66b2efa11eSurface unreachable Protected Resource Metadata instead of falling back to legacy discovery
4453 lines
201 KiB
Ruby
4453 lines
201 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "test_helper"
|
|
require "base64"
|
|
require "json"
|
|
require "webmock/minitest"
|
|
require "faraday"
|
|
require "mcp/client/oauth"
|
|
|
|
module MCP
|
|
class Client
|
|
module OAuth
|
|
class FlowTest < Minitest::Test
|
|
def setup
|
|
WebMock.enable!
|
|
@server_url = "https://srv.example.com/mcp"
|
|
@prm_url = "https://srv.example.com/.well-known/oauth-protected-resource/mcp"
|
|
@auth_base = "https://auth.example.com"
|
|
@as_metadata_url = "#{@auth_base}/.well-known/oauth-authorization-server"
|
|
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "test-client", client_name: "ruby-sdk-test"),
|
|
)
|
|
|
|
stub_request(:post, "#{@auth_base}/token").to_return do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
{
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
access_token: "test-token-from-flow",
|
|
token_type: "Bearer",
|
|
expires_in: 3600,
|
|
grant_type_received: form["grant_type"],
|
|
code_verifier_received: form["code_verifier"],
|
|
),
|
|
}
|
|
end
|
|
end
|
|
|
|
def teardown
|
|
WebMock.reset!
|
|
end
|
|
|
|
# A plain authorization-code provider for the destination-check tests.
|
|
# They all expect to fail before any redirect happens, so the handlers stay inert;
|
|
# a test that reached them would be asserting the wrong thing.
|
|
def ssrf_test_provider
|
|
Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
end
|
|
|
|
def client_credentials_provider(token_endpoint_auth_method: "client_secret_basic", token_request_params: nil, http_client_customizer: nil)
|
|
ClientCredentialsProvider.new(
|
|
client_id: "cc-client",
|
|
client_secret: "cc-secret",
|
|
token_endpoint_auth_method: token_endpoint_auth_method,
|
|
token_request_params: token_request_params,
|
|
http_client_customizer: http_client_customizer,
|
|
)
|
|
end
|
|
|
|
# An authorization-code provider that drives the code exchange and refresh with the given parameters.
|
|
def provider_with_token_request_params(params, redirect_handler: ->(_url) {}, callback_handler: -> { [nil, nil] })
|
|
Provider.new(**authorization_code_provider_arguments(redirect_handler, callback_handler), token_request_params: params)
|
|
end
|
|
|
|
# Overriding the reader bypasses the constructor's validation, leaving the flow's own check to be exercised.
|
|
def provider_returning_token_request_params(params, redirect_handler: ->(_url) {}, callback_handler: -> { [nil, nil] })
|
|
provider_class = Class.new(Provider) do
|
|
define_method(:token_request_params) { params }
|
|
end
|
|
|
|
provider_class.new(**authorization_code_provider_arguments(redirect_handler, callback_handler))
|
|
end
|
|
|
|
def authorization_code_provider_arguments(redirect_handler, callback_handler)
|
|
{
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: redirect_handler,
|
|
callback_handler: callback_handler,
|
|
}
|
|
end
|
|
|
|
# See `provider_returning_token_request_params`.
|
|
def client_credentials_provider_returning(token_request_params:)
|
|
provider_class = Class.new(ClientCredentialsProvider) do
|
|
define_method(:token_request_params) { token_request_params }
|
|
end
|
|
|
|
provider_class.new(client_id: "cc-client", client_secret: "cc-secret")
|
|
end
|
|
|
|
# `OpenSSL::PKey::EC.generate` only exists from the openssl gem 2.2 (Ruby 3.0);
|
|
# fall back to the pre-3.0 API on older Rubies.
|
|
def generate_es256_key
|
|
if OpenSSL::PKey::EC.respond_to?(:generate)
|
|
OpenSSL::PKey::EC.generate("prime256v1")
|
|
else
|
|
OpenSSL::PKey::EC.new("prime256v1").tap(&:generate_key)
|
|
end
|
|
end
|
|
|
|
# Records `[method, url]` for every request that passes through, standing in for the tracing middleware
|
|
# an application adds through `http_client_customizer`.
|
|
class RecordingMiddleware
|
|
def initialize(app, log)
|
|
@app = app
|
|
@log = log
|
|
end
|
|
|
|
def call(env)
|
|
@log << [env.method, env.url.to_s]
|
|
@app.call(env)
|
|
end
|
|
end
|
|
|
|
# Sends the request for `from` to `to` instead, the shape redirect-following middleware leaves behind:
|
|
# the flow asked for one URL and the adapter is handed another.
|
|
class URLRewritingMiddleware
|
|
def initialize(app, from:, to:)
|
|
@app = app
|
|
@from = from
|
|
@to = to
|
|
end
|
|
|
|
def call(env)
|
|
env.url = URI(@to) if env.url.to_s == @from
|
|
@app.call(env)
|
|
end
|
|
end
|
|
|
|
# Replaces the per-request context the way instrumentation middleware may; the guard must not depend on it.
|
|
class ContextReplacingMiddleware
|
|
def initialize(app)
|
|
@app = app
|
|
end
|
|
|
|
def call(env)
|
|
env.request.context = { tag: "instrumented" }
|
|
@app.call(env)
|
|
end
|
|
end
|
|
|
|
# Hands the next middleware an environment rebuilt from Faraday's own members only, dropping whatever
|
|
# an earlier middleware recorded on the original.
|
|
class EnvRebuildingMiddleware
|
|
def initialize(app)
|
|
@app = app
|
|
end
|
|
|
|
def call(env)
|
|
@app.call(Faraday::Env.from(env.to_h))
|
|
end
|
|
end
|
|
|
|
# Follows a `3xx` the way `faraday-follow_redirects` does: duplicates the environment, points it at the `Location`,
|
|
# and re-enters the stack from its own position.
|
|
class RedirectFollowingMiddleware
|
|
def initialize(app)
|
|
@app = app
|
|
end
|
|
|
|
def call(env)
|
|
response = @app.call(env)
|
|
location = response.headers["Location"]
|
|
return response unless location && (300..399).cover?(response.status)
|
|
|
|
redirected = env.dup
|
|
redirected.url = URI(location)
|
|
redirected.response = nil
|
|
@app.call(redirected)
|
|
end
|
|
end
|
|
|
|
# Replaces the request options wholesale, the way middleware that resets timeouts or contexts might.
|
|
class RequestOptionsReplacingMiddleware
|
|
def initialize(app)
|
|
@app = app
|
|
end
|
|
|
|
def call(env)
|
|
env.request = Faraday::RequestOptions.new
|
|
@app.call(env)
|
|
end
|
|
end
|
|
|
|
# Re-enters the stack once with the same environment after a `5xx`, the way retry middleware does.
|
|
class RetryingMiddleware
|
|
def initialize(app)
|
|
@app = app
|
|
end
|
|
|
|
def call(env)
|
|
response = @app.call(env)
|
|
return response unless response.status >= 500
|
|
|
|
env.response = nil
|
|
@app.call(env)
|
|
end
|
|
end
|
|
|
|
# Records the application's `trace_id` from the per-request context, as a tracing middleware would.
|
|
class ContextRecordingMiddleware
|
|
def initialize(app, log)
|
|
@app = app
|
|
@log = log
|
|
end
|
|
|
|
def call(env)
|
|
@log << env.request.context&.dig(:trace_id)
|
|
@app.call(env)
|
|
end
|
|
end
|
|
|
|
# Runs the full authorization flow and returns the `scope` query parameter
|
|
# sent on the authorization request. The caller stubs the AS metadata;
|
|
# this helper supplies a provider whose `grant_types` and optional pre-set
|
|
# `scope` drive the SEP-2207 offline_access decision.
|
|
def capture_authorization_scope(grant_types:, provider_scope: nil)
|
|
captured_scope = nil
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: grant_types,
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
query = URI.decode_www_form(url.query).to_h
|
|
captured_scope = query["scope"]
|
|
state_holder[:state] = query.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
scope: provider_scope,
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
captured_scope
|
|
end
|
|
|
|
def test_run_uses_client_credentials_grant_for_client_credentials_provider
|
|
provider = client_credentials_provider
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
# No authorization-code machinery: /authorize is never contacted
|
|
# (no stub exists for it, so a request would raise), and DCR is not
|
|
# run because credentials are pre-registered.
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
expected_basic = "Basic " + Base64.strict_encode64("cc-client:cc-secret")
|
|
form["grant_type"] == "client_credentials" &&
|
|
!form.key?("code") &&
|
|
!form.key?("code_verifier") &&
|
|
req.headers["Authorization"] == expected_basic
|
|
end
|
|
end
|
|
|
|
def test_run_sends_every_authorization_server_request_through_the_provider_customizer
|
|
log = []
|
|
provider = client_credentials_provider(http_client_customizer: ->(faraday) { faraday.use(RecordingMiddleware, log) })
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal([[:get, @prm_url], [:get, @as_metadata_url], [:post, "#{@auth_base}/token"]], log)
|
|
|
|
# The SDK's defaults are applied before the customizer runs.
|
|
assert_requested(:get, @prm_url, headers: { "Accept" => "application/json" })
|
|
end
|
|
|
|
def test_run_refuses_a_customized_connection_that_sends_a_request_off_the_origin
|
|
stub_request(:get, "https://other.example.com/prm.json").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) { faraday.use(URLRewritingMiddleware, from: @prm_url, to: "https://other.example.com/prm.json") },
|
|
)
|
|
|
|
error = assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_equal(<<~MESSAGE, error.message)
|
|
Request to \"#{@prm_url}\" would be sent to \"https://other.example.com/prm.json\", on a different origin; \
|
|
middleware that follows redirects or rewrites URLs is refused.
|
|
MESSAGE
|
|
|
|
# The guard sits before the adapter, so the request never leaves.
|
|
assert_not_requested(:get, "https://other.example.com/prm.json")
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_keeps_a_same_origin_rewrite
|
|
moved_url = "https://srv.example.com/prm-moved.json"
|
|
stub_request(:get, moved_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) { faraday.use(URLRewritingMiddleware, from: @prm_url, to: moved_url) },
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:get, moved_url)
|
|
end
|
|
|
|
def test_run_refuses_a_rewritten_request_even_when_middleware_replaces_the_request_context
|
|
stub_request(:get, "https://other.example.com/prm.json").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) {
|
|
faraday.use(ContextReplacingMiddleware)
|
|
faraday.use(URLRewritingMiddleware, from: @prm_url, to: "https://other.example.com/prm.json")
|
|
},
|
|
)
|
|
|
|
assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:get, "https://other.example.com/prm.json")
|
|
end
|
|
|
|
def test_run_refuses_a_redirect_off_the_origin_followed_by_middleware_placed_ahead_of_the_stamp
|
|
# `builder.insert(0, ...)` is where middleware that wants to be outermost puts itself, so a follower can
|
|
# land ahead of the SDK's stamp and re-enter the stack; the record of the first URL must survive that.
|
|
stub_request(:get, @prm_url).to_return(status: 302, headers: { "Location" => "https://other.example.com/prm.json" })
|
|
stub_request(:get, "https://other.example.com/prm.json").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) { faraday.builder.insert(0, RedirectFollowingMiddleware) },
|
|
)
|
|
|
|
error = assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/would be sent to "https:\/\/other\.example\.com\/prm\.json", on a different origin/, error.message)
|
|
assert_not_requested(:get, "https://other.example.com/prm.json")
|
|
end
|
|
|
|
def test_run_keeps_a_same_origin_redirect_followed_by_middleware_placed_ahead_of_the_stamp
|
|
moved_url = "https://srv.example.com/prm-moved.json"
|
|
stub_request(:get, @prm_url).to_return(status: 302, headers: { "Location" => moved_url })
|
|
stub_request(:get, moved_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) { faraday.builder.insert(0, RedirectFollowingMiddleware) },
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:get, moved_url)
|
|
end
|
|
|
|
def test_run_refuses_a_request_whose_environment_was_rebuilt
|
|
provider = client_credentials_provider(http_client_customizer: ->(faraday) { faraday.use(EnvRebuildingMiddleware) })
|
|
|
|
error = assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_equal(<<~MESSAGE, error.message)
|
|
Request to \"#{@prm_url}\" carries no record of the URL the flow asked for; \
|
|
middleware that rebuilds the request environment is refused.
|
|
MESSAGE
|
|
assert_not_requested(:get, @prm_url)
|
|
end
|
|
|
|
def test_run_refuses_a_rewritten_token_request
|
|
stub_request(:post, "https://other.example.com/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "stolen", token_type: "Bearer"),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) {
|
|
faraday.use(URLRewritingMiddleware, from: "#{@auth_base}/token", to: "https://other.example.com/token")
|
|
},
|
|
)
|
|
|
|
assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:post, "https://other.example.com/token")
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
assert_nil(provider.access_token)
|
|
end
|
|
|
|
def test_run_keeps_the_application_request_context_for_every_request
|
|
trace_ids = []
|
|
|
|
result = run_authorization_flow(
|
|
http_client_customizer: ->(faraday) {
|
|
faraday.options.context = { trace_id: "incident-123" }
|
|
faraday.use(ContextRecordingMiddleware, trace_ids)
|
|
},
|
|
)
|
|
|
|
assert_equal(:authorized, result)
|
|
# Protected Resource Metadata and authorization server metadata (GET), registration (JSON POST),
|
|
# and the token exchange (form POST) all carry it.
|
|
assert_equal(["incident-123"] * 4, trace_ids)
|
|
end
|
|
|
|
def test_run_keeps_the_application_request_context_on_a_factory_connection
|
|
trace_ids = []
|
|
factory = -> {
|
|
Faraday.new do |faraday|
|
|
faraday.options.context = { trace_id: "incident-123" }
|
|
faraday.use(ContextRecordingMiddleware, trace_ids)
|
|
end
|
|
}
|
|
|
|
result = Flow.new(provider: client_credentials_provider, http_client_factory: factory).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal(["incident-123"] * 3, trace_ids)
|
|
end
|
|
|
|
def test_run_refuses_a_rewritten_request_even_when_middleware_replaces_the_request_options
|
|
stub_request(:get, "https://other.example.com/prm.json").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(
|
|
http_client_customizer: ->(faraday) {
|
|
faraday.use(RequestOptionsReplacingMiddleware)
|
|
faraday.use(URLRewritingMiddleware, from: @prm_url, to: "https://other.example.com/prm.json")
|
|
},
|
|
)
|
|
|
|
error = assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
# The mismatch, not a lost record: replacing the options must leave the record in place.
|
|
assert_match(/would be sent to "https:\/\/other\.example\.com\/prm\.json", on a different origin/, error.message)
|
|
assert_not_requested(:get, "https://other.example.com/prm.json")
|
|
end
|
|
|
|
def test_run_refuses_a_redirect_off_the_origin_followed_by_middleware_placed_after_the_stamp
|
|
stub_request(:get, @prm_url).to_return(status: 302, headers: { "Location" => "https://other.example.com/prm.json" })
|
|
stub_request(:get, "https://other.example.com/prm.json").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(http_client_customizer: ->(faraday) { faraday.use(RedirectFollowingMiddleware) })
|
|
|
|
error = assert_raises(Flow::DestinationMismatchError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
# The mismatch, not a lost record: the duplicate the follower re-enters with shares the record.
|
|
assert_match(/would be sent to "https:\/\/other\.example\.com\/prm\.json", on a different origin/, error.message)
|
|
assert_not_requested(:get, "https://other.example.com/prm.json")
|
|
end
|
|
|
|
def test_run_keeps_a_same_origin_redirect_followed_by_middleware_placed_after_the_stamp
|
|
moved_url = "https://srv.example.com/prm-moved.json"
|
|
stub_request(:get, @prm_url).to_return(status: 302, headers: { "Location" => moved_url })
|
|
stub_request(:get, moved_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
)
|
|
provider = client_credentials_provider(http_client_customizer: ->(faraday) { faraday.use(RedirectFollowingMiddleware) })
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:get, moved_url)
|
|
end
|
|
|
|
def test_run_keeps_a_retry_by_middleware_placed_ahead_of_the_stamp
|
|
# The same environment re-enters the stack with the same URL, so the first record still matches.
|
|
stub_request(:get, @prm_url).to_return(
|
|
{ status: 503 },
|
|
{
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: "https://srv.example.com/mcp", authorization_servers: [@auth_base]),
|
|
},
|
|
)
|
|
provider = client_credentials_provider(http_client_customizer: ->(faraday) { faraday.builder.insert(0, RetryingMiddleware) })
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:get, @prm_url, times: 2)
|
|
end
|
|
|
|
def test_build_http_client_records_each_request_on_its_own
|
|
# A caller using the SDK-built connection directly may address different origins from one request
|
|
# to the next; each request gets its own record.
|
|
stub_request(:get, "https://a.example.com/one").to_return(status: 200, body: "one")
|
|
stub_request(:get, "https://b.example.com/two").to_return(status: 200, body: "two")
|
|
connection = Flow.build_http_client
|
|
|
|
assert_equal("one", connection.get("https://a.example.com/one").body)
|
|
assert_equal("two", connection.get("https://b.example.com/two").body)
|
|
end
|
|
|
|
def test_run_prefers_an_explicit_http_client_factory_over_the_customizer
|
|
provider = client_credentials_provider(http_client_customizer: ->(_faraday) { raise "the customizer must not run" })
|
|
|
|
result = Flow.new(provider: provider, http_client_factory: -> { Faraday.new }).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
end
|
|
|
|
def test_run_client_credentials_with_client_secret_post_sends_credentials_in_body
|
|
# `client_secret_post` puts the credentials in the form body rather
|
|
# than an HTTP Basic header (RFC 6749 Section 2.3.1).
|
|
provider = client_credentials_provider(token_endpoint_auth_method: "client_secret_post")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
form["grant_type"] == "client_credentials" &&
|
|
form["client_id"] == "cc-client" &&
|
|
form["client_secret"] == "cc-secret" &&
|
|
req.headers["Authorization"].nil?
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_with_client_secret_basic_omits_client_id_from_body
|
|
# Explicit Basic authentication must keep both credentials in the header
|
|
# to avoid servers treating body credentials as a second auth method.
|
|
provider = client_credentials_provider(token_endpoint_auth_method: "client_secret_basic")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
req.headers["Authorization"] == "Basic " + Base64.strict_encode64("cc-client:cc-secret") &&
|
|
!form.key?("client_id") &&
|
|
!form.key?("client_secret")
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_raises_clean_error_when_client_information_missing
|
|
# The constructor always stores credentials, but if a custom storage loses them
|
|
# the grant must fail with a domain error rather than a `NoMethodError` from
|
|
# the authorization-code registration helper.
|
|
provider = client_credentials_provider
|
|
provider.storage.save_client_information(nil)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
assert_match(/client_credentials grant/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_client_credentials_succeeds_with_matching_stored_issuer
|
|
provider = client_credentials_provider
|
|
provider.storage.save_client_information(
|
|
provider.storage.client_information.merge("issuer" => @auth_base),
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
end
|
|
|
|
def test_run_client_credentials_raises_for_mismatched_stored_issuer
|
|
# Per SEP-2352, static machine-to-machine credentials bound to another authorization server must surface
|
|
# an error instead of being replayed; re-registration is not an option for pre-registered credentials.
|
|
provider = client_credentials_provider
|
|
provider.storage.save_client_information(
|
|
provider.storage.client_information.merge("issuer" => "https://old-as.example.com"),
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/bound to a different authorization server/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_client_credentials_requests_scope_from_prm_scopes_supported
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp",
|
|
authorization_servers: [@auth_base],
|
|
scopes_supported: ["mcp:read", "mcp:write"],
|
|
),
|
|
)
|
|
|
|
provider = client_credentials_provider
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
URI.decode_www_form(req.body).to_h["scope"] == "mcp:read mcp:write"
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_with_private_key_jwt_sends_signed_assertion
|
|
# SEP-1046 / RFC 7523 Section 2.2: the token request authenticates
|
|
# with a signed JWT assertion; `client_id` and any shared secret are
|
|
# absent from the body, and the assertion's audience is the AS issuer.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
token_endpoint: "#{@auth_base}/token",
|
|
grant_types_supported: ["client_credentials"],
|
|
token_endpoint_auth_methods_supported: ["private_key_jwt"],
|
|
token_endpoint_auth_signing_alg_values_supported: ["ES256"],
|
|
),
|
|
)
|
|
|
|
provider = ClientCredentialsProvider.new(
|
|
client_id: "cc-client",
|
|
token_endpoint_auth_method: "private_key_jwt",
|
|
private_key: generate_es256_key,
|
|
signing_algorithm: "ES256",
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
payload_segment = form["client_assertion"].to_s.split(".")[1].to_s
|
|
claims = JSON.parse(Base64.urlsafe_decode64(payload_segment + "=" * (-payload_segment.length % 4)))
|
|
|
|
form["grant_type"] == "client_credentials" &&
|
|
form["client_assertion_type"] == "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" &&
|
|
!form.key?("client_id") &&
|
|
!form.key?("client_secret") &&
|
|
req.headers["Authorization"].nil? &&
|
|
claims["iss"] == "cc-client" &&
|
|
claims["sub"] == "cc-client" &&
|
|
claims["aud"] == @auth_base &&
|
|
form["resource"] == "https://srv.example.com/mcp"
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_sends_token_request_params_with_client_secret_basic
|
|
provider = client_credentials_provider(token_request_params: { "audience" => "https://api.example.com" })
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "client_credentials" &&
|
|
form["resource"] == "https://srv.example.com/mcp" &&
|
|
form["audience"] == "https://api.example.com" &&
|
|
!form.key?("client_id") &&
|
|
req.headers["Authorization"] == "Basic " + Base64.strict_encode64("cc-client:cc-secret")
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_sends_token_request_params_returned_by_a_provider_method
|
|
provider = client_credentials_provider_returning(token_request_params: { "audience" => "https://api.example.com" })
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
URI.decode_www_form(req.body).to_h["audience"] == "https://api.example.com"
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_sends_the_same_request_for_empty_token_request_params
|
|
provider = client_credentials_provider(token_request_params: {})
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
URI.decode_www_form(req.body).map(&:first) == ["grant_type", "resource"]
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_sends_token_request_params_with_client_secret_post
|
|
provider = client_credentials_provider(
|
|
token_endpoint_auth_method: "client_secret_post",
|
|
token_request_params: { "audience" => "https://api.example.com" },
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["audience"] == "https://api.example.com" &&
|
|
form["client_id"] == "cc-client" &&
|
|
form["client_secret"] == "cc-secret"
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_sends_token_request_params_with_private_key_jwt
|
|
provider = ClientCredentialsProvider.new(
|
|
client_id: "cc-client",
|
|
token_endpoint_auth_method: "private_key_jwt",
|
|
private_key: generate_es256_key,
|
|
signing_algorithm: "ES256",
|
|
token_request_params: { "audience" => "https://api.example.com" },
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["audience"] == "https://api.example.com" &&
|
|
form["client_assertion_type"] == "urn:ietf:params:oauth:client-assertion-type:jwt-bearer" &&
|
|
!form["client_assertion"].to_s.empty?
|
|
end
|
|
end
|
|
|
|
def test_run_sends_token_request_params_on_the_authorization_code_exchange
|
|
state_value = nil
|
|
provider = provider_with_token_request_params(
|
|
{ "audience" => "https://api.example.com" },
|
|
redirect_handler: ->(url) { state_value = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", state_value] },
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "authorization_code" &&
|
|
form["code"] == "test-auth-code" &&
|
|
form["audience"] == "https://api.example.com"
|
|
end
|
|
end
|
|
|
|
def test_refresh_sends_token_request_params
|
|
provider = provider_with_token_request_params({ "audience" => "https://api.example.com" })
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
result = Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:refreshed, result)
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "refresh_token" &&
|
|
form["refresh_token"] == "saved-rt" &&
|
|
form["audience"] == "https://api.example.com"
|
|
end
|
|
end
|
|
|
|
def test_run_sends_token_request_params_on_the_jwt_bearer_grant
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(**) { "id-jag-assertion" },
|
|
token_request_params: { "audience" => "https://api.example.com" },
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "urn:ietf:params:oauth:grant-type:jwt-bearer" &&
|
|
form["assertion"] == "id-jag-assertion" &&
|
|
form["audience"] == "https://api.example.com"
|
|
end
|
|
end
|
|
|
|
def test_run_refuses_token_request_params_that_name_a_reserved_parameter
|
|
provider = client_credentials_provider_returning(token_request_params: { "grant_type" => "password" })
|
|
|
|
error = assert_raises(Flow::InvalidTokenRequestParamsError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/"grant_type"/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_refuses_token_request_params_that_are_not_a_hash_of_strings
|
|
shapes = ["audience=x", { audience: "x" }, { "audience" => 1 }, { "audience" => nil }, { "audience" => "x" }.compare_by_identity]
|
|
shapes.each do |params|
|
|
provider = client_credentials_provider_returning(token_request_params: params)
|
|
|
|
assert_raises(Flow::InvalidTokenRequestParamsError, "should refuse #{params.inspect}") do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
end
|
|
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_refresh_refuses_token_request_params_that_name_a_reserved_parameter
|
|
# Not an `AuthorizationError`: the transport treats a failed refresh as a reason
|
|
# to run the interactive flow, which would fail the same way afterwards.
|
|
provider = provider_returning_token_request_params({ "refresh_token" => "other" })
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
error = assert_raises(Flow::InvalidTokenRequestParamsError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/"refresh_token"/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_refuses_token_request_params_on_the_authorization_code_exchange
|
|
state_value = nil
|
|
provider = provider_returning_token_request_params(
|
|
{ "code" => "other" },
|
|
redirect_handler: ->(url) { state_value = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", state_value] },
|
|
)
|
|
|
|
error = assert_raises(Flow::InvalidTokenRequestParamsError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/"code"/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_uses_jwt_bearer_grant_for_cross_app_access_provider
|
|
# SEP-990: the ID-JAG assertion (obtained out of band, typically via IdP token exchange) is presented at
|
|
# the token endpoint with client_secret_basic; no PKCE, redirect, or DCR is involved.
|
|
received = nil
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(audience:, resource:) {
|
|
received = { audience: audience, resource: resource }
|
|
"id-jag-assertion"
|
|
},
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
# The assertion audience is the validated AS issuer; the resource is the canonical MCP server URL.
|
|
assert_equal({ audience: @auth_base, resource: "https://srv.example.com/mcp" }, received)
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
expected_basic = "Basic " + Base64.strict_encode64("xaa-client:xaa-secret")
|
|
form["grant_type"] == "urn:ietf:params:oauth:grant-type:jwt-bearer" &&
|
|
form["assertion"] == "id-jag-assertion" &&
|
|
form["resource"] == "https://srv.example.com/mcp" &&
|
|
!form.key?("code") &&
|
|
!form.key?("code_verifier") &&
|
|
req.headers["Authorization"] == expected_basic
|
|
end
|
|
end
|
|
|
|
def test_run_jwt_bearer_raises_when_assertion_provider_returns_nothing
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(audience:, resource:) {},
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/returned no ID-JAG/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_refresh_uses_the_stored_credentials_of_a_cross_app_access_provider
|
|
# RFC 7521 Section 4.1 makes a refresh token unusual for an assertion grant, not forbidden;
|
|
# when the authorization server issued one, it is exchanged with the stored client secret
|
|
# and no new ID-JAG assertion is minted.
|
|
assertion_calls = 0
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(**) {
|
|
assertion_calls += 1
|
|
"id-jag-assertion"
|
|
},
|
|
)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt", "issuer" => @auth_base)
|
|
|
|
result = Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:refreshed, result)
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
assert_equal(@auth_base, provider.tokens["issuer"])
|
|
assert_equal(0, assertion_calls)
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "refresh_token" &&
|
|
form["refresh_token"] == "saved-rt" &&
|
|
!form.key?("assertion") &&
|
|
req.headers["Authorization"] == "Basic " + Base64.strict_encode64("xaa-client:xaa-secret")
|
|
end
|
|
end
|
|
|
|
def test_refresh_uses_the_stored_credentials_of_a_client_credentials_provider
|
|
# RFC 6749 Section 4.4.3 says a refresh token SHOULD NOT be issued for this grant,
|
|
# so one in storage is unusual, but it must be exchanged rather than crash the refresh.
|
|
provider = client_credentials_provider
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt", "issuer" => @auth_base)
|
|
|
|
result = Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:refreshed, result)
|
|
assert_equal(@auth_base, provider.tokens["issuer"])
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "refresh_token" &&
|
|
form["refresh_token"] == "saved-rt" &&
|
|
req.headers["Authorization"] == "Basic " + Base64.strict_encode64("cc-client:cc-secret")
|
|
end
|
|
end
|
|
|
|
def test_refresh_refuses_an_authorization_server_that_did_not_issue_a_cross_app_access_token
|
|
# The token-level issuer binding is what protects these providers: their stored `client_information` carries no `issuer`,
|
|
# so `ensure_refreshable_client_information!` has nothing to compare.
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(**) { "id-jag-assertion" },
|
|
)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt", "issuer" => "https://old-as.example.com")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/issued by a different authorization server/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
def test_refresh_refuses_tokens_without_a_recorded_issuer_for_the_client_credentials_and_jwt_bearer_providers
|
|
# These providers had no refresh before their tokens recorded the issuer, so nothing older needs
|
|
# tolerating; without the record a refresh would go to whatever server discovery names, unasked.
|
|
cross_app = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(**) { "id-jag-assertion" },
|
|
)
|
|
[cross_app, client_credentials_provider].each do |provider|
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
error = assert_raises(Flow::AuthorizationError, "should refuse #{provider.class}") do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/record no issuer/, error.message)
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
assert_not_requested(:get, @prm_url)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_refresh_raises_cleanly_for_a_provider_with_neither_client_information_nor_a_cimd_url
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(**) { "id-jag-assertion" },
|
|
)
|
|
provider.storage.save_client_information(nil)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt", "issuer" => @auth_base)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/no client_information/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_registers_through_dcr_for_a_provider_without_a_cimd_url_reader
|
|
# Registration reads the CIMD URL through the same duck-typed helper as refresh,
|
|
# so a provider that lacks the reader goes to Dynamic Client Registration.
|
|
provider_class = Class.new(Provider) { undef_method :client_id_metadata_document_url }
|
|
state_value = nil
|
|
provider = provider_class.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) { state_value = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", state_value] },
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
end
|
|
|
|
def test_run_uses_authorization_code_grant_for_default_provider
|
|
# A standard `Provider` declares `authorization_flow == :authorization_code`,
|
|
# so `Flow` runs the interactive grant regardless of what `client_metadata[:grant_types]` happens to list.
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code", "client_credentials"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
URI.decode_www_form(req.body).to_h["grant_type"] == "authorization_code"
|
|
end
|
|
end
|
|
|
|
# Runs the full authorization flow with a minimal provider so tests can assert on
|
|
# the Dynamic Client Registration request body. The default loopback redirect URI
|
|
# exercises SEP-837's `"native"` inference; passing an HTTPS `redirect_uri` exercises
|
|
# the `"web"` inference.
|
|
def run_authorization_flow(redirect_uri: "http://localhost:0/callback", client_metadata_extra: {}, http_client_customizer: nil)
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: [redirect_uri],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
}.merge(client_metadata_extra),
|
|
redirect_uri: redirect_uri,
|
|
redirect_handler: ->(url) { state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
http_client_customizer: http_client_customizer,
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
# Runs the authorization-code flow with an `authorization_request_validator` that records what it
|
|
# was handed and answers `approve`.
|
|
private def run_flow_with_validator(approve:, recorder: [])
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
recorder << :redirected
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
authorization_request_validator: ->(request) {
|
|
recorder << request
|
|
approve
|
|
},
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
def test_run_hands_the_authorization_server_and_scopes_to_the_validator
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: @server_url,
|
|
authorization_servers: [@auth_base],
|
|
scopes_supported: ["Mail.Read", "Files.ReadWrite.All"],
|
|
),
|
|
)
|
|
|
|
recorder = []
|
|
run_flow_with_validator(approve: true, recorder: recorder)
|
|
|
|
request = recorder.first
|
|
|
|
assert_equal(@auth_base, request.authorization_server)
|
|
assert_equal(["Mail.Read", "Files.ReadWrite.All"], request.scopes)
|
|
assert_equal(@server_url, request.server_url)
|
|
assert_equal("https://srv.example.com/mcp", request.resource)
|
|
end
|
|
|
|
def test_run_refuses_the_flow_and_registers_nothing_when_the_validator_declines
|
|
recorder = []
|
|
|
|
error = assert_raises(Flow::AuthorizationRefusedError) do
|
|
run_flow_with_validator(approve: false, recorder: recorder)
|
|
end
|
|
|
|
assert_match(/refused by `authorization_request_validator`/, error.message)
|
|
|
|
# Refused before registration, so nothing of this client is left at the authorization server
|
|
# the host just rejected, and no browser was opened.
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
refute_includes(recorder, :redirected)
|
|
end
|
|
|
|
def test_run_client_credentials_consults_the_validator
|
|
provider = ClientCredentialsProvider.new(
|
|
client_id: "cc-client",
|
|
client_secret: "cc-secret",
|
|
authorization_request_validator: ->(_request) { false },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationRefusedError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/refused by `authorization_request_validator`/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_jwt_bearer_consults_the_validator
|
|
minted = false
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(audience:, resource:) {
|
|
minted = true
|
|
"id-jag-assertion"
|
|
},
|
|
authorization_request_validator: ->(_request) { false },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationRefusedError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/refused by `authorization_request_validator`/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
|
|
# Refused before the identity provider was asked for an assertion carrying this authorization server as its audience.
|
|
refute(minted, "the ID-JAG assertion must not be minted for a refused authorization server")
|
|
end
|
|
|
|
def test_run_registers_native_application_type_for_loopback_redirect_uri
|
|
run_authorization_flow
|
|
|
|
assert_requested(:post, "#{@auth_base}/register") do |req|
|
|
JSON.parse(req.body)["application_type"] == "native"
|
|
end
|
|
end
|
|
|
|
def test_run_registers_web_application_type_for_https_redirect_uri
|
|
run_authorization_flow(redirect_uri: "https://app.example.com/callback")
|
|
|
|
assert_requested(:post, "#{@auth_base}/register") do |req|
|
|
JSON.parse(req.body)["application_type"] == "web"
|
|
end
|
|
end
|
|
|
|
def test_run_does_not_override_explicit_application_type
|
|
run_authorization_flow(client_metadata_extra: { application_type: "web" })
|
|
|
|
assert_requested(:post, "#{@auth_base}/register") do |req|
|
|
JSON.parse(req.body)["application_type"] == "web"
|
|
end
|
|
end
|
|
|
|
def test_run_does_not_override_explicit_string_keyed_application_type
|
|
run_authorization_flow(
|
|
redirect_uri: "https://app.example.com/callback",
|
|
client_metadata_extra: { "application_type" => "native" },
|
|
)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register") do |req|
|
|
JSON.parse(req.body)["application_type"] == "native"
|
|
end
|
|
end
|
|
|
|
def test_run_completes_full_authorization_flow
|
|
captured_authorization_url = nil
|
|
state_value = nil
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
client_name: "ruby-sdk-test",
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
captured_authorization_url = url
|
|
state_value = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_value] },
|
|
)
|
|
|
|
flow = Flow.new(provider: provider)
|
|
result = flow.run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
|
|
query = URI.decode_www_form(captured_authorization_url.query).to_h
|
|
assert_equal("code", query["response_type"])
|
|
assert_equal("test-client", query["client_id"])
|
|
assert_equal("S256", query["code_challenge_method"])
|
|
assert_equal("http://localhost:0/callback", query["redirect_uri"])
|
|
assert_equal("https://srv.example.com/mcp", query["resource"])
|
|
|
|
assert_requested(:get, @prm_url)
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
form["grant_type"] == "authorization_code" &&
|
|
form["code"] == "test-auth-code" &&
|
|
!form["code_verifier"].to_s.empty? &&
|
|
form["resource"] == "https://srv.example.com/mcp"
|
|
end
|
|
end
|
|
|
|
def test_run_requests_offline_access_when_advertised_and_refresh_token_grant_declared
|
|
# SEP-2207: a client that declares the `refresh_token` grant type requests `offline_access`
|
|
# when the AS advertises it, so it can obtain a refresh token.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
scopes_supported: ["mcp:basic", "offline_access"],
|
|
),
|
|
)
|
|
|
|
captured = capture_authorization_scope(grant_types: ["authorization_code", "refresh_token"])
|
|
|
|
assert_includes(captured.split, "offline_access")
|
|
end
|
|
|
|
def test_run_does_not_request_offline_access_when_refresh_token_grant_not_declared
|
|
# The AS advertises offline_access, but the client did not opt into refresh tokens,
|
|
# so the scope is not requested.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
scopes_supported: ["mcp:basic", "offline_access"],
|
|
),
|
|
)
|
|
|
|
captured = capture_authorization_scope(grant_types: ["authorization_code"])
|
|
|
|
refute_includes(captured.to_s.split, "offline_access")
|
|
end
|
|
|
|
def test_run_does_not_request_offline_access_when_server_does_not_advertise_it
|
|
# SEP-2207 forbids requesting offline_access when the AS does not list it,
|
|
# even if the client declared the refresh_token grant type.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
scopes_supported: ["mcp:basic", "mcp:read"],
|
|
),
|
|
)
|
|
|
|
captured = capture_authorization_scope(grant_types: ["authorization_code", "refresh_token"])
|
|
|
|
refute_includes(captured.to_s.split, "offline_access")
|
|
end
|
|
|
|
def test_run_strips_offline_access_from_provider_scope_when_server_does_not_advertise_it
|
|
# SDK policy: even when `offline_access` reaches the resolved scope from a provider-supplied scope
|
|
# (or a challenge / PRM scope), do not propagate it to the AS when the AS does not advertise the scope.
|
|
# SEP-2207 itself only says clients should not request unsupported scopes; this strip is the SDK's
|
|
# defensive layer against misbehaving resource servers and misconfigured PRMs that surface `offline_access`
|
|
# even though the AS has not opted in.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
scopes_supported: ["mcp:basic"],
|
|
),
|
|
)
|
|
|
|
captured = capture_authorization_scope(
|
|
grant_types: ["authorization_code", "refresh_token"],
|
|
provider_scope: "mcp:basic offline_access",
|
|
)
|
|
|
|
refute_includes(captured.to_s.split, "offline_access")
|
|
assert_includes(captured.to_s.split, "mcp:basic")
|
|
end
|
|
|
|
def test_run_strips_sole_offline_access_scope_when_server_does_not_advertise_it
|
|
# When stripping leaves an empty scope, no `scope` parameter is sent.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
scopes_supported: ["mcp:basic"],
|
|
),
|
|
)
|
|
|
|
captured = capture_authorization_scope(
|
|
grant_types: ["authorization_code", "refresh_token"],
|
|
provider_scope: "offline_access",
|
|
)
|
|
|
|
assert_nil(captured)
|
|
end
|
|
|
|
def test_run_does_not_duplicate_offline_access_already_in_scope
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
scopes_supported: ["mcp:basic", "offline_access"],
|
|
),
|
|
)
|
|
|
|
captured = capture_authorization_scope(
|
|
grant_types: ["authorization_code", "refresh_token"],
|
|
provider_scope: "mcp:basic offline_access",
|
|
)
|
|
|
|
assert_equal(1, captured.split.count("offline_access"))
|
|
end
|
|
|
|
def test_run_raises_on_state_mismatch
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "wrong-state"] },
|
|
)
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
end
|
|
|
|
def test_run_raises_when_pkce_unsupported
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
code_challenge_methods_supported: ["plain"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/S256/, error.message)
|
|
end
|
|
|
|
def test_run_raises_when_authorization_endpoint_is_missing
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
# NB: no `authorization_endpoint`.
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/authorization_endpoint/i, error.message)
|
|
end
|
|
|
|
def test_run_raises_when_authorization_endpoint_is_malformed_uri
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "ht!tp:bad uri",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/authorization_endpoint/i, error.message)
|
|
end
|
|
|
|
def test_run_raises_when_prm_resource_is_malformed_uri
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "ht!tp:bad uri",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/PRM `resource`|not a valid URI/i, error.message)
|
|
end
|
|
|
|
def test_run_falls_back_to_legacy_discovery_when_prm_is_not_a_json_object
|
|
# Valid JSON but the wrong shape counts as nothing usable being published, so it selects the legacy 2025-03-26 path
|
|
# (matching the TypeScript and Python SDKs); here the legacy path also dead-ends, surfacing a domain error rather than
|
|
# a raw `TypeError` from indexing the array.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: "[]",
|
|
)
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource/mcp").to_return(status: 404)
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-authorization-server").to_return(status: 404)
|
|
stub_request(:get, "https://srv.example.com/.well-known/openid-configuration").to_return(status: 404)
|
|
stub_request(:post, "https://srv.example.com/register").to_return(status: 404)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/Dynamic client registration failed/i, error.message)
|
|
assert_requested(:get, "https://srv.example.com/.well-known/oauth-authorization-server")
|
|
end
|
|
|
|
def test_run_surfaces_a_network_error_during_prm_discovery_instead_of_falling_back
|
|
# A request that never reached the server says nothing about whether it publishes PRM, so once
|
|
# the other candidates answer 404 the flow stops instead of moving to the legacy authorization base;
|
|
# the TypeScript and Python SDKs propagate the error the same way.
|
|
challenge_url = "https://srv.example.com/prm.json"
|
|
stub_request(:get, challenge_url).to_raise(Faraday::ConnectionFailed.new("connection refused"))
|
|
stub_prm_not_found
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: challenge_url)
|
|
end
|
|
|
|
assert_match(/Faraday::ConnectionFailed/, error.message)
|
|
assert_not_requested(:get, "https://srv.example.com/.well-known/oauth-authorization-server")
|
|
assert_not_requested(:post, "https://srv.example.com/register")
|
|
end
|
|
|
|
def test_run_reports_a_prm_candidate_url_without_its_query_in_the_discovery_error
|
|
# The candidate URL comes from the server's `WWW-Authenticate` challenge and lands in every log line
|
|
# the error reaches, so the query is dropped, while the path keeps the spelling that was requested
|
|
# (`%2E` is not decoded) so the line can be matched against the server's access log.
|
|
challenge_url = "https://srv.example.com/prm%2Ejson?token=abc"
|
|
stub_request(:get, challenge_url).to_raise(Faraday::ConnectionFailed.new("connection refused"))
|
|
stub_prm_not_found
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: challenge_url)
|
|
end
|
|
|
|
assert_includes(error.message, "GET https://srv.example.com/prm%2Ejson raised Faraday::ConnectionFailed: connection refused; GET")
|
|
refute_includes(error.message, "token=abc")
|
|
end
|
|
|
|
def test_run_cuts_an_overlong_prm_candidate_url_in_the_discovery_error
|
|
# The challenge URL is the server's to choose, so its length is bounded before it lands in the message.
|
|
challenge_url = "https://srv.example.com/#{"a" * 5000}/prm.json"
|
|
stub_request(:get, challenge_url).to_raise(Faraday::ConnectionFailed.new("connection refused"))
|
|
stub_prm_not_found
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: challenge_url)
|
|
end
|
|
|
|
assert_includes(error.message, "GET #{challenge_url[0, Flow::METADATA_URL_MAX_LENGTH - 3]}... raised Faraday::ConnectionFailed")
|
|
refute_includes(error.message, "a" * (Flow::METADATA_URL_MAX_LENGTH - 3))
|
|
end
|
|
|
|
def test_run_bounds_the_transport_error_message_in_the_discovery_error
|
|
# A caller-supplied client can raise with server-chosen text in the message (Faraday's `raise_error` middleware repeats
|
|
# the status line and the request URL), so it is bounded like the parser's message.
|
|
stub_request(:get, @prm_url).to_raise(Faraday::ConnectionFailed.new("x" * 5000))
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_includes(error.message, "raised Faraday::ConnectionFailed: #{"x" * 125}...; GET")
|
|
refute_includes(error.message, "x" * 126)
|
|
end
|
|
|
|
def test_run_bounds_the_parser_message_in_the_discovery_error
|
|
# json before 2.10 repeats the remaining source in `JSON::ParserError#message`, so a malformed body
|
|
# could otherwise put up to the response cap into the message once per candidate.
|
|
stub_request(:get, @prm_url).to_return(status: 200, headers: { "Content-Type" => "application/json" }, body: "{")
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 503)
|
|
JSON.stubs(:parse).raises(JSON::ParserError, "unexpected token at '#{"{" * 5000}'")
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
# `METADATA_DIAGNOSTIC_MAX_LENGTH` is 128: the first 125 characters survive, then three dots.
|
|
assert_includes(error.message, <<~MESSAGE.chomp)
|
|
returned a body that is not JSON: unexpected token at '#{"{" * 104}...; \
|
|
GET https://srv.example.com/.well-known/oauth-protected-resource returned 503.
|
|
MESSAGE
|
|
|
|
refute_includes(error.message, "{" * 105)
|
|
end
|
|
|
|
def test_run_surfaces_a_server_error_during_prm_discovery_instead_of_falling_back
|
|
# A `5xx` or `429` says nothing about what the server publishes either, even when a later candidate answers 404;
|
|
# the Python SDK refuses the legacy path the same way.
|
|
[503, 429].each do |status|
|
|
stub_request(:get, @prm_url).to_return(status: status)
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError, "status #{status}") do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/returned #{status}/, error.message)
|
|
end
|
|
|
|
assert_not_requested(:get, "https://srv.example.com/.well-known/oauth-authorization-server")
|
|
assert_not_requested(:post, "https://srv.example.com/register")
|
|
end
|
|
|
|
def test_run_keeps_a_server_error_in_mind_when_a_later_candidate_is_unusable
|
|
# An unusable document from a later candidate must not turn an earlier `503` into "nothing published".
|
|
challenge_url = "https://srv.example.com/prm.json"
|
|
stub_request(:get, challenge_url).to_return(status: 503)
|
|
stub_request(:get, @prm_url).to_return(status: 200, headers: { "Content-Type" => "application/json" }, body: "[]")
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: challenge_url)
|
|
end
|
|
|
|
assert_match(/returned 503/, error.message)
|
|
assert_not_requested(:get, "https://srv.example.com/.well-known/oauth-authorization-server")
|
|
end
|
|
|
|
def test_run_uses_a_later_prm_candidate_when_the_challenge_url_serves_an_unusable_document
|
|
# The setup stubs a valid document at the well-known path; a broken one at the challenge URL is skipped.
|
|
challenge_url = "https://srv.example.com/prm.json"
|
|
stub_request(:get, challenge_url).to_return(status: 200, headers: { "Content-Type" => "application/json" }, body: "[]")
|
|
|
|
result = Flow.new(provider: build_legacy_discovery_provider({})).run!(server_url: @server_url, resource_metadata_url: challenge_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:get, @prm_url)
|
|
end
|
|
|
|
def test_run_recovers_authorization_server_metadata_from_a_later_candidate_after_a_network_error
|
|
# The OAuth document being unreachable must not stop the OpenID one from being tried.
|
|
stub_request(:get, @as_metadata_url).to_raise(Faraday::TimeoutError.new("execution expired"))
|
|
stub_request(:get, "#{@auth_base}/.well-known/openid-configuration").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
result = run_authorization_flow
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_requested(:get, "#{@auth_base}/.well-known/openid-configuration")
|
|
end
|
|
|
|
def test_run_recovers_authorization_server_metadata_from_a_later_candidate_after_an_unusable_document
|
|
# An OAuth document that is not JSON, or not a JSON object, must not stop the OpenID one from being tried.
|
|
stub_request(:get, "#{@auth_base}/.well-known/openid-configuration").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
["{", "[]"].each do |body|
|
|
stub_request(:get, @as_metadata_url).to_return(status: 200, headers: { "Content-Type" => "application/json" }, body: body)
|
|
|
|
assert_equal(:authorized, run_authorization_flow, "body #{body.inspect}")
|
|
end
|
|
|
|
assert_requested(:get, "#{@auth_base}/.well-known/openid-configuration", times: 2)
|
|
end
|
|
|
|
def test_refresh_surfaces_a_network_error_during_prm_discovery_instead_of_falling_back
|
|
stub_request(:get, @prm_url).to_raise(Faraday::TimeoutError.new("execution expired"))
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
provider = build_legacy_discovery_provider({})
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:get, "https://srv.example.com/.well-known/oauth-authorization-server")
|
|
assert_not_requested(:post, "https://srv.example.com/token")
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
def test_refresh_surfaces_a_server_error_during_prm_discovery_instead_of_falling_back
|
|
stub_request(:get, @prm_url).to_return(status: 503)
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
provider = build_legacy_discovery_provider({})
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
error = assert_raises(Flow::MetadataUnreachableError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/returned 503/, error.message)
|
|
assert_not_requested(:post, "https://srv.example.com/token")
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
# Builds a provider for the legacy-discovery tests, capturing the authorization URL so tests can assert
|
|
# which endpoint was used.
|
|
def build_legacy_discovery_provider(holder)
|
|
Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
holder[:authorization_url] = url
|
|
holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", holder[:state]] },
|
|
)
|
|
end
|
|
|
|
def stub_prm_not_found
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource/mcp").to_return(status: 404)
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
end
|
|
|
|
# Legacy 2025-03-26 shape: no PRM, AS metadata served from the MCP server origin with the given `issuer`
|
|
# and the OAuth endpoints under a path prefix.
|
|
def stub_legacy_metadata_with_prefixed_endpoints(issuer:, iss_supported: false)
|
|
stub_prm_not_found
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-authorization-server").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: issuer,
|
|
authorization_endpoint: "https://srv.example.com/oauth/authorize",
|
|
token_endpoint: "https://srv.example.com/oauth/token",
|
|
registration_endpoint: "https://srv.example.com/oauth/register",
|
|
response_types_supported: ["code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
authorization_response_iss_parameter_supported: iss_supported,
|
|
),
|
|
)
|
|
stub_request(:post, "https://srv.example.com/oauth/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "legacy-client"),
|
|
)
|
|
stub_request(:post, "https://srv.example.com/oauth/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "legacy-token", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
end
|
|
|
|
def test_run_falls_back_to_server_origin_metadata_without_prm
|
|
# The document names the origin, so the RFC 8414 Section 3.3 check passes and its prefixed endpoints are used.
|
|
stub_legacy_metadata_with_prefixed_endpoints(issuer: "https://srv.example.com")
|
|
|
|
holder = {}
|
|
provider = build_legacy_discovery_provider(holder)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("legacy-token", provider.access_token)
|
|
assert_equal("https://srv.example.com", provider.tokens["issuer"])
|
|
assert_equal("/oauth/authorize", holder[:authorization_url].path)
|
|
assert_requested(:post, "https://srv.example.com/oauth/register")
|
|
assert_requested(:post, "https://srv.example.com/oauth/token")
|
|
end
|
|
|
|
def test_run_accepts_legacy_metadata_naming_the_origin_with_a_trailing_slash
|
|
# A root issuer rendered as `https://host/` names the same server; the TypeScript and Python SDKs accept it too,
|
|
# and the document's spelling is what the RFC 9207 `iss` and the recorded issuer carry.
|
|
stub_legacy_metadata_with_prefixed_endpoints(issuer: "https://srv.example.com/", iss_supported: true)
|
|
|
|
holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) { holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", holder[:state], "https://srv.example.com/"] },
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("https://srv.example.com/", provider.tokens["issuer"])
|
|
end
|
|
|
|
def test_run_refuses_legacy_metadata_whose_issuer_is_not_the_origin
|
|
# RFC 8414 Section 3.3 applies on the legacy path as well: the 2025-03-26 spec places the metadata
|
|
# at the origin, so an issuer under a path prefix is a mismatch, as it is for the TypeScript and Python SDKs.
|
|
stub_legacy_metadata_with_prefixed_endpoints(issuer: "https://srv.example.com/oauth")
|
|
|
|
holder = {}
|
|
provider = build_legacy_discovery_provider(holder)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url)
|
|
end
|
|
|
|
assert_match(/`issuer` does not match/, error.message)
|
|
assert_nil(holder[:authorization_url])
|
|
assert_not_requested(:post, "https://srv.example.com/oauth/register")
|
|
assert_not_requested(:post, "https://srv.example.com/oauth/token")
|
|
end
|
|
|
|
def test_run_falls_back_to_default_endpoints_without_any_metadata
|
|
# Legacy 2025-03-26 "Fallbacks for Servers without Metadata Discovery": with no PRM and no AS metadata,
|
|
# the client MUST use /authorize, /token, and /register at the authorization base URL, still sending PKCE S256.
|
|
stub_prm_not_found
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-authorization-server").to_return(status: 404)
|
|
stub_request(:get, "https://srv.example.com/.well-known/openid-configuration").to_return(status: 404)
|
|
stub_request(:post, "https://srv.example.com/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "legacy-client"),
|
|
)
|
|
stub_request(:post, "https://srv.example.com/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "legacy-token", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
holder = {}
|
|
provider = build_legacy_discovery_provider(holder)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("/authorize", holder[:authorization_url].path)
|
|
query = URI.decode_www_form(holder[:authorization_url].query).to_h
|
|
assert_equal("S256", query["code_challenge_method"])
|
|
refute_empty(query["code_challenge"].to_s)
|
|
assert_requested(:post, "https://srv.example.com/register")
|
|
assert_requested(:post, "https://srv.example.com/token") do |req|
|
|
URI.decode_www_form(req.body).to_h["code_verifier"].to_s != ""
|
|
end
|
|
end
|
|
|
|
def test_run_client_credentials_without_prm_uses_the_legacy_authorization_base
|
|
# A PRM-less server takes the legacy path for this grant too: metadata at the origin, no advertised scopes,
|
|
# so the provider's own scope is used and the tokens are bound to the origin.
|
|
stub_prm_not_found
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-authorization-server").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: "https://srv.example.com",
|
|
token_endpoint: "https://srv.example.com/token",
|
|
token_endpoint_auth_methods_supported: ["client_secret_basic"],
|
|
),
|
|
)
|
|
stub_request(:post, "https://srv.example.com/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "legacy-token", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
provider = ClientCredentialsProvider.new(client_id: "cc-client", client_secret: "cc-secret", scope: "mcp:read")
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("legacy-token", provider.access_token)
|
|
assert_equal("https://srv.example.com", provider.tokens["issuer"])
|
|
assert_requested(:post, "https://srv.example.com/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "client_credentials" &&
|
|
form["scope"] == "mcp:read" &&
|
|
form["resource"] == "https://srv.example.com/mcp"
|
|
end
|
|
end
|
|
|
|
def test_run_jwt_bearer_without_any_metadata_uses_the_legacy_default_endpoints
|
|
stub_prm_not_found
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-authorization-server").to_return(status: 404)
|
|
stub_request(:get, "https://srv.example.com/.well-known/openid-configuration").to_return(status: 404)
|
|
stub_request(:post, "https://srv.example.com/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "legacy-token", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
received = nil
|
|
provider = CrossAppAccessProvider.new(
|
|
client_id: "xaa-client",
|
|
client_secret: "xaa-secret",
|
|
assertion_provider: ->(audience:, resource:) {
|
|
received = { audience: audience, resource: resource }
|
|
"id-jag-assertion"
|
|
},
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
# The assertion is minted for the legacy authorization base, which is the only identity such a server has.
|
|
assert_equal({ audience: "https://srv.example.com", resource: "https://srv.example.com/mcp" }, received)
|
|
assert_equal("https://srv.example.com", provider.tokens["issuer"])
|
|
assert_requested(:post, "https://srv.example.com/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
|
|
form["grant_type"] == "urn:ietf:params:oauth:grant-type:jwt-bearer" &&
|
|
form["assertion"] == "id-jag-assertion" &&
|
|
form["resource"] == "https://srv.example.com/mcp" &&
|
|
!form.key?("scope")
|
|
end
|
|
end
|
|
|
|
def test_run_legacy_fallback_rejects_insecure_authorization_base
|
|
# The Communication Security requirement still applies on the legacy path: a remote plain-http origin must not
|
|
# become the authorization base URL.
|
|
stub_request(:get, "http://internal.example.com/.well-known/oauth-protected-resource/mcp").to_return(status: 404)
|
|
stub_request(:get, "http://internal.example.com/.well-known/oauth-protected-resource").to_return(status: 404)
|
|
|
|
holder = {}
|
|
provider = build_legacy_discovery_provider(holder)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: "http://internal.example.com/mcp")
|
|
end
|
|
|
|
assert_match(/legacy authorization base URL/, error.message)
|
|
end
|
|
|
|
def test_run_keeps_strict_issuer_validation_when_prm_is_present
|
|
# The legacy issuer-check relaxation must not leak into the modern path: with PRM present,
|
|
# a mismatched issuer still aborts.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: "https://evil.example.com",
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
),
|
|
)
|
|
|
|
holder = {}
|
|
provider = build_legacy_discovery_provider(holder)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/`issuer` does not match/, error.message)
|
|
end
|
|
|
|
# Legacy metadata served at the MCP server origin that claims the identity of another authorization server,
|
|
# with every endpoint at the origin itself. The claim fails the RFC 8414 check, so none of these endpoints is reached.
|
|
def stub_legacy_metadata_claiming(issuer)
|
|
stub_prm_not_found
|
|
stub_request(:get, "https://srv.example.com/.well-known/oauth-authorization-server").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: issuer,
|
|
authorization_endpoint: "https://srv.example.com/authorize",
|
|
token_endpoint: "https://srv.example.com/token",
|
|
registration_endpoint: "https://srv.example.com/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
),
|
|
)
|
|
stub_request(:post, "https://srv.example.com/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "legacy-client"),
|
|
)
|
|
stub_request(:post, "https://srv.example.com/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "legacy-token", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
end
|
|
|
|
def test_run_refuses_legacy_metadata_claiming_another_authorization_server_before_the_validator
|
|
stub_legacy_metadata_claiming(@auth_base)
|
|
recorder = []
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) { recorder << :redirected },
|
|
callback_handler: -> { ["test-auth-code", "state"] },
|
|
authorization_request_validator: ->(request) {
|
|
recorder << request
|
|
true
|
|
},
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url)
|
|
end
|
|
|
|
assert_match(/`issuer` does not match/, error.message)
|
|
assert_empty(recorder)
|
|
assert_not_requested(:post, "https://srv.example.com/register")
|
|
assert_not_requested(:post, "https://srv.example.com/token")
|
|
end
|
|
|
|
def test_refresh_refuses_legacy_metadata_claiming_the_issuer_that_minted_the_tokens
|
|
# The tokens came from https://auth.example.com; a PRM-less server claiming that issuer at its own origin
|
|
# must not receive them, so the refresh token stays for the server that issued it.
|
|
stub_legacy_metadata_claiming(@auth_base)
|
|
provider = build_legacy_discovery_provider({})
|
|
provider.save_client_information("client_id" => "conf-client", "client_secret" => "conf-secret")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt", "issuer" => @auth_base)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url)
|
|
end
|
|
|
|
assert_match(/`issuer` does not match/, error.message)
|
|
assert_not_requested(:post, "https://srv.example.com/token")
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
def test_run_does_not_present_client_information_bound_elsewhere_when_legacy_metadata_claims_that_issuer
|
|
# Client information issued by https://auth.example.com is bound to it (SEP-2352); a PRM-less server claiming
|
|
# that issuer is refused before the credentials could be presented anywhere.
|
|
stub_legacy_metadata_claiming(@auth_base)
|
|
holder = {}
|
|
provider = build_legacy_discovery_provider(holder)
|
|
provider.save_client_information("client_id" => "conf-client", "client_secret" => "conf-secret", "issuer" => @auth_base)
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url)
|
|
end
|
|
|
|
assert_nil(holder[:authorization_url])
|
|
assert_not_requested(:post, "https://srv.example.com/register")
|
|
assert_not_requested(:post, "https://srv.example.com/token")
|
|
assert_equal("conf-secret", provider.client_information["client_secret"])
|
|
assert_equal(@auth_base, provider.client_information["issuer"])
|
|
end
|
|
|
|
def test_run_raises_when_prm_authorization_servers_is_not_an_array
|
|
# `authorization_servers` MUST be an Array per RFC 9728. A misbehaving
|
|
# PRM that returns a String would otherwise reach `.first` and raise
|
|
# raw `NoMethodError` out of the SDK.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp",
|
|
authorization_servers: "https://auth.example.com",
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/authorization_servers/i, error.message)
|
|
end
|
|
|
|
def test_run_refuses_an_authorization_server_metadata_body_over_the_cap
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: over_cap_body,
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) { run_authorization_flow }
|
|
|
|
assert_match(/exceeds \d+ bytes/, error.message)
|
|
end
|
|
|
|
def test_run_refuses_a_protected_resource_metadata_body_over_the_cap
|
|
# An oversized document is refused outright rather than treated as unpublished, so the flow stops
|
|
# without the legacy fallback. The padded document is valid JSON naming an authorization server,
|
|
# so contacting that server is exactly what would happen if the body had been read:
|
|
# the assertion below fails if the cap stops working.
|
|
stub_request(:any, %r{\Ahttps://srv\.example\.com/}).to_return(status: 404)
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp",
|
|
authorization_servers: [@auth_base],
|
|
padding: "a" * (4 * 1024 * 1024),
|
|
),
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) { run_authorization_flow }
|
|
|
|
assert_match(/exceeds \d+ bytes/, error.message)
|
|
assert_not_requested(:get, @as_metadata_url)
|
|
assert_not_requested(:get, "https://srv.example.com/.well-known/oauth-authorization-server")
|
|
end
|
|
|
|
def test_run_refuses_a_dynamic_client_registration_body_over_the_cap
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: over_cap_body,
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) { run_authorization_flow }
|
|
|
|
assert_match(/exceeds \d+ bytes/, error.message)
|
|
end
|
|
|
|
def test_run_refuses_a_token_endpoint_body_over_the_cap
|
|
stub_request(:post, "#{@auth_base}/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: over_cap_body,
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) { run_authorization_flow }
|
|
|
|
assert_match(/exceeds \d+ bytes/, error.message)
|
|
end
|
|
|
|
# One byte past the cap, so the three request wrappers are each proven to install the streaming callback.
|
|
# A wrapper that forgot it would buffer this whole body and parse it.
|
|
def over_cap_body
|
|
"a" * (4 * 1024 * 1024 + 1)
|
|
end
|
|
|
|
def test_run_raises_when_token_response_is_not_a_json_object
|
|
# The token endpoint MUST return a JSON object per RFC 6749 §5.1.
|
|
# A non-object body would otherwise be persisted into the provider
|
|
# and raise raw exceptions the next time `provider.access_token`
|
|
# is read.
|
|
stub_request(:post, "#{@auth_base}/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: "[]",
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/Token endpoint response is not a JSON object/i, error.message)
|
|
end
|
|
|
|
def test_run_treats_whitespace_only_stored_client_id_as_unregistered
|
|
# `" "` (whitespace only) is just as meaningless as `""`.
|
|
# The check on stored client_information must trigger DCR rather than
|
|
# passing the blank value through to the token endpoint.
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "registered-after-whitespace"),
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
provider.save_client_information("client_id" => " ")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
assert_equal("registered-after-whitespace", provider.client_information.fetch("client_id"))
|
|
end
|
|
|
|
def test_run_raises_when_as_metadata_is_not_a_json_object
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: "null",
|
|
)
|
|
stub_request(:get, "#{@auth_base}/.well-known/openid-configuration").to_return(status: 404)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/not a JSON object/i, error.message)
|
|
end
|
|
|
|
def test_run_raises_when_dcr_response_has_blank_client_id
|
|
# A blank `client_id` is just as invalid as a missing one: peer SDKs
|
|
# (TS / Python) require a non-empty string, and treating `""` as
|
|
# truthy would let a misbehaving AS register a "client" the SDK can
|
|
# never authenticate as.
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "", client_name: "blank-id"),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/client_id/i, error.message)
|
|
end
|
|
|
|
def test_run_treats_blank_stored_client_id_as_unregistered
|
|
# Pre-stored `client_information` with a blank `client_id` must
|
|
# trigger DCR rather than skipping registration; otherwise
|
|
# the token endpoint receives `client_id=""` which the AS will reject.
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "registered-after-blank"),
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
provider.save_client_information("client_id" => "")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
assert_equal("registered-after-blank", provider.client_information.fetch("client_id"))
|
|
end
|
|
|
|
def test_run_raises_when_dcr_response_lacks_client_id
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_name: "test-but-no-id"),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/client_id/i, error.message)
|
|
end
|
|
|
|
# Builds a provider whose callback returns the given `iss` shape:
|
|
# `:omitted` keeps the legacy 2-element `[code, state]` form, any other value (including nil) returns
|
|
# the 3-element `[code, state, iss]` form that opts into SEP-2468 / RFC 9207 issuer validation.
|
|
def build_iss_validation_provider(callback_iss: :omitted)
|
|
state_holder = {}
|
|
callback_handler = if callback_iss == :omitted
|
|
-> { ["test-auth-code", state_holder[:state]] }
|
|
else
|
|
-> { ["test-auth-code", state_holder[:state], callback_iss] }
|
|
end
|
|
|
|
Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: callback_handler,
|
|
)
|
|
end
|
|
|
|
# Re-stubs the AS metadata with `authorization_response_iss_parameter_supported: true`.
|
|
def stub_as_metadata_with_iss_support
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
authorization_response_iss_parameter_supported: true,
|
|
),
|
|
)
|
|
end
|
|
|
|
def test_run_completes_when_authorization_response_iss_matches_issuer
|
|
provider = build_iss_validation_provider(callback_iss: @auth_base)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
end
|
|
|
|
def test_run_aborts_before_code_exchange_when_authorization_response_iss_mismatches
|
|
provider = build_iss_validation_provider(callback_iss: "https://evil.example.com")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
# Per RFC 9207, the client MUST NOT send the authorization code to a token endpoint after an `iss` mismatch.
|
|
assert_match(/`iss` does not match/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_aborts_when_iss_is_missing_but_as_advertises_iss_support
|
|
stub_as_metadata_with_iss_support
|
|
provider = build_iss_validation_provider(callback_iss: nil)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/carried no `iss`/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_completes_with_legacy_two_element_callback_even_when_as_advertises_iss_support
|
|
stub_as_metadata_with_iss_support
|
|
provider = build_iss_validation_provider
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
end
|
|
|
|
def test_run_completes_when_iss_is_missing_and_as_does_not_advertise_iss_support
|
|
provider = build_iss_validation_provider(callback_iss: nil)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
end
|
|
|
|
def test_run_validates_present_iss_even_when_as_does_not_advertise_iss_support
|
|
provider = build_iss_validation_provider(callback_iss: "https://evil.example.com")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_run_skips_dcr_when_client_information_already_stored
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
provider.save_client_information("client_id" => "preregistered-client")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
end
|
|
|
|
def test_run_accepts_symbol_keys_in_preregistered_client_information
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
provider.save_client_information(client_id: "preregistered-symbol")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
end
|
|
|
|
# Builds a provider that completes the non-interactive authorization
|
|
# flow against the stubs from `setup`, for the SEP-2352 issuer-binding
|
|
# tests.
|
|
def build_issuer_binding_provider
|
|
state_holder = {}
|
|
Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
end
|
|
|
|
def test_run_skips_dcr_when_stored_issuer_matches
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
provider = build_issuer_binding_provider
|
|
provider.save_client_information("client_id" => "preregistered-client", "issuer" => @auth_base)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
end
|
|
|
|
def test_run_reregisters_when_authorization_server_changes
|
|
provider = build_issuer_binding_provider
|
|
provider.save_client_information("client_id" => "old-client", "issuer" => "https://other-as.example.com")
|
|
provider.save_tokens("access_token" => "old-as-token")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
info = provider.client_information
|
|
assert_equal("test-client", info["client_id"])
|
|
assert_equal(@auth_base, info["issuer"])
|
|
end
|
|
|
|
def test_run_clears_stale_tokens_when_authorization_server_changes
|
|
# Abort the flow right after the discard (DCR fails) to observe that tokens minted by
|
|
# the old authorization server were wiped before any re-registration attempt.
|
|
stub_request(:post, "#{@auth_base}/register").to_return(status: 500, body: "")
|
|
|
|
provider = build_issuer_binding_provider
|
|
provider.save_client_information("client_id" => "old-client", "issuer" => "https://other-as.example.com")
|
|
provider.save_tokens("access_token" => "old-as-token", "refresh_token" => "old-as-rt")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_nil(provider.tokens)
|
|
assert_nil(provider.client_information)
|
|
end
|
|
|
|
def test_run_binds_legacy_client_information_to_issuer_on_first_use
|
|
# Credentials persisted before issuer binding existed (or supplied as pre-registered credentials)
|
|
# are reused and stamped with the current issuer rather than discarded.
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
provider = build_issuer_binding_provider
|
|
provider.save_client_information("client_id" => "preregistered-client")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
assert_equal(@auth_base, provider.client_information["issuer"])
|
|
end
|
|
|
|
def test_run_binds_symbol_keyed_client_information_to_issuer_on_first_use
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
provider = build_issuer_binding_provider
|
|
provider.save_client_information(client_id: "preregistered-symbol")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
assert_equal("test-token-from-flow", provider.access_token)
|
|
assert_equal(@auth_base, provider.client_information["issuer"])
|
|
end
|
|
|
|
def test_run_reuses_portable_cimd_client_id_across_authorization_servers
|
|
# Per SEP-2352, a CIMD `client_id` (an HTTPS URL) is portable across authorization servers:
|
|
# reuse it and re-bind the issuer instead of discarding the registration.
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
provider = build_issuer_binding_provider
|
|
provider.save_client_information(
|
|
"client_id" => "https://app.example.com/client-metadata.json",
|
|
"issuer" => "https://other-as.example.com",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
info = provider.client_information
|
|
assert_equal("https://app.example.com/client-metadata.json", info["client_id"])
|
|
assert_equal(@auth_base, info["issuer"])
|
|
end
|
|
|
|
def test_run_persists_issuer_with_dcr_client_information
|
|
provider = build_issuer_binding_provider
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
info = provider.client_information
|
|
assert_equal("test-client", info["client_id"])
|
|
assert_equal(@auth_base, info["issuer"])
|
|
end
|
|
|
|
def test_run_skips_dcr_when_as_supports_cimd_and_provider_has_cimd_url
|
|
# When the AS advertises Client ID Metadata Document support and the provider was configured with a CIMD URL,
|
|
# the SDK uses the URL as the OAuth `client_id` and does not call /register.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: true,
|
|
),
|
|
)
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
captured_authorization_url = nil
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
captured_authorization_url = url
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_not_requested(:post, "#{@auth_base}/register")
|
|
query = URI.decode_www_form(captured_authorization_url.query).to_h
|
|
assert_equal("https://app.example.com/client-metadata.json", query["client_id"])
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
URI.decode_www_form(req.body).to_h["client_id"] == "https://app.example.com/client-metadata.json"
|
|
end
|
|
# The CIMD URL is NOT persisted to storage: AS metadata is re-read on every flow,
|
|
# so a later AS that no longer advertises CIMD will not be sent a stale CIMD `client_id`.
|
|
assert_nil(provider.client_information)
|
|
end
|
|
|
|
def test_run_falls_back_to_dcr_when_provider_has_cimd_url_but_as_does_not_advertise_support
|
|
# The provider may carry a CIMD URL across multiple servers; if a particular AS does not advertise CIMD support,
|
|
# the SDK must still register via DCR rather than send an unsupported `client_id`.
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
assert_equal("test-client", provider.client_information["client_id"])
|
|
end
|
|
|
|
def test_run_does_not_enter_cimd_branch_when_support_advertised_as_string_false
|
|
# A misconfigured AS that ships `"client_id_metadata_document_supported": "false"`
|
|
# is truthy in Ruby. The SDK must NOT route through CIMD on truthy non-boolean values;
|
|
# only a JSON `boolean true` opts in.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: "false",
|
|
),
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
assert_equal("test-client", provider.client_information["client_id"])
|
|
end
|
|
|
|
def test_run_does_not_enter_cimd_branch_when_support_advertised_as_string_true
|
|
# Mirror of the previous test for the other truthy non-boolean value:
|
|
# `"true"` is also a string, not the JSON boolean the spec requires.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: "true",
|
|
),
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
end
|
|
|
|
def test_run_does_not_persist_cimd_client_id_so_later_flow_recovers_when_as_drops_support
|
|
# Regression for the storage side-effect: if the SDK persisted the CIMD URL on the first flow,
|
|
# a second flow against an AS that no longer advertises CIMD support would still send the URL as
|
|
# the `client_id` and skip DCR. Re-running with the same provider must honour the updated AS metadata.
|
|
shared_storage = InMemoryStorage.new
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
storage: shared_storage,
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
|
|
# First flow: AS supports CIMD, so DCR is skipped.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: true,
|
|
),
|
|
)
|
|
stub_request(:post, "#{@auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "test-client"),
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
assert_nil(shared_storage.client_information, "CIMD client_id must not be persisted")
|
|
|
|
# Second flow: AS no longer advertises CIMD. The SDK must register via DCR rather than reuse a stale CIMD URL.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/register")
|
|
assert_equal("test-client", shared_storage.client_information["client_id"])
|
|
end
|
|
|
|
def test_run_skips_cimd_when_pre_registered_client_information_exists
|
|
# Pre-registered `client_information` wins over CIMD: the user explicitly chose a DCR-style identity,
|
|
# so neither DCR nor the CIMD URL should overwrite it.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: true,
|
|
),
|
|
)
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
captured_authorization_url = nil
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
captured_authorization_url = url
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
provider.save_client_information("client_id" => "preregistered-client")
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
query = URI.decode_www_form(captured_authorization_url.query).to_h
|
|
assert_equal("preregistered-client", query["client_id"])
|
|
end
|
|
|
|
def test_run_uses_basic_auth_when_token_endpoint_auth_method_is_client_secret_basic
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "client_secret_basic",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
provider.save_client_information(
|
|
"client_id" => "pre-registered-client",
|
|
"client_secret" => "pre-registered-secret",
|
|
"token_endpoint_auth_method" => "client_secret_basic",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
expected = "Basic " + Base64.strict_encode64("pre-registered-client:pre-registered-secret")
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
req.headers["Authorization"] == expected &&
|
|
!form.key?("client_id") &&
|
|
!form.key?("client_secret")
|
|
end
|
|
end
|
|
|
|
def test_run_form_urlencodes_basic_auth_credentials_with_special_characters
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "client_secret_basic",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
# Per RFC 6749 Section 2.3.1, credentials must be `application/x-www-form-urlencoded`
|
|
# before being joined with ":" and base64-encoded. A `:` in the secret would
|
|
# otherwise be ambiguous with the username/password separator.
|
|
provider.save_client_information(
|
|
"client_id" => "client:with colon",
|
|
"client_secret" => "secret:with:colons and spaces",
|
|
"token_endpoint_auth_method" => "client_secret_basic",
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
encoded_id = URI.encode_www_form_component("client:with colon")
|
|
encoded_secret = URI.encode_www_form_component("secret:with:colons and spaces")
|
|
expected = "Basic " + Base64.strict_encode64("#{encoded_id}:#{encoded_secret}")
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
req.headers["Authorization"] == expected
|
|
end
|
|
end
|
|
|
|
def test_run_rejects_non_https_resource_metadata_url
|
|
# `WWW-Authenticate` may carry a `resource_metadata=` URL we have never
|
|
# seen before; if it isn't HTTPS-or-loopback, an attacker could lure us
|
|
# into fetching a doctored PRM document over plain HTTP.
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: "http://attacker.example.com/.well-known/oauth-protected-resource",
|
|
)
|
|
end
|
|
|
|
assert_match(/resource_metadata|HTTPS|Communication Security/i, error.message)
|
|
end
|
|
|
|
def test_run_does_not_fetch_a_resource_metadata_url_off_the_server_origin
|
|
# A server that answers 401 chooses the `resource_metadata` URL, and discovery puts it first
|
|
# in the candidate list. Left unchecked, a single response header aims the client's first OAuth request
|
|
# at any host it can route to, including the cloud metadata address. The assertion that matters is not
|
|
# the raise but `assert_not_requested`: nothing downstream can un-send a request.
|
|
metadata_url = "https://169.254.169.254/latest/meta-data/iam/"
|
|
stub_request(:get, metadata_url).to_return(status: 200, body: "{}")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: ssrf_test_provider).run!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: metadata_url,
|
|
)
|
|
end
|
|
|
|
assert_not_requested(:get, metadata_url)
|
|
assert_match(/resource_metadata/i, error.message)
|
|
assert_match(/origin/i, error.message)
|
|
end
|
|
|
|
def test_run_does_not_fetch_an_https_resource_metadata_url_on_a_foreign_public_origin
|
|
# The scheme check alone passes this one: it is HTTPS, just not the server's.
|
|
metadata_url = "https://attacker.example.com/.well-known/oauth-protected-resource"
|
|
stub_request(:get, metadata_url).to_return(status: 200, body: "{}")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: ssrf_test_provider).run!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: metadata_url,
|
|
)
|
|
end
|
|
|
|
assert_not_requested(:get, metadata_url)
|
|
end
|
|
|
|
def test_refresh_does_not_fetch_a_resource_metadata_url_off_the_server_origin
|
|
# `refresh!` reads the same header on a 401 and must gate it identically;
|
|
# otherwise the token-refresh path stays reachable after `run!` is closed.
|
|
metadata_url = "https://169.254.169.254/latest/meta-data/iam/"
|
|
stub_request(:get, metadata_url).to_return(status: 200, body: "{}")
|
|
|
|
provider = ssrf_test_provider
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: metadata_url,
|
|
)
|
|
end
|
|
|
|
assert_not_requested(:get, metadata_url)
|
|
end
|
|
|
|
def test_run_does_not_contact_an_authorization_server_on_a_private_address
|
|
# One hop deeper than the `resource_metadata` URL: the server serves its own PRM from its own origin,
|
|
# then names a private address as its authorization server. Same-origin cannot see this one,
|
|
# so the range check has to.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: @server_url,
|
|
authorization_servers: ["https://169.254.169.254"],
|
|
),
|
|
)
|
|
stub_request(:get, %r{\Ahttps://169\.254\.169\.254/}).to_return(status: 200, body: "{}")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: ssrf_test_provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:get, %r{\Ahttps://169\.254\.169\.254/})
|
|
assert_match(/private network/i, error.message)
|
|
end
|
|
|
|
def test_run_does_not_contact_an_authorization_server_spelled_as_a_packed_integer
|
|
# `0xa9fea9fe` is 169.254.169.254 written for `inet_aton`. The connection resolves it to
|
|
# the same address, so the previous test's protection has to survive the rewrite.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: @server_url,
|
|
authorization_servers: ["https://0xa9fea9fe"],
|
|
),
|
|
)
|
|
stub_request(:get, %r{\Ahttps://0xa9fea9fe/}).to_return(status: 200, body: "{}")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: ssrf_test_provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:get, %r{\Ahttps://0xa9fea9fe/})
|
|
assert_match(/private network/i, error.message)
|
|
end
|
|
|
|
def test_run_does_not_post_to_a_token_endpoint_on_a_private_address
|
|
# The token endpoint receives the client credentials and the authorization code,
|
|
# so an AS document that relocates it inside the client's network is a credential disclosure,
|
|
# not just a probe.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "https://10.0.0.5/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
stub_request(:post, "https://10.0.0.5/token").to_return(status: 200, body: "{}")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: ssrf_test_provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:post, "https://10.0.0.5/token")
|
|
assert_match(/private network/i, error.message)
|
|
end
|
|
|
|
def test_run_does_not_post_to_a_registration_endpoint_on_a_private_address
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "https://192.168.1.1/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
stub_request(:post, "https://192.168.1.1/register").to_return(status: 201, body: "{}")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: ssrf_test_provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_not_requested(:post, "https://192.168.1.1/register")
|
|
end
|
|
|
|
def test_run_allows_a_private_authorization_server_when_the_mcp_server_is_also_private
|
|
# The shape the conformance harness runs and the shape local development takes:
|
|
# the MCP server and the authorization server sit on two loopback ports.
|
|
# Once the caller has pointed the client at a private address, the authorization server
|
|
# living there too is not an escalation, and refusing it would break every local setup.
|
|
server_url = "http://localhost:9292/mcp"
|
|
prm_url = "http://localhost:9292/.well-known/oauth-protected-resource/mcp"
|
|
auth_base = "http://localhost:9393"
|
|
|
|
stub_request(:get, prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(resource: server_url, authorization_servers: [auth_base]),
|
|
)
|
|
stub_request(:get, "#{auth_base}/.well-known/oauth-authorization-server").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: auth_base,
|
|
authorization_endpoint: "#{auth_base}/authorize",
|
|
token_endpoint: "#{auth_base}/token",
|
|
registration_endpoint: "#{auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
stub_request(:post, "#{auth_base}/register").to_return(
|
|
status: 201,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(client_id: "local-client"),
|
|
)
|
|
stub_request(:post, "#{auth_base}/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "local-token", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) { state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
|
|
result = Flow.new(provider: provider).run!(server_url: server_url, resource_metadata_url: prm_url)
|
|
|
|
assert_equal(:authorized, result)
|
|
assert_equal("local-token", provider.access_token)
|
|
end
|
|
|
|
def test_run_rejects_when_as_metadata_issuer_does_not_match
|
|
# RFC 8414 Section 3.3: the AS metadata's `issuer` value MUST equal the discovery URL.
|
|
# A metadata document advertising a different issuer than the one PRM pointed at is treated
|
|
# as a confused-deputy attempt.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: "https://other-auth.example.com",
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/issuer/i, error.message)
|
|
end
|
|
|
|
def test_run_rejects_when_as_metadata_issuer_differs_by_trailing_slash
|
|
# RFC 8414 Section 3.3 requires the issuer to be identical, not "equivalent after normalization".
|
|
# `https://auth.example.com` and `https://auth.example.com/` are different strings and MUST NOT match.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: "#{@auth_base}/",
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/issuer/i, error.message)
|
|
end
|
|
|
|
def test_run_rejects_when_as_metadata_issuer_differs_by_case
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base.upcase,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/issuer/i, error.message)
|
|
end
|
|
|
|
def test_run_rejects_when_as_metadata_lacks_issuer
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/issuer/i, error.message)
|
|
end
|
|
|
|
def test_run_rejects_non_https_authorization_server
|
|
# Communication Security: an `http://` authorization server URL (other
|
|
# than loopback) MUST be refused. Returning a non-HTTPS auth server
|
|
# from a hijacked PRM would let the attacker steer the client at
|
|
# an endpoint they control to harvest tokens.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp",
|
|
authorization_servers: ["http://auth.example.com"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/HTTPS|Communication Security/i, error.message)
|
|
end
|
|
|
|
def test_run_rejects_non_https_token_endpoint
|
|
# Even when PRM and AS metadata discovery happen over HTTPS, the AS
|
|
# metadata document itself can advertise an `http://` token endpoint.
|
|
# That endpoint is where the bearer token lands, so it MUST be rejected.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "http://insecure.example.com/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/HTTPS|Communication Security|token_endpoint/i, error.message)
|
|
end
|
|
|
|
def test_refresh_swaps_refresh_token_for_new_access_token
|
|
# Refresh should NOT hit /register (no DCR) and SHOULD post
|
|
# grant_type=refresh_token with the saved refresh_token.
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
|
|
stub_request(:post, "#{@auth_base}/token")
|
|
.with(body: hash_including("grant_type" => "refresh_token", "refresh_token" => "saved-rt"))
|
|
.to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "fresh-at", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
result = Flow.new(provider: provider).refresh!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: @prm_url,
|
|
)
|
|
|
|
assert_equal(:refreshed, result)
|
|
assert_equal("fresh-at", provider.access_token)
|
|
# New response did not include a refresh_token, so the old one is preserved (RFC 6749 Section 6).
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
def test_refresh_with_client_secret_basic_omits_client_id_from_body
|
|
# Stored credentials without an auth method default to Basic. Refresh
|
|
# must also omit the body `client_id` when using that fallback.
|
|
stub_request(:post, "#{@auth_base}/token")
|
|
.with(body: hash_including("grant_type" => "refresh_token"))
|
|
.to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "fresh-at", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "conf-client", "client_secret" => "conf-secret")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
req.headers["Authorization"] == "Basic " + Base64.strict_encode64("conf-client:conf-secret") &&
|
|
!form.key?("client_id") &&
|
|
!form.key?("client_secret")
|
|
end
|
|
end
|
|
|
|
def test_run_records_the_issuer_that_minted_the_tokens
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) { state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state") },
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(@auth_base, provider.tokens["issuer"])
|
|
end
|
|
|
|
def test_refresh_refuses_an_authorization_server_that_did_not_issue_the_tokens
|
|
# The stored tokens came from a different authorization server, so this refresh token must not reach the one named now.
|
|
stub_request(:post, "#{@auth_base}/token").to_raise(StandardError.new("must not reach the token endpoint."))
|
|
|
|
provider = refresh_only_provider
|
|
provider.save_tokens(
|
|
"access_token" => "stale-at",
|
|
"refresh_token" => "saved-rt",
|
|
"issuer" => "https://issued-by.example.com",
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/issued by a different authorization server/, error.message)
|
|
|
|
# Left in place: it is still good at the server that issued it, and the caller answers this by running the full authorization flow.
|
|
assert_equal("saved-rt", provider.tokens["refresh_token"])
|
|
end
|
|
|
|
def test_refresh_proceeds_for_tokens_stored_before_the_issuer_was_recorded
|
|
stub_request(:post, "#{@auth_base}/token").to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "fresh-at", token_type: "Bearer"),
|
|
)
|
|
|
|
provider = refresh_only_provider
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
result = Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal(:refreshed, result)
|
|
|
|
# Recorded on the way out, so the binding takes effect from here on.
|
|
assert_equal(@auth_base, provider.tokens["issuer"])
|
|
end
|
|
|
|
def test_refresh_succeeds_when_stored_issuer_matches
|
|
stub_request(:post, "#{@auth_base}/token").with(
|
|
body: hash_including("grant_type" => "refresh_token", "refresh_token" => "saved-rt"),
|
|
).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "fresh-at", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client", "issuer" => @auth_base)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
result = Flow.new(provider: provider).refresh!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: @prm_url,
|
|
)
|
|
|
|
assert_equal(:refreshed, result)
|
|
assert_equal("fresh-at", provider.access_token)
|
|
end
|
|
|
|
def test_refresh_raises_when_stored_issuer_differs
|
|
# Per SEP-2352, another authorization server's credentials must not be replayed at this token endpoint;
|
|
# the caller falls back to the full flow, which discards the stale registration and re-registers.
|
|
stub_request(:post, "#{@auth_base}/token").to_raise(StandardError.new("Token endpoint should not be called."))
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "old-client", "issuer" => "https://other-as.example.com")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/different authorization server/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_refresh_uses_cimd_url_as_client_id_when_provider_has_cimd_and_as_supports_it
|
|
# Regression: the CIMD branch in `ensure_client_registered` does not persist `client_information`,
|
|
# so a refresh call that requires stored client info would always fail after a CIMD-only flow.
|
|
# `refresh!` must reconstruct the CIMD `client_id` from live AS metadata + the provider URL on every call.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: true,
|
|
),
|
|
)
|
|
stub_request(:post, "#{@auth_base}/register").to_raise(StandardError.new("DCR should not be called."))
|
|
stub_request(:post, "#{@auth_base}/token").with(
|
|
body: hash_including(
|
|
"grant_type" => "refresh_token",
|
|
"refresh_token" => "saved-rt",
|
|
"client_id" => "https://app.example.com/client-metadata.json",
|
|
),
|
|
).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "fresh-at", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
result = Flow.new(provider: provider).refresh!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: @prm_url,
|
|
)
|
|
|
|
assert_equal(:refreshed, result)
|
|
assert_equal("fresh-at", provider.access_token)
|
|
assert_nil(provider.client_information, "refresh must not persist a CIMD client_information entry")
|
|
end
|
|
|
|
def test_refresh_raises_when_provider_has_cimd_url_but_as_no_longer_advertises_support
|
|
# If the AS later drops CIMD support and the provider has neither a stored `client_information` nor
|
|
# an alternative identity, refresh has no way to authenticate. Fail loudly rather than send a CIMD
|
|
# `client_id` the AS no longer recognises.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
assert_match(/client_id_metadata_document_supported/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_refresh_prefers_stored_client_information_over_cimd_url
|
|
# Even when both are available, an explicitly stored `client_information` wins.
|
|
# CIMD MUST NOT silently override it.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: true,
|
|
),
|
|
)
|
|
stub_request(:post, "#{@auth_base}/token").with(
|
|
body: hash_including(
|
|
"grant_type" => "refresh_token",
|
|
"client_id" => "preregistered-client",
|
|
),
|
|
).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "fresh-at", token_type: "Bearer", expires_in: 3600),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
provider.save_client_information("client_id" => "preregistered-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
assert_equal("fresh-at", provider.access_token)
|
|
end
|
|
|
|
def test_refresh_raises_when_cimd_support_advertised_as_string_true
|
|
# Mirror of the `run!` strict-boolean tests on the refresh path: a truthy non-boolean value
|
|
# such as the string `"true"` must NOT be treated as CIMD support. With no stored `client_information`
|
|
# and no genuine CIMD support, refresh has no identity to authenticate with.
|
|
stub_request(:get, @as_metadata_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
issuer: @auth_base,
|
|
authorization_endpoint: "#{@auth_base}/authorize",
|
|
token_endpoint: "#{@auth_base}/token",
|
|
registration_endpoint: "#{@auth_base}/register",
|
|
response_types_supported: ["code"],
|
|
grant_types_supported: ["authorization_code", "refresh_token"],
|
|
code_challenge_methods_supported: ["S256"],
|
|
token_endpoint_auth_methods_supported: ["none"],
|
|
client_id_metadata_document_supported: "true",
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
client_id_metadata_document_url: "https://app.example.com/client-metadata.json",
|
|
)
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
assert_match(/client_id_metadata_document_supported/, error.message)
|
|
assert_not_requested(:post, "#{@auth_base}/token")
|
|
end
|
|
|
|
def test_refresh_raises_when_no_refresh_token
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "only-at")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
end
|
|
|
|
def test_refresh_raises_when_token_endpoint_rejects_refresh
|
|
stub_request(:post, "#{@auth_base}/token").to_return(status: 401, body: "")
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "revoked-rt")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
end
|
|
|
|
def test_refresh_raises_invalid_grant_error_when_token_endpoint_says_invalid_grant
|
|
stub_request(:post, "#{@auth_base}/token").to_return(
|
|
status: 400,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(error: "invalid_grant", error_description: "refresh token expired"),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "revoked-rt")
|
|
|
|
error = assert_raises(Flow::InvalidGrantError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
assert_equal(400, error.http_status)
|
|
assert_equal("invalid_grant", error.error)
|
|
assert_equal("refresh token expired", error.error_description)
|
|
assert_equal("Token endpoint returned status 400. invalid_grant: refresh token expired", error.message)
|
|
end
|
|
|
|
def test_token_exchange_preserves_oauth_diagnostics
|
|
stub_request(:post, "#{@auth_base}/token").to_return(
|
|
status: 400,
|
|
body: JSON.generate(
|
|
error: "invalid_request",
|
|
error_description: "Client must not use multiple authentication methods",
|
|
access_token: "do-not-log-access-token",
|
|
refresh_token: "do-not-log-refresh-token",
|
|
client_secret: "do-not-log-client-secret",
|
|
error_uri: "https://auth.example.com/error?secret=do-not-log",
|
|
),
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
capture_authorization_scope(grant_types: ["authorization_code"])
|
|
end
|
|
|
|
assert_equal(400, error.http_status)
|
|
assert_equal("invalid_request", error.error)
|
|
assert_equal("Client must not use multiple authentication methods", error.error_description)
|
|
assert_equal(
|
|
"Token endpoint returned status 400. invalid_request: Client must not use multiple authentication methods",
|
|
error.message,
|
|
)
|
|
end
|
|
|
|
def test_refresh_preserves_oauth_diagnostics
|
|
error = refresh_token_endpoint_error(
|
|
JSON.generate(error: "invalid_client", error_description: "Client authentication failed"),
|
|
status: 401,
|
|
)
|
|
|
|
assert_instance_of(Flow::AuthorizationError, error)
|
|
assert_equal(401, error.http_status)
|
|
assert_equal("invalid_client", error.error)
|
|
assert_equal("Client authentication failed", error.error_description)
|
|
assert_equal("Token endpoint returned status 401. invalid_client: Client authentication failed", error.message)
|
|
end
|
|
|
|
def test_token_endpoint_errors_fall_back_for_malformed_bodies
|
|
["", "<html>secret</html>", "{broken", "null", "[]", '"secret"', "42"].each do |body|
|
|
error = refresh_token_endpoint_error(body)
|
|
|
|
assert_instance_of(Flow::AuthorizationError, error)
|
|
assert_equal(400, error.http_status)
|
|
assert_nil(error.error)
|
|
assert_nil(error.error_description)
|
|
assert_equal("Token endpoint returned status 400.", error.message)
|
|
end
|
|
end
|
|
|
|
def test_token_endpoint_errors_ignore_non_string_and_empty_fields
|
|
[nil, 42, true, [], { secret: "hidden" }, "", " \r\n\t"].each do |value|
|
|
error = refresh_token_endpoint_error(JSON.generate(error: value, error_description: value))
|
|
|
|
assert_nil(error.error)
|
|
assert_nil(error.error_description)
|
|
assert_equal("Token endpoint returned status 400.", error.message)
|
|
end
|
|
end
|
|
|
|
def test_token_endpoint_errors_preserve_optional_fields_independently
|
|
error = refresh_token_endpoint_error(JSON.generate(error: "provider_extension"))
|
|
assert_equal("provider_extension", error.error)
|
|
assert_nil(error.error_description)
|
|
assert_equal("Token endpoint returned status 400. provider_extension", error.message)
|
|
|
|
error = refresh_token_endpoint_error(JSON.generate(error_description: "Details without a code"))
|
|
assert_nil(error.error)
|
|
assert_equal("Details without a code", error.error_description)
|
|
assert_equal("Token endpoint returned status 400. Details without a code", error.message)
|
|
end
|
|
|
|
def test_token_endpoint_errors_sanitize_without_changing_grant_classification
|
|
error = refresh_token_endpoint_error(
|
|
JSON.generate(error: "invalid_grant\n", error_description: "expired\r\n\t\e\u0000\"\\\u2028token"),
|
|
)
|
|
|
|
assert_instance_of(Flow::AuthorizationError, error)
|
|
assert_equal("invalid_grant", error.error)
|
|
assert_equal("expired token", error.error_description)
|
|
assert_equal("Token endpoint returned status 400. invalid_grant: expired token", error.message)
|
|
end
|
|
|
|
def test_invalid_grant_with_invalid_utf8_description_preserves_classification
|
|
error = refresh_token_endpoint_error(
|
|
"{\"error\":\"invalid_grant\",\"error_description\":\"bad \xFF byte\"}".b,
|
|
)
|
|
|
|
assert_instance_of(Flow::InvalidGrantError, error)
|
|
assert_equal(400, error.http_status)
|
|
assert_equal("invalid_grant", error.error)
|
|
assert_equal("bad byte", error.error_description)
|
|
assert_equal("Token endpoint returned status 400. invalid_grant: bad byte", error.message)
|
|
end
|
|
|
|
def test_token_endpoint_errors_scrub_invalid_utf8_in_both_fields
|
|
error = refresh_token_endpoint_error(
|
|
"{\"error\":\"invalid_grant\xFF\",\"error_description\":\"bad \xFF byte\"}".b,
|
|
)
|
|
|
|
assert_instance_of(Flow::AuthorizationError, error)
|
|
assert_equal(400, error.http_status)
|
|
assert_equal("invalid_grant", error.error)
|
|
assert_equal("bad byte", error.error_description)
|
|
assert_equal("Token endpoint returned status 400. invalid_grant: bad byte", error.message)
|
|
end
|
|
|
|
def test_token_endpoint_errors_fall_back_when_diagnostic_extraction_raises
|
|
Flow.any_instance.stubs(:bounded_diagnostic).raises(ArgumentError, "sensitive provider text")
|
|
|
|
{ "invalid_grant" => Flow::InvalidGrantError, "invalid_client" => Flow::AuthorizationError }.each do |code, klass|
|
|
error = refresh_token_endpoint_error(JSON.generate(error: code, error_description: "details"))
|
|
|
|
assert_instance_of(klass, error)
|
|
assert_equal(400, error.http_status)
|
|
assert_nil(error.error)
|
|
assert_nil(error.error_description)
|
|
assert_equal("Token endpoint returned status 400.", error.message)
|
|
end
|
|
end
|
|
|
|
def test_token_endpoint_errors_bound_diagnostic_lengths
|
|
error = refresh_token_endpoint_error(JSON.generate(error: "e" * 200, error_description: "d" * 1000))
|
|
|
|
assert_equal("#{"e" * 125}...", error.error)
|
|
assert_equal("#{"d" * 509}...", error.error_description)
|
|
assert_equal("Token endpoint returned status 400. #{error.error}: #{error.error_description}", error.message)
|
|
end
|
|
|
|
def test_other_authorization_errors_have_no_token_endpoint_diagnostics
|
|
error = Flow::AuthorizationError.new("Discovery failed")
|
|
|
|
assert_equal("Discovery failed", error.message)
|
|
assert_nil(error.http_status)
|
|
assert_nil(error.error)
|
|
assert_nil(error.error_description)
|
|
end
|
|
|
|
def refresh_token_endpoint_error(body, status: 400)
|
|
stub_request(:post, "#{@auth_base}/token").to_return(status: status, body: body)
|
|
provider = ssrf_test_provider
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "saved-rt")
|
|
|
|
assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
end
|
|
|
|
def test_refresh_raises_generic_authorization_error_on_5xx
|
|
stub_request(:post, "#{@auth_base}/token").to_return(status: 503, body: "")
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client")
|
|
provider.save_tokens("access_token" => "stale-at", "refresh_token" => "live-rt")
|
|
|
|
err = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
refute_kind_of(
|
|
Flow::InvalidGrantError,
|
|
err,
|
|
"5xx must not be classified as invalid_grant; transient failures must preserve the refresh token",
|
|
)
|
|
end
|
|
|
|
def test_resolve_scope_prefers_prm_scopes_supported_over_provider_scope
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp",
|
|
authorization_servers: [@auth_base],
|
|
scopes_supported: ["mcp:read", "mcp:write"],
|
|
),
|
|
)
|
|
|
|
captured = nil
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
scope: "provider-supplied-scope",
|
|
redirect_handler: ->(url) { captured = url },
|
|
callback_handler: -> {
|
|
[
|
|
"code-1",
|
|
URI.decode_www_form(captured.query).to_h["state"],
|
|
]
|
|
},
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: @prm_url,
|
|
scope: nil,
|
|
)
|
|
|
|
authorized_params = URI.decode_www_form(captured.query).to_h
|
|
assert_equal(
|
|
"mcp:read mcp:write",
|
|
authorized_params["scope"],
|
|
"PRM scopes_supported must win over provider.scope when challenge scope is absent",
|
|
)
|
|
end
|
|
|
|
def test_resolve_scope_falls_back_to_provider_scope_when_prm_omits_scopes_supported
|
|
captured = nil
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
scope: "provider-fallback",
|
|
redirect_handler: ->(url) { captured = url },
|
|
callback_handler: -> {
|
|
[
|
|
"code-1",
|
|
URI.decode_www_form(captured.query).to_h["state"],
|
|
]
|
|
},
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(
|
|
server_url: @server_url,
|
|
resource_metadata_url: @prm_url,
|
|
scope: nil,
|
|
)
|
|
|
|
authorized_params = URI.decode_www_form(captured.query).to_h
|
|
assert_equal(
|
|
"provider-fallback",
|
|
authorized_params["scope"],
|
|
"provider.scope is the last-resort fallback when neither challenge nor PRM supplies one",
|
|
)
|
|
end
|
|
|
|
def test_token_endpoint_defaults_to_client_secret_basic_for_confidential_clients
|
|
captured_authorization = nil
|
|
captured_form = nil
|
|
stub_request(:post, "#{@auth_base}/token").to_return do |req|
|
|
captured_authorization = req.headers["Authorization"]
|
|
captured_form = URI.decode_www_form(req.body).to_h
|
|
{
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(access_token: "tok", token_type: "Bearer"),
|
|
}
|
|
end
|
|
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
# Confidential pre-registered client without `token_endpoint_auth_method`.
|
|
provider.save_client_information(
|
|
"client_id" => "preregistered",
|
|
"client_secret" => "s3cret",
|
|
)
|
|
provider.save_tokens("access_token" => "stale", "refresh_token" => "live-rt")
|
|
|
|
Flow.new(provider: provider).refresh!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
expected = Base64.strict_encode64("preregistered:s3cret")
|
|
assert_equal(
|
|
"Basic #{expected}",
|
|
captured_authorization,
|
|
"default to client_secret_basic per RFC 6749 §2.3.1 and TS/Python SDK convention",
|
|
)
|
|
refute(
|
|
captured_form.key?("client_secret"),
|
|
"client_secret must not be duplicated in the form when sent via Basic auth",
|
|
)
|
|
end
|
|
|
|
def test_run_blocks_percent_encoded_dot_segment_bypass_in_server_url
|
|
# Same audience-binding bypass as the literal `..` case, but using
|
|
# the percent-encoded form `%2e%2e`. RFC 3986 Section 6.2.2.2 normalization must
|
|
# decode `%2e`/`%2E` before resolving dot-segments.
|
|
stub_request(:get, "https://srv.example.com/api/%2e%2e/evil/.well-known/oauth-protected-resource")
|
|
.to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/api",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(
|
|
server_url: "https://srv.example.com/api/%2e%2e/evil",
|
|
resource_metadata_url: "https://srv.example.com/api/%2e%2e/evil/.well-known/oauth-protected-resource",
|
|
)
|
|
end
|
|
|
|
assert_match(/resource/i, error.message)
|
|
end
|
|
|
|
def test_run_blocks_dot_segment_bypass_in_server_url
|
|
# An attacker-supplied server URL like "/api/../evil" must not be
|
|
# treated as covered by a PRM whose resource is the more privileged
|
|
# "/api". Canonicalization resolves the dot-segments so the bypass
|
|
# is detected.
|
|
stub_request(:get, "https://srv.example.com/api/../evil/.well-known/oauth-protected-resource")
|
|
.to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/api",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(
|
|
server_url: "https://srv.example.com/api/../evil",
|
|
resource_metadata_url: "https://srv.example.com/api/../evil/.well-known/oauth-protected-resource",
|
|
)
|
|
end
|
|
|
|
assert_match(/resource/i, error.message)
|
|
end
|
|
|
|
def test_run_strips_userinfo_from_resource_parameter_when_server_url_carries_credentials
|
|
# `Discovery.canonicalize_url` drops `user:pass@`, so the RFC 8707
|
|
# `resource` parameter sent on both the authorization request and
|
|
# the token exchange must contain only the origin + path: shipping
|
|
# the raw URL would hand the user's credentials to the authorization
|
|
# server.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(authorization_servers: [@auth_base]),
|
|
)
|
|
|
|
captured_url = nil
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) { captured_url = url },
|
|
callback_handler: -> {
|
|
[
|
|
"test-auth-code",
|
|
URI.decode_www_form(captured_url.query).to_h.fetch("state"),
|
|
]
|
|
},
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(
|
|
server_url: "https://hunter2:t0psecret@srv.example.com/mcp",
|
|
resource_metadata_url: @prm_url,
|
|
)
|
|
|
|
query = URI.decode_www_form(captured_url.query).to_h
|
|
assert_equal("https://srv.example.com/mcp", query["resource"])
|
|
refute_includes(query["resource"], "hunter2")
|
|
refute_includes(query["resource"], "t0psecret")
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
form = URI.decode_www_form(req.body).to_h
|
|
form["resource"] == "https://srv.example.com/mcp"
|
|
end
|
|
end
|
|
|
|
def test_run_resource_mismatch_error_does_not_leak_userinfo
|
|
# When PRM advertises a `resource` that does not cover the MCP server
|
|
# URL, the mismatch error message MUST cite the canonicalized URLs so
|
|
# that `user:pass@` cannot reach logs, stack traces, or exception
|
|
# reporters.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://hunter2:t0psecret@evil.example.com/mcp",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(
|
|
server_url: "https://hunter2:t0psecret@srv.example.com/mcp",
|
|
resource_metadata_url: @prm_url,
|
|
)
|
|
end
|
|
|
|
refute_includes(error.message, "hunter2")
|
|
refute_includes(error.message, "t0psecret")
|
|
end
|
|
|
|
def test_run_blocks_cross_tenant_query_bypass
|
|
# A hijacked PRM that advertises a different tenant's `resource`
|
|
# MUST cause an audience-binding failure rather than allowing
|
|
# the client to mint a token bound to the attacker's tenant for
|
|
# the victim's MCP server.
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://srv.example.com/mcp?tenant=evil",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(
|
|
server_url: "https://srv.example.com/mcp?tenant=victim",
|
|
resource_metadata_url: @prm_url,
|
|
)
|
|
end
|
|
|
|
assert_match(/resource/i, error.message)
|
|
end
|
|
|
|
def test_run_raises_on_resource_mismatch
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(
|
|
resource: "https://evil.example.com/mcp",
|
|
authorization_servers: [@auth_base],
|
|
),
|
|
)
|
|
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { ["code", "state"] },
|
|
)
|
|
|
|
error = assert_raises(Flow::AuthorizationError) do
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
end
|
|
|
|
assert_match(/resource/i, error.message)
|
|
end
|
|
|
|
def test_run_sends_server_url_as_resource_when_prm_omits_it
|
|
stub_request(:get, @prm_url).to_return(
|
|
status: 200,
|
|
headers: { "Content-Type" => "application/json" },
|
|
body: JSON.generate(authorization_servers: [@auth_base]),
|
|
)
|
|
|
|
state_holder = {}
|
|
provider = Provider.new(
|
|
client_metadata: {
|
|
redirect_uris: ["http://localhost:0/callback"],
|
|
grant_types: ["authorization_code"],
|
|
response_types: ["code"],
|
|
token_endpoint_auth_method: "none",
|
|
},
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(url) {
|
|
state_holder[:url] = url
|
|
state_holder[:state] = URI.decode_www_form(url.query).to_h.fetch("state")
|
|
},
|
|
callback_handler: -> { ["test-auth-code", state_holder[:state]] },
|
|
)
|
|
|
|
Flow.new(provider: provider).run!(server_url: @server_url, resource_metadata_url: @prm_url)
|
|
|
|
query = URI.decode_www_form(state_holder[:url].query).to_h
|
|
assert_equal("https://srv.example.com/mcp", query["resource"])
|
|
|
|
assert_requested(:post, "#{@auth_base}/token") do |req|
|
|
URI.decode_www_form(req.body).to_h["resource"] == "https://srv.example.com/mcp"
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def refresh_only_provider
|
|
provider = Provider.new(
|
|
client_metadata: { redirect_uris: ["http://localhost:0/callback"] },
|
|
redirect_uri: "http://localhost:0/callback",
|
|
redirect_handler: ->(_url) {},
|
|
callback_handler: -> { [nil, nil] },
|
|
)
|
|
provider.save_client_information("client_id" => "test-client")
|
|
|
|
provider
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|