mcpctl/src/mcpd/tests/auth.test.ts

import { describe, it, expect, vi, afterEach } from 'vitest';
import Fastify from 'fastify';
import type { FastifyInstance } from 'fastify';
import { createAuthMiddleware } from '../src/middleware/auth.js';

let app: FastifyInstance;

afterEach(async () => {
  if (app) await app.close();
});

function setupApp(findSession: (token: string) => Promise<{ userId: string; expiresAt: Date } | null>) {
  app = Fastify({ logger: false });
  const authMiddleware = createAuthMiddleware({ findSession });

  app.addHook('preHandler', authMiddleware);
  app.get('/protected', async (request) => {
    return { userId: request.userId };
  });

  return app.ready();
}

describe('auth middleware', () => {
  it('returns 401 when no Authorization header', async () => {
    await setupApp(async () => null);
    const res = await app.inject({ method: 'GET', url: '/protected' });
    expect(res.statusCode).toBe(401);
    expect(res.json<{ error: string }>().error).toContain('Authorization');
  });

  it('returns 401 when header is not Bearer', async () => {
    await setupApp(async () => null);
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Basic abc123' },
    });
    expect(res.statusCode).toBe(401);
  });

  it('returns 401 when token is empty', async () => {
    await setupApp(async () => null);
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer ' },
    });
    expect(res.statusCode).toBe(401);
    expect(res.json<{ error: string }>().error).toContain('Empty');
  });

  it('returns 401 when token not found', async () => {
    await setupApp(async () => null);
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer invalid-token' },
    });
    expect(res.statusCode).toBe(401);
    expect(res.json<{ error: string }>().error).toContain('Invalid');
  });

  it('returns 401 when token is expired', async () => {
    const pastDate = new Date(Date.now() - 86400_000);
    await setupApp(async () => ({ userId: 'user-1', expiresAt: pastDate }));
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer expired-token' },
    });
    expect(res.statusCode).toBe(401);
    expect(res.json<{ error: string }>().error).toContain('expired');
  });

  it('passes valid token and sets userId', async () => {
    const futureDate = new Date(Date.now() + 86400_000);
    await setupApp(async () => ({ userId: 'user-42', expiresAt: futureDate }));
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer valid-token' },
    });
    expect(res.statusCode).toBe(200);
    expect(res.json<{ userId: string }>().userId).toBe('user-42');
  });

  it('calls findSession with the token', async () => {
    const findSession = vi.fn(async () => ({
      userId: 'user-1',
      expiresAt: new Date(Date.now() + 86400_000),
    }));
    await setupApp(findSession);
    await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer my-token' },
    });
    expect(findSession).toHaveBeenCalledWith('my-token');
  });
});

describe('auth middleware — McpToken dispatch', () => {
  async function setupAppWithMcpToken(deps: Parameters<typeof createAuthMiddleware>[0]) {
    app = Fastify({ logger: false });
    const authMiddleware = createAuthMiddleware(deps);
    app.addHook('preHandler', authMiddleware);
    app.get('/protected', async (request) => ({
      userId: request.userId,
      mcpToken: request.mcpToken,
    }));
    return app.ready();
  }

  it('routes mcpctl_pat_ bearers to findMcpToken and skips findSession', async () => {
    const findSession = vi.fn(async () => null);
    const findMcpToken = vi.fn(async () => ({
      tokenId: 'ctok1',
      tokenName: 'mytok',
      tokenSha: 'deadbeef',
      projectId: 'cproj1',
      projectName: 'myproj',
      ownerId: 'cuser1',
      expiresAt: null,
      revokedAt: null,
    }));
    await setupAppWithMcpToken({ findSession, findMcpToken });
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer mcpctl_pat_abcdefghij' },
    });
    expect(res.statusCode).toBe(200);
    expect(findSession).not.toHaveBeenCalled();
    expect(findMcpToken).toHaveBeenCalledTimes(1);
    const body = res.json<{ userId: string; mcpToken: { tokenName: string; projectName: string } }>();
    expect(body.userId).toBe('cuser1');
    expect(body.mcpToken.tokenName).toBe('mytok');
    expect(body.mcpToken.projectName).toBe('myproj');
  });

  it('returns 401 for a revoked McpToken', async () => {
    await setupAppWithMcpToken({
      findSession: async () => null,
      findMcpToken: async () => ({
        tokenId: 'ctok1',
        tokenName: 'mytok',
        tokenSha: 'x',
        projectId: 'p',
        projectName: 'p',
        ownerId: 'u',
        expiresAt: null,
        revokedAt: new Date(),
      }),
    });
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer mcpctl_pat_revoked' },
    });
    expect(res.statusCode).toBe(401);
    expect(res.json<{ error: string }>().error).toContain('revoked');
  });

  it('returns 401 when a mcpctl_pat_ bearer arrives but findMcpToken is not configured', async () => {
    await setupAppWithMcpToken({ findSession: async () => null });
    const res = await app.inject({
      method: 'GET',
      url: '/protected',
      headers: { authorization: 'Bearer mcpctl_pat_no-lookup-wired' },
    });
    expect(res.statusCode).toBe(401);
  });
});