## Summary Fixes #663 - **Security fix**: `mcp-publisher login` no longer writes `.mcpregistry_github_token` and `.mcpregistry_registry_token` to the current working directory. GitHub tokens are kept in memory during the login→exchange flow and cleared immediately after. - **Token location**: Unified token moved from `~/.mcp_publisher_token` to `~/.config/mcp-publisher/token.json` (dir 0700, file 0600), following the convention used by `gh`, `docker`, and `kubectl`. - **Dead code removed**: `NeedsLogin()` was on the `Provider` interface but never called — removed from interface and all 4 implementations. `forceLogin` field also removed. - **Auth tests added**: 11 new tests for `GitHubATProvider` (package previously had 0 tests). - **Test isolation**: `SetupTestToken` now uses `t.TempDir()` + `t.Setenv("HOME", ...)` instead of writing to real `$HOME`. ### Breaking change Users must re-login after upgrading (`mcp-publisher login <method>`). Existing tokens at `~/.mcp_publisher_token` are not auto-migrated. `logout` cleans up both old and new locations. ## Test plan - [x] `make check` passes (lint, unit tests, integration tests) - [x] `mcp-publisher login none` stores token at `~/.config/mcp-publisher/token.json` - [x] No `.mcpregistry_*` files created in cwd after login (with `--token`, `MCP_GITHUB_TOKEN`, or device flow) - [x] `mcp-publisher publish` reads token from new location - [x] `mcp-publisher validate` reads registry URL from new location - [x] `mcp-publisher logout` cleans up new location, legacy `~/.mcp_publisher_token`, and cwd `.mcpregistry_*` files - [x] `mcp-publisher logout` when not logged in shows "Not logged in" - [x] File permissions: dir 0700, file 0600 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
117 lines
3.1 KiB
Go
117 lines
3.1 KiB
Go
package commands_test
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/modelcontextprotocol/registry/internal/validators"
|
|
apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// SetupMockRegistryServer creates an httptest.Server that mocks the registry API
|
|
func SetupMockRegistryServer(t *testing.T, publishHandler func(w http.ResponseWriter, r *http.Request), validateHandler func(w http.ResponseWriter, r *http.Request)) *httptest.Server {
|
|
t.Helper()
|
|
|
|
mux := http.NewServeMux()
|
|
|
|
// Default handlers if not provided
|
|
if publishHandler == nil {
|
|
publishHandler = func(w http.ResponseWriter, _ *http.Request) {
|
|
w.WriteHeader(http.StatusCreated)
|
|
response := apiv0.ServerResponse{
|
|
Server: apiv0.ServerJSON{
|
|
Name: "com.example/test",
|
|
Version: "1.0.0",
|
|
},
|
|
}
|
|
_ = json.NewEncoder(w).Encode(response)
|
|
}
|
|
}
|
|
|
|
if validateHandler == nil {
|
|
validateHandler = func(w http.ResponseWriter, _ *http.Request) {
|
|
w.Header().Set("Content-Type", "application/json")
|
|
result := validators.ValidationResult{Valid: true}
|
|
_ = json.NewEncoder(w).Encode(result)
|
|
}
|
|
}
|
|
|
|
mux.HandleFunc("/v0/publish", func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodPost {
|
|
w.WriteHeader(http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
publishHandler(w, r)
|
|
})
|
|
|
|
mux.HandleFunc("/v0/validate", func(w http.ResponseWriter, r *http.Request) {
|
|
if r.Method != http.MethodPost {
|
|
w.WriteHeader(http.StatusMethodNotAllowed)
|
|
return
|
|
}
|
|
validateHandler(w, r)
|
|
})
|
|
|
|
server := httptest.NewServer(mux)
|
|
t.Cleanup(server.Close)
|
|
|
|
return server
|
|
}
|
|
|
|
// SetupTestToken creates a token file pointing to the test server.
|
|
// It overrides $HOME to a temp directory so tests don't touch real credentials.
|
|
func SetupTestToken(t *testing.T, registryURL, token string) string {
|
|
t.Helper()
|
|
|
|
// Override $HOME so tokenFilePath() resolves to a temp directory
|
|
tempHome := t.TempDir()
|
|
t.Setenv("HOME", tempHome)
|
|
|
|
dir := filepath.Join(tempHome, ".config", "mcp-publisher")
|
|
require.NoError(t, os.MkdirAll(dir, 0700))
|
|
|
|
tokenPath := filepath.Join(dir, "token.json")
|
|
tokenData := map[string]string{
|
|
"token": token,
|
|
"registry": registryURL,
|
|
}
|
|
|
|
data, err := json.Marshal(tokenData)
|
|
require.NoError(t, err)
|
|
|
|
err = os.WriteFile(tokenPath, data, 0600)
|
|
require.NoError(t, err)
|
|
|
|
return tokenPath
|
|
}
|
|
|
|
// CreateTestServerJSON creates a server.json file in a temp directory and changes to it
|
|
func CreateTestServerJSON(t *testing.T, serverJSON apiv0.ServerJSON) (string, string) {
|
|
t.Helper()
|
|
|
|
tempDir, err := os.MkdirTemp("", "mcp-publisher-test")
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { os.RemoveAll(tempDir) })
|
|
|
|
jsonData, err := json.MarshalIndent(serverJSON, "", " ")
|
|
require.NoError(t, err)
|
|
|
|
serverFile := filepath.Join(tempDir, "server.json")
|
|
err = os.WriteFile(serverFile, jsonData, 0600)
|
|
require.NoError(t, err)
|
|
|
|
// Change to temp directory
|
|
originalDir, err := os.Getwd()
|
|
require.NoError(t, err)
|
|
t.Cleanup(func() { _ = os.Chdir(originalDir) })
|
|
|
|
err = os.Chdir(tempDir)
|
|
require.NoError(t, err)
|
|
|
|
return tempDir, serverFile
|
|
}
|