fixes

Author: Zvonimir

packages/plugin-epcis/tests/pluginEpcis.spec.ts

@@ -26,6 +26,7 @@ import {
 } from "@dkg/plugins/testing";
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
 import express from "express";
 
 const story = bicycleStory as any;
@@ -54,14 +55,24 @@ type ToolCallParams = {
   arguments?: Record<string, unknown>;
 };
 
-const MCP_TOOL_AUTH = {
+const MCP_TOOL_AUTH: { authInfo: AuthInfo } = {
   authInfo: {
+    token: "test-token",
+    clientId: "test-client",
     scopes: ["epcis.read", "epcis.write"],
   },
-} as const;
+};
+
+let setMcpClientAuthInfo: ((authInfo?: AuthInfo) => void) | null = null;
 
 function callToolWithAuth(client: Client, params: ToolCallParams) {
-  return client.callTool(params, undefined, MCP_TOOL_AUTH as any);
+  setMcpClientAuthInfo?.(MCP_TOOL_AUTH.authInfo);
+  return client.callTool(params);
+}
+
+function callToolWithoutAuth(client: Client, params: ToolCallParams) {
+  setMcpClientAuthInfo?.(undefined);
+  return client.callTool(params);
 }
 
 describe("@dkg/plugin-epcis checks", function () {
@@ -87,9 +98,11 @@ describe("@dkg/plugin-epcis checks", function () {
     };
     dkgQueryStub = sinon.stub(dkgContext.dkg.graph, "query");
 
-    const { server, client, connect } = await createMcpServerClientPair();
+    const { server, client, connect, setClientAuthInfo } =
+      await createMcpServerClientPair();
     mockMcpServer = server;
     mockMcpClient = client;
+    setMcpClientAuthInfo = setClientAuthInfo;
     apiRouter = express.Router();
     app = createExpressApp();
 
@@ -99,6 +112,7 @@ describe("@dkg/plugin-epcis checks", function () {
   });
 
   afterEach(() => {
+    setMcpClientAuthInfo = null;
     sinon.restore();
     if (originalMcpUrl !== undefined) {
       process.env.EXPO_PUBLIC_MCP_URL = originalMcpUrl;
@@ -562,6 +576,18 @@ describe("@dkg/plugin-epcis checks", function () {
       );
     });
 
+    it("returns Forbidden when MCP auth context is missing", async () => {
+      const result = await callToolWithoutAuth(mockMcpClient, {
+        name: "epcis-query",
+        arguments: { bizStep: "receiving" },
+      });
+      const payload = parseToolResult(result);
+
+      expect(result.isError).to.equal(true);
+      expect(payload.error).to.equal("Forbidden");
+      expect(payload.requiredScope).to.equal("epcis.read");
+    });
+
     it("returns MCP error when DKG query fails", async () => {
       dkgQueryStub.rejects(new Error("query exploded"));
       const result = await callToolWithAuth(mockMcpClient, {

packages/plugins/src/testing.ts

@@ -1,6 +1,7 @@
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
 import { createBlobStorage, express } from "./helpers";
 import { BlobData, BlobMetadata } from "./types";
 
@@ -36,12 +37,26 @@ export const createExpressApp = () => {
 export const createMcpServerClientPair = async () => {
   const server = new McpServer({ name: "Test DKG Server", version: "1.0.0" });
   const client = new Client({ name: "Test DKG Client", version: "1.0.0" });
-  const [serverTransport, clientTransport] =
+  const [clientTransport, serverTransport] =
     InMemoryTransport.createLinkedPair();
+  let authInfoForClientMessages: AuthInfo | undefined;
+
+  const originalClientSend = clientTransport.send.bind(clientTransport);
+  clientTransport.send = (message, options) => {
+    return originalClientSend(message, {
+      ...options,
+      authInfo: options?.authInfo ?? authInfoForClientMessages,
+    });
+  };
 
   return {
     server,
     client,
+    clientTransport,
+    serverTransport,
+    setClientAuthInfo: (authInfo?: AuthInfo) => {
+      authInfoForClientMessages = authInfo;
+    },
     connect: () =>
       Promise.all([
         server.connect(serverTransport),