- Default oauthEnabled to WPMedia\MCP\OAuth\Context::is_enabled() instead of duplicating its filter logic, so the deprecated rocket_mcp_oauth_server_enabled filter and the typed wpmedia_mcp_oauth_server_enabled filter are honored exactly as mcp-oauth itself defines them. - register() now disables mcp-adapter's default server (mcp_adapter_create_default_server => false) so no second, unauthenticated MCP endpoint (plain HttpTransport, is_user_logged_in()) is exposed alongside our OAuth-protected one; mcp-oauth's own ServerRegistrar registers the shared meta-abilities itself once the default server is disabled. - Pass WPMedia\MCP\OAuth\Context::observability_handler() instead of null so mcp-oauth's own observability filter keeps working for our server too. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
150 lines
5.4 KiB
PHP
150 lines
5.4 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace LIT\MCP\Tests\Unit\Server;
|
||
|
||
use Brain\Monkey\Filters;
|
||
use Brain\Monkey\Functions;
|
||
use LIT\MCP\Abilities\Ability;
|
||
use LIT\MCP\Guides\InstructionsBuilder;
|
||
use LIT\MCP\Integrations\Integration;
|
||
use LIT\MCP\Integrations\IntegrationRegistry;
|
||
use LIT\MCP\Server\ServerRegistrar;
|
||
use LIT\MCP\Tests\Unit\TestCase;
|
||
use Mockery;
|
||
use WPMedia\MCP\OAuth\Transport\ServerRegistrar as OAuthServerRegistrar;
|
||
|
||
final class ServerRegistrarTest extends TestCase
|
||
{
|
||
protected function tearDown(): void
|
||
{
|
||
unset($GLOBALS['wp_filter']);
|
||
parent::tearDown();
|
||
}
|
||
|
||
private function registry(): IntegrationRegistry
|
||
{
|
||
$direct = Mockery::mock(Ability::class);
|
||
$direct->allows('name')->andReturn('lit/guide');
|
||
$direct->allows('isDirect')->andReturn(true);
|
||
$indirect = Mockery::mock(Ability::class);
|
||
$indirect->allows('name')->andReturn('lit/rare-tool');
|
||
$indirect->allows('isDirect')->andReturn(false);
|
||
|
||
$core = Mockery::mock(Integration::class);
|
||
$core->allows('id')->andReturn('core');
|
||
$core->allows('isAvailable')->andReturn(true);
|
||
$core->allows('abilities')->andReturn([$direct, $indirect]);
|
||
|
||
return new IntegrationRegistry($core);
|
||
}
|
||
|
||
private function instructions(): InstructionsBuilder
|
||
{
|
||
// InstructionsBuilder is final (not mockable) and pure – use the real one.
|
||
return new InstructionsBuilder($this->registry());
|
||
}
|
||
|
||
public function testServerUsesOauthRouteDirectToolsPlusMetaToolsAndInstructions(): void
|
||
{
|
||
$args = (new ServerRegistrar($this->registry(), $this->instructions(), static fn () => true))->serverArguments();
|
||
|
||
self::assertSame('mcp-oauth-server', $args['id']);
|
||
self::assertSame('mcp', $args['namespace']);
|
||
self::assertSame('mcp-oauth-server', $args['route']);
|
||
self::assertStringContainsString('Aktive Integrationen: core', $args['description']);
|
||
self::assertSame(
|
||
['lit/guide', 'mcp-adapter/discover-abilities', 'mcp-adapter/get-ability-info', 'mcp-adapter/execute-ability'],
|
||
$args['tools']
|
||
);
|
||
self::assertNotContains('lit/rare-tool', $args['tools']);
|
||
}
|
||
|
||
public function testNoServerWhenOauthIsDisabled(): void
|
||
{
|
||
$registrar = new ServerRegistrar($this->registry(), $this->instructions(), static fn () => false);
|
||
|
||
self::assertNull($registrar->serverArguments());
|
||
}
|
||
|
||
public function testCreateServerOutsideAdapterInitDoesNothing(): void
|
||
{
|
||
Functions\when('doing_action')->justReturn(false);
|
||
$oauthChecked = false;
|
||
$registrar = new ServerRegistrar(
|
||
$this->registry(),
|
||
$this->instructions(),
|
||
static function () use (&$oauthChecked): bool {
|
||
$oauthChecked = true;
|
||
return true;
|
||
}
|
||
);
|
||
|
||
$registrar->createServer();
|
||
|
||
self::assertFalse($oauthChecked, 'createServer must bail out before touching the adapter');
|
||
}
|
||
|
||
public function testRegisterDisablesAdapterDefaultServerAndHooksCreateServer(): void
|
||
{
|
||
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
|
||
|
||
Functions\expect('add_filter')
|
||
->once()
|
||
->with('mcp_adapter_create_default_server', '__return_false');
|
||
Functions\expect('add_action')
|
||
->once()
|
||
->with('mcp_adapter_init', [$registrar, 'createServer'], 5);
|
||
|
||
$registrar->register();
|
||
}
|
||
|
||
public function testDefaultOauthEnabledDelegatesToMcpOauthContext(): void
|
||
{
|
||
// LIT\MCP\Server\ServerRegistrar::__construct() defaults to
|
||
// (new \WPMedia\MCP\OAuth\Context())->is_enabled() – exercise that real
|
||
// Context, only stubbing the filter it reads, to prove we track its notion
|
||
// of "enabled" (including the deprecated rocket_mcp_oauth_server_enabled
|
||
// filter Context::is_enabled() also seeds from) instead of duplicating it.
|
||
Filters\expectApplied('wpmedia_mcp_oauth_server_enabled')->once()->andReturn(false);
|
||
|
||
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
|
||
|
||
self::assertNull($registrar->serverArguments());
|
||
}
|
||
|
||
public function testUnhookOAuthDefaultServerRemovesOnlyTheMcpOauthCallback(): void
|
||
{
|
||
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
|
||
$oauthCallback = [$oauthRegistrar, 'register_server'];
|
||
$unrelatedCallback = static function (): void {
|
||
};
|
||
|
||
$hook = new class {
|
||
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
|
||
public array $callbacks = [];
|
||
};
|
||
$hook->callbacks = [
|
||
5 => ['unrelated-id' => ['function' => $unrelatedCallback, 'accepted_args' => 0]],
|
||
10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]],
|
||
];
|
||
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
|
||
|
||
Functions\expect('remove_action')
|
||
->once()
|
||
->with('mcp_adapter_init', $oauthCallback, 10);
|
||
|
||
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
|
||
}
|
||
|
||
public function testUnhookOAuthDefaultServerIsNoOpWhenHookIsMissing(): void
|
||
{
|
||
unset($GLOBALS['wp_filter']['mcp_adapter_init']);
|
||
|
||
Functions\expect('remove_action')->never();
|
||
|
||
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
|
||
}
|
||
}
|