f975e68cf2## Summary Simplified the schema structure by: - Replacing `version_detail.version` with direct `version` field - Removing unused `release_date` field from seed data - Updating all API types, models, and tests to match new structure - Maintaining backwards compatibility in API responses This change makes the schema more intuitive and reduces nesting depth.
238 lines
7.7 KiB
Go
238 lines
7.7 KiB
Go
package v0_test
|
|
|
|
import (
|
|
"bytes"
|
|
"crypto/ed25519"
|
|
"crypto/rand"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/danielgtaylor/huma/v2"
|
|
"github.com/danielgtaylor/huma/v2/adapters/humago"
|
|
v0 "github.com/modelcontextprotocol/registry/internal/api/handlers/v0"
|
|
"github.com/modelcontextprotocol/registry/internal/auth"
|
|
"github.com/modelcontextprotocol/registry/internal/config"
|
|
"github.com/modelcontextprotocol/registry/internal/database"
|
|
"github.com/modelcontextprotocol/registry/internal/service"
|
|
apiv0 "github.com/modelcontextprotocol/registry/pkg/api/v0"
|
|
"github.com/modelcontextprotocol/registry/pkg/model"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestPublishRegistryValidation(t *testing.T) {
|
|
// Create test config with validation ENABLED
|
|
testSeed := make([]byte, ed25519.SeedSize)
|
|
_, err := rand.Read(testSeed)
|
|
require.NoError(t, err)
|
|
testConfig := &config.Config{
|
|
JWTPrivateKey: hex.EncodeToString(testSeed),
|
|
EnableRegistryValidation: true, // Enable validation for this test
|
|
}
|
|
|
|
// Setup fake service
|
|
registryService := service.NewRegistryService(database.NewMemoryDB(), testConfig)
|
|
|
|
// Create a new ServeMux and Huma API
|
|
mux := http.NewServeMux()
|
|
api := humago.New(mux, huma.DefaultConfig("Test API", "1.0.0"))
|
|
|
|
// Register the endpoint
|
|
v0.RegisterPublishEndpoint(api, registryService, testConfig)
|
|
|
|
t.Run("publish fails with npm registry validation error", func(t *testing.T) {
|
|
publishReq := apiv0.ServerJSON{
|
|
Name: "com.example/test-server-with-npm",
|
|
Description: "A test server with invalid npm package reference",
|
|
Version: "1.0.0",
|
|
Packages: []model.Package{
|
|
{
|
|
RegistryType: model.RegistryTypeNPM,
|
|
Identifier: "nonexistent-npm-package-xyz123",
|
|
Version: "1.0.0",
|
|
Transport: model.Transport{
|
|
Type: model.TransportTypeStdio,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Generate valid JWT token with wildcard permission
|
|
claims := auth.JWTClaims{
|
|
AuthMethod: auth.MethodNone,
|
|
Permissions: []auth.Permission{
|
|
{Action: auth.PermissionActionPublish, ResourcePattern: "*"},
|
|
},
|
|
}
|
|
token, err := generateTestJWTToken(testConfig, claims)
|
|
require.NoError(t, err)
|
|
|
|
body, err := json.Marshal(publishReq)
|
|
require.NoError(t, err)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v0/publish", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
|
|
rr := httptest.NewRecorder()
|
|
mux.ServeHTTP(rr, req)
|
|
|
|
assert.Equal(t, http.StatusBadRequest, rr.Code)
|
|
assert.Contains(t, rr.Body.String(), "registry validation failed")
|
|
})
|
|
|
|
t.Run("publish succeeds with MCPB package (registry validation enabled)", func(t *testing.T) {
|
|
publishReq := apiv0.ServerJSON{
|
|
Name: "com.example/test-server-mcpb-validation",
|
|
Description: "A test server with MCPB package and registry validation enabled",
|
|
Version: "0.0.36",
|
|
Packages: []model.Package{
|
|
{
|
|
RegistryType: model.RegistryTypeMCPB,
|
|
Identifier: "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
|
|
Version: "0.0.36",
|
|
FileSHA256: "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
|
|
Transport: model.Transport{
|
|
Type: model.TransportTypeStdio,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Generate valid JWT token with wildcard permission
|
|
claims := auth.JWTClaims{
|
|
AuthMethod: auth.MethodNone,
|
|
Permissions: []auth.Permission{
|
|
{Action: auth.PermissionActionPublish, ResourcePattern: "*"},
|
|
},
|
|
}
|
|
token, err := generateTestJWTToken(testConfig, claims)
|
|
require.NoError(t, err)
|
|
|
|
body, err := json.Marshal(publishReq)
|
|
require.NoError(t, err)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v0/publish", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
|
|
rr := httptest.NewRecorder()
|
|
mux.ServeHTTP(rr, req)
|
|
|
|
assert.Equal(t, http.StatusOK, rr.Code)
|
|
|
|
var response apiv0.ServerJSON
|
|
err = json.Unmarshal(rr.Body.Bytes(), &response)
|
|
require.NoError(t, err)
|
|
|
|
assert.Equal(t, publishReq.Name, response.Name)
|
|
assert.Equal(t, publishReq.Version, response.Version)
|
|
assert.Len(t, response.Packages, 1)
|
|
assert.Equal(t, model.RegistryTypeMCPB, response.Packages[0].RegistryType)
|
|
})
|
|
|
|
t.Run("publish fails when second package fails npm validation", func(t *testing.T) {
|
|
publishReq := apiv0.ServerJSON{
|
|
Name: "com.example/test-server-multiple-packages",
|
|
Description: "A test server with multiple packages where second fails",
|
|
Version: "1.0.0",
|
|
Packages: []model.Package{
|
|
{
|
|
RegistryType: model.RegistryTypeMCPB,
|
|
Identifier: "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
|
|
Version: "1.0.0",
|
|
FileSHA256: "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
|
|
Transport: model.Transport{
|
|
Type: model.TransportTypeStdio,
|
|
},
|
|
},
|
|
{
|
|
RegistryType: model.RegistryTypeNPM,
|
|
Identifier: "nonexistent-second-package-abc123",
|
|
Version: "1.0.0",
|
|
Transport: model.Transport{
|
|
Type: model.TransportTypeStdio,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Generate valid JWT token with wildcard permission
|
|
claims := auth.JWTClaims{
|
|
AuthMethod: auth.MethodNone,
|
|
Permissions: []auth.Permission{
|
|
{Action: auth.PermissionActionPublish, ResourcePattern: "*"},
|
|
},
|
|
}
|
|
token, err := generateTestJWTToken(testConfig, claims)
|
|
require.NoError(t, err)
|
|
|
|
body, err := json.Marshal(publishReq)
|
|
require.NoError(t, err)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v0/publish", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
|
|
rr := httptest.NewRecorder()
|
|
mux.ServeHTTP(rr, req)
|
|
|
|
assert.Equal(t, http.StatusBadRequest, rr.Code)
|
|
assert.Contains(t, rr.Body.String(), "registry validation failed for package 1")
|
|
assert.Contains(t, rr.Body.String(), "nonexistent-second-package-abc123")
|
|
})
|
|
|
|
t.Run("publish fails when first package fails validation", func(t *testing.T) {
|
|
publishReq := apiv0.ServerJSON{
|
|
Name: "com.example/test-server-first-package-fails",
|
|
Description: "A test server where first package fails",
|
|
Version: "1.0.0",
|
|
Packages: []model.Package{
|
|
{
|
|
RegistryType: model.RegistryTypeNPM,
|
|
Identifier: "nonexistent-first-package-xyz789",
|
|
Version: "1.0.0",
|
|
Transport: model.Transport{
|
|
Type: model.TransportTypeStdio,
|
|
},
|
|
},
|
|
{
|
|
RegistryType: model.RegistryTypeMCPB,
|
|
Identifier: "https://github.com/microsoft/playwright-mcp/releases/download/v0.0.36/playwright-mcp-extension-v0.0.36.zip",
|
|
Version: "1.0.0",
|
|
FileSHA256: "fe333e598595000ae021bd27117db32ec69af6987f507ba7a63c90638ff633ce",
|
|
Transport: model.Transport{
|
|
Type: model.TransportTypeStdio,
|
|
},
|
|
},
|
|
},
|
|
}
|
|
|
|
// Generate valid JWT token with wildcard permission
|
|
claims := auth.JWTClaims{
|
|
AuthMethod: auth.MethodNone,
|
|
Permissions: []auth.Permission{
|
|
{Action: auth.PermissionActionPublish, ResourcePattern: "*"},
|
|
},
|
|
}
|
|
token, err := generateTestJWTToken(testConfig, claims)
|
|
require.NoError(t, err)
|
|
|
|
body, err := json.Marshal(publishReq)
|
|
require.NoError(t, err)
|
|
|
|
req := httptest.NewRequest(http.MethodPost, "/v0/publish", bytes.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("Authorization", "Bearer "+token)
|
|
|
|
rr := httptest.NewRecorder()
|
|
mux.ServeHTTP(rr, req)
|
|
|
|
assert.Equal(t, http.StatusBadRequest, rr.Code)
|
|
assert.Contains(t, rr.Body.String(), "registry validation failed for package 0")
|
|
assert.Contains(t, rr.Body.String(), "nonexistent-first-package-xyz789")
|
|
})
|
|
}
|