test_provider.py

"""Tests for mcp.server.auth.provider module."""

from pydantic import AnyUrl

from mcp.server.auth.provider import AccessToken, AuthorizationCode, RefreshToken, construct_redirect_uri


def test_access_token_subject_and_claims_default_to_none():
    token = AccessToken(token="t", client_id="c", scopes=["read"])
    assert token.subject is None
    assert token.claims is None


def test_access_token_carries_subject_and_claims():
    token = AccessToken(
        token="t",
        client_id="c",
        scopes=["read"],
        subject="user-123",
        claims={"iss": "https://auth.example.com", "act": {"sub": "gateway"}},
    )
    assert token.subject == "user-123"
    assert token.claims is not None
    assert token.claims["iss"] == "https://auth.example.com"


def test_authorization_code_carries_subject():
    code = AuthorizationCode(
        code="x",
        scopes=["read"],
        expires_at=0.0,
        client_id="c",
        code_challenge="cc",
        redirect_uri=AnyUrl("https://example.com/cb"),
        redirect_uri_provided_explicitly=True,
        subject="user-123",
    )
    assert code.subject == "user-123"


def test_refresh_token_carries_subject():
    refresh = RefreshToken(token="r", client_id="c", scopes=["read"], subject="user-123")
    assert refresh.subject == "user-123"


def test_construct_redirect_uri_no_existing_params():
    """Test construct_redirect_uri with no existing query parameters."""
    base_uri = "http://localhost:8000/callback"
    result = construct_redirect_uri(base_uri, code="auth_code", state="test_state")

    assert "http://localhost:8000/callback?code=auth_code&state=test_state" == result


def test_construct_redirect_uri_with_existing_params():
    """Test construct_redirect_uri with existing query parameters (regression test for #1279)."""
    base_uri = "http://localhost:8000/callback?session_id=1234"
    result = construct_redirect_uri(base_uri, code="auth_code", state="test_state")

    # Should preserve existing params and add new ones
    assert "session_id=1234" in result
    assert "code=auth_code" in result
    assert "state=test_state" in result
    assert result.startswith("http://localhost:8000/callback?")


def test_construct_redirect_uri_multiple_existing_params():
    """Test construct_redirect_uri with multiple existing query parameters."""
    base_uri = "http://localhost:8000/callback?session_id=1234&user=test"
    result = construct_redirect_uri(base_uri, code="auth_code")

    assert "session_id=1234" in result
    assert "user=test" in result
    assert "code=auth_code" in result


def test_construct_redirect_uri_with_none_values():
    """Test construct_redirect_uri filters out None values."""
    base_uri = "http://localhost:8000/callback"
    result = construct_redirect_uri(base_uri, code="auth_code", state=None)

    assert result == "http://localhost:8000/callback?code=auth_code"
    assert "state" not in result


def test_construct_redirect_uri_empty_params():
    """Test construct_redirect_uri with no additional parameters."""
    base_uri = "http://localhost:8000/callback?existing=param"
    result = construct_redirect_uri(base_uri)

    assert result == "http://localhost:8000/callback?existing=param"


def test_construct_redirect_uri_duplicate_param_names():
    """Test construct_redirect_uri when adding param that already exists."""
    base_uri = "http://localhost:8000/callback?code=existing"
    result = construct_redirect_uri(base_uri, code="new_code")

    # Should contain both values (this is expected behavior of parse_qs/urlencode)
    assert "code=existing" in result
    assert "code=new_code" in result


def test_construct_redirect_uri_multivalued_existing_params():
    """Test construct_redirect_uri with existing multi-valued parameters."""
    base_uri = "http://localhost:8000/callback?scope=read&scope=write"
    result = construct_redirect_uri(base_uri, code="auth_code")

    assert "scope=read" in result
    assert "scope=write" in result
    assert "code=auth_code" in result


def test_construct_redirect_uri_encoded_values():
    """Test construct_redirect_uri handles URL encoding properly."""
    base_uri = "http://localhost:8000/callback"
    result = construct_redirect_uri(base_uri, state="test state with spaces")

    # urlencode uses + for spaces by default
    assert "state=test+state+with+spaces" in result