69 lines
2.3 KiB
JavaScript
69 lines
2.3 KiB
JavaScript
const decodePayload = (token) => {
|
|
try {
|
|
const part = String(token || "").split(".")[1] || "";
|
|
return JSON.parse(Buffer.from(part, "base64url").toString("utf8"));
|
|
} catch {
|
|
return {};
|
|
}
|
|
};
|
|
|
|
const call = async (label, token) => {
|
|
const headers = token === undefined ? {} : { Authorization: `Bearer ${token}` };
|
|
const response = await fetch("http://127.0.0.1:8787/api/mcp/annotations?limit=1", { headers });
|
|
const body = await response.text();
|
|
console.log("[oauth-probe]", JSON.stringify({
|
|
test: label,
|
|
status: response.status,
|
|
body: body.slice(0, 240)
|
|
}));
|
|
return response.status;
|
|
};
|
|
|
|
(async () => {
|
|
const issuer = String(process.env.MCP_TEST_ISSUER || "").replace(/\/$/, "");
|
|
const clientId = String(process.env.MCP_TEST_CLIENT_ID || "");
|
|
const clientSecret = String(process.env.MCP_TEST_CLIENT_SECRET || "");
|
|
if (!issuer || !clientId || !clientSecret) {
|
|
throw new Error("temporary MCP test credentials are not configured");
|
|
}
|
|
|
|
const tokenResponse = await fetch(`${issuer}/protocol/openid-connect/token`, {
|
|
method: "POST",
|
|
headers: { "content-type": "application/x-www-form-urlencoded" },
|
|
body: new URLSearchParams({
|
|
grant_type: "client_credentials",
|
|
client_id: clientId,
|
|
client_secret: clientSecret
|
|
})
|
|
});
|
|
const tokenBody = await tokenResponse.json().catch(() => ({}));
|
|
console.log("[oauth-probe]", JSON.stringify({
|
|
test: "client_credentials",
|
|
status: tokenResponse.status,
|
|
tokenType: tokenBody.token_type || null,
|
|
expiresIn: tokenBody.expires_in || null
|
|
}));
|
|
if (!tokenResponse.ok || !tokenBody.access_token) {
|
|
process.exitCode = 2;
|
|
return;
|
|
}
|
|
|
|
const claims = decodePayload(tokenBody.access_token);
|
|
console.log("[oauth-probe]", JSON.stringify({
|
|
test: "safe_claims",
|
|
iss: claims.iss || null,
|
|
azp: claims.azp || claims.client_id || null,
|
|
aud: claims.aud || null,
|
|
preferredUsername: claims.preferred_username || null,
|
|
realmRoles: claims.realm_access && claims.realm_access.roles || [],
|
|
resourceAccess: claims.resource_access || {}
|
|
}));
|
|
|
|
await call("missing_token", undefined);
|
|
await call("invalid_token", "not-a-jwt");
|
|
await call("service_account", tokenBody.access_token);
|
|
})().catch((error) => {
|
|
console.error("[oauth-probe-error]", error && error.message ? error.message : error);
|
|
process.exitCode = 3;
|
|
});
|