fix: report OAuth metadata deployment errors

2026-08-20 17:11:45 +08:00
parent e56ff6b1e1
commit ac4480bb09
9 changed files with 81 additions and 22 deletions
@@ -6,7 +6,7 @@ import { OAuthCallbackServer } from "../src/callbackServer.js";
 import { credentialAccount, resolveClientOptions, validateMcpUrl } from "../src/config.js";
 import type { TokenStore } from "../src/credentials.js";
 import { GameCraftOAuthProvider } from "../src/oauthProvider.js";
-import { logoutRemote } from "../src/remote.js";
+import { logoutRemote, requireOAuthProtectedResourceMetadata } from "../src/remote.js";

 class MemoryTokens implements TokenStore {
  readonly values = new Map<string, OAuthTokens>();
@@ -118,6 +118,21 @@ test("failed remote revocation retains local credentials", async () => {
  assert.equal(tokens.values.has(account), true);
 });

+test("OAuth metadata validation reports HTML and missing production routes without JSON parser noise", async () => {
+  const resource = new URL("https://example.test/mcp");
+  await assert.rejects(
+    requireOAuthProtectedResourceMetadata(resource, async () => new Response("<!doctype html>", {
+      status: 200,
+      headers: { "content-type": "text/html" },
+    }) as never),
+    /returned text\/html instead of JSON/,
+  );
+  await assert.rejects(
+    requireOAuthProtectedResourceMetadata(resource, async () => new Response("not found", { status: 404 }) as never),
+    /OAuth is not enabled.*HTTP 404/,
+  );
+});
+
 async function availablePort(): Promise<number> {
  const server = createServer();
  await new Promise<void>((resolve) => server.listen(0, "127.0.0.1", resolve));