|
| 1 | +import type { MCPOptions } from 'librechat-data-provider'; |
| 2 | +import type { IUser } from '@librechat/data-schemas'; |
| 3 | +import type { ParsedServerConfig } from './types'; |
| 4 | +import { buildMCPDomainValidationConfig } from './domainValidation'; |
| 5 | +import { OpenIDReauthRequiredError } from '~/utils/oidc'; |
| 6 | +import { isMCPDomainAllowed } from '~/auth/domain'; |
| 7 | +import { processMCPEnv } from '~/utils/env'; |
| 8 | + |
| 9 | +/** What `openIdJwtStrategy` attaches from `req.session.openidTokens` without refreshing it. */ |
| 10 | +const staleOpenIDUser = (): Partial<IUser> => |
| 11 | + ({ |
| 12 | + id: 'user-1', |
| 13 | + provider: 'openid', |
| 14 | + openidId: 'oidc-sub-1', |
| 15 | + federatedTokens: { |
| 16 | + access_token: 'stale-access-token', |
| 17 | + expires_at: Math.floor(Date.now() / 1000) - 3600, |
| 18 | + }, |
| 19 | + }) as Partial<IUser>; |
| 20 | + |
| 21 | +/** `MCPOptions` is a union by transport, so a test reads these two through the union. */ |
| 22 | +const urlOf = (options: MCPOptions | ParsedServerConfig): string | undefined => |
| 23 | + (options as { url?: string }).url; |
| 24 | +const headersOf = (options: ParsedServerConfig): Record<string, string> | undefined => |
| 25 | + (options as { headers?: Record<string, string> }).headers; |
| 26 | + |
| 27 | +const yamlServer = (overrides: Record<string, unknown> = {}): ParsedServerConfig => |
| 28 | + ({ |
| 29 | + type: 'streamable-http', |
| 30 | + url: 'https://mcp.example.com/mcp', |
| 31 | + source: 'yaml', |
| 32 | + requiresOAuth: false, |
| 33 | + ...overrides, |
| 34 | + }) as ParsedServerConfig; |
| 35 | + |
| 36 | +describe('buildMCPDomainValidationConfig', () => { |
| 37 | + it('lets a stale OpenID snapshot resolve a URL that an Authorization placeholder blocked', async () => { |
| 38 | + const config = yamlServer({ headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_TOKEN}}' } }); |
| 39 | + const user = staleOpenIDUser(); |
| 40 | + |
| 41 | + /** The trap: a header no domain decision reads fails the whole resolution. */ |
| 42 | + expect(() => processMCPEnv({ user, options: config })).toThrow(OpenIDReauthRequiredError); |
| 43 | + |
| 44 | + const resolved = processMCPEnv({ user, options: buildMCPDomainValidationConfig(config) }); |
| 45 | + expect(urlOf(resolved)).toBe('https://mcp.example.com/mcp'); |
| 46 | + expect('headers' in resolved).toBe(false); |
| 47 | + await expect(isMCPDomainAllowed(resolved, ['mcp.example.com'])).resolves.toBe(true); |
| 48 | + }); |
| 49 | + |
| 50 | + it.each([ |
| 51 | + ['headers', { headers: { 'X-Auth-Token': '{{LIBRECHAT_OPENID_ACCESS_TOKEN}}' } }], |
| 52 | + ['oauth_headers', { oauth_headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_TOKEN}}' } }], |
| 53 | + ['env', { env: { UPSTREAM_TOKEN: '{{LIBRECHAT_OPENID_ACCESS_TOKEN}}' } }], |
| 54 | + ['args', { args: ['--token={{LIBRECHAT_OPENID_ACCESS_TOKEN}}'] }], |
| 55 | + ['oauth', { oauth: { client_secret: '{{LIBRECHAT_OPENID_ACCESS_TOKEN}}' } }], |
| 56 | + [ |
| 57 | + 'apiKey', |
| 58 | + { |
| 59 | + apiKey: { |
| 60 | + source: 'admin', |
| 61 | + key: '{{LIBRECHAT_OPENID_ACCESS_TOKEN}}', |
| 62 | + authorization_type: 'bearer', |
| 63 | + }, |
| 64 | + }, |
| 65 | + ], |
| 66 | + ])( |
| 67 | + 'drops a credential placeholder carried by %s, not only by Authorization', |
| 68 | + (_field, overrides) => { |
| 69 | + const config = yamlServer(overrides); |
| 70 | + const user = staleOpenIDUser(); |
| 71 | + |
| 72 | + expect(() => processMCPEnv({ user, options: config })).toThrow(OpenIDReauthRequiredError); |
| 73 | + expect(urlOf(processMCPEnv({ user, options: buildMCPDomainValidationConfig(config) }))).toBe( |
| 74 | + 'https://mcp.example.com/mcp', |
| 75 | + ); |
| 76 | + }, |
| 77 | + ); |
| 78 | + |
| 79 | + it('keeps failing closed when the URL itself carries a credential placeholder', () => { |
| 80 | + const config = yamlServer({ |
| 81 | + url: 'https://mcp.example.com/mcp/{{LIBRECHAT_OPENID_ACCESS_TOKEN}}', |
| 82 | + headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_TOKEN}}' }, |
| 83 | + }); |
| 84 | + |
| 85 | + expect(() => |
| 86 | + processMCPEnv({ |
| 87 | + user: staleOpenIDUser(), |
| 88 | + options: buildMCPDomainValidationConfig(config), |
| 89 | + }), |
| 90 | + ).toThrow(OpenIDReauthRequiredError); |
| 91 | + }); |
| 92 | + |
| 93 | + it('preserves every field resolution and the domain decision depend on, and mutates nothing', () => { |
| 94 | + const headers = { Authorization: 'Bearer {{LIBRECHAT_OPENID_TOKEN}}' }; |
| 95 | + const config = yamlServer({ headers, dbId: 'server-1', source: 'user', consumeOnly: true }); |
| 96 | + |
| 97 | + expect(buildMCPDomainValidationConfig(config)).toEqual({ |
| 98 | + type: 'streamable-http', |
| 99 | + url: 'https://mcp.example.com/mcp', |
| 100 | + source: 'user', |
| 101 | + requiresOAuth: false, |
| 102 | + dbId: 'server-1', |
| 103 | + consumeOnly: true, |
| 104 | + }); |
| 105 | + /** The connection path still needs the placeholder it knows how to refresh. */ |
| 106 | + expect(headersOf(config)).toBe(headers); |
| 107 | + }); |
| 108 | + |
| 109 | + it('still resolves the user placeholders a URL depends on', async () => { |
| 110 | + const config = yamlServer({ |
| 111 | + url: 'https://{{LIBRECHAT_USER_ID}}.mcp.example.com/mcp', |
| 112 | + headers: { Authorization: 'Bearer {{LIBRECHAT_OPENID_TOKEN}}' }, |
| 113 | + }); |
| 114 | + |
| 115 | + const resolved = processMCPEnv({ |
| 116 | + user: staleOpenIDUser(), |
| 117 | + options: buildMCPDomainValidationConfig(config), |
| 118 | + }); |
| 119 | + |
| 120 | + expect(urlOf(resolved)).toBe('https://user-1.mcp.example.com/mcp'); |
| 121 | + await expect(isMCPDomainAllowed(resolved, ['*.mcp.example.com'])).resolves.toBe(true); |
| 122 | + await expect(isMCPDomainAllowed(resolved, ['other.example.com'])).resolves.toBe(false); |
| 123 | + }); |
| 124 | +}); |
0 commit comments