From 482da6bf05dfd98e8b143908521f5bcc51db7cd6 Mon Sep 17 00:00:00 2001 From: Admin Date: Thu, 8 Oct 2026 04:01:52 +0000 Subject: [PATCH] Mirror confidential OAuth diagnostic test --- tests/mcp.test.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/tests/mcp.test.ts b/tests/mcp.test.ts index 5af4789..7eebade 100644 --- a/tests/mcp.test.ts +++ b/tests/mcp.test.ts @@ -42,7 +42,9 @@ test('predefined confidential ChatGPT OAuth client accepts secret with PKCE and const rejected=await fetch(base+'/authorize?'+new URLSearchParams({...params,redirect_uri:'https://evil.example/callback'}),{redirect:'manual'}); assert.notEqual(rejected.status,302); const started=await fetch(base+'/authorize?'+new URLSearchParams(params),{redirect:'manual'});assert.equal(started.status,302); - const consent=await fetch(base+started.headers.get('location'),{redirect:'manual'}),html=await consent.text(),ticket=html.match(/name="ticket" value="([^"]+)"/)![1],nonce=html.match(/name="nonce" value="([^"]+)"/)![1],csrf=consent.headers.get('set-cookie')!.split(';')[0]; + const location=started.headers.get('location')!;assert.match(location,/^\/mcp\/consent\?ticket=/,'Unexpected authorize redirect: '+location.slice(0,130)); + const consent=await fetch(base+location,{redirect:'manual'}),html=await consent.text();assert.equal(consent.status,200,'Consent endpoint response: '+html.slice(0,350));assert.match(html,/name="ticket" value="([^"]+)"/,'Consent HTML missing ticket: '+html.slice(0,350)); + const ticket=html.match(/name="ticket" value="([^"]+)"/)![1],nonce=html.match(/name="nonce" value="([^"]+)"/)![1],csrf=consent.headers.get('set-cookie')!.split(';')[0]; const approved=await fetch(base+'/mcp/consent',{method:'POST',headers:{'content-type':'application/x-www-form-urlencoded',origin,cookie:csrf},body:new URLSearchParams({ticket,nonce,decision:'allow'}),redirect:'manual'}); assert.equal(approved.status,302);const callback=new URL(approved.headers.get('location')!);assert.equal(callback.origin,'https://chatgpt.com');const code=callback.searchParams.get('code')!; const body=(secret:string)=>new URLSearchParams({client_id:predefined.client_id,client_secret:secret,grant_type:'authorization_code',code,code_verifier:verifier,redirect_uri:predefined.redirect_uris[0],resource:origin+'/mcp'});