Nostos.Backend.Tests/Mcp/McpOAuthTests.cs
Rama main · réplica de lectura del repositorio original.
using System.Buffers.Text;
using System.Net;
using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
using System.Text.RegularExpressions;
using FluentAssertions;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc.Testing;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.DependencyInjection.Extensions;
using ModelContextProtocol.Client;
using ModelContextProtocol.Protocol;
using Nostos.Backend.Data;
using Nostos.Backend.Integrations.Mcp;
using Nostos.Backend.Services.Mcp;
using Nostos.Backend.Services.Mcp.OAuth;
using Nostos.Backend.Tests.Support;
using Xunit;
namespace Nostos.Backend.Tests.Mcp;
/// <summary>
/// The SelfHosted host with <c>Mcp:PublicBaseUrl</c> set (issue #1470). The
/// one stand-in is the client metadata fetch, which would need the internet;
/// its limits are covered by <see cref="McpClientMetadataFetcherTests"/>.
/// </summary>
public sealed class McpOAuthFactory : LibraryEndpointFactory
{
public const string PublicBase = "https://nostos.example.ts.net";
public const string ClaudeClientId = "https://claude.ai/oauth/mcp-oauth-client-metadata";
public const string ClaudeRedirect = "https://claude.ai/api/mcp/auth_callback";
protected override void ConfigureWebHost(IWebHostBuilder builder)
{
base.ConfigureWebHost(builder);
builder.UseSetting(McpOAuthSettings.ConfigurationKey, PublicBase);
builder.ConfigureServices(services =>
{
services.RemoveAll<IMcpClientMetadataFetcher>();
services.AddSingleton<IMcpClientMetadataFetcher>(new KnownClients(
new McpClientMetadata(ClaudeClientId, "Claude", [ClaudeRedirect])));
});
}
private sealed class KnownClients(params McpClientMetadata[] clients) : IMcpClientMetadataFetcher
{
public Task<McpClientMetadataResult> FetchAsync(string clientId, CancellationToken cancellationToken) =>
Task.FromResult(clients.FirstOrDefault(c => c.ClientId == clientId) is { } client
? new McpClientMetadataResult(client, null)
: McpClientMetadataResult.Fail("The app's address answered 404."));
}
}
public sealed class McpOAuthTests : IAsyncLifetime
{
private const string Resource = McpOAuthFactory.PublicBase + "/mcp";
private readonly McpOAuthFactory _factory = new();
/// <summary>The owner, on the private network.</summary>
private HttpClient _local = null!;
/// <summary>The app, through the tunnel: requests carry the public host.</summary>
private HttpClient _public = null!;
public async Task InitializeAsync()
{
_local = _factory.CreateClient(new WebApplicationFactoryClientOptions { AllowAutoRedirect = false });
_public = _factory.CreateClient(new WebApplicationFactoryClientOptions
{
AllowAutoRedirect = false,
BaseAddress = new Uri(McpOAuthFactory.PublicBase),
});
(await _local.GetAsync("/health/live")).EnsureSuccessStatusCode();
}
public async Task DisposeAsync()
{
_local.Dispose();
_public.Dispose();
await _factory.DisposeAsync();
}
// --- metadata -------------------------------------------------------
[Theory]
[InlineData("/.well-known/oauth-protected-resource")]
[InlineData("/.well-known/oauth-protected-resource/mcp")]
public async Task The_protected_resource_metadata_names_the_public_mcp_url(string path)
{
var prm = await _public.GetFromJsonAsync<JsonElement>(path);
prm.GetProperty("resource").GetString().Should().Be(Resource);
prm.GetProperty("authorization_servers").EnumerateArray().Select(e => e.GetString()).Should().Equal(McpOAuthFactory.PublicBase);
prm.GetProperty("scopes_supported").EnumerateArray().Select(e => e.GetString()).Should().Equal("nostos:read", "nostos:write");
prm.GetProperty("bearer_methods_supported").EnumerateArray().Select(e => e.GetString()).Should().Equal("header");
}
[Fact]
public async Task The_authorization_server_metadata_offers_code_pkce_and_cimd_only()
{
var meta = await _public.GetFromJsonAsync<JsonElement>("/.well-known/oauth-authorization-server");
meta.GetProperty("issuer").GetString().Should().Be(McpOAuthFactory.PublicBase);
meta.GetProperty("authorization_endpoint").GetString().Should().Be(McpOAuthFactory.PublicBase + "/oauth/authorize");
meta.GetProperty("token_endpoint").GetString().Should().Be(McpOAuthFactory.PublicBase + "/oauth/token");
meta.GetProperty("revocation_endpoint").GetString().Should().Be(McpOAuthFactory.PublicBase + "/oauth/revoke");
Strings(meta, "response_types_supported").Should().Equal("code");
Strings(meta, "grant_types_supported").Should().Equal("authorization_code", "refresh_token");
Strings(meta, "code_challenge_methods_supported").Should().Equal("S256");
Strings(meta, "token_endpoint_auth_methods_supported").Should().Equal("none");
Strings(meta, "scopes_supported").Should().Equal("nostos:read", "nostos:write");
meta.GetProperty("client_id_metadata_document_supported").GetBoolean().Should().BeTrue();
meta.TryGetProperty("registration_endpoint", out _).Should().BeFalse();
}
[Fact]
public async Task A_401_on_mcp_points_at_the_protected_resource_metadata()
{
var none = await ListToolsRawAsync(_public, null);
var wrong = await ListToolsRawAsync(_public, "nsa_" + new string('A', 43));
none.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
var challenge = none.Headers.WwwAuthenticate.ToString();
challenge.Should().Contain($"resource_metadata=\"{McpOAuthFactory.PublicBase}/.well-known/oauth-protected-resource/mcp\"");
challenge.Should().Contain("scope=\"nostos:read nostos:write\"");
wrong.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
wrong.Headers.WwwAuthenticate.ToString().Should().Contain("invalid_token").And.Contain("resource_metadata=");
}
// --- the whole flow -------------------------------------------------
[Fact]
public async Task Claude_connects_after_the_owner_approves_and_appears_in_connected_apps()
{
var bookId = await CreateBookAsync("Moby-Dick");
var verifier = Verifier();
var page = await AuthorizeAsync(Challenge(verifier), state: "xyz");
page.StatusCode.Should().Be(HttpStatusCode.OK);
page.Content.Headers.ContentType!.MediaType.Should().Be("text/html");
page.Headers.GetValues("Content-Security-Policy").Single().Should().Contain("default-src 'none'");
var html = await page.Content.ReadAsStringAsync();
html.Should().Contain("Claude wants to connect to your Nostos").And.Contain("Settings → Connected apps");
var pending = await PendingAsync();
var request = pending.Single();
html.Should().Contain(request.GetProperty("code").GetString());
request.GetProperty("code").GetString().Should().MatchRegex("^[A-Z]{4}$");
request.GetProperty("clientName").GetString().Should().Be("Claude");
request.GetProperty("clientHost").GetString().Should().Be("claude.ai");
request.GetProperty("redirectHost").GetString().Should().Be("claude.ai");
request.GetProperty("requestedScope").GetString().Should().Be("read_write");
(await PollAsync(RequestId(html))).GetProperty("status").GetString().Should().Be("pending");
(await _local.PostAsJsonAsync($"/api/mcp/oauth/requests/{request.GetProperty("id").GetString()}/approve", new { scope = "read_write" }))
.StatusCode.Should().Be(HttpStatusCode.NoContent);
var redirect = new Uri((await PollAsync(RequestId(html))).GetProperty("redirect").GetString()!);
(await PendingAsync()).Should().BeEmpty();
redirect.GetLeftPart(UriPartial.Path).Should().Be(McpOAuthFactory.ClaudeRedirect);
var query = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(redirect.Query);
query["state"].ToString().Should().Be("xyz");
query["iss"].ToString().Should().Be(McpOAuthFactory.PublicBase);
var token = await TokenAsync(new()
{
["grant_type"] = "authorization_code",
["code"] = query["code"].ToString(),
["redirect_uri"] = McpOAuthFactory.ClaudeRedirect,
["client_id"] = McpOAuthFactory.ClaudeClientId,
["code_verifier"] = verifier,
["resource"] = Resource,
});
token.StatusCode.Should().Be(HttpStatusCode.OK);
token.Headers.CacheControl!.NoStore.Should().BeTrue();
var body = await token.Content.ReadFromJsonAsync<JsonElement>();
body.GetProperty("token_type").GetString().Should().Be("Bearer");
body.GetProperty("expires_in").GetInt32().Should().Be(3600);
body.GetProperty("scope").GetString().Should().Be("nostos:read nostos:write");
var access = body.GetProperty("access_token").GetString()!;
access.Should().StartWith("nsa_");
body.GetProperty("refresh_token").GetString().Should().StartWith("nsr_");
await using (var mcp = await ConnectAsync(access))
{
var save = await mcp.CallToolAsync("save_note", new Dictionary<string, object?>
{
["bookId"] = bookId,
["thought"] = "Call me Ishmael.",
});
save.IsError.Should().NotBe(true, Text(save));
// The public address serves no app pages: no link may point there.
var book = await mcp.CallToolAsync("get_book", new Dictionary<string, object?> { ["bookId"] = bookId });
book.IsError.Should().NotBe(true, Text(book));
Text(book).Should().NotContain(McpOAuthFactory.PublicBase).And.Contain($"/library/{bookId:D}");
}
var apps = (await _local.GetFromJsonAsync<JsonElement>(McpConnectedAppsEndpoints.Route)).GetProperty("apps");
var app = apps.EnumerateArray().Single();
app.GetProperty("kind").GetString().Should().Be("oauth_app");
app.GetProperty("name").GetString().Should().Be("Claude");
app.GetProperty("scope").GetString().Should().Be("read_write");
app.GetProperty("lastUsedAt").ValueKind.Should().NotBe(JsonValueKind.Null);
apps.GetRawText().Should().NotContain(access);
await using var db = await Contexts().CreateDbContextAsync();
(await db.McpOAuthTokens.AnyAsync(t => t.TokenHash == McpAccessTokenService.Hash(access))).Should().BeTrue();
(await db.McpOAuthTokens.Select(t => t.TokenHash).ToListAsync()).Should().NotContain(access);
}
[Fact]
public async Task A_read_only_approval_is_refused_on_write_tools()
{
var bookId = await CreateBookAsync("Walden");
var (access, _) = await ConnectClaudeAsync(approveScope: "read");
await using var mcp = await ConnectAsync(access);
var save = await mcp.CallToolAsync("save_note", new Dictionary<string, object?>
{
["bookId"] = bookId,
["thought"] = "Simplify.",
});
var read = await mcp.CallToolAsync("list_books", new Dictionary<string, object?>());
save.IsError.Should().BeTrue();
Text(save).Should().Be(McpScopes.ReadOnlyRefusal);
read.IsError.Should().NotBe(true, Text(read));
await using var db = await Contexts().CreateDbContextAsync();
(await db.Notes.CountAsync()).Should().Be(0);
}
[Fact]
public async Task A_denied_request_sends_the_app_back_with_access_denied()
{
var html = await (await AuthorizeAsync(Challenge(Verifier()), state: "s1")).Content.ReadAsStringAsync();
var id = (await PendingAsync()).Single().GetProperty("id").GetString();
(await _local.PostAsJsonAsync($"/api/mcp/oauth/requests/{id}/deny", new { })).StatusCode.Should().Be(HttpStatusCode.NoContent);
var redirect = new Uri((await PollAsync(RequestId(html))).GetProperty("redirect").GetString()!);
var query = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(redirect.Query);
query["error"].ToString().Should().Be("access_denied");
query["state"].ToString().Should().Be("s1");
query.ContainsKey("code").Should().BeFalse();
(await _local.PostAsJsonAsync($"/api/mcp/oauth/requests/{id}/approve", new { scope = "read" }))
.StatusCode.Should().Be(HttpStatusCode.NotFound);
}
// --- authorize errors ---------------------------------------------
[Fact]
public async Task A_redirect_uri_the_client_does_not_list_gets_an_error_page_and_no_redirect()
{
var response = await _public.GetAsync(AuthorizeUrl(Challenge(Verifier()), redirectUri: "https://evil.example/callback"));
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
response.Headers.Location.Should().BeNull();
(await response.Content.ReadAsStringAsync()).Should().Contain("cannot connect");
(await PendingAsync()).Should().BeEmpty();
}
[Fact]
public async Task An_unknown_client_gets_an_error_page_and_no_redirect()
{
var response = await _public.GetAsync(AuthorizeUrl(Challenge(Verifier()), clientId: "https://unknown.example/client.json"));
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
response.Headers.Location.Should().BeNull();
}
[Theory]
[InlineData("code_challenge_method=plain", "invalid_request")]
[InlineData("no_challenge", "invalid_request")]
[InlineData("response_type=token", "unsupported_response_type")]
[InlineData("resource=https://elsewhere.example/mcp", "invalid_target")]
[InlineData("scope=openid", "invalid_scope")]
public async Task A_bad_authorization_request_is_sent_back_with_an_error(string variant, string error)
{
var url = AuthorizeUrl(Challenge(Verifier()), state: "st");
url = variant switch
{
"no_challenge" => Regex.Replace(url, "&code_challenge=[^&]*", ""),
"code_challenge_method=plain" => url.Replace("code_challenge_method=S256", "code_challenge_method=plain"),
"response_type=token" => url.Replace("response_type=code", "response_type=token"),
"resource=https://elsewhere.example/mcp" => Regex.Replace(url, "&resource=[^&]*", "&resource=" + Uri.EscapeDataString("https://elsewhere.example/mcp")),
"scope=openid" => Regex.Replace(url, "&scope=[^&]*", "&scope=openid"),
_ => url,
};
var response = await _public.GetAsync(url);
response.StatusCode.Should().Be(HttpStatusCode.Redirect);
var query = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(response.Headers.Location!.Query);
response.Headers.Location!.GetLeftPart(UriPartial.Path).Should().Be(McpOAuthFactory.ClaudeRedirect);
query["error"].ToString().Should().Be(error);
query["state"].ToString().Should().Be("st");
(await PendingAsync()).Should().BeEmpty();
}
// --- token errors ---------------------------------------------------
[Fact]
public async Task A_wrong_code_verifier_fails_and_leaves_the_code_for_the_real_client()
{
var verifier = Verifier();
var code = await ApprovedCodeAsync(Challenge(verifier), "read_write");
var wrong = await RedeemAsync(code, Verifier());
var right = await RedeemAsync(code, verifier);
await ExpectOAuthErrorAsync(wrong, "invalid_grant");
right.StatusCode.Should().Be(HttpStatusCode.OK);
await using var db = await Contexts().CreateDbContextAsync();
(await db.McpOAuthGrants.CountAsync()).Should().Be(1);
}
[Fact]
public async Task A_wrong_redirect_uri_or_client_at_the_token_endpoint_fails()
{
var verifier = Verifier();
var first = await ApprovedCodeAsync(Challenge(verifier), "read");
var second = await ApprovedCodeAsync(Challenge(verifier), "read");
await ExpectOAuthErrorAsync(await RedeemAsync(first, verifier, redirectUri: "https://claude.ai/other"), "invalid_grant");
await ExpectOAuthErrorAsync(await RedeemAsync(second, verifier, clientId: "https://other.example/client.json"), "invalid_grant");
}
[Fact]
public async Task A_code_used_twice_fails_and_revokes_what_the_first_use_made()
{
var verifier = Verifier();
var code = await ApprovedCodeAsync(Challenge(verifier), "read");
var first = await RedeemAsync(code, verifier);
first.StatusCode.Should().Be(HttpStatusCode.OK);
var access = (await first.Content.ReadFromJsonAsync<JsonElement>()).GetProperty("access_token").GetString()!;
(await ListToolsRawAsync(_public, access)).StatusCode.Should().Be(HttpStatusCode.OK);
await ExpectOAuthErrorAsync(await RedeemAsync(code, verifier), "invalid_grant");
(await ListToolsRawAsync(_public, access)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Fact]
public async Task Refresh_rotates_and_reusing_an_old_refresh_token_revokes_the_grant()
{
var (access1, refresh1) = await ConnectClaudeAsync("read_write");
var rotated = await RefreshAsync(refresh1);
rotated.StatusCode.Should().Be(HttpStatusCode.OK);
var body = await rotated.Content.ReadFromJsonAsync<JsonElement>();
var access2 = body.GetProperty("access_token").GetString()!;
var refresh2 = body.GetProperty("refresh_token").GetString()!;
refresh2.Should().NotBe(refresh1);
body.GetProperty("scope").GetString().Should().Be("nostos:read nostos:write");
(await ListToolsRawAsync(_public, access2)).StatusCode.Should().Be(HttpStatusCode.OK);
await AgeSpentRefreshTokensAsync(McpOAuthService.RefreshReuseGrace + TimeSpan.FromSeconds(1));
var replay = await RefreshAsync(refresh1);
await ExpectOAuthErrorAsync(replay, "invalid_grant");
await ExpectOAuthErrorAsync(await RefreshAsync(refresh2), "invalid_grant");
(await ListToolsRawAsync(_public, access2)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
(await ListToolsRawAsync(_public, access1)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
(await _local.GetFromJsonAsync<JsonElement>(McpConnectedAppsEndpoints.Route)).GetProperty("apps").GetArrayLength().Should().Be(0);
}
[Fact]
public async Task A_refresh_retried_within_the_grace_window_gets_a_fresh_pair_and_keeps_the_grant()
{
var (_, refresh1) = await ConnectClaudeAsync("read");
var first = await RefreshAsync(refresh1);
var retry = await RefreshAsync(refresh1);
first.StatusCode.Should().Be(HttpStatusCode.OK);
retry.StatusCode.Should().Be(HttpStatusCode.OK);
var a = await first.Content.ReadFromJsonAsync<JsonElement>();
var b = await retry.Content.ReadFromJsonAsync<JsonElement>();
b.GetProperty("access_token").GetString().Should().NotBe(a.GetProperty("access_token").GetString());
(await ListToolsRawAsync(_public, a.GetProperty("access_token").GetString())).StatusCode.Should().Be(HttpStatusCode.OK);
(await ListToolsRawAsync(_public, b.GetProperty("access_token").GetString())).StatusCode.Should().Be(HttpStatusCode.OK);
(await RefreshAsync(b.GetProperty("refresh_token").GetString()!)).StatusCode.Should().Be(HttpStatusCode.OK);
}
[Fact]
public async Task A_grant_idle_past_the_refresh_lifetime_is_no_longer_listed()
{
var (access, _) = await ConnectClaudeAsync("read");
await using (var db = await Contexts().CreateDbContextAsync())
{
await db.McpOAuthTokens.ExecuteUpdateAsync(set => set.SetProperty(t => t.ExpiresAtUtc, DateTime.UtcNow.AddMinutes(-1)));
}
(await _local.GetFromJsonAsync<JsonElement>(McpConnectedAppsEndpoints.Route)).GetProperty("apps").GetArrayLength().Should().Be(0);
(await ListToolsRawAsync(_public, access)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
await using var check = await Contexts().CreateDbContextAsync();
(await check.McpOAuthGrants.CountAsync()).Should().Be(0);
}
[Fact]
public async Task One_address_can_keep_only_a_few_requests_waiting()
{
for (var i = 0; i < McpOAuthRequests.MaxPendingPerAddress; i++)
(await AuthorizeAsync(Challenge(Verifier()))).StatusCode.Should().Be(HttpStatusCode.OK);
var refused = await AuthorizeAsync(Challenge(Verifier()), state: "st");
refused.StatusCode.Should().Be(HttpStatusCode.Redirect);
Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(refused.Headers.Location!.Query)["error"].ToString()
.Should().Be("temporarily_unavailable");
(await PendingAsync()).Should().HaveCount(McpOAuthRequests.MaxPendingPerAddress);
}
[Fact]
public void A_code_tried_again_while_its_grant_is_written_is_caught()
{
var requests = new McpOAuthRequests();
var client = new McpClientMetadata(McpOAuthFactory.ClaudeClientId, "Claude", [McpOAuthFactory.ClaudeRedirect]);
var (id, _) = requests.Create(client, McpOAuthFactory.ClaudeRedirect, null, Challenge(Verifier()), "read", McpOAuthFactory.PublicBase)!.Value;
requests.Approve(id, "read").Should().BeTrue();
var redirect = ((McpOAuthPollResult.Done)requests.Poll(id)).RedirectUrl;
var code = Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(new Uri(redirect).Query)["code"].ToString();
requests.Redeem(code, _ => false, out _, out var none).Should().BeNull();
none.Should().BeNull("a failed check leaves the code unspent");
requests.Redeem(code, _ => true, out var grantId, out _).Should().NotBeNull();
requests.Redeem(code, _ => true, out _, out var spent).Should().BeNull();
spent.Should().Be(grantId);
requests.FinishRedeem(code).Should().BeTrue();
}
[Fact]
public async Task A_refresh_for_another_client_fails_without_revoking()
{
var (access, refresh) = await ConnectClaudeAsync("read");
await ExpectOAuthErrorAsync(await RefreshAsync(refresh, "https://other.example/client.json"), "invalid_grant");
(await RefreshAsync(refresh)).StatusCode.Should().Be(HttpStatusCode.OK);
}
[Fact]
public async Task Revoking_in_settings_stops_the_next_refresh_and_the_next_mcp_call()
{
var (access, refresh) = await ConnectClaudeAsync("read_write");
(await ListToolsRawAsync(_public, access)).StatusCode.Should().Be(HttpStatusCode.OK);
var id = (await _local.GetFromJsonAsync<JsonElement>(McpConnectedAppsEndpoints.Route))
.GetProperty("apps").EnumerateArray().Single().GetProperty("id").GetString();
(await _local.DeleteAsync($"{McpConnectedAppsEndpoints.Route}/{id}")).StatusCode.Should().Be(HttpStatusCode.NoContent);
(await ListToolsRawAsync(_public, access)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
await ExpectOAuthErrorAsync(await RefreshAsync(refresh), "invalid_grant");
await using var db = await Contexts().CreateDbContextAsync();
(await db.McpOAuthTokens.CountAsync()).Should().Be(0);
}
[Fact]
public async Task The_revocation_endpoint_revokes_the_grant_for_a_refresh_token()
{
var (access, refresh) = await ConnectClaudeAsync("read");
var revoke = await _public.PostAsync("/oauth/revoke", new FormUrlEncodedContent(new Dictionary<string, string>
{
["token"] = refresh,
["token_type_hint"] = "refresh_token",
}));
var unknown = await _public.PostAsync("/oauth/revoke", new FormUrlEncodedContent(new Dictionary<string, string>
{
["token"] = "nsr_" + new string('Q', 43),
}));
revoke.StatusCode.Should().Be(HttpStatusCode.OK);
unknown.StatusCode.Should().Be(HttpStatusCode.OK);
(await ListToolsRawAsync(_public, access)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Theory]
[InlineData("password", "unsupported_grant_type")]
[InlineData(null, "invalid_request")]
public async Task Other_grant_types_are_refused(string? grantType, string error)
{
var form = new Dictionary<string, string> { ["client_id"] = McpOAuthFactory.ClaudeClientId };
if (grantType is not null)
form["grant_type"] = grantType;
await ExpectOAuthErrorAsync(await TokenAsync(form), error);
}
// --- the public host ----------------------------------------------
[Theory]
[InlineData("GET", "/")]
[InlineData("GET", "/index.html")]
[InlineData("GET", "/library")]
[InlineData("GET", "/settings")]
[InlineData("GET", "/api/books")]
[InlineData("GET", "/api/runtime/capabilities")]
[InlineData("GET", "/api/mcp/apps")]
[InlineData("POST", "/api/mcp/tokens")]
[InlineData("GET", "/api/mcp/oauth")]
[InlineData("POST", "/api/mcp/oauth/requests/abc/approve")]
[InlineData("POST", "/api/mcp/oauth/requests/abc/deny")]
[InlineData("GET", "/opds")]
[InlineData("GET", "/opds/")]
[InlineData("GET", "/health/live")]
[InlineData("GET", "/openapi/v1.json")]
[InlineData("GET", "/mcp/../api/books")]
[InlineData("GET", "/mcpx")]
[InlineData("GET", "/oauth/other")]
[InlineData("GET", "/.well-known/openid-configuration")]
public async Task Everything_outside_the_allowlist_is_404_on_the_public_host(string method, string path)
{
var response = await _public.SendAsync(new HttpRequestMessage(new HttpMethod(method), path)
{
Content = method == "POST" ? JsonContent.Create(new { scope = "read_write", name = "x" }) : null,
});
response.StatusCode.Should().Be(HttpStatusCode.NotFound);
(await response.Content.ReadAsStringAsync()).Should().NotContain(LibraryEndpointFactory.SpaShellMarker);
}
[Theory]
[InlineData("X-Forwarded-Host", "nostos.example.ts.net")]
[InlineData("X-Forwarded-Host", "NOSTOS.example.ts.net:443")]
[InlineData("Tailscale-Funnel-Request", "?1")]
public async Task A_request_forwarded_for_the_public_host_or_through_funnel_is_public_too(string header, string value)
{
var request = new HttpRequestMessage(HttpMethod.Get, "/api/books");
request.Headers.TryAddWithoutValidation(header, value);
(await _local.SendAsync(request)).StatusCode.Should().Be(HttpStatusCode.NotFound);
(await _local.GetAsync("/api/books")).StatusCode.Should().Be(HttpStatusCode.OK);
}
[Fact]
public async Task The_allowed_paths_answer_on_the_public_host()
{
(await _public.GetAsync("/.well-known/oauth-protected-resource/mcp")).StatusCode.Should().Be(HttpStatusCode.OK);
(await _public.GetAsync("/.well-known/oauth-authorization-server")).StatusCode.Should().Be(HttpStatusCode.OK);
(await _public.GetAsync(AuthorizeUrl(Challenge(Verifier())))).StatusCode.Should().Be(HttpStatusCode.OK);
(await _public.GetAsync("/oauth/authorize/status?request=nope")).StatusCode.Should().Be(HttpStatusCode.NotFound);
(await TokenAsync(new() { ["grant_type"] = "refresh_token", ["refresh_token"] = "x" })).StatusCode.Should().Be(HttpStatusCode.BadRequest);
(await ListToolsRawAsync(_public, null)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
[Fact]
public void The_owner_routes_recognise_the_public_host_in_every_form()
{
var settings = McpOAuthSettings.From(McpOAuthFactory.PublicBase);
HttpContext Request(string host, params (string Name, string Value)[] headers)
{
var context = new DefaultHttpContext();
context.Request.Host = new HostString(host);
foreach (var (name, value) in headers)
context.Request.Headers[name] = value;
return context;
}
McpPublicHost.IsPublicRequest(Request("nostos.example.ts.net"), settings).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("Nostos.Example.TS.net:443"), settings).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("nostos.example.ts.net."), settings).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("nostos.example.ts.net:8443"), settings).Should().BeFalse();
McpPublicHost.IsPublicRequest(Request("nostos.example.ts.net:8443"), McpOAuthSettings.From(McpOAuthFactory.PublicBase + ":8443")).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("127.0.0.1:5214", ("X-Original-Host", "nostos.example.ts.net")), settings).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("127.0.0.1:5214", ("X-Forwarded-Host", "a.example, nostos.example.ts.net")), settings).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("192.168.1.20:5214", ("Tailscale-Funnel-Request", "?1")), settings).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("192.168.1.20:5214", ("Tailscale-Funnel-Request", "?1")), McpOAuthSettings.Disabled).Should().BeTrue();
McpPublicHost.IsPublicRequest(Request("192.168.1.20:5214"), settings).Should().BeFalse();
McpPublicHost.IsPublicRequest(Request("nostos.example.ts.net.evil.example"), settings).Should().BeFalse();
McpPublicHost.IsPublicRequest(Request("nostos.example.ts.net"), McpOAuthSettings.Disabled).Should().BeFalse();
}
[Fact]
public async Task Approve_and_deny_need_a_json_body_from_this_site()
{
await AuthorizeAsync(Challenge(Verifier()));
var id = (await PendingAsync()).Single().GetProperty("id").GetString();
var approve = $"/api/mcp/oauth/requests/{id}/approve";
// A cross-site page can send these without a CORS preflight.
(await _local.PostAsync(approve, null)).StatusCode.Should().Be(HttpStatusCode.Forbidden);
// A form or text body fails JSON binding first (415): refused either way.
(await _local.PostAsync(approve, new FormUrlEncodedContent(new Dictionary<string, string> { ["scope"] = "read" })))
.StatusCode.Should().BeOneOf(HttpStatusCode.Forbidden, HttpStatusCode.UnsupportedMediaType);
(await _local.PostAsync(approve, new StringContent("{\"scope\":\"read\"}", Encoding.UTF8, "text/plain")))
.StatusCode.Should().BeOneOf(HttpStatusCode.Forbidden, HttpStatusCode.UnsupportedMediaType);
(await _local.PostAsync($"/api/mcp/oauth/requests/{id}/deny", null)).StatusCode.Should().Be(HttpStatusCode.Forbidden);
var crossSite = new HttpRequestMessage(HttpMethod.Post, approve) { Content = JsonContent.Create(new { scope = "read" }) };
crossSite.Headers.TryAddWithoutValidation("Sec-Fetch-Site", "cross-site");
(await _local.SendAsync(crossSite)).StatusCode.Should().Be(HttpStatusCode.Forbidden);
(await PendingAsync()).Should().ContainSingle("nothing above approved the request");
var sameSite = new HttpRequestMessage(HttpMethod.Post, approve) { Content = JsonContent.Create(new { scope = "read" }) };
sameSite.Headers.TryAddWithoutValidation("Sec-Fetch-Site", "same-origin");
(await _local.SendAsync(sameSite)).StatusCode.Should().Be(HttpStatusCode.NoContent);
}
[Theory]
[InlineData(null, null, null, null, true)] // direct, any browser
[InlineData("same-origin", null, null, null, true)]
[InlineData("none", null, null, null, true)]
[InlineData("cross-site", null, null, null, false)]
[InlineData("same-site", null, null, null, false)]
[InlineData(null, "http://evil.example", null, null, false)] // no Sec-Fetch-Site: Origin decides
[InlineData(null, "http://nas.local:5214", null, null, true)]
[InlineData(null, null, "100.101.102.103", "127.0.0.1", true)] // Tailscale serve, applied
[InlineData(null, null, "203.0.113.9, 8.8.8.8", "127.0.0.1", false)] // proxied from the internet
[InlineData(null, null, null, "8.8.8.8", true)] // direct: address not checked
[InlineData(null, null, "192.168.1.4", "172.17.0.1", true)] // proxy Nostos does not trust, private
[InlineData(null, null, "8.8.4.4", "172.17.0.1", false)] // same, public caller
public void An_owner_decision_comes_from_this_site_and_the_owners_network(
string? fetchSite, string? origin, string? forwardedFor, string? remote, bool allowed)
{
var context = new DefaultHttpContext();
context.Request.Method = "POST";
context.Request.Host = new HostString("nas.local:5214");
context.Request.ContentType = "application/json";
if (fetchSite is not null)
context.Request.Headers["Sec-Fetch-Site"] = fetchSite;
if (origin is not null)
context.Request.Headers.Origin = origin;
if (forwardedFor is not null)
context.Request.Headers["X-Forwarded-For"] = forwardedFor;
if (remote is not null)
context.Connection.RemoteIpAddress = IPAddress.Parse(remote);
McpOAuthEndpoints.IsOwnerDecision(context).Should().Be(allowed);
}
[Fact]
public async Task The_authorize_endpoint_is_rate_limited_per_address()
{
var url = AuthorizeUrl(Challenge(Verifier()), clientId: "https://unknown.example/client.json");
for (var i = 0; i < McpOAuthRateLimiter.PermitsPerMinute(McpOAuthRateLimiter.Endpoint.Authorize); i++)
(await _public.GetAsync(url)).StatusCode.Should().Be(HttpStatusCode.BadRequest);
(await _public.GetAsync(url)).StatusCode.Should().Be(HttpStatusCode.TooManyRequests);
}
[Theory]
[InlineData(null, false)]
[InlineData("", false)]
[InlineData("http://nostos.example.ts.net", false)]
[InlineData("https://nostos.example.ts.net/nostos", false)]
[InlineData("https://nostos.example.ts.net?x=1", false)]
[InlineData("nostos.example.ts.net", false)]
[InlineData("https://nostos.example.ts.net", true)]
[InlineData("https://Nostos.Example.ts.net/", true)]
[InlineData("https://nostos.example.ts.net:8443", true)]
public void Oauth_is_on_only_for_an_https_base_url_without_a_path(string? value, bool enabled)
{
var settings = McpOAuthSettings.From(value);
settings.Enabled.Should().Be(enabled);
if (enabled)
{
settings.Resource.Should().Be(settings.Issuer + "/mcp");
settings.Issuer.Should().NotEndWith("/");
}
else if (!string.IsNullOrEmpty(value))
{
settings.Problem.Should().NotBeNull();
}
}
[Theory]
[InlineData(null, "read_write")]
[InlineData("nostos:read nostos:write", "read_write")]
[InlineData("nostos:read", "read")]
[InlineData("nostos:write", "read_write")]
[InlineData("nostos:read offline_access", "read")]
[InlineData("openid", null)]
public void The_requested_scope_maps_to_what_settings_offers(string? scope, string? expected) =>
McpOAuthEndpoints.ParseScope(scope).Should().Be(expected);
// ------------------------------------------------------------------
private async Task<(string Access, string Refresh)> ConnectClaudeAsync(string approveScope)
{
var verifier = Verifier();
var code = await ApprovedCodeAsync(Challenge(verifier), approveScope);
var response = await RedeemAsync(code, verifier);
response.EnsureSuccessStatusCode();
var body = await response.Content.ReadFromJsonAsync<JsonElement>();
return (body.GetProperty("access_token").GetString()!, body.GetProperty("refresh_token").GetString()!);
}
private async Task<string> ApprovedCodeAsync(string challenge, string approveScope)
{
var html = await (await AuthorizeAsync(challenge)).Content.ReadAsStringAsync();
var requestId = RequestId(html);
var id = (await PendingAsync()).Single().GetProperty("id").GetString();
(await _local.PostAsJsonAsync($"/api/mcp/oauth/requests/{id}/approve", new { scope = approveScope })).EnsureSuccessStatusCode();
var redirect = new Uri((await PollAsync(requestId)).GetProperty("redirect").GetString()!);
return Microsoft.AspNetCore.WebUtilities.QueryHelpers.ParseQuery(redirect.Query)["code"].ToString();
}
private Task<HttpResponseMessage> RedeemAsync(string code, string verifier, string? redirectUri = null, string? clientId = null) =>
TokenAsync(new()
{
["grant_type"] = "authorization_code",
["code"] = code,
["redirect_uri"] = redirectUri ?? McpOAuthFactory.ClaudeRedirect,
["client_id"] = clientId ?? McpOAuthFactory.ClaudeClientId,
["code_verifier"] = verifier,
});
private Task<HttpResponseMessage> RefreshAsync(string refresh, string? clientId = null) =>
TokenAsync(new()
{
["grant_type"] = "refresh_token",
["refresh_token"] = refresh,
["client_id"] = clientId ?? McpOAuthFactory.ClaudeClientId,
});
private Task<HttpResponseMessage> TokenAsync(Dictionary<string, string> form) =>
_public.PostAsync("/oauth/token", new FormUrlEncodedContent(form));
private static async Task ExpectOAuthErrorAsync(HttpResponseMessage response, string error)
{
response.StatusCode.Should().Be(HttpStatusCode.BadRequest);
var body = await response.Content.ReadFromJsonAsync<JsonElement>();
body.GetProperty("error").GetString().Should().Be(error);
body.GetProperty("error_description").GetString().Should().NotBeNullOrEmpty();
}
private Task<HttpResponseMessage> AuthorizeAsync(string challenge, string? state = null) =>
_public.GetAsync(AuthorizeUrl(challenge, state: state));
private static string AuthorizeUrl(string challenge, string? redirectUri = null, string? clientId = null, string? state = null) =>
"/oauth/authorize?response_type=code"
+ "&client_id=" + Uri.EscapeDataString(clientId ?? McpOAuthFactory.ClaudeClientId)
+ "&redirect_uri=" + Uri.EscapeDataString(redirectUri ?? McpOAuthFactory.ClaudeRedirect)
+ "&code_challenge=" + challenge
+ "&code_challenge_method=S256"
+ "&scope=" + Uri.EscapeDataString("nostos:read nostos:write")
+ "&resource=" + Uri.EscapeDataString(Resource)
+ (state is null ? "" : "&state=" + Uri.EscapeDataString(state));
private async Task<List<JsonElement>> PendingAsync()
{
var status = await _local.GetFromJsonAsync<JsonElement>("/api/mcp/oauth");
status.GetProperty("enabled").GetBoolean().Should().BeTrue();
status.GetProperty("connectorUrl").GetString().Should().Be(Resource);
return status.GetProperty("requests").EnumerateArray().ToList();
}
private async Task<JsonElement> PollAsync(string requestId)
{
var response = await _public.GetAsync($"/oauth/authorize/status?request={Uri.EscapeDataString(requestId)}");
return await response.Content.ReadFromJsonAsync<JsonElement>();
}
private static string RequestId(string html)
{
var match = Regex.Match(html, "data-status=\"[^\"]*request=([^\"&]+)\"");
match.Success.Should().BeTrue("the waiting page names its status URL");
return Uri.UnescapeDataString(System.Net.WebUtility.HtmlDecode(match.Groups[1].Value));
}
private static string Verifier() => Base64Url.EncodeToString(RandomNumberGenerator.GetBytes(32));
private static string Challenge(string verifier) =>
Base64Url.EncodeToString(SHA256.HashData(Encoding.ASCII.GetBytes(verifier)));
private static IEnumerable<string?> Strings(JsonElement element, string property) =>
element.GetProperty(property).EnumerateArray().Select(e => e.GetString());
private async Task<McpClient> ConnectAsync(string token)
{
var authed = _factory.CreateClient(new WebApplicationFactoryClientOptions { BaseAddress = new Uri(McpOAuthFactory.PublicBase) });
authed.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
return await McpClient.CreateAsync(
new HttpClientTransport(
new HttpClientTransportOptions
{
Endpoint = new Uri(authed.BaseAddress!, NostosMcp.Path),
TransportMode = HttpTransportMode.StreamableHttp,
},
authed,
ownsHttpClient: true),
new McpClientOptions
{
InitializationTimeout = TimeSpan.FromMinutes(3),
DiscoverProbeTimeout = TimeSpan.FromMinutes(1),
});
}
private static Task<HttpResponseMessage> ListToolsRawAsync(HttpClient http, string? token)
{
var request = new HttpRequestMessage(HttpMethod.Post, NostosMcp.Path)
{
Content = new StringContent(
"""{"jsonrpc":"2.0","id":1,"method":"tools/list"}""", Encoding.UTF8, "application/json"),
};
request.Headers.Accept.ParseAdd("application/json");
request.Headers.Accept.ParseAdd("text/event-stream");
if (token is not null)
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);
return http.SendAsync(request);
}
private async Task<Guid> CreateBookAsync(string title)
{
var response = await _local.PostAsJsonAsync("/api/books", new { type = "physical", title, author = "Someone" });
response.EnsureSuccessStatusCode();
return (await response.Content.ReadFromJsonAsync<JsonElement>()).GetProperty("id").GetGuid();
}
private IDbContextFactory<NostosDbContext> Contexts() =>
_factory.Services.GetRequiredService<IDbContextFactory<NostosDbContext>>();
private async Task AgeSpentRefreshTokensAsync(TimeSpan by)
{
var at = DateTime.UtcNow - by;
await using var db = await Contexts().CreateDbContextAsync();
await db.McpOAuthTokens.Where(t => t.ConsumedAtUtc != null)
.ExecuteUpdateAsync(set => set.SetProperty(t => t.ConsumedAtUtc, at));
}
private static string Text(CallToolResult result) =>
string.Concat(result.Content.OfType<TextContentBlock>().Select(c => c.Text));
}
/// <summary>OAuth off: the SelfHosted host as it ships without <c>Mcp:PublicBaseUrl</c>.</summary>
public sealed class McpOAuthOffTests : IAsyncLifetime
{
private readonly McpAccessTokenFactory _factory = new();
private HttpClient _http = null!;
public Task InitializeAsync()
{
_http = _factory.CreateClient();
return Task.CompletedTask;
}
public async Task DisposeAsync()
{
_http.Dispose();
await _factory.DisposeAsync();
}
[Fact]
public async Task Without_a_public_base_url_there_is_no_oauth_and_the_challenge_stays_plain()
{
(await _http.GetAsync("/.well-known/oauth-protected-resource/mcp")).StatusCode.Should().Be(HttpStatusCode.NotFound);
(await _http.GetAsync("/.well-known/oauth-authorization-server")).StatusCode.Should().Be(HttpStatusCode.NotFound);
(await _http.GetAsync("/oauth/authorize")).StatusCode.Should().Be(HttpStatusCode.NotFound);
(await _http.PostAsync("/oauth/token", new FormUrlEncodedContent([]))).StatusCode.Should().NotBe(HttpStatusCode.OK);
var status = await _http.GetFromJsonAsync<JsonElement>("/api/mcp/oauth");
status.GetProperty("enabled").GetBoolean().Should().BeFalse();
status.GetProperty("requests").GetArrayLength().Should().Be(0);
var mcp = await _http.PostAsync(NostosMcp.Path, new StringContent("{}", Encoding.UTF8, "application/json"));
mcp.StatusCode.Should().Be(HttpStatusCode.Unauthorized);
mcp.Headers.WwwAuthenticate.ToString().Should().NotContain("resource_metadata");
}
[Fact]
public async Task An_oauth_access_token_made_while_oauth_was_on_stops_working_when_it_is_turned_off()
{
var oauth = _factory.Services.GetRequiredService<McpOAuthService>();
var tokens = await oauth.CreateGrantAsync(
new McpOAuthCodeGrant(McpOAuthFactory.ClaudeClientId, "Claude", McpOAuthFactory.ClaudeRedirect, "unused", "read"),
Guid.NewGuid());
(await oauth.AuthenticateAsync(tokens!.AccessToken)).Should().NotBeNull("the token itself is live");
var request = new HttpRequestMessage(HttpMethod.Post, NostosMcp.Path)
{
Content = new StringContent("""{"jsonrpc":"2.0","id":1,"method":"tools/list"}""", Encoding.UTF8, "application/json"),
};
request.Headers.Accept.ParseAdd("application/json");
request.Headers.Accept.ParseAdd("text/event-stream");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokens.AccessToken);
(await _http.SendAsync(request)).StatusCode.Should().Be(HttpStatusCode.Unauthorized);
}
}