History

Reject MCP no-auth credential input

Rhys Sullivan committed 2 months ago

Commit e8441ae1 parent 70c59071 file · +57 −0Browse files

Unified · Split

packages/plugins/mcp/src/sdk/plugin.test.ts+57−0
@@ -1649,6 +1649,63 @@ describe("stdio static env", () => { · 1648 unmodified lines
1649 ),1649 ),
1650 );1650 );
1651 1651
1652 it.effect(
1653 "rejects credential input for legacy no-auth stdio and accepts an empty input map",
1654 () =>
1655 Effect.scoped(
1656 Effect.gen(function* () {
1657 const config = makeTestConfig({
1658 plugins: [
1659 memoryCredentialsPlugin(),
1660 mcpPlugin({ dangerouslyAllowStdioMCP: true }),
1661 ] as const,
1662 });
1663 const executor = yield* Effect.acquireRelease(createExecutor(config), (executor) =>
1664 executor
1665 .close()
1666 .pipe(Effect.orDie, Effect.ensuring(Effect.promise(() => config.testDb.close()))),
1667 );
1668 const integration = IntegrationSlug.make("legacy-stdio-no-auth-create");
1669
1670 yield* executor.mcp.addServer({
1671 name: "Legacy stdio no-auth create",
1672 endpoint: "http://127.0.0.1:1/mcp",
1673 slug: String(integration),
1674 });
1675 yield* executor.mcp.configureServer(String(integration), {
1676 transport: "stdio",
1677 command: "bun",
1678 args: ["run", stdioNegotiationFixture],
1679 });
1680
1681 const error = yield* executor.connections
1682 .create({
1683 owner: "org",
1684 name: ConnectionName.make("with-secret"),
1685 integration,
1686 template: AuthTemplateSlug.make("none"),
1687 value: "must-not-be-stored",
1688 })
1689 .pipe(Effect.flip);
1690 expect(error).toMatchObject({
1691 _tag: "InvalidConnectionInputError",
1692 message: "A no-auth connection cannot accept credential inputs.",
1693 });
1694 expect(yield* executor.connections.list({ integration })).toEqual([]);
1695
1696 const connection = yield* executor.connections.create({
1697 owner: "org",
1698 name: ConnectionName.make("public"),
1699 integration,
1700 template: AuthTemplateSlug.make("none"),
1701 values: {},
1702 });
1703 expect(String(connection.address)).toBe("tools.legacy-stdio-no-auth-create.org.public");
1704 expect(yield* executor.connections.list({ integration })).toHaveLength(1);
1705 }),
1706 ),
1707 );
1708
1652 it.effect("reconciles a legacy no-secret stdio integration with its default connection", () =>1709 it.effect("reconciles a legacy no-secret stdio integration with its default connection", () =>
1653 Effect.scoped(1710 Effect.scoped(
1654 Effect.gen(function* () {1711 Effect.gen(function* () {