|
| 1 | +import type { Kysely } from "kysely"; |
| 2 | +import { afterEach, beforeEach, describe, expect, it } from "vitest"; |
| 3 | + |
| 4 | +import { handleOAuthClientCreate } from "../../../src/api/handlers/oauth-clients.js"; |
| 5 | +import { |
| 6 | + GET as getAuthorizationConsent, |
| 7 | + POST as postAuthorizationConsent, |
| 8 | +} from "../../../src/astro/routes/api/oauth/authorize.js"; |
| 9 | +import type { Database } from "../../../src/database/types.js"; |
| 10 | +import { setupTestDatabase, teardownTestDatabase } from "../../utils/test-db.js"; |
| 11 | + |
| 12 | +const REDIRECT_URI = "http://127.0.0.1:8080/callback"; |
| 13 | + |
| 14 | +describe("OAuth authorization consent", () => { |
| 15 | + let db: Kysely<Database>; |
| 16 | + |
| 17 | + beforeEach(async () => { |
| 18 | + db = await setupTestDatabase(); |
| 19 | + |
| 20 | + await db |
| 21 | + .insertInto("users") |
| 22 | + .values({ |
| 23 | + id: "user-1", |
| 24 | + email: "test@example.com", |
| 25 | + name: "Test User", |
| 26 | + role: 50, |
| 27 | + email_verified: 1, |
| 28 | + }) |
| 29 | + .execute(); |
| 30 | + |
| 31 | + await handleOAuthClientCreate(db, { |
| 32 | + id: "test-client", |
| 33 | + name: "Test Client", |
| 34 | + redirectUris: [REDIRECT_URI], |
| 35 | + }); |
| 36 | + }); |
| 37 | + |
| 38 | + afterEach(async () => { |
| 39 | + await teardownTestDatabase(db); |
| 40 | + }); |
| 41 | + |
| 42 | + it("renders every requested scope as a checked choice with accurate grant copy", async () => { |
| 43 | + const { response } = await renderConsent([ |
| 44 | + "content:read", |
| 45 | + "content:write", |
| 46 | + "schema:write", |
| 47 | + "mcp:tools:calendar", |
| 48 | + ]); |
| 49 | + |
| 50 | + expect(response.status).toBe(200); |
| 51 | + const html = await response.text(); |
| 52 | + expect(html).toContain('<input type="checkbox" name="scope" value="content:read" checked>'); |
| 53 | + expect(html).toContain('<input type="checkbox" name="scope" value="schema:write" checked>'); |
| 54 | + expect(html).toContain( |
| 55 | + '<input type="checkbox" name="scope" value="mcp:tools:calendar" checked>', |
| 56 | + ); |
| 57 | + expect(html).toContain("Create, edit, and delete content; manage menus and taxonomies"); |
| 58 | + expect(html).not.toContain('<input type="hidden" name="scope"'); |
| 59 | + const form = html.slice(html.indexOf("<form"), html.indexOf("</form>")); |
| 60 | + expect(form).toContain('<input type="checkbox" name="scope" value="content:read"'); |
| 61 | + }); |
| 62 | + |
| 63 | + it("grants only selected scopes from the original request", async () => { |
| 64 | + const consent = await renderConsent(["content:read", "schema:write"]); |
| 65 | + const response = await submitConsent(consent, ["admin", "content:read"]); |
| 66 | + |
| 67 | + expect(response.status).toBe(302); |
| 68 | + expect(new URL(response.headers.get("Location")!).searchParams.get("code")).toBeTruthy(); |
| 69 | + |
| 70 | + const authorizationCode = await db |
| 71 | + .selectFrom("_emdash_authorization_codes") |
| 72 | + .select("scopes") |
| 73 | + .executeTakeFirstOrThrow(); |
| 74 | + expect(JSON.parse(authorizationCode.scopes)).toEqual(["content:read"]); |
| 75 | + }); |
| 76 | + |
| 77 | + it("renders duplicate requests once so clearing a scope removes it", async () => { |
| 78 | + const consent = await renderConsent(["admin", "admin", "content:read"]); |
| 79 | + const html = await consent.response.clone().text(); |
| 80 | + expect(html.match(/name="scope" value="admin"/g)).toHaveLength(1); |
| 81 | + |
| 82 | + const response = await submitConsent(consent, ["content:read"]); |
| 83 | + expect(response.status).toBe(302); |
| 84 | + |
| 85 | + const authorizationCode = await db |
| 86 | + .selectFrom("_emdash_authorization_codes") |
| 87 | + .select("scopes") |
| 88 | + .executeTakeFirstOrThrow(); |
| 89 | + expect(JSON.parse(authorizationCode.scopes)).toEqual(["content:read"]); |
| 90 | + }); |
| 91 | + |
| 92 | + it("preserves client and role scope clamps after selection", async () => { |
| 93 | + await db |
| 94 | + .updateTable("_emdash_oauth_clients") |
| 95 | + .set({ scopes: JSON.stringify(["content:read", "schema:write"]) }) |
| 96 | + .where("id", "=", "test-client") |
| 97 | + .execute(); |
| 98 | + |
| 99 | + const consent = await renderConsent(["content:read", "media:read", "schema:write"]); |
| 100 | + const response = await submitConsent( |
| 101 | + consent, |
| 102 | + ["content:read", "media:read", "schema:write"], |
| 103 | + 20, |
| 104 | + ); |
| 105 | + |
| 106 | + expect(response.status).toBe(302); |
| 107 | + const authorizationCode = await db |
| 108 | + .selectFrom("_emdash_authorization_codes") |
| 109 | + .select("scopes") |
| 110 | + .executeTakeFirstOrThrow(); |
| 111 | + expect(JSON.parse(authorizationCode.scopes)).toEqual(["content:read"]); |
| 112 | + }); |
| 113 | + |
| 114 | + it("rejects approval when no requested scope is selected", async () => { |
| 115 | + const consent = await renderConsent(["content:read", "schema:write"]); |
| 116 | + const response = await submitConsent(consent, []); |
| 117 | + |
| 118 | + expect(response.status).toBe(302); |
| 119 | + const redirect = new URL(response.headers.get("Location")!); |
| 120 | + expect(redirect.searchParams.get("error")).toBe("invalid_scope"); |
| 121 | + expect(redirect.searchParams.get("error_description")).toBe( |
| 122 | + "No selected permission can be granted", |
| 123 | + ); |
| 124 | + |
| 125 | + const authorizationCodes = await db |
| 126 | + .selectFrom("_emdash_authorization_codes") |
| 127 | + .select("code_hash") |
| 128 | + .execute(); |
| 129 | + expect(authorizationCodes).toHaveLength(0); |
| 130 | + }); |
| 131 | + |
| 132 | + async function renderConsent(scopes: string[]): Promise<{ |
| 133 | + response: Response; |
| 134 | + url: URL; |
| 135 | + csrfToken: string; |
| 136 | + cookie: string; |
| 137 | + }> { |
| 138 | + const url = new URL("http://localhost:4321/_emdash/oauth/authorize"); |
| 139 | + url.searchParams.set("response_type", "code"); |
| 140 | + url.searchParams.set("client_id", "test-client"); |
| 141 | + url.searchParams.set("redirect_uri", REDIRECT_URI); |
| 142 | + url.searchParams.set("scope", scopes.join(" ")); |
| 143 | + url.searchParams.set("state", "state-1"); |
| 144 | + url.searchParams.set("code_challenge", "challenge"); |
| 145 | + url.searchParams.set("code_challenge_method", "S256"); |
| 146 | + |
| 147 | + const response = await getAuthorizationConsent({ |
| 148 | + url, |
| 149 | + request: new Request(url), |
| 150 | + locals: { |
| 151 | + emdash: { db, config: {} }, |
| 152 | + user: { |
| 153 | + id: "user-1", |
| 154 | + email: "test@example.com", |
| 155 | + name: "Test User", |
| 156 | + role: 50, |
| 157 | + }, |
| 158 | + }, |
| 159 | + } as Parameters<typeof getAuthorizationConsent>[0]); |
| 160 | + |
| 161 | + const html = response.clone(); |
| 162 | + const csrfToken = (await html.text()).match(/name="csrf_token" value="([^"]+)"/)?.[1]; |
| 163 | + const cookie = response.headers.get("Set-Cookie")?.split(";")[0]; |
| 164 | + if (!csrfToken || !cookie) throw new Error("Consent response omitted CSRF state"); |
| 165 | + |
| 166 | + return { response, url, csrfToken, cookie }; |
| 167 | + } |
| 168 | + |
| 169 | + async function submitConsent( |
| 170 | + consent: Awaited<ReturnType<typeof renderConsent>>, |
| 171 | + selectedScopes: string[], |
| 172 | + role = 50, |
| 173 | + ): Promise<Response> { |
| 174 | + const body = new URLSearchParams({ |
| 175 | + csrf_token: consent.csrfToken, |
| 176 | + response_type: "code", |
| 177 | + client_id: "test-client", |
| 178 | + redirect_uri: REDIRECT_URI, |
| 179 | + state: "state-1", |
| 180 | + code_challenge: "challenge", |
| 181 | + code_challenge_method: "S256", |
| 182 | + action: "approve", |
| 183 | + }); |
| 184 | + for (const scope of selectedScopes) body.append("scope", scope); |
| 185 | + |
| 186 | + const request = new Request(consent.url, { |
| 187 | + method: "POST", |
| 188 | + headers: { Cookie: consent.cookie }, |
| 189 | + body, |
| 190 | + }); |
| 191 | + |
| 192 | + return postAuthorizationConsent({ |
| 193 | + request, |
| 194 | + locals: { |
| 195 | + emdash: { db, config: {} }, |
| 196 | + user: { |
| 197 | + id: "user-1", |
| 198 | + email: "test@example.com", |
| 199 | + name: "Test User", |
| 200 | + role, |
| 201 | + }, |
| 202 | + }, |
| 203 | + } as Parameters<typeof postAuthorizationConsent>[0]); |
| 204 | + } |
| 205 | +}); |
0 commit comments