Documentation
¶
Overview ¶
Package mcpfacade provides conformance-kit assertions for an application's MCP transport routes.
The helpers implement Layer B of the MCP auth facade conformance kit (docs/development/planning/apptheory/mcp-auth-facade/CONFORMANCE_KIT.md): a credential-free request to a transport route is denied with the RFC 9728 challenge and never reaches the application handler, a token that is missing a route-required scope is denied with the RFC 6750 insufficient_scope challenge and likewise never reaches it, while an accepted bearer token does reach it.
Index ¶
- func AssertBearerTokenReachesHandler(tb testing.TB, env *testkit.Env, app *apptheory.App, ...)
- func AssertBearerTokenReachesHandlerSecureApp(tb testing.TB, env *testkit.Env, app *apptheory.SecureApp, ...)
- func AssertCredentialFreeDenied(tb testing.TB, env *testkit.Env, app *apptheory.App, ...)
- func AssertCredentialFreeDeniedSecureApp(tb testing.TB, env *testkit.Env, app *apptheory.SecureApp, ...)
- func AssertInsufficientScopeRemediation(tb testing.TB, env *testkit.Env, app *apptheory.App, ...)
- func AssertInsufficientScopeRemediationSecureApp(tb testing.TB, env *testkit.Env, app *apptheory.SecureApp, ...)
- type Handler
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AssertBearerTokenReachesHandler ¶
func AssertBearerTokenReachesHandler(tb testing.TB, env *testkit.Env, app *apptheory.App, method, path, token string, handler *Handler)
AssertBearerTokenReachesHandler is the positive control for AssertCredentialFreeDenied: a request carrying token reaches the handler exactly once, proving the denial is not "always deny".
func AssertBearerTokenReachesHandlerSecureApp ¶ added in v6.2.0
func AssertBearerTokenReachesHandlerSecureApp(tb testing.TB, env *testkit.Env, app *apptheory.SecureApp, method, path, token string, handler *Handler)
AssertBearerTokenReachesHandlerSecureApp is the positive control for AssertCredentialFreeDeniedSecureApp.
func AssertCredentialFreeDenied ¶
func AssertCredentialFreeDenied(tb testing.TB, env *testkit.Env, app *apptheory.App, method, path, resourceMetadataURL string, handler *Handler)
AssertCredentialFreeDenied drives a credential-free API Gateway v2 request to method path through env and asserts the RFC 9728 denial: HTTP 401, the exact WWW-Authenticate challenge for resourceMetadataURL, and no invocation of the application handler.
func AssertCredentialFreeDeniedSecureApp ¶ added in v6.2.0
func AssertCredentialFreeDeniedSecureApp(tb testing.TB, env *testkit.Env, app *apptheory.SecureApp, method, path, resourceMetadataURL string, handler *Handler)
AssertCredentialFreeDeniedSecureApp is AssertCredentialFreeDenied for the closed-by-default surface. A SecureApp that mounts its transport routes through the MCP auth facade's SecureApp registrar owes the same RFC 9728 denial, and this helper proves it from the same fixture world.
func AssertInsufficientScopeRemediation ¶
func AssertInsufficientScopeRemediation(tb testing.TB, env *testkit.Env, app *apptheory.App, method, path, token, expectedChallenge string, handler *Handler)
AssertInsufficientScopeRemediation drives a bearer request to method path through env and asserts the RFC 6750 insufficient_scope denial for a token that is otherwise valid: HTTP 403 with the exact WWW-Authenticate challenge expectedChallenge, and no invocation of the application handler.
expectedChallenge is compared verbatim, so a caller passes the challenge the matched route's scope map produces, for example `Bearer error="insufficient_scope", scope="namespace:use", resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/acme/mcp"`.
func AssertInsufficientScopeRemediationSecureApp ¶ added in v6.2.0
func AssertInsufficientScopeRemediationSecureApp(tb testing.TB, env *testkit.Env, app *apptheory.SecureApp, method, path, token, expectedChallenge string, handler *Handler)
AssertInsufficientScopeRemediationSecureApp is AssertInsufficientScopeRemediation for the closed-by-default surface.
Types ¶
type Handler ¶
type Handler struct {
// contains filtered or unexported fields
}
Handler is a counting MCP transport handler. Every request is counted and answered with 204 No Content, so a test can prove whether a denied request reached the application handler.
func (*Handler) Handle ¶
Handle is the apptheory.Handler to mount on the transport routes. Every call is counted and answered with 204 No Content.
func (*Handler) Invocations ¶
Invocations reports how many requests reached the handler.
Source Files