
|
|
$metadata = new ProtectedResourceMetadata(
|
|
authorizationServers: ['https://auth.example.com'],
|
|
scopesSupported: ['openid', 'profile'],
|
|
resource: 'https://api.example.com/mcp',
|
|
resourceName: 'Example MCP API',
|
|
resourceDocumentation: 'https://api.example.com/docs',
|
|
resourcePolicyUri: 'https://api.example.com/policy',
|
|
resourceTosUri: 'https://api.example.com/tos',
|
|
localizedHumanReadable: [
|
|
'resource_name#en' => 'Example MCP API',
|
|
],
|
|
extra: [
|
|
'bearer_methods_supported' => ['header'],
|
|
],
|
|
metadataPaths: ['.well-known/oauth-protected-resource'],
|
|
);
|
|
|
|
$this->assertSame(
|
|
[
|
|
'bearer_methods_supported' => ['header'],
|
|
'authorization_servers' => ['https://auth.example.com'],
|
|
'scopes_supported' => ['openid', 'profile'],
|
|
'resource' => 'https://api.example.com/mcp',
|
|
'resource_name' => 'Example MCP API',
|
|
'resource_documentation' => 'https://api.example.com/docs',
|
|
'resource_policy_uri' => 'https://api.example.com/policy',
|
|
'resource_tos_uri' => 'https://api.example.com/tos',
|
|
'resource_name#en' => 'Example MCP API',
|
|
],
|
|
$metadata->jsonSerialize(),
|
|
);
|
|
$this->assertSame('/.well-known/oauth-protected-resource', $metadata->getPrimaryMetadataPath());
|
|
$this->assertSame(['openid', 'profile'], $metadata->getScopesSupported());
|
|
}
|
|
|
|
#[TestDox('invalid localized human-readable field is rejected')]
|
|
public function testInvalidLocalizedHumanReadableFieldThrows(): void
|
|
{
|
|
$this->expectException(InvalidArgumentException::class);
|
|
$this->expectExceptionMessage('Invalid localized human-readable field');
|
|
|
|
new ProtectedResourceMetadata(
|
|
authorizationServers: ['https://auth.example.com'],
|
|
localizedHumanReadable: [
|
|
'invalid#en' => 'value',
|
|
],
|
|
);
|
|
}
|
|
|
|
#[TestDox('empty authorization servers are rejected')]
|
|
public function testEmptyAuthorizationServersThrows(): void
|
|
{
|
|
$this->expectException(InvalidArgumentException::class);
|
|
$this->expectExceptionMessage('requires at least one authorization server');
|
|
|
|
new ProtectedResourceMetadata([]);
|
|
}
|
|
|
|
#[TestDox('the SDK advertises exactly the scopes it was given, and never adds offline_access')]
|
|
public function testScopesAreOperatorSuppliedOnly(): void
|
|
{
|
|
// SEP-2207: `offline_access` is a refresh-token scope, not something a
|
|
// resource requires. Nothing in the SDK injects it — this pins that, so
|
|
// a future default cannot quietly start advertising one.
|
|
$metadata = new ProtectedResourceMetadata(
|
|
resource: 'https://api.example.com/mcp',
|
|
authorizationServers: ['https://auth.example.com'],
|
|
scopesSupported: ['mcp:read', 'mcp:write'],
|
|
);
|
|
|
|
$data = $metadata->jsonSerialize();
|
|
|
|
$this->assertSame(['mcp:read', 'mcp:write'], $data['scopes_supported']);
|
|
$this->assertNotContains('offline_access', $data['scopes_supported']);
|
|
}
|
|
|
|
#[TestDox('no scopes given means no scopes_supported member at all')]
|
|
public function testNoScopesMeansNoMember(): void
|
|
{
|
|
$metadata = new ProtectedResourceMetadata(
|
|
resource: 'https://api.example.com/mcp',
|
|
authorizationServers: ['https://auth.example.com'],
|
|
);
|
|
|
|
$this->assertArrayNotHasKey('scopes_supported', $metadata->jsonSerialize());
|
|
}
|
|
}
|