feat: harden Claude MCP OAuth transport

2026-06-13 21:05:11 +02:00
parent ed3130ef74
commit 541124e92a
11 changed files with 1377 additions and 68 deletions
@@ -29,6 +29,7 @@ def oauth_env(monkeypatch: pytest.MonkeyPatch) -> None:
    monkeypatch.setenv("OAUTH_MODE", "true")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_ID", "test-client-id")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_SECRET", "test-client-secret")
+    monkeypatch.setenv("OAUTH_STATE_SECRET", "test-state-secret-0123456789abcdef")
    monkeypatch.setenv("ENVIRONMENT", "test")
    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")
    monkeypatch.setenv("WRITE_MODE", "false")
@@ -84,12 +85,13 @@ def test_health_endpoint(client: TestClient) -> None:


 def test_oauth_protected_resource_metadata(client: TestClient) -> None:
-    """OAuth protected-resource metadata contains required OpenAI-compatible fields."""
+    """PRM advertises THIS server's canonical URL as the protected resource."""
    response = client.get("/.well-known/oauth-protected-resource")

    assert response.status_code == 200
    data = response.json()
-    assert data["resource"] == "https://gitea.example.com"
+    # RFC 9728/8707: the resource identifier is the MCP server's own URL, not Gitea's.
+    assert data["resource"] == "http://testserver"
    assert data["authorization_servers"] == [
        "http://testserver",
        "https://gitea.example.com",
@@ -100,12 +102,15 @@ def test_oauth_protected_resource_metadata(client: TestClient) -> None:


 def test_oauth_authorization_server_metadata(client: TestClient) -> None:
-    """Auth server metadata includes expected OAuth endpoints and scopes."""
+    """Auth server metadata advertises this server's proxy OAuth endpoints."""
    response = client.get("/.well-known/oauth-authorization-server")
    assert response.status_code == 200
    payload = response.json()
-    assert payload["authorization_endpoint"].endswith("/login/oauth/authorize")
-    assert payload["token_endpoint"].endswith("/oauth/token")
+    # Claude must be sent to our proxy authorize endpoint (Gitea does not know
+    # Claude's redirect_uri), so the endpoint lives on this server.
+    assert payload["authorization_endpoint"] == "http://testserver/oauth/authorize"
+    assert payload["token_endpoint"] == "http://testserver/oauth/token"
+    assert payload["registration_endpoint"] == "http://testserver/register"
    assert payload["scopes_supported"] == ["read:repository", "write:repository"]


@@ -115,8 +120,8 @@ def test_openid_configuration_metadata(client: TestClient) -> None:
    assert response.status_code == 200
    payload = response.json()
    assert payload["issuer"] == "https://gitea.example.com"
-    assert payload["authorization_endpoint"].endswith("/login/oauth/authorize")
-    assert payload["token_endpoint"].endswith("/oauth/token")
+    assert payload["authorization_endpoint"] == "http://testserver/oauth/authorize"
+    assert payload["token_endpoint"] == "http://testserver/oauth/token"
    assert payload["userinfo_endpoint"].endswith("/login/oauth/userinfo")
    assert payload["jwks_uri"].endswith("/login/oauth/keys")
    assert "read:repository" in payload["scopes_supported"]
@@ -129,6 +134,7 @@ def test_oauth_metadata_uses_public_base_url(monkeypatch: pytest.MonkeyPatch) ->
    monkeypatch.setenv("OAUTH_MODE", "true")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_ID", "test-client-id")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_SECRET", "test-client-secret")
+    monkeypatch.setenv("OAUTH_STATE_SECRET", "test-state-secret-0123456789abcdef")
    monkeypatch.setenv("PUBLIC_BASE_URL", "https://mcp.example.com")
    monkeypatch.setenv("ENVIRONMENT", "test")
    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "false")
@@ -149,6 +155,8 @@ def test_oauth_metadata_uses_public_base_url(monkeypatch: pytest.MonkeyPatch) ->
    protected_response = client.get("/.well-known/oauth-protected-resource")
    assert protected_response.status_code == 200
    protected_payload = protected_response.json()
+    # P4: the protected resource identifier must equal this server's public base.
+    assert protected_payload["resource"] == "https://mcp.example.com"
    assert protected_payload["authorization_servers"] == [
        "https://mcp.example.com",
        "https://gitea.example.com",
@@ -166,6 +174,201 @@ def test_oauth_metadata_uses_public_base_url(monkeypatch: pytest.MonkeyPatch) ->
    )


+def test_mcp_streamable_http_path_works(client: TestClient) -> None:
+    """The spec path /mcp exposes the same transport behavior as the SSE alias."""
+    response = client.post(
+        "/mcp",
+        headers={"Authorization": "Bearer valid-read"},
+        json={"jsonrpc": "2.0", "id": "init-1", "method": "initialize"},
+    )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["result"]["protocolVersion"] == "2024-11-05"
+
+
+def test_mcp_preflight_allows_same_origin(client: TestClient) -> None:
+    """Same-origin preflight requests to /mcp return strict CORS headers."""
+    response = client.options(
+        "/mcp",
+        headers={
+            "Origin": "http://testserver",
+            "Access-Control-Request-Method": "POST",
+            "Access-Control-Request-Headers": "authorization,content-type",
+        },
+    )
+
+    assert response.status_code == 204
+    assert response.headers["Access-Control-Allow-Origin"] == "http://testserver"
+
+
+def test_mcp_preflight_rejects_cross_origin(client: TestClient) -> None:
+    """Cross-origin browser requests to /mcp are denied."""
+    response = client.options(
+        "/mcp",
+        headers={
+            "Origin": "https://evil.example.com",
+            "Access-Control-Request-Method": "POST",
+        },
+    )
+
+    assert response.status_code == 403
+
+
+def test_service_pat_requests_verify_user_repo_access_before_execution(
+    oauth_env: None, mock_oauth_validation: None, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Service PAT fallback checks the user's repository permission before executing tools."""
+    from aegis_gitea_mcp import server
+
+    monkeypatch.setenv("GITEA_TOKEN", "service-pat-token")
+    server._api_scope_cache.clear()
+    server.reset_repo_authz_cache()
+
+    probe_response = MagicMock()
+    probe_response.status_code = 200
+
+    repo_response = MagicMock()
+    repo_response.status_code = 403
+
+    with patch("aegis_gitea_mcp.server.httpx.AsyncClient") as mock_client_cls:
+        mock_client = AsyncMock()
+        mock_client.get = AsyncMock(side_effect=[probe_response, repo_response])
+        mock_client_cls.return_value.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+
+        from aegis_gitea_mcp.server import app
+
+        client = TestClient(app, raise_server_exceptions=False)
+        response = client.post(
+            "/mcp/tool/call",
+            headers={"Authorization": "Bearer valid-read"},
+            json={
+                "tool": "get_repository_info",
+                "arguments": {"owner": "acme", "repo": "demo"},
+            },
+        )
+
+    assert response.status_code == 403
+    assert "permission" in response.json()["detail"].lower()
+
+
+@pytest.mark.asyncio
+async def test_service_pat_repo_authz_allows_user_with_read_permission(
+    oauth_env: None, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Read-level collaborator permission allows service PAT execution to proceed."""
+    from aegis_gitea_mcp import server
+
+    monkeypatch.setenv("GITEA_TOKEN", "service-pat-token")
+    server.reset_repo_authz_cache()
+
+    permission_response = MagicMock()
+    permission_response.status_code = 200
+    permission_response.json.return_value = {"permission": "read"}
+
+    with patch("aegis_gitea_mcp.server.httpx.AsyncClient") as mock_client_cls:
+        mock_client = AsyncMock()
+        mock_client.get = AsyncMock(return_value=permission_response)
+        mock_client_cls.return_value.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+
+        await server._verify_user_repository_access(
+            repository="acme/demo",
+            required_scope=server.READ_SCOPE,
+            user_login="alice",
+            correlation_id="corr-1",
+            tool_name="get_repository_info",
+        )
+
+    mock_client.get.assert_awaited_once()
+    requested_url = mock_client.get.await_args.args[0]
+    requested_headers = mock_client.get.await_args.kwargs["headers"]
+    assert requested_url.endswith("/api/v1/repos/acme/demo/collaborators/alice/permission")
+    assert requested_headers["Authorization"] == "token service-pat-token"
+
+
+@pytest.mark.asyncio
+async def test_service_pat_repo_authz_denies_read_user_for_write_tool(
+    oauth_env: None, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Read permission is insufficient for write tools in service PAT mode."""
+    from fastapi import HTTPException
+
+    from aegis_gitea_mcp import server
+
+    monkeypatch.setenv("GITEA_TOKEN", "service-pat-token")
+    server.reset_repo_authz_cache()
+
+    permission_response = MagicMock()
+    permission_response.status_code = 200
+    permission_response.json.return_value = {"permission": "read"}
+
+    with patch("aegis_gitea_mcp.server.httpx.AsyncClient") as mock_client_cls:
+        mock_client = AsyncMock()
+        mock_client.get = AsyncMock(return_value=permission_response)
+        mock_client_cls.return_value.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+
+        with pytest.raises(HTTPException) as exc_info:
+            await server._verify_user_repository_access(
+                repository="acme/demo",
+                required_scope=server.WRITE_SCOPE,
+                user_login="alice",
+                correlation_id="corr-1",
+                tool_name="create_issue",
+            )
+
+    assert exc_info.value.status_code == 403
+
+
+@pytest.mark.asyncio
+async def test_service_pat_repo_authz_cache_hit_and_expiry(
+    oauth_env: None, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    """Repository permission decisions are cached briefly and rechecked after expiry."""
+    from aegis_gitea_mcp import cache as cache_module
+    from aegis_gitea_mcp import server
+
+    monkeypatch.setenv("GITEA_TOKEN", "service-pat-token")
+    monkeypatch.setenv("REPO_AUTHZ_CACHE_TTL_SECONDS", "1")
+    server.reset_repo_authz_cache()
+
+    now = 1000.0
+    monkeypatch.setattr(cache_module.time, "monotonic", lambda: now)
+
+    permission_response = MagicMock()
+    permission_response.status_code = 200
+    permission_response.json.return_value = {"permission": "read"}
+
+    with patch("aegis_gitea_mcp.server.httpx.AsyncClient") as mock_client_cls:
+        mock_client = AsyncMock()
+        mock_client.get = AsyncMock(return_value=permission_response)
+        mock_client_cls.return_value.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_client_cls.return_value.__aexit__ = AsyncMock(return_value=False)
+
+        for _ in range(2):
+            await server._verify_user_repository_access(
+                repository="acme/demo",
+                required_scope=server.READ_SCOPE,
+                user_login="alice",
+                correlation_id="corr-1",
+                tool_name="get_repository_info",
+            )
+        assert mock_client.get.await_count == 1
+
+        now = 1002.0
+        await server._verify_user_repository_access(
+            repository="acme/demo",
+            required_scope=server.READ_SCOPE,
+            user_login="alice",
+            correlation_id="corr-1",
+            tool_name="get_repository_info",
+        )
+
+    assert mock_client.get.await_count == 2
+
+
 def test_scope_compatibility_write_implies_read() -> None:
    """write:repository grants read-level access for read tools."""
    from aegis_gitea_mcp.server import READ_SCOPE, _has_required_scope
@@ -348,6 +551,7 @@ async def test_startup_event_fails_when_discovery_unreachable(
    monkeypatch.setenv("OAUTH_MODE", "true")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_ID", "test-client-id")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_SECRET", "test-client-secret")
+    monkeypatch.setenv("OAUTH_STATE_SECRET", "test-state-secret-0123456789abcdef")
    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "true")

    from aegis_gitea_mcp import server
@@ -377,6 +581,7 @@ async def test_startup_event_succeeds_when_discovery_ready(
    monkeypatch.setenv("OAUTH_MODE", "true")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_ID", "test-client-id")
    monkeypatch.setenv("GITEA_OAUTH_CLIENT_SECRET", "test-client-secret")
+    monkeypatch.setenv("OAUTH_STATE_SECRET", "test-state-secret-0123456789abcdef")
    monkeypatch.setenv("STARTUP_VALIDATE_GITEA", "true")

    from aegis_gitea_mcp import server