Files
WP-LIT-MCP/tests/Unit/Server/ServerRegistrarTest.php
T
janniclas.loosenandClaude Opus 5.5 f2580a7c64 fix: honor mcp-oauth's enabled/observability filters, disable second unprotected MCP endpoint
- Default oauthEnabled to WPMedia\MCP\OAuth\Context::is_enabled() instead of
  duplicating its filter logic, so the deprecated rocket_mcp_oauth_server_enabled
  filter and the typed wpmedia_mcp_oauth_server_enabled filter are honored
  exactly as mcp-oauth itself defines them.
- register() now disables mcp-adapter's default server
  (mcp_adapter_create_default_server => false) so no second, unauthenticated
  MCP endpoint (plain HttpTransport, is_user_logged_in()) is exposed alongside
  our OAuth-protected one; mcp-oauth's own ServerRegistrar registers the
  shared meta-abilities itself once the default server is disabled.
- Pass WPMedia\MCP\OAuth\Context::observability_handler() instead of null so
  mcp-oauth's own observability filter keeps working for our server too.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01At3V6SjwbMe6eMzVGW3Hs7
2026-09-25 15:56:50 +02:00

150 lines
5.4 KiB
PHP
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<?php
declare(strict_types=1);
namespace LIT\MCP\Tests\Unit\Server;
use Brain\Monkey\Filters;
use Brain\Monkey\Functions;
use LIT\MCP\Abilities\Ability;
use LIT\MCP\Guides\InstructionsBuilder;
use LIT\MCP\Integrations\Integration;
use LIT\MCP\Integrations\IntegrationRegistry;
use LIT\MCP\Server\ServerRegistrar;
use LIT\MCP\Tests\Unit\TestCase;
use Mockery;
use WPMedia\MCP\OAuth\Transport\ServerRegistrar as OAuthServerRegistrar;
final class ServerRegistrarTest extends TestCase
{
protected function tearDown(): void
{
unset($GLOBALS['wp_filter']);
parent::tearDown();
}
private function registry(): IntegrationRegistry
{
$direct = Mockery::mock(Ability::class);
$direct->allows('name')->andReturn('lit/guide');
$direct->allows('isDirect')->andReturn(true);
$indirect = Mockery::mock(Ability::class);
$indirect->allows('name')->andReturn('lit/rare-tool');
$indirect->allows('isDirect')->andReturn(false);
$core = Mockery::mock(Integration::class);
$core->allows('id')->andReturn('core');
$core->allows('isAvailable')->andReturn(true);
$core->allows('abilities')->andReturn([$direct, $indirect]);
return new IntegrationRegistry($core);
}
private function instructions(): InstructionsBuilder
{
// InstructionsBuilder is final (not mockable) and pure – use the real one.
return new InstructionsBuilder($this->registry());
}
public function testServerUsesOauthRouteDirectToolsPlusMetaToolsAndInstructions(): void
{
$args = (new ServerRegistrar($this->registry(), $this->instructions(), static fn () => true))->serverArguments();
self::assertSame('mcp-oauth-server', $args['id']);
self::assertSame('mcp', $args['namespace']);
self::assertSame('mcp-oauth-server', $args['route']);
self::assertStringContainsString('Aktive Integrationen: core', $args['description']);
self::assertSame(
['lit/guide', 'mcp-adapter/discover-abilities', 'mcp-adapter/get-ability-info', 'mcp-adapter/execute-ability'],
$args['tools']
);
self::assertNotContains('lit/rare-tool', $args['tools']);
}
public function testNoServerWhenOauthIsDisabled(): void
{
$registrar = new ServerRegistrar($this->registry(), $this->instructions(), static fn () => false);
self::assertNull($registrar->serverArguments());
}
public function testCreateServerOutsideAdapterInitDoesNothing(): void
{
Functions\when('doing_action')->justReturn(false);
$oauthChecked = false;
$registrar = new ServerRegistrar(
$this->registry(),
$this->instructions(),
static function () use (&$oauthChecked): bool {
$oauthChecked = true;
return true;
}
);
$registrar->createServer();
self::assertFalse($oauthChecked, 'createServer must bail out before touching the adapter');
}
public function testRegisterDisablesAdapterDefaultServerAndHooksCreateServer(): void
{
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
Functions\expect('add_filter')
->once()
->with('mcp_adapter_create_default_server', '__return_false');
Functions\expect('add_action')
->once()
->with('mcp_adapter_init', [$registrar, 'createServer'], 5);
$registrar->register();
}
public function testDefaultOauthEnabledDelegatesToMcpOauthContext(): void
{
// LIT\MCP\Server\ServerRegistrar::__construct() defaults to
// (new \WPMedia\MCP\OAuth\Context())->is_enabled() – exercise that real
// Context, only stubbing the filter it reads, to prove we track its notion
// of "enabled" (including the deprecated rocket_mcp_oauth_server_enabled
// filter Context::is_enabled() also seeds from) instead of duplicating it.
Filters\expectApplied('wpmedia_mcp_oauth_server_enabled')->once()->andReturn(false);
$registrar = new ServerRegistrar($this->registry(), $this->instructions());
self::assertNull($registrar->serverArguments());
}
public function testUnhookOAuthDefaultServerRemovesOnlyTheMcpOauthCallback(): void
{
$oauthRegistrar = Mockery::mock(OAuthServerRegistrar::class);
$oauthCallback = [$oauthRegistrar, 'register_server'];
$unrelatedCallback = static function (): void {
};
$hook = new class {
/** @var array<int, array<string, array{function: mixed, accepted_args: int}>> */
public array $callbacks = [];
};
$hook->callbacks = [
5 => ['unrelated-id' => ['function' => $unrelatedCallback, 'accepted_args' => 0]],
10 => ['oauth-id' => ['function' => $oauthCallback, 'accepted_args' => 0]],
];
$GLOBALS['wp_filter']['mcp_adapter_init'] = $hook;
Functions\expect('remove_action')
->once()
->with('mcp_adapter_init', $oauthCallback, 10);
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
}
public function testUnhookOAuthDefaultServerIsNoOpWhenHookIsMissing(): void
{
unset($GLOBALS['wp_filter']['mcp_adapter_init']);
Functions\expect('remove_action')->never();
(new ServerRegistrar($this->registry(), $this->instructions()))->unhookOAuthDefaultServer();
}
}