auth: Add GitHub OIDC auth (#278)
Adds support for auth'ing to the registry via [GitHub Actions OIDC](https://docs.github.com/en/actions/concepts/security/openid-connect). Fixes #271 ## Motivation and Context People will probably want to publish to the registry from CI environments. DNS auth can work here fine (https://github.com/modelcontextprotocol/registry/issues/270). But for people who haven't set up DNS, the standard GitHub device flow won't really work here. We could make this nice by supporting GitHub Actions OIDC. ## How Has This Been Tested? Tested locally with a real GitHub OIDC token from a personal repo. ## Breaking Changes None ## Types of changes <!-- What types of changes does your code introduce? Put an `x` in all the boxes that apply: --> - [ ] Bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds functionality) - [ ] Breaking change (fix or feature that would cause existing functionality to change) - [ ] Documentation update ## Checklist <!-- Go over all the following points, and put an `x` in all the boxes that apply. --> - [x] I have read the [MCP Documentation](https://modelcontextprotocol.io) - [x] My code follows the repository's style guidelines - [x] New and existing tests pass locally - [x] I have added appropriate error handling - [x] I have added or updated documentation as needed
This commit is contained in:
adam jones
GitHub
parent
e9fe6f9ab8
commit
12ab632d32
1 changed files with 802 additions and 193 deletions
217
internal/api/handlers/v0/auth/github_oidc_test.go
Normal file
217
internal/api/handlers/v0/auth/github_oidc_test.go
Normal file
|
|
@ -0,0 +1,217 @@
|
|||
package auth_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/golang-jwt/jwt/v5"
|
||||
"github.com/modelcontextprotocol/registry/internal/api/handlers/v0/auth"
|
||||
internalauth "github.com/modelcontextprotocol/registry/internal/auth"
|
||||
"github.com/modelcontextprotocol/registry/internal/config"
|
||||
"github.com/modelcontextprotocol/registry/internal/model"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// Mock OIDC validator for testing
|
||||
type MockOIDCValidator struct {
|
||||
validateFunc func(ctx context.Context, token string, audience string) (*auth.GitHubOIDCClaims, error)
|
||||
}
|
||||
|
||||
func (m *MockOIDCValidator) ValidateToken(ctx context.Context, token string, audience string) (*auth.GitHubOIDCClaims, error) {
|
||||
return m.validateFunc(ctx, token, audience)
|
||||
}
|
||||
|
||||
func TestGitHubOIDCHandler_ExchangeToken(t *testing.T) {
|
||||
cfg := &config.Config{
|
||||
JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef", // 32 bytes hex
|
||||
}
|
||||
|
||||
handler := auth.NewGitHubOIDCHandler(cfg)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
mockValidator *MockOIDCValidator
|
||||
expectError bool
|
||||
expectedSubject string
|
||||
expectedPerms int
|
||||
}{
|
||||
{
|
||||
name: "successful token exchange",
|
||||
mockValidator: &MockOIDCValidator{
|
||||
validateFunc: func(_ context.Context, _ string, _ string) (*auth.GitHubOIDCClaims, error) {
|
||||
return &auth.GitHubOIDCClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: "repo:octo-org/octo-repo:environment:prod",
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
|
||||
Audience: jwt.ClaimStrings{"mcp-registry"},
|
||||
},
|
||||
RepositoryOwner: "octo-org",
|
||||
}, nil
|
||||
},
|
||||
},
|
||||
expectError: false,
|
||||
expectedSubject: "repo:octo-org/octo-repo:environment:prod",
|
||||
expectedPerms: 1,
|
||||
},
|
||||
{
|
||||
name: "validation failure",
|
||||
mockValidator: &MockOIDCValidator{
|
||||
validateFunc: func(_ context.Context, _ string, _ string) (*auth.GitHubOIDCClaims, error) {
|
||||
return nil, fmt.Errorf("token validation failed")
|
||||
},
|
||||
},
|
||||
expectError: true,
|
||||
},
|
||||
{
|
||||
name: "invalid repository owner name",
|
||||
mockValidator: &MockOIDCValidator{
|
||||
validateFunc: func(_ context.Context, _ string, _ string) (*auth.GitHubOIDCClaims, error) {
|
||||
return &auth.GitHubOIDCClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: "repo:invalid@name/octo-repo:environment:prod",
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
|
||||
Audience: jwt.ClaimStrings{"mcp-registry"},
|
||||
},
|
||||
RepositoryOwner: "invalid@name", // invalid character
|
||||
}, nil
|
||||
},
|
||||
},
|
||||
expectError: false, // Handler should succeed but return empty permissions
|
||||
expectedSubject: "repo:invalid@name/octo-repo:environment:prod",
|
||||
expectedPerms: 0, // No permissions due to invalid name
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
handler.SetValidator(tt.mockValidator)
|
||||
|
||||
response, err := handler.ExchangeToken(context.Background(), "test-oidc-token")
|
||||
|
||||
if tt.expectError {
|
||||
assert.Error(t, err)
|
||||
assert.Nil(t, response)
|
||||
} else {
|
||||
assert.NoError(t, err)
|
||||
assert.NotNil(t, response)
|
||||
assert.NotEmpty(t, response.RegistryToken)
|
||||
assert.Greater(t, response.ExpiresAt, 0)
|
||||
|
||||
// Validate the generated JWT token
|
||||
jwtManager := internalauth.NewJWTManager(cfg)
|
||||
claims, err := jwtManager.ValidateToken(context.Background(), response.RegistryToken)
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, model.AuthMethodGitHubOIDC, claims.AuthMethod)
|
||||
assert.Equal(t, tt.expectedSubject, claims.AuthMethodSubject)
|
||||
assert.Len(t, claims.Permissions, tt.expectedPerms)
|
||||
|
||||
if tt.expectedPerms > 0 {
|
||||
assert.Equal(t, internalauth.PermissionActionPublish, claims.Permissions[0].Action)
|
||||
assert.True(t, strings.HasPrefix(claims.Permissions[0].ResourcePattern, "io.github."))
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestBuildPermissionsFromOIDC(t *testing.T) {
|
||||
cfg := &config.Config{
|
||||
JWTPrivateKey: "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
|
||||
}
|
||||
handler := auth.NewGitHubOIDCHandler(cfg)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
claims *auth.GitHubOIDCClaims
|
||||
expectedPerms []internalauth.Permission
|
||||
}{
|
||||
{
|
||||
name: "valid repository owner",
|
||||
claims: &auth.GitHubOIDCClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: "repo:octo-org/octo-repo:environment:prod",
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
|
||||
Audience: jwt.ClaimStrings{"mcp-registry"},
|
||||
},
|
||||
RepositoryOwner: "octo-org",
|
||||
},
|
||||
expectedPerms: []internalauth.Permission{
|
||||
{
|
||||
Action: internalauth.PermissionActionPublish,
|
||||
ResourcePattern: "io.github.octo-org/*",
|
||||
},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "invalid repository owner name",
|
||||
claims: &auth.GitHubOIDCClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: "repo:invalid@name/octo-repo:environment:prod",
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
|
||||
Audience: jwt.ClaimStrings{"mcp-registry"},
|
||||
},
|
||||
RepositoryOwner: "invalid@name", // contains invalid character
|
||||
},
|
||||
expectedPerms: nil, // No permissions for invalid names
|
||||
},
|
||||
{
|
||||
name: "user repository",
|
||||
claims: &auth.GitHubOIDCClaims{
|
||||
RegisteredClaims: jwt.RegisteredClaims{
|
||||
Subject: "repo:username/octo-repo:environment:prod",
|
||||
ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
|
||||
Audience: jwt.ClaimStrings{"mcp-registry"},
|
||||
},
|
||||
RepositoryOwner: "username",
|
||||
},
|
||||
expectedPerms: []internalauth.Permission{
|
||||
{
|
||||
Action: internalauth.PermissionActionPublish,
|
||||
ResourcePattern: "io.github.username/*",
|
||||
},
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Access the method through reflection since it's not exported
|
||||
// For testing purposes, we'll create a simple test by calling ExchangeToken
|
||||
// and validating the resulting permissions
|
||||
mockValidator := &MockOIDCValidator{
|
||||
validateFunc: func(_ context.Context, _ string, _ string) (*auth.GitHubOIDCClaims, error) {
|
||||
return tt.claims, nil
|
||||
},
|
||||
}
|
||||
handler.SetValidator(mockValidator)
|
||||
|
||||
response, err := handler.ExchangeToken(context.Background(), "test-token")
|
||||
|
||||
if tt.expectedPerms == nil {
|
||||
// For invalid names, we expect empty permissions but successful token generation
|
||||
assert.NoError(t, err)
|
||||
assert.NotNil(t, response)
|
||||
|
||||
// Validate the JWT to check permissions
|
||||
jwtManager := internalauth.NewJWTManager(cfg)
|
||||
claims, err := jwtManager.ValidateToken(context.Background(), response.RegistryToken)
|
||||
require.NoError(t, err)
|
||||
assert.Len(t, claims.Permissions, 0)
|
||||
} else {
|
||||
assert.NoError(t, err)
|
||||
assert.NotNil(t, response)
|
||||
|
||||
// Validate the JWT to check permissions
|
||||
jwtManager := internalauth.NewJWTManager(cfg)
|
||||
claims, err := jwtManager.ValidateToken(context.Background(), response.RegistryToken)
|
||||
require.NoError(t, err)
|
||||
assert.Equal(t, tt.expectedPerms, claims.Permissions)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
Loading…
Reference in a new issue