Admin/dnd-character-deploy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mirror confidential OAuth diagnostic test

Browse Source
This commit is contained in:
Admin 2026-10-08 04:01:52 +00:00
parent c47049753d
commit 482da6bf05
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tests/mcp.test.ts
View File

@ -42,7 +42,9 @@ test('predefined confidential ChatGPT OAuth client accepts secret with PKCE and
const rejected=await fetch(base+'/authorize?'+new URLSearchParams({...params,redirect_uri:'https://evil.example/callback'}),{redirect:'manual'});
assert.notEqual(rejected.status,302);
const started=await fetch(base+'/authorize?'+new URLSearchParams(params),{redirect:'manual'});assert.equal(started.status,302);
const consent=await fetch(base+started.headers.get('location'),{redirect:'manual'}),html=await consent.text(),ticket=html.match(/name="ticket" value="([^"]+)"/)![1],nonce=html.match(/name="nonce" value="([^"]+)"/)![1],csrf=consent.headers.get('set-cookie')!.split(';')[0];
const location=started.headers.get('location')!;assert.match(location,/^\/mcp\/consent\?ticket=/,'Unexpected authorize redirect: '+location.slice(0,130));
const consent=await fetch(base+location,{redirect:'manual'}),html=await consent.text();assert.equal(consent.status,200,'Consent endpoint response: '+html.slice(0,350));assert.match(html,/name="ticket" value="([^"]+)"/,'Consent HTML missing ticket: '+html.slice(0,350));
const ticket=html.match(/name="ticket" value="([^"]+)"/)![1],nonce=html.match(/name="nonce" value="([^"]+)"/)![1],csrf=consent.headers.get('set-cookie')!.split(';')[0];
const approved=await fetch(base+'/mcp/consent',{method:'POST',headers:{'content-type':'application/x-www-form-urlencoded',origin,cookie:csrf},body:new URLSearchParams({ticket,nonce,decision:'allow'}),redirect:'manual'});
assert.equal(approved.status,302);const callback=new URL(approved.headers.get('location')!);assert.equal(callback.origin,'https://chatgpt.com');const code=callback.searchParams.get('code')!;
const body=(secret:string)=>new URLSearchParams({client_id:predefined.client_id,client_secret:secret,grant_type:'authorization_code',code,code_verifier:verifier,redirect_uri:predefined.redirect_uris[0],resource:origin+'/mcp'});