283 lines
10 KiB
TypeScript
283 lines
10 KiB
TypeScript
import 'dotenv/config';
|
|
import { test } from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { randomUUID, randomBytes, createHash } from 'node:crypto';
|
|
import { PrismaClient } from '@prisma/client';
|
|
const root = process.env.TEST_API_URL?.replace(/\/api$/, '') || 'http://127.0.0.1:3100';
|
|
const resource = process.env.MCP_PUBLIC_URL || 'http://localhost:3100/mcp';
|
|
const origin = process.env.WEB_ORIGIN === '*' ? 'http://localhost:5173' : process.env.WEB_ORIGIN!;
|
|
test('OAuth consent persists selected lifetime; refresh rotates and cannot extend authorization or access past its end', async () => {
|
|
const db = new PrismaClient();
|
|
let userId = '',
|
|
clientId = '';
|
|
try {
|
|
const u = await db.user.create({
|
|
data: { username: 'oauth_days_' + randomUUID(), passwordHash: 'unused', idleMinutes: 0 },
|
|
});
|
|
userId = u.id;
|
|
const session = randomBytes(32).toString('hex'),
|
|
sid = createHash('sha256').update(session).digest('hex');
|
|
await db.session.create({
|
|
data: { id: sid, userId, expiresAt: new Date(Date.now() + 3600000) },
|
|
});
|
|
const cookie = 'wp_session=' + session;
|
|
clientId = randomUUID();
|
|
const callback = 'http://127.0.0.1:47891/callback';
|
|
await db.agentClient.create({
|
|
data: {
|
|
id: clientId,
|
|
metadata: {
|
|
client_id: clientId,
|
|
client_name: '期限测试',
|
|
redirect_uris: [callback],
|
|
token_endpoint_auth_method: 'none',
|
|
grant_types: ['authorization_code', 'refresh_token'],
|
|
response_types: ['code'],
|
|
},
|
|
},
|
|
});
|
|
async function authorization() {
|
|
const verifier = randomBytes(32).toString('base64url'),
|
|
id = randomUUID();
|
|
await db.agentAuthorization.create({
|
|
data: {
|
|
id,
|
|
clientId,
|
|
expiresAt: new Date(Date.now() + 600000),
|
|
parameters: {
|
|
redirectUri: callback,
|
|
resource,
|
|
scopes: ['read', 'draft'],
|
|
codeChallenge: createHash('sha256').update(verifier).digest('base64url'),
|
|
},
|
|
},
|
|
});
|
|
return { id, verifier };
|
|
}
|
|
async function consent(id: string, days?: number) {
|
|
const r = await fetch(root + '/api/agent/authorizations/' + id, {
|
|
method: 'POST',
|
|
headers: { Cookie: cookie, Origin: origin, 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
approve: true,
|
|
scopes: ['read', 'draft'],
|
|
...(days === undefined ? {} : { days }),
|
|
}),
|
|
});
|
|
return { status: r.status, data: await r.json() };
|
|
}
|
|
async function token(data: Record<string, string>) {
|
|
const r = await fetch(root + '/token', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
body: new URLSearchParams({ client_id: clientId, resource, ...data }),
|
|
});
|
|
return { status: r.status, data: await r.json() };
|
|
}
|
|
for (const days of [1, 3, 7, 30, 365, undefined]) {
|
|
const a = await authorization(),
|
|
approved = await consent(a.id, days);
|
|
assert.equal(approved.status, 201);
|
|
const code = new URL(approved.data.redirect).searchParams.get('code')!;
|
|
const issued = await token({
|
|
grant_type: 'authorization_code',
|
|
code,
|
|
code_verifier: a.verifier,
|
|
redirect_uri: callback,
|
|
});
|
|
assert.equal(issued.status, 200);
|
|
assert.equal(issued.data.expires_in, 3600);
|
|
let grant = await db.agentGrant.findUniqueOrThrow({
|
|
where: {
|
|
accessDigest: createHash('sha256').update(issued.data.access_token).digest('hex'),
|
|
},
|
|
});
|
|
const ending = +grant.refreshExpiresAt!;
|
|
assert.ok(Math.abs(ending - Date.now() - (days ?? 30) * 86400000) < 5000);
|
|
const sessionRow = await db.session.findUniqueOrThrow({ where: { id: grant.sessionId } });
|
|
assert.equal(+sessionRow.expiresAt, ending);
|
|
const refreshed = await token({
|
|
grant_type: 'refresh_token',
|
|
refresh_token: issued.data.refresh_token,
|
|
});
|
|
assert.equal(refreshed.status, 200);
|
|
grant = await db.agentGrant.findUniqueOrThrow({ where: { id: grant.id } });
|
|
assert.equal(+grant.refreshExpiresAt!, ending);
|
|
const nearEnd = new Date(Date.now() + 50000);
|
|
await db.agentGrant.update({ where: { id: grant.id }, data: { refreshExpiresAt: nearEnd } });
|
|
const finalRefresh = await token({
|
|
grant_type: 'refresh_token',
|
|
refresh_token: refreshed.data.refresh_token,
|
|
});
|
|
assert.equal(finalRefresh.status, 200);
|
|
assert.ok(finalRefresh.data.expires_in <= 50);
|
|
grant = await db.agentGrant.findUniqueOrThrow({ where: { id: grant.id } });
|
|
assert.equal(+grant.expiresAt!, +nearEnd);
|
|
await db.agentGrant.update({
|
|
where: { id: grant.id },
|
|
data: { refreshExpiresAt: new Date(0) },
|
|
});
|
|
assert.equal(
|
|
(
|
|
await token({
|
|
grant_type: 'refresh_token',
|
|
refresh_token: finalRefresh.data.refresh_token,
|
|
})
|
|
).status,
|
|
400,
|
|
);
|
|
const request = await fetch(resource, {
|
|
method: 'POST',
|
|
headers: {
|
|
Authorization: 'Bearer ' + finalRefresh.data.access_token,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: '{}',
|
|
});
|
|
assert.equal(request.status, 401);
|
|
}
|
|
for (const days of [0, 2, 366]) {
|
|
const a = await authorization();
|
|
assert.equal((await consent(a.id, days)).status, 400);
|
|
assert.equal(
|
|
(await db.agentAuthorization.findUniqueOrThrow({ where: { id: a.id } })).status,
|
|
'pending',
|
|
);
|
|
}
|
|
} finally {
|
|
if (userId) await db.user.deleteMany({ where: { id: userId } });
|
|
if (clientId) {
|
|
await db.agentAuthorization.deleteMany({ where: { clientId } });
|
|
await db.agentClient.deleteMany({ where: { id: clientId } });
|
|
}
|
|
await db.$disconnect();
|
|
}
|
|
});
|
|
test('permanent OAuth rotates credentials, renews deleted business session and remains revocable', async () => {
|
|
const db = new PrismaClient();
|
|
let userId = '',
|
|
clientId = '';
|
|
try {
|
|
const u = await db.user.create({
|
|
data: { username: 'oauth_permanent_' + randomUUID(), passwordHash: 'unused', idleMinutes: 0 },
|
|
});
|
|
userId = u.id;
|
|
const cookieToken = randomBytes(32).toString('hex'),
|
|
sid = createHash('sha256').update(cookieToken).digest('hex');
|
|
await db.session.create({
|
|
data: { id: sid, userId, expiresAt: new Date(Date.now() + 3600000) },
|
|
});
|
|
clientId = randomUUID();
|
|
const redirectUri = 'http://127.0.0.1:47891/callback';
|
|
await db.agentClient.create({
|
|
data: {
|
|
id: clientId,
|
|
metadata: {
|
|
client_id: clientId,
|
|
client_name: '永久授权测试',
|
|
redirect_uris: [redirectUri],
|
|
token_endpoint_auth_method: 'none',
|
|
grant_types: ['authorization_code', 'refresh_token'],
|
|
response_types: ['code'],
|
|
},
|
|
},
|
|
});
|
|
const id = randomUUID(),
|
|
verifier = randomBytes(32).toString('base64url');
|
|
await db.agentAuthorization.create({
|
|
data: {
|
|
id,
|
|
clientId,
|
|
parameters: {
|
|
redirectUri,
|
|
resource,
|
|
scopes: ['read'],
|
|
codeChallenge: createHash('sha256').update(verifier).digest('base64url'),
|
|
},
|
|
expiresAt: new Date(Date.now() + 600000),
|
|
},
|
|
});
|
|
const res = await fetch(root + '/api/agent/authorizations/' + id, {
|
|
method: 'POST',
|
|
headers: {
|
|
Cookie: 'wp_session=' + cookieToken,
|
|
Origin: origin,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: JSON.stringify({ approve: true, scopes: ['read'], days: null }),
|
|
});
|
|
assert.equal(res.status, 201);
|
|
const consent = await res.json();
|
|
async function token(data: Record<string, string>) {
|
|
const r = await fetch(root + '/token', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
body: new URLSearchParams({ client_id: clientId, resource, ...data }),
|
|
});
|
|
return { status: r.status, data: await r.json() };
|
|
}
|
|
const issued = await token({
|
|
grant_type: 'authorization_code',
|
|
code: new URL(consent.redirect).searchParams.get('code')!,
|
|
code_verifier: verifier,
|
|
redirect_uri: redirectUri,
|
|
});
|
|
assert.equal(issued.status, 200);
|
|
assert.equal(issued.data.expires_in, 3600);
|
|
const grant = await db.agentGrant.findUniqueOrThrow({
|
|
where: { accessDigest: createHash('sha256').update(issued.data.access_token).digest('hex') },
|
|
});
|
|
assert.equal(grant.refreshExpiresAt, null);
|
|
assert.ok(grant.expiresAt);
|
|
assert.equal(
|
|
((await db.agentAuthorization.findUniqueOrThrow({ where: { id } })).parameters as any)
|
|
.authorizationDays,
|
|
null,
|
|
);
|
|
await db.session.delete({ where: { id: grant.sessionId } });
|
|
const refreshed = await token({
|
|
grant_type: 'refresh_token',
|
|
refresh_token: issued.data.refresh_token,
|
|
});
|
|
assert.equal(refreshed.status, 200);
|
|
const renewed = await db.session.findUniqueOrThrow({ where: { id: grant.sessionId } });
|
|
assert.ok(+renewed.expiresAt > Date.now() + 29 * 86400000);
|
|
assert.equal(
|
|
(await db.agentGrant.findUniqueOrThrow({ where: { id: grant.id } })).refreshExpiresAt,
|
|
null,
|
|
);
|
|
assert.equal(
|
|
(await token({ grant_type: 'refresh_token', refresh_token: issued.data.refresh_token }))
|
|
.status,
|
|
400,
|
|
);
|
|
const revoke = await fetch(root + '/revoke', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
|
|
body: new URLSearchParams({ client_id: clientId, token: refreshed.data.access_token }),
|
|
});
|
|
assert.equal(revoke.status, 200);
|
|
assert.equal(
|
|
(await token({ grant_type: 'refresh_token', refresh_token: refreshed.data.refresh_token }))
|
|
.status,
|
|
400,
|
|
);
|
|
const denied = await fetch(resource, {
|
|
method: 'POST',
|
|
headers: {
|
|
Authorization: 'Bearer ' + refreshed.data.access_token,
|
|
'Content-Type': 'application/json',
|
|
},
|
|
body: '{}',
|
|
});
|
|
assert.equal(denied.status, 401);
|
|
} finally {
|
|
if (userId) await db.user.deleteMany({ where: { id: userId } });
|
|
if (clientId) {
|
|
await db.agentAuthorization.deleteMany({ where: { clientId } });
|
|
await db.agentClient.deleteMany({ where: { id: clientId } });
|
|
}
|
|
await db.$disconnect();
|
|
}
|
|
});
|