Clean MCP per-user auth test boundaries

Rhys Sullivan committed 6 months ago

Commit 7656b2e1 parent b039b6e1 file · +18 −23Browse files

Unified · Split

packages/plugins/mcp/src/sdk/per-user-auth-isolation.test.ts+18−23

 import * as http from "node:http";
 import { describe, expect, it } from "@effect/vitest";
-import { Cause, Effect, Exit } from "effect";
+import { Cause, Effect, Exit, Predicate } from "effect";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { z } from "zod";
   definePlugin,
   makeInMemoryBlobStore,
   type SecretProvider,
+  type ToolInvocationError,
 } from "@executor-js/sdk";
 import { makeMemoryAdapter } from "@executor-js/storage-core/testing/memory";
   readonly recorded: () => readonly RecordedRequest[];
 };
+const failureError = <E>(exit: Exit.Exit<unknown, E>): E | undefined =>
+  Exit.isFailure(exit) ? exit.cause.reasons.find(Cause.isFailReason)?.error : undefined;
+const isToolInvocationError = (error: unknown): error is ToolInvocationError =>
+  Predicate.isTagged(error, "ToolInvocationError");
 const createAuthRecordingServer: Effect.Effect<TestServer, Error, never> =
   Effect.callback<TestServer, Error>((resume) => {
     const transports = new Map<string, StreamableHTTPServerTransport>();
         // stack [userB, org] can see them via fall-through.
         yield* execUserA.mcp.addSource({
           transport: "remote",
-          scope: ORG as string,
+          scope: ORG,
           name: "Shared MCP",
           endpoint: server.url,
           namespace: "iso_test",
         // Pin the exact error tag so a future regression that swaps
         // the "connection not found" check for a silent `auth: { kind:
         // "none" }` fallback would fail here, not silently connect.
-        if (!Exit.isFailure(userBResult)) return;
         // tools.invoke wraps plugin failures in ToolInvocationError
         // with the original error carried on `cause`. Pin the exact
         // inner tag — a regression that swapped the "no connection
         // found" check for a silent no-auth fallback would either
         // succeed outright (leaking) or surface a different tag here.
-        const failure = userBResult.cause.reasons.find(Cause.isFailReason);
+        const outer = failureError(userBResult);
-        const outer = failure?.error as
+        expect(isToolInvocationError(outer)).toBe(true);
-          | {
+        const inner = isToolInvocationError(outer) ? outer.cause : undefined;
-              _tag?: string;
+        expect(Predicate.isTagged(inner, "McpConnectionError")).toBe(true);
-              cause?: { _tag?: string };
-            }
-          | undefined;
-        expect(outer?._tag).toBe("ToolInvocationError");
-        expect(outer?.cause?._tag).toBe("McpConnectionError");
         // CRITICAL: no outbound MCP request was made on user B's behalf
         // carrying user A's bearer token. Auth resolution must have
         yield* execUserA.mcp.addSource({
           transport: "remote",
-          scope: ORG as string,
+          scope: ORG,
           name: "Shared MCP (header)",
           endpoint: server.url,
           namespace: "iso_header",
         );
         expect(Exit.isFailure(userBResult)).toBe(true);
-        if (!Exit.isFailure(userBResult)) return;
         // tools.invoke wraps plugin failures in ToolInvocationError
         // with the original error carried on `cause`. Pin the exact
         // inner tag — a regression that swapped the "no connection
         // found" check for a silent no-auth fallback would either
         // succeed outright (leaking) or surface a different tag here.
-        const failure = userBResult.cause.reasons.find(Cause.isFailReason);
+        const outer = failureError(userBResult);
-        const outer = failure?.error as
+        expect(isToolInvocationError(outer)).toBe(true);
-          | {
+        const inner = isToolInvocationError(outer) ? outer.cause : undefined;
-              _tag?: string;
+        expect(Predicate.isTagged(inner, "McpConnectionError")).toBe(true);
-              cause?: { _tag?: string };
-            }
-          | undefined;
-        expect(outer?._tag).toBe("ToolInvocationError");
-        expect(outer?.cause?._tag).toBe("McpConnectionError");
         const afterUserB = server.recorded().slice(recordedBeforeUserB);
         for (const req of afterUserB) {