fix: answer /.well-known OAuth discovery without a canonical redirect; smoke checks the real path

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-09-26 16:27:25 +02:00
parent d67cd0ede6
commit bb85868192
4 changed files with 87 additions and 8 deletions
@@ -0,0 +1,46 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LIT\MCP\Tests\Unit\Server;
+
+use Brain\Monkey\Functions;
+use LIT\MCP\Server\DiscoveryCanonical;
+use LIT\MCP\Tests\Unit\TestCase;
+
+final class DiscoveryCanonicalTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        Functions\when('wp_parse_url')->alias('parse_url');
+    }
+
+    /** @return array<string, array{string}> */
+    public static function discoveryUrls(): array
+    {
+        return [
+            'protected resource' => ['https://example.test/.well-known/oauth-protected-resource'],
+            'authorization server' => ['https://example.test/.well-known/oauth-authorization-server'],
+            'subdirectory install' => ['https://example.test/wp/.well-known/oauth-protected-resource'],
+        ];
+    }
+
+    /** @dataProvider discoveryUrls */
+    public function testDiscoveryDocumentsAreNeverRedirected(string $requested): void
+    {
+        self::assertFalse((new DiscoveryCanonical())->filter($requested . '/', $requested));
+    }
+
+    public function testOtherRedirectsStayUntouched(): void
+    {
+        $filter = new DiscoveryCanonical();
+
+        $page = 'https://example.test/seite';
+        $acme = 'https://example.test/.well-known/acme-challenge/x';
+
+        self::assertSame($page . '/', $filter->filter($page . '/', $page));
+        self::assertSame($acme . '/', $filter->filter($acme . '/', $acme));
+        self::assertFalse($filter->filter(false, 'https://example.test/.well-known/oauth-authorization-server'));
+    }
+}