121 lines
5.1 KiB
TypeScript
121 lines
5.1 KiB
TypeScript
/**
|
|
* 覆盖系统凭据存储适配器的令牌分块、轮换清理与旧格式兼容行为。
|
|
*
|
|
* @packageDocumentation
|
|
*/
|
|
|
|
import assert from "node:assert/strict";
|
|
import test from "node:test";
|
|
import type { OAuthTokens } from "@modelcontextprotocol/sdk/shared/auth.js";
|
|
import { KeyringTokenStore } from "../src/credentials.js";
|
|
import { credentialAccount, resolveClientOptions } from "../src/config.js";
|
|
import { logoutRemote } from "../src/remote.js";
|
|
|
|
class MemoryEntry {
|
|
constructor(private readonly values: Map<string, string>, private readonly account: string) {}
|
|
|
|
async getPassword(): Promise<string | undefined> {
|
|
return this.values.get(this.account);
|
|
}
|
|
|
|
async setPassword(password: string): Promise<void> {
|
|
if (password.length > 1000) throw new Error("credential too large");
|
|
this.values.set(this.account, password);
|
|
}
|
|
|
|
async deleteCredential(): Promise<boolean> {
|
|
return this.values.delete(this.account);
|
|
}
|
|
}
|
|
|
|
function memoryStore(values = new Map<string, string>()): KeyringTokenStore {
|
|
return new KeyringTokenStore(async (account) => new MemoryEntry(values, account));
|
|
}
|
|
|
|
test("keyring token store chunks large OAuth credentials and removes every chunk", async () => {
|
|
const values = new Map<string, string>();
|
|
const store = memoryStore(values);
|
|
const tokens: OAuthTokens = {
|
|
access_token: "a".repeat(3400),
|
|
refresh_token: "r".repeat(2400),
|
|
token_type: "Bearer",
|
|
};
|
|
|
|
await store.set("account", tokens);
|
|
|
|
assert.ok(values.size > 2);
|
|
assert.deepEqual(await store.get("account"), tokens);
|
|
assert.ok([...values.values()].every((value) => value.length <= 1000));
|
|
|
|
await store.delete("account");
|
|
assert.equal(values.size, 0);
|
|
});
|
|
|
|
test("keyring token store replaces rotated credentials and cleans old chunks", async () => {
|
|
const values = new Map<string, string>();
|
|
const store = memoryStore(values);
|
|
await store.set("account", { access_token: "a".repeat(3000), refresh_token: "old", token_type: "Bearer" });
|
|
const oldAccounts = [...values.keys()].filter((account) => account !== "account");
|
|
|
|
await store.set("account", { access_token: "b".repeat(3000), refresh_token: "new", token_type: "Bearer" });
|
|
|
|
assert.equal((await store.get("account"))?.refresh_token, "new");
|
|
assert.ok(oldAccounts.every((account) => !values.has(account)));
|
|
});
|
|
|
|
test("keyring token store still reads and removes legacy single-entry credentials", async () => {
|
|
const tokens: OAuthTokens = { access_token: "legacy", token_type: "Bearer" };
|
|
const values = new Map([["account", JSON.stringify(tokens)]]);
|
|
const store = memoryStore(values);
|
|
|
|
assert.deepEqual(await store.get("account"), tokens);
|
|
await store.delete("account");
|
|
assert.equal(values.size, 0);
|
|
});
|
|
|
|
for (const damage of ["invalid-json", "missing-token-fields", "missing-chunk"] as const) {
|
|
test(`local-only logout removes ${damage} credentials without remote requests`, async () => {
|
|
const options = resolveClientOptions({ url: "https://example.test/mcp", env: {} });
|
|
const account = credentialAccount(options);
|
|
const values = new Map<string, string>();
|
|
const store = memoryStore(values);
|
|
if (damage === "missing-chunk") {
|
|
await store.set(account, { access_token: "a".repeat(3000), token_type: "Bearer" });
|
|
values.delete([...values.keys()].find((key) => key !== account)!);
|
|
} else {
|
|
values.set(account, damage === "invalid-json" ? "{broken" : "{}");
|
|
}
|
|
values.set("other-account", "untouched");
|
|
await assert.rejects(store.get(account), /credential is invalid/);
|
|
const discovery = new Map([[account, "cached"], ["other-account", "untouched"]]);
|
|
const result = await logoutRemote(options, store, {
|
|
async delete(key: string) { discovery.delete(key); },
|
|
} as never, true, async () => { throw new Error("unexpected network request"); });
|
|
|
|
assert.deepEqual(result, { hadCredential: true, revoked: false });
|
|
assert.deepEqual([...values], [["other-account", "untouched"]]);
|
|
assert.deepEqual([...discovery], [["other-account", "untouched"]]);
|
|
assert.equal(await store.get(account), undefined);
|
|
assert.deepEqual(await logoutRemote(options, store, {
|
|
async delete(key: string) { discovery.delete(key); },
|
|
} as never, true), { hadCredential: false, revoked: false });
|
|
});
|
|
}
|
|
|
|
test("local-only logout reports credential store failures without claiming success", async () => {
|
|
const store = new KeyringTokenStore(async () => { throw new Error("access denied"); });
|
|
await assert.rejects(logoutRemote(resolveClientOptions({ env: {} }), store, {
|
|
async delete() { assert.fail("discovery must be retained when credential deletion fails"); },
|
|
} as never, true), /credential store is unavailable.*access denied/);
|
|
});
|
|
|
|
test("keyring null for an absent Windows credential is treated as missing", async () => {
|
|
const store = new KeyringTokenStore(async () => ({
|
|
async getPassword() { return null; },
|
|
async setPassword() { assert.fail("unexpected credential write"); },
|
|
async deleteCredential() { return false; },
|
|
}));
|
|
assert.equal(await store.get("account"), undefined);
|
|
assert.equal(await store.delete("account"), false);
|
|
});
|