feat: initial public release

test/oauth.test.ts

@@ -0,0 +1,210 @@
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+import type { AppConfig } from "../src/config.js";
+import { DingTalkMcpOAuthProvider } from "../src/oauth.js";
+
+function config(databasePath: string): AppConfig {
+  return {
+    clientId: "ding-app-key", clientSecret: "ding-app-secret", corpId: "ding-corp",
+    apiBaseUrl: "https://api.example.test", oapiBaseUrl: "https://oapi.example.test",
+    publicBaseUrl: "https://approval.example.test", bindHost: "127.0.0.1", port: 3000,
+    requestTimeoutMs: 1000, officialLookbackDays: 120, officialScanConcurrency: 2,
+    officialClientOnlyProcessCodes: [], batchLimit: 20, approvalRefSecret: "ref-secret",
+    remoteAuth: {
+      issuerUrl: "https://approval.example.test", databasePath, sessionSecret: "session-secret",
+      accessTokenTtlSeconds: 900, refreshTokenTtlSeconds: 3600,
+    },
+  };
+}
+
+function jsonResponse(value: unknown, status = 200): Response {
+  return new Response(JSON.stringify(value), { status, headers: { "content-type": "application/json" } });
+}
+
+test("OAuth provider performs DCR, DingTalk login, PKCE exchange and refresh rotation", async () => {
+  const root = mkdtempSync(join(tmpdir(), "ding-oauth-"));
+  const database = join(root, "auth.sqlite");
+  const requests: Array<{ url: string; body?: Record<string, unknown> }> = [];
+  const fetchFn: typeof fetch = async (input, init) => {
+    const url = String(input);
+    const body = typeof init?.body === "string" ? JSON.parse(init.body) as Record<string, unknown> : undefined;
+    requests.push({ url, body });
+    if (url.endsWith("/v1.0/oauth2/userAccessToken") && body?.grantType === "authorization_code") {
+      return jsonResponse({ accessToken: "ding-user-access", refreshToken: "ding-user-refresh", expireIn: 7200, corpId: "ding-corp" });
+    }
+    if (url.endsWith("/v1.0/contact/users/me")) {
+      return jsonResponse({ userId: "user-1", nick: "测试用户", corpId: "ding-corp" });
+    }
+    throw new Error(`unexpected request ${url}`);
+  };
+  const provider = new DingTalkMcpOAuthProvider(config(database), fetchFn);
+  try {
+    const client = await provider.clientsStore.registerClient!({
+      redirect_uris: ["http://127.0.0.1:49152/callback"], token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"], response_types: ["code"],
+      client_name: "test-agent",
+    });
+    let upstream = "";
+    await provider.authorize(client, {
+      redirectUri: "http://127.0.0.1:55001/callback", codeChallenge: "pkce-challenge",
+      scopes: ["mcp:tools"], state: "agent-state", resource: new URL("https://approval.example.test/mcp"),
+    }, { redirect: (_status: number, value: string) => { upstream = value; } } as never);
+    const loginState = new URL(upstream).searchParams.get("login_state");
+    assert.ok(loginState);
+    assert.deepEqual(provider.consentDetails(loginState!), {
+      clientName: "test-agent",
+      scopes: ["mcp:tools"],
+      redirectOrigin: "http://127.0.0.1:55001",
+    });
+    upstream = provider.approveConsent(loginState!);
+    assert.equal(new URL(upstream).searchParams.get("state"), loginState);
+    const callback = await provider.completeDingTalkLogin("ding-code", loginState!);
+    const returned = new URL(callback);
+    const authorizationCode = returned.searchParams.get("code");
+    assert.ok(authorizationCode);
+    assert.equal(returned.searchParams.get("state"), "agent-state");
+    assert.equal(await provider.challengeForAuthorizationCode(client, authorizationCode!), "pkce-challenge");
+
+    const tokens = await provider.exchangeAuthorizationCode(
+      client, authorizationCode!, "verifier", returned.origin + returned.pathname,
+      new URL("https://approval.example.test/mcp"),
+    );
+    const auth = await provider.verifyAccessToken(tokens.access_token);
+    assert.equal(auth.extra?.userId, "user-1");
+    assert.equal(await provider.getDingTalkUserAccessToken("user-1"), "ding-user-access");
+    await assert.rejects(provider.exchangeAuthorizationCode(client, authorizationCode!), /无效/);
+
+    const rotated = await provider.exchangeRefreshToken(client, tokens.refresh_token!);
+    await assert.rejects(provider.exchangeRefreshToken(client, tokens.refresh_token!), /无效/);
+    assert.equal((await provider.verifyAccessToken(rotated.access_token)).extra?.userId, "user-1");
+    await provider.revokeToken(client, { token: rotated.access_token });
+    await assert.rejects(provider.verifyAccessToken(rotated.access_token), /无效/);
+
+    const file = readFileSync(database);
+    assert.equal(file.includes(Buffer.from(tokens.access_token)), false);
+    assert.equal(file.includes(Buffer.from(tokens.refresh_token!)), false);
+    assert.equal(requests[0]!.body?.clientSecret, "ding-app-secret");
+  } finally { provider.close(); }
+});
+
+test("OAuth provider requires explicit client consent before DingTalk callback completion", async () => {
+  const database = join(mkdtempSync(join(tmpdir(), "ding-oauth-consent-")), "auth.sqlite");
+  let upstreamCalls = 0;
+  const provider = new DingTalkMcpOAuthProvider(config(database), async () => {
+    upstreamCalls += 1;
+    throw new Error("consent bypass must not reach DingTalk");
+  });
+  try {
+    const client = await provider.clientsStore.registerClient!({
+      redirect_uris: ["https://agent.example/callback"], token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code"], response_types: ["code"], client_name: "untrusted-test-client",
+    });
+    let consentUrl = "";
+    await provider.authorize(client, {
+      redirectUri: "https://agent.example/callback", codeChallenge: "challenge", scopes: ["mcp:tools"],
+    }, { redirect: (_status: number, value: string) => { consentUrl = value; } } as never);
+    const loginState = new URL(consentUrl).searchParams.get("login_state");
+    assert.ok(loginState);
+    await assert.rejects(provider.completeDingTalkLogin("code", loginState!), /尚未确认/);
+    assert.equal(upstreamCalls, 0);
+  } finally { provider.close(); }
+});
+
+test("OAuth provider refreshes a DingTalk identity once for concurrent callers", async () => {
+  const database = join(mkdtempSync(join(tmpdir(), "ding-oauth-refresh-")), "auth.sqlite");
+  let refreshCalls = 0;
+  const provider = new DingTalkMcpOAuthProvider(config(database), async (input, init) => {
+    const url = String(input);
+    const body = typeof init?.body === "string" ? JSON.parse(init.body) as Record<string, unknown> : {};
+    if (url.endsWith("/v1.0/oauth2/userAccessToken") && body.grantType === "authorization_code") {
+      return jsonResponse({ accessToken: "initial-access", refreshToken: "refresh-1", expireIn: 1, corpId: "ding-corp" });
+    }
+    if (url.endsWith("/v1.0/oauth2/userAccessToken") && body.grantType === "refresh_token") {
+      refreshCalls += 1;
+      await new Promise<void>((resolve) => setTimeout(resolve, 20));
+      return jsonResponse({ accessToken: "fresh-access", refreshToken: "refresh-2", expireIn: 7200, corpId: "ding-corp" });
+    }
+    if (url.endsWith("/v1.0/contact/users/me")) return jsonResponse({ userId: "user-1", nick: "测试用户", corpId: "ding-corp" });
+    throw new Error(`unexpected request ${url}`);
+  });
+  try {
+    const client = await provider.clientsStore.registerClient!({
+      redirect_uris: ["https://agent.example/callback"], token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], client_name: "agent",
+    });
+    let consentUrl = "";
+    await provider.authorize(client, {
+      redirectUri: "https://agent.example/callback", codeChallenge: "challenge", scopes: ["mcp:tools"],
+    }, { redirect: (_status: number, value: string) => { consentUrl = value; } } as never);
+    const loginState = new URL(consentUrl).searchParams.get("login_state")!;
+    provider.approveConsent(loginState);
+    await provider.completeDingTalkLogin("code", loginState);
+    const tokens = await Promise.all([
+      provider.getDingTalkUserAccessToken("user-1"),
+      provider.getDingTalkUserAccessToken("user-1"),
+      provider.getDingTalkUserAccessToken("user-1"),
+    ]);
+    assert.deepEqual(tokens, ["fresh-access", "fresh-access", "fresh-access"]);
+    assert.equal(refreshCalls, 1);
+  } finally { provider.close(); }
+});
+
+test("OAuth provider rejects unsafe redirects and users from another corp", async () => {
+  const database = join(mkdtempSync(join(tmpdir(), "ding-oauth-corp-")), "auth.sqlite");
+  const fetchFn: typeof fetch = async (input) => String(input).endsWith("/userAccessToken")
+    ? jsonResponse({ accessToken: "foreign-token", refreshToken: "refresh", expireIn: 7200, corpId: "other-corp" })
+    : jsonResponse({});
+  const provider = new DingTalkMcpOAuthProvider(config(database), fetchFn);
+  try {
+    await assert.rejects(async () => provider.clientsStore.registerClient!({
+      redirect_uris: ["http://attacker.example/callback"],
+      token_endpoint_auth_method: "none", grant_types: ["authorization_code"], response_types: ["code"],
+    }), /HTTPS/);
+    const client = await provider.clientsStore.registerClient!({
+      redirect_uris: ["https://agent.example/callback"],
+      token_endpoint_auth_method: "none", grant_types: ["authorization_code"], response_types: ["code"],
+    });
+    let upstream = "";
+    await provider.authorize(client, {
+      redirectUri: "https://agent.example/callback", codeChallenge: "challenge", scopes: ["mcp:tools"],
+    }, { redirect: (_status: number, value: string) => { upstream = value; } } as never);
+    const loginState = new URL(upstream).searchParams.get("login_state");
+    assert.ok(loginState);
+    provider.approveConsent(loginState!);
+    await assert.rejects(
+      provider.completeDingTalkLogin("code", loginState!),
+      /不属于允许的企业/,
+    );
+  } finally { provider.close(); }
+});
+
+test("device compatibility flow returns a link, polls, and issues a user-bound token", async () => {
+  const database = join(mkdtempSync(join(tmpdir(), "ding-oauth-device-")), "auth.sqlite");
+  const fetchFn: typeof fetch = async (input) => String(input).endsWith("/userAccessToken")
+    ? jsonResponse({ accessToken: "device-user-token", refreshToken: "device-refresh", expireIn: 7200, corpId: "ding-corp" })
+    : jsonResponse({ userId: "device-user", nick: "设备用户", corpId: "ding-corp" });
+  const provider = new DingTalkMcpOAuthProvider(config(database), fetchFn);
+  try {
+    const client = await provider.clientsStore.registerClient!({
+      redirect_uris: ["https://localhost.invalid/device"], token_endpoint_auth_method: "none",
+      grant_types: ["authorization_code", "refresh_token"], response_types: ["code"],
+    });
+    const challenge = provider.startDeviceAuthorization(client.client_id, ["mcp:tools"], "https://approval.example.test/mcp");
+    assert.match(challenge.user_code, /^[A-Z2-9]{4}-[A-Z2-9]{4}$/);
+    assert.equal(provider.exchangeDeviceCode(client.client_id, challenge.device_code), "authorization_pending");
+    const upstream = provider.beginDeviceLogin(challenge.user_code.toLowerCase());
+    const state = new URL(upstream).searchParams.get("login_state");
+    assert.ok(state);
+    provider.approveConsent(state!);
+    assert.equal(await provider.completeDingTalkLogin("device-code", state!), "https://approval.example.test/oauth/device/success");
+    const tokens = provider.exchangeDeviceCode(client.client_id, challenge.device_code);
+    assert.notEqual(typeof tokens, "string");
+    if (typeof tokens !== "string") {
+      assert.equal((await provider.verifyAccessToken(tokens.access_token)).extra?.userId, "device-user");
+    }
+    assert.throws(() => provider.exchangeDeviceCode(client.client_id, challenge.device_code), /无效/);
+  } finally { provider.close(); }
+});