135 lines
13 KiB
JavaScript
135 lines
13 KiB
JavaScript
/** External SDK consumer: imports NO server/store/runtime/database module. */
|
|
import assert from 'node:assert/strict'
|
|
import { randomUUID, createHash } from 'node:crypto'
|
|
import { Client, StreamableHTTPClientTransport, auth } from '@modelcontextprotocol/client'
|
|
import { StdioClientTransport } from '@modelcontextprotocol/client/stdio'
|
|
const endpoint = new URL(process.env.OWN_MCP_ENDPOINT), origin = endpoint.origin
|
|
assert.equal(endpoint.hostname, '127.0.0.1'); assert.equal(process.env.OWN_EXTERNAL_CLIENT, 'true')
|
|
let phase = 'start', next = 0, maxResponseBytes = 0, stderrBytes = 0, bridgePid = null
|
|
const pending = new Map(), cases = []
|
|
const activeClients = new Set()
|
|
let closing = false
|
|
async function closeClients() { await Promise.allSettled([...activeClients].map(client => client.close())) }
|
|
async function interrupted() { if (closing) return; closing = true; await closeClients(); process.disconnect?.(); process.exitCode = 1 }
|
|
process.on('SIGTERM', interrupted); process.on('SIGINT', interrupted); process.on('disconnect', interrupted)
|
|
process.on('message', m => { if (m?.kind === 'reply') { const p = pending.get(m.id); pending.delete(m.id); if (m.error) p?.reject(Error('Fixture control refused')); else p?.resolve(m.value) } })
|
|
const control = command => new Promise((resolve, reject) => { const id = ++next; pending.set(id, { resolve, reject }); process.send({ kind: 'control', command, id }) })
|
|
async function boundedFetch(input, init) {
|
|
const url = new URL(typeof input === 'string' || input instanceof URL ? input : input.url)
|
|
assert.equal(url.origin, origin, 'External fixture refuses all nonlocal origins')
|
|
const response = await fetch(input, { ...init, redirect: 'manual', signal: init?.signal ? AbortSignal.any([init.signal, AbortSignal.timeout(5000)]) : AbortSignal.timeout(5000) })
|
|
const chunks = []; let count = 0
|
|
if (response.body) {
|
|
const reader = response.body.getReader()
|
|
try {
|
|
for (;;) { const item = await reader.read(); if (item.done) break; count += item.value.length; if (count >= 1048576) { await reader.cancel(); throw Error('Own external client response bound') }; chunks.push(item.value) }
|
|
} finally { reader.releaseLock() }
|
|
}
|
|
const bytes = Buffer.concat(chunks); maxResponseBytes = Math.max(maxResponseBytes, bytes.length)
|
|
return new Response(bytes.length ? bytes : null, { status: response.status, statusText: response.statusText, headers: response.headers })
|
|
}
|
|
function content(result) {
|
|
assert(!result.isError)
|
|
const text = result.content.find(c => c.type === 'text')?.text
|
|
const parsed = JSON.parse(text)
|
|
assert(!text.includes(process.env.OWN_SERVER_SECRET)); assert(Buffer.byteLength(text) < 65536)
|
|
return parsed
|
|
}
|
|
async function denied(work) { try { const r = await work(); assert.equal(r?.isError, true) } catch (e) { if (e?.code === 'ERR_ASSERTION') throw e; assert(!/timeout|timed out/i.test(String(e?.message)), 'A timeout is not authorization denial') } }
|
|
async function opened(mode, token) {
|
|
const client = new Client({ name: 'actual-external-process-' + mode, version: '1.0.0' })
|
|
activeClients.add(client)
|
|
let transport
|
|
if (mode === 'http') transport = new StreamableHTTPClientTransport(endpoint, { requestInit: { headers: { authorization: 'Bearer ' + token } }, fetch: boundedFetch })
|
|
else {
|
|
transport = new StdioClientTransport({ command: process.execPath, args: ['--import', import.meta.resolve('tsx'), process.env.OWN_BRIDGE_FILE],
|
|
cwd: process.cwd(), env: { MCP_URL: endpoint.href, MCP_TOKEN: token }, stderr: 'pipe', maxBufferSize: 131072 })
|
|
transport.stderr?.on('data', chunk => { stderrBytes += chunk.length; const text = String(chunk); assert(!text.includes(token)); assert(stderrBytes < 1048576) })
|
|
const start = transport.start.bind(transport)
|
|
transport.start = async () => { await start(); bridgePid = transport.pid; assert(bridgePid && bridgePid !== process.pid && bridgePid !== Number(process.env.OWN_SERVER_PID)); process.send({ kind: 'bridge-pid', pid: bridgePid }) }
|
|
}
|
|
const connecting = client.connect(transport, { timeout: 10000 })
|
|
try { await connecting; return client }
|
|
catch (e) { await client.close().catch(() => {}); throw e }
|
|
}
|
|
async function scoped(client) {
|
|
const list = await client.listTools({}, { timeout: 5000 })
|
|
assert.deepEqual(list.tools.map(t => t.name), ['mm_servers_list'])
|
|
const result = content(await client.callTool({ name: 'mm_servers_list', arguments: { limit: 1, offset: 0 } }, undefined, { timeout: 5000 }))
|
|
assert.equal(result.items.length, 1); assert.equal(result.items[0].id, Number(process.env.OWN_ALLOWED_SERVER))
|
|
await denied(() => client.callTool({ name: 'mm_servers_list', arguments: { serverId: Number(process.env.OWN_FORBIDDEN_SERVER) } }, undefined, { timeout: 5000 }))
|
|
await denied(() => client.callTool({ name: 'mm_servers_list', arguments: { limit: 501 } }, undefined, { timeout: 5000 }))
|
|
await denied(() => client.callTool({ name: 'mm_servers_delete_plan', arguments: { serverId: Number(process.env.OWN_ALLOWED_SERVER) } }, undefined, { timeout: 5000 }))
|
|
}
|
|
try {
|
|
assert.notEqual(process.pid, Number(process.env.OWN_SERVER_PID))
|
|
for (const mode of ['http', 'stdio']) {
|
|
phase = mode + ':issue'; const initial = await control('new-connection'); let token = initial.token
|
|
phase = mode + ':initialize'; let client = await opened(mode, token)
|
|
try {
|
|
await scoped(client); cases.push(mode + ': separate SDK process initializes, filters tool/host scope, bounds page/result and redacts credentials')
|
|
if (mode === 'stdio' && process.env.OWN_EXTERNAL_CLEANUP_FAULT === 'failure') throw Error('Owned deliberate external client failure with bridge active')
|
|
if (mode === 'stdio' && process.env.OWN_EXTERNAL_CLEANUP_FAULT === 'timeout') { process.send({ kind: 'arm-cleanup-timeout' }); await new Promise(() => {}) }
|
|
phase = mode + ':result-bound'; await control('large-result')
|
|
try {
|
|
const bounded = content(await client.callTool({ name: 'mm_servers_list', arguments: { limit: 1 } }, undefined, { timeout: 5000 }))
|
|
assert.equal(bounded.items[0].comment.length, 16000); assert(!bounded.items[0].comment.includes('OWNED_TRUNCATION_TAIL'))
|
|
cases.push(mode + ': actual production public-string16k bound truncates owned40k comment through real SDK result')
|
|
} finally { await control('reset-result') }
|
|
phase = mode + ':rotate'; const rotated = await control('rotate'); await denied(() => client.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 }))
|
|
await client.close(); await assert.rejects(opened(mode, token)); token = rotated.token; client = await opened(mode, token)
|
|
content(await client.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 })); cases.push(mode + ': old credential and reconnect refused after rotation; fresh transport reconnect succeeds')
|
|
phase = mode + ':pause'; await control('pause'); await denied(() => client.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 }))
|
|
await control('resume'); content(await client.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 })); cases.push(mode + ': established client observes pause/resume on real requests')
|
|
phase = mode + ':revoke'; await control('revoke'); await denied(() => client.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 }))
|
|
await client.close(); await assert.rejects(opened(mode, token)); cases.push(mode + ': permanent revocation blocks established and newly initialized external clients')
|
|
} finally { await client.close().catch(() => {}) }
|
|
}
|
|
phase = 'http:body-bound'; const bound = await control('new-connection')
|
|
const oversized = await fetch(endpoint, { method: 'POST', headers: { authorization: 'Bearer ' + bound.token, 'content-type': 'application/json', accept: 'application/json,text/event-stream' },
|
|
body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'mm_servers_list', arguments: { padding: 'x'.repeat(1048576) } } }), signal: AbortSignal.timeout(5000) })
|
|
assert.equal(oversized.status, 413); assert((await oversized.text()).length < 65536)
|
|
cases.push('actual HTTP request envelope over1MiB refused before tool execution; successful client results remain bounded')
|
|
|
|
phase = 'sdk:pkce'; const grant = await control('new-connection')
|
|
const metadata = { client_name: 'owned-external-sdk-pkce', redirect_uris: [origin + '/owned-callback'], grant_types: ['authorization_code', 'refresh_token'], response_types: ['code'], token_endpoint_auth_method: 'none', scope: 'mcp' }
|
|
const registered = await boundedFetch(origin + '/api/mcp/oauth/clients', { method: 'POST', headers: { authorization: 'Bearer ' + process.env.OWN_PORTAL_JWT, 'content-type': 'application/json' }, body: JSON.stringify({ name: metadata.client_name, redirectUris: metadata.redirect_uris }) })
|
|
assert.equal(registered.status, 200); const clientId = (await registered.json()).clientId
|
|
let tokens, verifier, authorizationCode, authorizationIssuer, discovery, consentAllowed = true
|
|
const state = randomUUID()
|
|
const provider = { redirectUrl: metadata.redirect_uris[0], clientMetadata: metadata, clientInformation: () => ({ client_id: clientId, token_endpoint_auth_method: 'none' }),
|
|
tokens: () => tokens, saveTokens: v => { tokens = v }, saveCodeVerifier: v => { verifier = v }, codeVerifier: () => verifier, state: () => state,
|
|
discoveryState: () => discovery, saveDiscoveryState: v => { discovery = v }, invalidateCredentials: scope => { if (scope === 'tokens') tokens = undefined },
|
|
redirectToAuthorization: async url => {
|
|
if (!consentAllowed) throw Error('Synthetic consent disabled after revocation')
|
|
assert.equal(url.origin, origin); assert.equal(url.searchParams.get('code_challenge_method'), 'S256')
|
|
assert.equal(url.searchParams.get('code_challenge'), createHash('sha256').update(verifier).digest('base64url'))
|
|
const response = await boundedFetch(url); assert.equal(response.status, 302)
|
|
const requestId = new URL(response.headers.get('location')).searchParams.get('oauthRequest'); assert(requestId)
|
|
const consent = await boundedFetch(origin + '/api/mcp/oauth/consent', { method: 'POST', headers: { authorization: 'Bearer ' + process.env.OWN_PORTAL_JWT, 'content-type': 'application/json' }, body: JSON.stringify({ requestId, connectionId: grant.connectionId, approve: true }) })
|
|
assert.equal(consent.status, 200); const callback = new URL((await consent.json()).redirectUrl)
|
|
assert.equal(callback.searchParams.get('state'), state); authorizationCode = callback.searchParams.get('code'); authorizationIssuer = callback.searchParams.get('iss')
|
|
} }
|
|
phase = 'sdk:pkce-redirect'; assert.equal(await auth(provider, { serverUrl: endpoint, scope: 'mcp', fetchFn: boundedFetch }), 'REDIRECT')
|
|
assert(authorizationCode && verifier); assert.equal(authorizationIssuer, origin)
|
|
phase = 'sdk:pkce-exchange'; assert.equal(await auth(provider, { serverUrl: endpoint, authorizationCode, iss: authorizationIssuer, fetchFn: boundedFetch }), 'AUTHORIZED')
|
|
assert(tokens?.access_token && tokens?.refresh_token)
|
|
const oauthClient = new Client({ name: 'external-sdk-real-pkce-mock-portal', version: '1.0.0' })
|
|
activeClients.add(oauthClient)
|
|
try {
|
|
phase = 'sdk:pkce-initialize'; await oauthClient.connect(new StreamableHTTPClientTransport(endpoint, { authProvider: provider, fetch: boundedFetch }), { timeout: 10000 })
|
|
content(await oauthClient.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 }))
|
|
cases.push('installed SDK auth() discovers actual OAuth metadata, produces PKCE/S256, exchanges one-use code and calls scoped tool; portal JWT/consent is synthetic')
|
|
phase = 'sdk:pkce-revoke'; const access = tokens.access_token, refresh = tokens.refresh_token
|
|
const revoked = await boundedFetch(origin + '/oauth/revoke', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ token: refresh, client_id: clientId }).toString() }); assert.equal(revoked.status, 200)
|
|
consentAllowed = false; await assert.rejects(opened('http', access))
|
|
await denied(() => oauthClient.callTool({ name: 'mm_servers_list', arguments: {} }, undefined, { timeout: 5000 }))
|
|
cases.push('actual OAuth family revocation refuses established and fresh external transport; no implicit new consent granted')
|
|
} finally { await oauthClient.close().catch(() => {}) }
|
|
process.send({ kind: 'result', result: { cases: cases.length, names: cases, externalClientPid: process.pid, serverPid: Number(process.env.OWN_SERVER_PID), bridgePid,
|
|
sdkOnlyExternalClient: true, maxObservedHttpResponseBytes: maxResponseBytes, clientResponseLimitBytes: 1048576, stdioSdkBufferLimitBytes: 131072,
|
|
actualPublicStringLimitObserved: 16000, wholeGenericResultEnvelopeLimitAccepted: false,
|
|
syntheticPortalJwtAndConsent: true, liveAuthPortal: false, livePortalSender: false, endUserUi: false, wholeExternalDirectionComplete: false } })
|
|
} catch (error) { process.send?.({ kind: 'failure', phase, errorType: error?.name ?? 'Error', completedCases: cases }); process.exitCode = 1 }
|
|
finally { closing = true; await closeClients(); process.disconnect?.() }
|