From d1f09c48553ca26aa3c4888204c80e86b3b3741f Mon Sep 17 00:00:00 2001 From: Admin Date: Thu, 8 Oct 2026 04:42:15 +0000 Subject: [PATCH] Expect retired consent path to be denied by MCP authentication middleware --- tests/mcp.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tests/mcp.test.ts b/tests/mcp.test.ts index f4a3742..b8f7692 100644 --- a/tests/mcp.test.ts +++ b/tests/mcp.test.ts @@ -26,7 +26,8 @@ test('MCP middleware advertises Keycloak, denies anonymous tokens and isolates m const base='http://127.0.0.1:'+server.address().port; try{ const metadata=await(await fetch(base+'/.well-known/oauth-protected-resource/mcp')).json();assert.deepEqual(metadata.authorization_servers,[issuer]); - for(const path of ['/authorize','/token','/register','/mcp/consent'])assert.equal((await fetch(base+path)).status,404,path); + for(const path of ['/authorize','/token','/register'])assert.equal((await fetch(base+path)).status,404,path); + assert.equal((await fetch(base+'/mcp/consent')).status,401,'Old consent path must not issue tokens'); const payload={jsonrpc:'2.0',id:1,method:'tools/list',params:{}}; const call=authorization=>fetch(base+'/mcp',{method:'POST',headers:{'content-type':'application/json',accept:'application/json, text/event-stream',...(authorization?{authorization}:{})},body:JSON.stringify(payload)}); assert.equal((await call()).status,401);