876 lines
31 KiB
TypeScript
876 lines
31 KiB
TypeScript
import 'dotenv/config';
|
|
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { randomUUID, randomBytes } from 'node:crypto';
|
|
import { PrismaClient } from '@prisma/client';
|
|
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
|
|
import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
|
|
import { auth, OAuthClientProvider } from '@modelcontextprotocol/sdk/client/auth.js';
|
|
import { today } from '../src/validation';
|
|
import { readBackupZip } from '../src/zip';
|
|
import sharp from 'sharp';
|
|
const root = process.env.TEST_API_URL?.replace(/\/api$/, '') || 'http://127.0.0.1:3100';
|
|
const resource = process.env.MCP_PUBLIC_URL || 'http://localhost:3100/mcp';
|
|
const origin = process.env.WEB_ORIGIN === '*' ? 'http://localhost:5173' : process.env.WEB_ORIGIN!;
|
|
|
|
test('official SDK Streamable HTTP: real MySQL full business paths, drafts, isolation, files and sensitive confirmation', async () => {
|
|
const db = new PrismaClient(),
|
|
users: string[] = [],
|
|
clients: Client[] = [];
|
|
async function web(cookie: string, path: string, method = 'GET', body?: unknown) {
|
|
const response = await fetch(root + '/api' + path, {
|
|
method,
|
|
headers: {
|
|
Origin: origin,
|
|
...(cookie ? { Cookie: cookie } : {}),
|
|
...(body ? { 'Content-Type': 'application/json' } : {}),
|
|
},
|
|
body: body ? JSON.stringify(body) : undefined,
|
|
});
|
|
return {
|
|
status: response.status,
|
|
data: await response.json(),
|
|
cookie: response.headers.get('set-cookie')?.split(';')[0] || cookie,
|
|
};
|
|
}
|
|
async function fixture(mode = 'direct', selected = ['read', 'draft', 'write', 'sensitive']) {
|
|
const username = 'mcp_test_' + randomUUID().slice(0, 12),
|
|
password = randomBytes(20).toString('hex');
|
|
const registered = await web('', '/auth/register', 'POST', { username, password });
|
|
assert.equal(registered.status, 201);
|
|
const user = await db.user.findUniqueOrThrow({ where: { username } });
|
|
users.push(user.id);
|
|
const cookie = registered.cookie;
|
|
assert.equal((await web(cookie, '/agent/policy', 'PUT', { mode, password })).status, 200);
|
|
const token = await web(cookie, '/agent/tokens', 'POST', {
|
|
name: 'Official SDK integration',
|
|
days: 1,
|
|
scopes: selected,
|
|
password,
|
|
});
|
|
assert.equal(token.status, 201);
|
|
const client = new Client({ name: 'WorthPath integration', version: '1.31.0' });
|
|
clients.push(client);
|
|
await client.connect(
|
|
new StreamableHTTPClientTransport(new URL(resource), {
|
|
requestInit: { headers: { Authorization: 'Bearer ' + token.data.token } },
|
|
}),
|
|
);
|
|
return {
|
|
id: user.id,
|
|
client,
|
|
cookie,
|
|
password,
|
|
token: token.data.token,
|
|
grantId: token.data.id,
|
|
};
|
|
}
|
|
async function call(a: any, name: string, args: any = {}) {
|
|
const v: any = await a.client.callTool({ name, arguments: args });
|
|
assert.ok(!v.isError, JSON.stringify(v));
|
|
return v.structuredContent.data;
|
|
}
|
|
async function fail(a: any, name: string, args: any = {}) {
|
|
const v: any = await a.client.callTool({ name, arguments: args });
|
|
assert.equal(v.isError, true, JSON.stringify(v));
|
|
return v;
|
|
}
|
|
async function write(a: any, name: string, args: any = {}) {
|
|
const state = (await call(a, 'state_get')).state;
|
|
return call(a, name, { ...args, expectedState: state, idempotencyKey: randomUUID() });
|
|
}
|
|
async function confirm(a: any, operation: any, extra: any = {}) {
|
|
const v = await web(a.cookie, '/agent/operations/' + operation.operationId, 'POST', {
|
|
approve: true,
|
|
password: a.password,
|
|
...extra,
|
|
});
|
|
assert.equal(v.status, 201, JSON.stringify(v.data));
|
|
a.cookie = v.cookie;
|
|
return call(a, 'operation_get', { operationId: operation.operationId });
|
|
}
|
|
const day = today(),
|
|
position = {
|
|
kind: 'account',
|
|
side: 'asset',
|
|
name: 'same name',
|
|
category: 'cash',
|
|
currency: 'CNY',
|
|
amount: '1000.87654321',
|
|
date: day,
|
|
notes: '',
|
|
};
|
|
try {
|
|
const unauth = await fetch(resource, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: '{}',
|
|
});
|
|
assert.equal(unauth.status, 401);
|
|
assert.match(unauth.headers.get('www-authenticate') || '', /resource_metadata/);
|
|
const metadata = await (await fetch(root + '/.well-known/oauth-protected-resource/mcp')).json();
|
|
assert.equal(metadata.resource, resource);
|
|
const a = await fixture(),
|
|
b = await fixture(),
|
|
d = await fixture('draft', ['read', 'draft']);
|
|
await write(a, 'rates_refresh');
|
|
await write(a, 'metals_refresh');
|
|
await call(a, 'connection_info');
|
|
const discovered = await a.client.listTools();
|
|
assert.ok(discovered.tools.length >= 40);
|
|
assert.equal(
|
|
discovered.tools.find((t) => t.name === 'positions_list')!.annotations!.readOnlyHint,
|
|
true,
|
|
);
|
|
const first = await write(a, 'position_create', position),
|
|
cash = first.result.id;
|
|
const second = (await write(a, 'position_create', { ...position, amount: '0' })).result.id;
|
|
const liability = (
|
|
await write(a, 'position_create', {
|
|
...position,
|
|
name: 'credit',
|
|
side: 'liability',
|
|
category: 'credit_card',
|
|
amount: '100',
|
|
})
|
|
).result.id;
|
|
const debt = (
|
|
await write(a, 'position_create', {
|
|
...position,
|
|
kind: 'debt',
|
|
side: 'liability',
|
|
name: 'loan',
|
|
category: 'loan',
|
|
amount: '100',
|
|
})
|
|
).result.id;
|
|
const metal = (
|
|
await write(a, 'position_create', {
|
|
...position,
|
|
kind: 'asset',
|
|
category: 'gold',
|
|
name: 'gold',
|
|
amount: '200',
|
|
})
|
|
).result.id;
|
|
assert.equal((await call(a, 'positions_list', { limit: 1, q: 'same name' })).total, 2);
|
|
assert.equal((await call(a, 'positions_list', { limit: 1, q: 'same name' })).nextOffset, 1);
|
|
await fail(b, 'position_get', { id: cash });
|
|
await fail(a, 'positions_list', { userId: b.id });
|
|
await fail(a, 'position_create', {
|
|
...position,
|
|
amount: 12,
|
|
idempotencyKey: randomUUID(),
|
|
expectedState: (await call(a, 'state_get')).state,
|
|
});
|
|
const key = randomUUID(),
|
|
state = (await call(a, 'state_get')).state,
|
|
args = { ...position, name: 'idempotent', expectedState: state, idempotencyKey: key };
|
|
const once = await call(a, 'position_create', args),
|
|
again = await call(a, 'position_create', args);
|
|
assert.equal(once.result.id, again.result.id);
|
|
await fail(a, 'position_create', { ...args, name: 'changed' });
|
|
await fail(a, 'balance_record', {
|
|
id: cash,
|
|
data: { amount: '10', date: day },
|
|
idempotencyKey: randomUUID(),
|
|
expectedState: state,
|
|
});
|
|
const draft = await write(d, 'position_create', position);
|
|
assert.equal(draft.status, 'pending');
|
|
assert.equal((await call(d, 'positions_list')).total, 0);
|
|
assert.equal((await web(b.cookie, '/agent/operations/' + draft.operationId)).status, 404);
|
|
assert.equal(
|
|
(
|
|
await web(d.cookie, '/agent/operations/' + draft.operationId, 'POST', {
|
|
approve: true,
|
|
confirmed: true,
|
|
})
|
|
).status,
|
|
400,
|
|
);
|
|
const applied = await confirm(d, draft);
|
|
assert.ok(applied.result.id);
|
|
assert.equal((await call(d, 'positions_list')).total, 1);
|
|
const expired = await write(d, 'position_create', { ...position, name: 'expired' });
|
|
await db.agentOperation.update({
|
|
where: { id: expired.operationId },
|
|
data: { expiresAt: new Date(0) },
|
|
});
|
|
assert.equal(
|
|
(await call(d, 'operation_get', { operationId: expired.operationId })).status,
|
|
'expired',
|
|
);
|
|
assert.equal(
|
|
(await web(d.cookie, '/agent/operations/' + expired.operationId, 'POST', { approve: true }))
|
|
.status,
|
|
409,
|
|
);
|
|
const cancelled = await write(d, 'position_create', { ...position, name: 'cancelled' });
|
|
assert.equal(
|
|
(
|
|
await web(d.cookie, '/agent/operations/' + cancelled.operationId, 'POST', {
|
|
approve: false,
|
|
})
|
|
).status,
|
|
201,
|
|
);
|
|
const stale = await write(d, 'position_create', { ...position, name: 'stale' });
|
|
await web(d.cookie, '/settings', 'PATCH', { showNotes: false });
|
|
assert.equal(
|
|
(await web(d.cookie, '/agent/operations/' + stale.operationId, 'POST', { approve: true }))
|
|
.status,
|
|
409,
|
|
);
|
|
const mv = (
|
|
await write(a, 'movement_create', {
|
|
sourceId: cash,
|
|
targetId: second,
|
|
amount: '30.00000001',
|
|
received: '30.00000001',
|
|
fee: '0',
|
|
date: day,
|
|
})
|
|
).result;
|
|
assert.equal((await call(a, 'position_get', { id: cash })).amount, '970.8765432');
|
|
await write(a, 'movement_update', {
|
|
id: mv.id,
|
|
data: { sourceId: cash, targetId: second, amount: '40', received: '40', fee: '0', date: day },
|
|
});
|
|
assert.equal((await call(a, 'position_get', { id: second })).amount, '40');
|
|
const movementPage = await call(a, 'movements_list', { limit: 1 });
|
|
await call(a, 'movement_by_revision', { revisionId: movementPage.items[0].sourceRevisionId });
|
|
await write(a, 'movement_delete', { id: mv.id });
|
|
assert.equal((await call(a, 'position_get', { id: cash })).amount, '1000.87654321');
|
|
await write(a, 'movement_create', {
|
|
operation: 'repay',
|
|
sourceId: cash,
|
|
targetId: debt,
|
|
amount: '10',
|
|
received: '10',
|
|
date: day,
|
|
});
|
|
assert.equal((await call(a, 'position_get', { id: debt })).amount, '90');
|
|
await write(a, 'movement_create', {
|
|
sourceId: cash,
|
|
targetId: liability,
|
|
amount: '150',
|
|
received: '150',
|
|
date: day,
|
|
});
|
|
assert.equal((await call(a, 'position_get', { id: liability })).amount, '-50');
|
|
await write(a, 'debt_links_set', { id: debt, targetIds: [cash, metal] });
|
|
const rev = (
|
|
await write(a, 'balance_record', {
|
|
id: second,
|
|
data: { amount: '33.25', date: day, reason: 'balance' },
|
|
})
|
|
).result;
|
|
await write(a, 'history_update', {
|
|
id: second,
|
|
revisionId: rev.id,
|
|
data: { amount: '35.25', date: day },
|
|
});
|
|
assert.equal((await call(a, 'position_get', { id: second })).amount, '35.25');
|
|
await write(a, 'history_delete', { id: second, revisionId: rev.id });
|
|
assert.equal((await call(a, 'position_get', { id: second })).amount, '0');
|
|
const h = await call(a, 'history_list', { limit: 1 });
|
|
assert.equal(h.items.length, 1);
|
|
assert.ok(h.nextCursor);
|
|
await call(a, 'history_list', { limit: 1, cursor: h.nextCursor });
|
|
await write(a, 'settings_update', {
|
|
accountGroupOrder: ['invest', ''],
|
|
baseCurrency: 'CNY',
|
|
overviewCards: ['net'],
|
|
includeIndependentAssets: true,
|
|
});
|
|
await write(a, 'position_update', {
|
|
id: cash,
|
|
data: {
|
|
name: 'cash',
|
|
category: 'cash',
|
|
groupName: 'invest',
|
|
notes: 'memo',
|
|
archived: false,
|
|
hidden: false,
|
|
included: true,
|
|
},
|
|
});
|
|
await write(a, 'position_update', {
|
|
id: metal,
|
|
data: { name: 'gold', category: 'gold', notes: '', archived: true, hidden: false },
|
|
});
|
|
await fail(a, 'balance_record', {
|
|
id: metal,
|
|
data: { amount: '1', date: day },
|
|
expectedState: (await call(a, 'state_get')).state,
|
|
idempotencyKey: randomUUID(),
|
|
});
|
|
await write(a, 'position_update', {
|
|
id: metal,
|
|
data: { name: 'gold', category: 'gold', notes: '', archived: false, hidden: false },
|
|
});
|
|
await write(a, 'metal_price_set', {
|
|
metalType: 'gold',
|
|
currency: 'CNY',
|
|
price: '10.876543210987',
|
|
date: day,
|
|
});
|
|
await write(a, 'metal_configure', {
|
|
id: metal,
|
|
data: { metalType: 'gold', metalGrams: '2', metalPurity: '1', autoValuation: true },
|
|
});
|
|
assert.equal((await call(a, 'position_get', { id: metal })).amount, '21.75308642');
|
|
await write(a, 'metal_value', { id: metal });
|
|
await call(a, 'metals_prices');
|
|
await call(a, 'settings_get');
|
|
await call(a, 'overview_get', { limit: 1 });
|
|
await call(a, 'trend_get', { from: day, to: day, grain: 'day' });
|
|
await call(a, 'calendar_month', { month: day.slice(0, 7) });
|
|
await call(a, 'calendar_day', { date: day, limit: 1 });
|
|
await call(a, 'icons_list', { q: '', page: 1 });
|
|
const planInput = {
|
|
name: 'once',
|
|
operation: 'expense',
|
|
sourceId: cash,
|
|
amount: '1.25',
|
|
nextAt: day + 'T00:00',
|
|
intervalDays: 0,
|
|
};
|
|
const plan = (await write(a, 'schedule_create', planInput)).result.id;
|
|
await write(a, 'schedule_update', { id: plan, data: { ...planInput, amount: '2.25' } });
|
|
await write(a, 'schedule_toggle', { id: plan, enabled: false });
|
|
await call(a, 'schedules_list', { limit: 1 });
|
|
await write(a, 'schedule_toggle', { id: plan, enabled: true });
|
|
const before = (await call(a, 'position_get', { id: cash })).amount;
|
|
assert.equal((await write(a, 'schedules_run')).result.executed, 1);
|
|
assert.notEqual((await call(a, 'position_get', { id: cash })).amount, before);
|
|
assert.equal((await write(a, 'schedules_run')).result.executed, 0);
|
|
await write(a, 'schedule_delete', { id: plan });
|
|
const hidden = (
|
|
await write(a, 'position_create', { ...position, name: 'hidden', hidden: true })
|
|
).result.id;
|
|
await fail(a, 'position_get', { id: hidden });
|
|
await fail(a, 'debt_links_set', {
|
|
id: debt,
|
|
targetIds: [hidden],
|
|
expectedState: (await call(a, 'state_get')).state,
|
|
idempotencyKey: randomUUID(),
|
|
});
|
|
await fail(d, 'settings_update', {
|
|
requireHiddenPassword: false,
|
|
expectedState: (await call(d, 'state_get')).state,
|
|
idempotencyKey: randomUUID(),
|
|
});
|
|
const unlock = await write(a, 'hidden_unlock_request');
|
|
await confirm(a, unlock);
|
|
assert.equal((await call(a, 'position_get', { id: hidden })).id, hidden);
|
|
await write(a, 'hidden_lock');
|
|
await fail(a, 'position_get', { id: hidden });
|
|
const exported = await write(a, 'backup_export');
|
|
assert.equal(exported.status, 'pending');
|
|
const out = (await confirm(a, exported)).result;
|
|
assert.equal((await fetch(out.url)).status, 401);
|
|
assert.equal(
|
|
(await fetch(out.url, { headers: { Authorization: 'Bearer ' + b.token } })).status,
|
|
403,
|
|
);
|
|
const download = await fetch(out.url, { headers: { Authorization: 'Bearer ' + a.token } });
|
|
assert.equal(download.status, 200);
|
|
const zipped = Buffer.from(await download.arrayBuffer());
|
|
const backup: any = await readBackupZip(zipped);
|
|
assert.ok(backup.positions.find((p: any) => p.id === hidden));
|
|
assert.equal(JSON.stringify(backup).includes(a.token), false);
|
|
const target = await fixture('draft'),
|
|
upload = await call(target, 'file_upload_request', { kind: 'backup' }),
|
|
form = new FormData();
|
|
form.append('file', new Blob([zipped]), 'backup.zip');
|
|
const uploaded = await fetch(upload.url, {
|
|
method: 'POST',
|
|
headers: { Authorization: 'Bearer ' + target.token },
|
|
body: form,
|
|
});
|
|
assert.equal(uploaded.status, 200);
|
|
const info = await uploaded.json();
|
|
assert.ok(info.token);
|
|
await call(target, 'file_status', { fileId: upload.fileId });
|
|
await call(target, 'import_preview', { token: info.token });
|
|
const imported = await write(target, 'backup_import', { token: info.token });
|
|
await confirm(target, imported);
|
|
assert.equal(
|
|
await db.position.count({ where: { userId: target.id } }),
|
|
backup.positions.length,
|
|
);
|
|
const retry = await write(target, 'backup_import', { token: info.token });
|
|
assert.equal(
|
|
(
|
|
await web(target.cookie, '/agent/operations/' + retry.operationId, 'POST', {
|
|
approve: true,
|
|
password: target.password,
|
|
})
|
|
).status,
|
|
409,
|
|
);
|
|
assert.equal(
|
|
await db.position.count({ where: { userId: target.id } }),
|
|
backup.positions.length,
|
|
);
|
|
const clear = await write(target, 'data_clear_request');
|
|
assert.equal(
|
|
(
|
|
await web(target.cookie, '/agent/operations/' + clear.operationId, 'POST', {
|
|
approve: true,
|
|
password: target.password,
|
|
confirmation: '确定清空',
|
|
})
|
|
).status,
|
|
400,
|
|
);
|
|
const save = await fetch(root + '/api/backup', { headers: { Cookie: target.cookie } });
|
|
assert.equal(save.status, 200);
|
|
await save.arrayBuffer();
|
|
await confirm(target, clear, { confirmation: '确定清空' });
|
|
assert.equal(await db.position.count({ where: { userId: target.id } }), 0);
|
|
assert.equal(
|
|
(await web(a.cookie, '/agent/policy', 'PUT', { mode: 'readonly', password: a.password }))
|
|
.status,
|
|
200,
|
|
);
|
|
await fail(a, 'position_create', {
|
|
...position,
|
|
expectedState: (await call(a, 'state_get')).state,
|
|
idempotencyKey: randomUUID(),
|
|
});
|
|
await db.agentGrant.update({ where: { id: b.grantId }, data: { expiresAt: new Date(0) } });
|
|
assert.equal(
|
|
(
|
|
await fetch(resource, {
|
|
method: 'POST',
|
|
headers: { Authorization: 'Bearer ' + b.token, 'Content-Type': 'application/json' },
|
|
body: '{}',
|
|
})
|
|
).status,
|
|
401,
|
|
);
|
|
await call(d, 'connection_revoke');
|
|
assert.equal(
|
|
(
|
|
await fetch(resource, {
|
|
method: 'POST',
|
|
headers: { Authorization: 'Bearer ' + d.token, 'Content-Type': 'application/json' },
|
|
body: '{}',
|
|
})
|
|
).status,
|
|
401,
|
|
);
|
|
const originDenied = await fetch(resource, {
|
|
method: 'POST',
|
|
headers: {
|
|
Origin: 'https://evil.invalid',
|
|
Authorization: 'Bearer ' + a.token,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: '{}',
|
|
});
|
|
assert.equal(originDenied.status, 403);
|
|
} finally {
|
|
for (const c of clients) await c.close().catch(() => {});
|
|
await db.user.deleteMany({ where: { id: { in: users } } });
|
|
await db.$disconnect();
|
|
}
|
|
});
|
|
|
|
test('real concurrent MCP idempotency, stale writes, icon workflow, nested rollback and credentials completion', async () => {
|
|
const db = new PrismaClient();
|
|
const username = 'mcp_extra_' + randomUUID().slice(0, 10),
|
|
password = randomBytes(20).toString('hex');
|
|
let userId = '',
|
|
cookie = '';
|
|
const clients: Client[] = [];
|
|
const iconIds: string[] = [];
|
|
async function web(path: string, method = 'GET', body?: unknown) {
|
|
const r = await fetch(root + '/api' + path, {
|
|
method,
|
|
headers: {
|
|
Origin: origin,
|
|
...(cookie ? { Cookie: cookie } : {}),
|
|
...(body ? { 'Content-Type': 'application/json' } : {}),
|
|
},
|
|
body: body ? JSON.stringify(body) : undefined,
|
|
});
|
|
cookie = r.headers.get('set-cookie')?.split(';')[0] || cookie;
|
|
return { status: r.status, data: await r.json() };
|
|
}
|
|
async function tool(c: Client, name: string, args: any = {}) {
|
|
return c.callTool({ name, arguments: args }) as Promise<any>;
|
|
}
|
|
async function call(c: Client, name: string, args: any = {}) {
|
|
const r = await tool(c, name, args);
|
|
assert.ok(!r.isError, JSON.stringify(r));
|
|
return r.structuredContent.data;
|
|
}
|
|
async function write(c: Client, name: string, args: any = {}) {
|
|
return call(c, name, {
|
|
...args,
|
|
expectedState: (await call(c, 'state_get')).state,
|
|
idempotencyKey: randomUUID(),
|
|
});
|
|
}
|
|
try {
|
|
assert.equal((await web('/auth/register', 'POST', { username, password })).status, 201);
|
|
userId = (await db.user.findUniqueOrThrow({ where: { username } })).id;
|
|
await web('/agent/policy', 'PUT', { mode: 'direct', password });
|
|
const grant = (
|
|
await web('/agent/tokens', 'POST', {
|
|
name: 'extra',
|
|
days: 1,
|
|
scopes: ['read', 'draft', 'write', 'sensitive'],
|
|
password,
|
|
})
|
|
).data;
|
|
const headers = { Authorization: 'Bearer ' + grant.token };
|
|
for (let i = 0; i < 2; i++) {
|
|
const c = new Client({ name: 'concurrent', version: '1.31.0' });
|
|
clients.push(c);
|
|
await c.connect(
|
|
new StreamableHTTPClientTransport(new URL(resource), { requestInit: { headers } }),
|
|
);
|
|
}
|
|
const c = clients[0],
|
|
position = {
|
|
kind: 'account',
|
|
side: 'asset',
|
|
name: 'concurrent',
|
|
category: 'cash',
|
|
currency: 'CNY',
|
|
amount: '100',
|
|
date: today(),
|
|
};
|
|
const args = {
|
|
...position,
|
|
idempotencyKey: randomUUID(),
|
|
expectedState: (await call(c, 'state_get')).state,
|
|
};
|
|
const [one, two] = await Promise.all(
|
|
clients.map((client) => call(client, 'position_create', args)),
|
|
);
|
|
assert.equal(one.operationId, two.operationId);
|
|
assert.equal(await db.position.count({ where: { userId } }), 1);
|
|
const state = (await call(c, 'state_get')).state;
|
|
const results = await Promise.all(
|
|
clients.map((client) =>
|
|
tool(client, 'position_create', {
|
|
...position,
|
|
name: randomUUID(),
|
|
expectedState: state,
|
|
idempotencyKey: randomUUID(),
|
|
}),
|
|
),
|
|
);
|
|
assert.equal(results.filter((r) => !r.isError).length, 1);
|
|
assert.equal(await db.position.count({ where: { userId } }), 2);
|
|
const upload = await call(c, 'file_upload_request', { kind: 'icon' }),
|
|
form = new FormData();
|
|
form.append(
|
|
'file',
|
|
new Blob([
|
|
await sharp({ create: { width: 4, height: 4, channels: 4, background: '#33aa88' } })
|
|
.png()
|
|
.toBuffer(),
|
|
]),
|
|
'icon.png',
|
|
);
|
|
assert.equal((await fetch(upload.url, { method: 'POST', headers, body: form })).status, 200);
|
|
const published = (
|
|
await write(c, 'icon_publish', { fileId: upload.fileId, name: '测试私有图标', shared: false })
|
|
).result;
|
|
iconIds.push(published.id);
|
|
const image = await call(c, 'icon_image', { id: published.id });
|
|
assert.equal((await fetch(image.url, { headers })).status, 200);
|
|
const shared = await write(c, 'icon_publish', {
|
|
fileId: upload.fileId,
|
|
name: '测试共享图标',
|
|
shared: true,
|
|
});
|
|
assert.equal(shared.status, 'pending');
|
|
assert.equal(
|
|
(await web('/agent/operations/' + shared.operationId, 'POST', { approve: true, password }))
|
|
.status,
|
|
201,
|
|
);
|
|
iconIds.push((await call(c, 'operation_get', { operationId: shared.operationId })).result.id);
|
|
// A failed paired transfer leaves neither side changed, including inside outer
|
|
// idempotency transaction and nested service savepoints.
|
|
const account = one.result.id,
|
|
foreign = randomUUID(),
|
|
balance = (await call(c, 'position_get', { id: account })).amount;
|
|
const failure = await tool(c, 'movement_create', {
|
|
sourceId: account,
|
|
targetId: foreign,
|
|
amount: '1',
|
|
received: '1',
|
|
date: today(),
|
|
expectedState: (await call(c, 'state_get')).state,
|
|
idempotencyKey: randomUUID(),
|
|
});
|
|
assert.equal(failure.isError, true);
|
|
assert.equal((await call(c, 'position_get', { id: account })).amount, balance);
|
|
assert.equal(await db.transfer.count({ where: { userId } }), 0);
|
|
const other = (await call(c, 'positions_list')).items.find((v: any) => v.id !== account).id;
|
|
const good = (
|
|
await write(c, 'schedule_create', {
|
|
name: 'first valid',
|
|
operation: 'expense',
|
|
sourceId: account,
|
|
amount: '2',
|
|
nextAt: today() + 'T00:00',
|
|
intervalDays: 0,
|
|
})
|
|
).result.id;
|
|
const bad = (
|
|
await write(c, 'schedule_create', {
|
|
name: 'second archived',
|
|
operation: 'expense',
|
|
sourceId: other,
|
|
amount: '3',
|
|
nextAt: today() + 'T00:01',
|
|
intervalDays: 0,
|
|
})
|
|
).result.id;
|
|
await write(c, 'position_update', {
|
|
id: other,
|
|
data: { name: 'archived', category: 'cash', notes: '', archived: true, hidden: false },
|
|
});
|
|
const revisions = await db.revision.count({ where: { position: { userId } } });
|
|
const batch = await tool(c, 'schedules_run', {
|
|
idempotencyKey: randomUUID(),
|
|
expectedState: (await call(c, 'state_get')).state,
|
|
});
|
|
assert.equal(batch.isError, true);
|
|
assert.equal((await call(c, 'position_get', { id: account })).amount, balance);
|
|
assert.equal(await db.revision.count({ where: { position: { userId } } }), revisions);
|
|
assert.equal((await db.schedule.findUniqueOrThrow({ where: { id: good } })).completed, false);
|
|
await write(c, 'schedule_delete', { id: good });
|
|
await write(c, 'schedule_delete', { id: bad });
|
|
const management = (await web('/agent')).data;
|
|
assert.ok(management.calls.some((v: any) => v.status === 'error'));
|
|
assert.equal(JSON.stringify(management).includes(grant.token), false);
|
|
const operation = await write(c, 'credentials_change_request');
|
|
const replacement = randomBytes(20).toString('hex');
|
|
assert.equal(
|
|
(
|
|
await web('/agent/operations/' + operation.operationId, 'POST', {
|
|
approve: true,
|
|
password,
|
|
newPassword: replacement,
|
|
})
|
|
).status,
|
|
201,
|
|
);
|
|
assert.equal(
|
|
(await call(c, 'operation_get', { operationId: operation.operationId })).status,
|
|
'completed',
|
|
);
|
|
assert.equal(
|
|
(
|
|
await tool(c, 'position_create', {
|
|
...position,
|
|
idempotencyKey: randomUUID(),
|
|
expectedState: (await call(c, 'state_get')).state,
|
|
})
|
|
).isError,
|
|
true,
|
|
);
|
|
assert.equal(
|
|
(await web('/auth/login', 'POST', { username, password: replacement })).status,
|
|
201,
|
|
);
|
|
} finally {
|
|
for (const c of clients) await c.close().catch(() => {});
|
|
await db.icon.deleteMany({ where: { id: { in: iconIds } } });
|
|
if (userId) await db.user.deleteMany({ where: { id: userId } });
|
|
await db.$disconnect();
|
|
}
|
|
});
|
|
|
|
test('official SDK OAuth discovery, DCR, PKCE, consent, one-use codes, rotation and resource validation', async () => {
|
|
const db = new PrismaClient();
|
|
const username = 'mcp_oauth_' + randomUUID().slice(0, 10),
|
|
password = randomBytes(20).toString('hex');
|
|
let userId = '',
|
|
clientId = '';
|
|
let saved: any,
|
|
tokens: any,
|
|
verifier = '',
|
|
authorization: URL | undefined;
|
|
const provider: OAuthClientProvider = {
|
|
redirectUrl: 'http://127.0.0.1:47891/callback',
|
|
clientMetadata: {
|
|
client_name: 'WorthPath official OAuth test',
|
|
redirect_uris: ['http://127.0.0.1:47891/callback'],
|
|
grant_types: ['authorization_code', 'refresh_token'],
|
|
response_types: ['code'],
|
|
token_endpoint_auth_method: 'none',
|
|
scope: 'read draft write sensitive',
|
|
},
|
|
clientInformation: () => saved,
|
|
saveClientInformation: (v) => {
|
|
saved = v;
|
|
clientId = v.client_id;
|
|
},
|
|
tokens: () => tokens,
|
|
saveTokens: (v) => {
|
|
tokens = v;
|
|
},
|
|
redirectToAuthorization: (v) => {
|
|
authorization = v;
|
|
},
|
|
saveCodeVerifier: (v) => {
|
|
verifier = v;
|
|
},
|
|
codeVerifier: () => verifier,
|
|
state: () => 'test-state',
|
|
};
|
|
async function post(path: string, body: any, cookie = '') {
|
|
const r = await fetch(root + path, {
|
|
method: 'POST',
|
|
headers: {
|
|
Origin: origin,
|
|
'Content-Type': 'application/json',
|
|
...(cookie ? { Cookie: cookie } : {}),
|
|
},
|
|
body: JSON.stringify(body),
|
|
});
|
|
return {
|
|
status: r.status,
|
|
data: await r.json(),
|
|
cookie: r.headers.get('set-cookie')?.split(';')[0] || cookie,
|
|
};
|
|
}
|
|
try {
|
|
const registered = await post('/api/auth/register', { username, password });
|
|
assert.equal(registered.status, 201);
|
|
userId = (await db.user.findUniqueOrThrow({ where: { username } })).id;
|
|
assert.equal(
|
|
await auth(provider, { serverUrl: resource, scope: 'read draft write sensitive' }),
|
|
'REDIRECT',
|
|
);
|
|
assert.ok(authorization);
|
|
const redirected = await fetch(authorization!, { redirect: 'manual' });
|
|
assert.equal(redirected.status, 302);
|
|
const location = new URL(redirected.headers.get('location')!);
|
|
const id = location.searchParams.get('agent_authorization');
|
|
assert.ok(id);
|
|
const consent = await post(
|
|
'/api/agent/authorizations/' + id,
|
|
{ approve: true },
|
|
registered.cookie,
|
|
);
|
|
assert.equal(consent.status, 201);
|
|
const callback = new URL(consent.data.redirect);
|
|
assert.equal(callback.searchParams.get('state'), 'test-state');
|
|
const code = callback.searchParams.get('code')!;
|
|
assert.equal(
|
|
await auth(provider, { serverUrl: resource, authorizationCode: code }),
|
|
'AUTHORIZED',
|
|
);
|
|
assert.ok(tokens.access_token);
|
|
const old = tokens;
|
|
const client = new Client({ name: 'oauth-client', version: '1.31.0' });
|
|
await client.connect(
|
|
new StreamableHTTPClientTransport(new URL(resource), { authProvider: provider }),
|
|
);
|
|
assert.ok((await client.listTools()).tools.length >= 40);
|
|
await client.close();
|
|
async function exchange(params: Record<string, string>) {
|
|
const r = await fetch(root + '/token', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
body: new URLSearchParams(params),
|
|
});
|
|
return { status: r.status, data: await r.json() };
|
|
}
|
|
assert.equal(
|
|
(
|
|
await exchange({
|
|
grant_type: 'authorization_code',
|
|
client_id: clientId,
|
|
code,
|
|
code_verifier: verifier,
|
|
redirect_uri: String(provider.redirectUrl),
|
|
resource,
|
|
})
|
|
).status,
|
|
400,
|
|
);
|
|
assert.equal(
|
|
(
|
|
await exchange({
|
|
grant_type: 'refresh_token',
|
|
client_id: clientId,
|
|
refresh_token: old.refresh_token,
|
|
resource: 'https://evil.invalid/mcp',
|
|
})
|
|
).status,
|
|
400,
|
|
);
|
|
const refreshed = await exchange({
|
|
grant_type: 'refresh_token',
|
|
client_id: clientId,
|
|
refresh_token: old.refresh_token,
|
|
resource,
|
|
});
|
|
assert.equal(refreshed.status, 200);
|
|
assert.notEqual(refreshed.data.refresh_token, old.refresh_token);
|
|
assert.equal(
|
|
(
|
|
await exchange({
|
|
grant_type: 'refresh_token',
|
|
client_id: clientId,
|
|
refresh_token: old.refresh_token,
|
|
resource,
|
|
})
|
|
).status,
|
|
400,
|
|
);
|
|
assert.equal(
|
|
(
|
|
await fetch(resource, {
|
|
method: 'POST',
|
|
headers: {
|
|
Authorization: 'Bearer ' + old.access_token,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: '{}',
|
|
})
|
|
).status,
|
|
401,
|
|
);
|
|
const grant = await db.agentGrant.findFirstOrThrow({ where: { userId } });
|
|
assert.notEqual(grant.accessDigest, refreshed.data.access_token);
|
|
const revoke = await fetch(root + '/revoke', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
body: new URLSearchParams({ client_id: clientId, token: refreshed.data.access_token }),
|
|
});
|
|
assert.equal(revoke.status, 200);
|
|
assert.equal(
|
|
(
|
|
await fetch(resource, {
|
|
method: 'POST',
|
|
headers: {
|
|
Authorization: 'Bearer ' + refreshed.data.access_token,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: '{}',
|
|
})
|
|
).status,
|
|
401,
|
|
);
|
|
} finally {
|
|
if (userId) await db.user.deleteMany({ where: { id: userId } });
|
|
if (clientId) await db.agentClient.deleteMany({ where: { id: clientId } });
|
|
await db.$disconnect();
|
|
}
|
|
});
|