tests: add MCP auth e2e collection covering discovery, credential matrix, OAuth issuance, refresh rotation, revocation window, and runtime mode flip#4525
Conversation
|
|
📝 WalkthroughSummary by CodeRabbit
WalkthroughExtends the MCP auth Postman collection with config validation, full OAuth virtual-key identity and session identity flows, revocation window tests, and a runtime config flip scenario. The Newman runner gains ChangesMCP Auth E2E Test Suite Expansion
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Confidence Score: 5/5Test-only additions with no changes to production Go or transport code; safe to merge. All three changed files are test infrastructure. The single-line runner change is mechanical and directly required by the new collection. The collection logic is well-structured with consistent auth_mode guards, correct RFC 7636 PKCE, and robust grant isolation via set-difference. No files require special attention. Important Files Changed
Reviews (3): Last reviewed commit: "feat: mcp oauth server e2e tests" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Pratham-Mishra04
force-pushed
the
06-18-feat_mcp_oauth_server_e2e_tests
branch
from
395dd0c to
a5fa0bd
Compare
Pratham-Mishra04
force-pushed
the
06-18-feat_adds_mcp_oauth_server_type_e2e_tests
branch
from
7e7c217 to
32e4bc0
Compare
Pratham-Mishra04
force-pushed
the
06-18-feat_adds_mcp_oauth_server_type_e2e_tests
branch
from
32e4bc0 to
0fc852e
Compare
Pratham-Mishra04
force-pushed
the
06-18-feat_mcp_oauth_server_e2e_tests
branch
from
a5fa0bd to
fb2ee5f
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/e2e/api/README.md`:
- Around line 268-269: The documentation comment for MCP auth runner options is
missing the `--mcp-port` flag from the list of supported options. Update the
comment line that documents the runner options (currently showing `--port`,
`--html`, `--json`, `--verbose`, `--bail`) to also include `--mcp-port` with an
appropriate description (e.g., default port number for MCP server). This will
allow users to easily discover and use the flag when configuring local test
runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 76273975-5e1a-4083-b462-b4bf00757edd
📒 Files selected for processing (3)
tests/e2e/api/README.mdtests/e2e/api/collections/bifrost-v1-mcp-auth.postman_collection.jsontests/e2e/api/runners/individual/run-newman-mcp-auth-tests.sh
| # options: --port <port> (default 8090), --html, --json, --verbose, --bail | ||
| ``` |
There was a problem hiding this comment.
Document --mcp-port in MCP auth runner options.
Line 268 lists runner flags but omits --mcp-port, which the runner supports (see run-newman-mcp-auth-tests.sh, Line 66). This makes local runs harder when port 3001 is occupied.
📝 Suggested doc fix
-# options: --port <port> (default 8090), --html, --json, --verbose, --bail
+# options: --port <port> (default 8090), --mcp-port <port> (default 3001), --html, --json, --verbose, --bail🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@tests/e2e/api/README.md` around lines 268 - 269, The documentation comment
for MCP auth runner options is missing the `--mcp-port` flag from the list of
supported options. Update the comment line that documents the runner options
(currently showing `--port`, `--html`, `--json`, `--verbose`, `--bail`) to also
include `--mcp-port` with an appropriate description (e.g., default port number
for MCP server). This will allow users to easily discover and use the flag when
configuring local test runs.
2 participants
Summary
Adds a comprehensive end-to-end test suite for MCP inbound authentication, covering all three server auth modes (
headers,both,oauth) in a single Postman collection driven by a dedicated Newman runner.Changes
bifrost-v1-mcp-auth.postman_collection.jsonwith five new test folders:mcp_server_auth_modevalues andoauth2_server_configpayloads sent withheadersmode are rejected with 400, and that the boot mode round-trips correctly throughGET /api/config./mcp, refresh rotation, and stolen-token family revocation (replaying a rotated refresh token revokes the entire grant family)./mcp, and then enablingenforce_auth_on_inferenceat runtime causes that same session token to be rejected.headers-mode boot, upgrades tobothviaPUT /api/config, confirms discovery endpoints come alive, and verifies header-VK connections are unaffected.auth_modeenv-var so a single collection encodes the full credential matrix across modes; steps that do not apply to a given mode are skipped with a passing no-op assertion.--ignore-redirectsto the Newman invocation inrun-newman-mcp-auth-tests.shso that authorize redirects are captured as 302 responses rather than followed, allowing the collection to extract flow IDs fromLocationheaders.README.mdwith a full description of the new collection and runner, including per-mode assertion summaries and local run instructions.Type of change
Affected areas
How to test
Run the MCP auth test suite locally from
tests/e2e/api:The runner builds and starts the upstream MCP server (
examples/mcps/http-no-ping-server), boots a fresh server instance permcp_server_auth_mode, pre-seeds an MCP client and two virtual keys (one active, one inactive), and executes the collection against each mode in sequence. A builtbifrost-httpbinary is required.Screenshots/Recordings
N/A
Breaking changes
Related issues
N/A
Security considerations
The collection exercises the full OAuth 2.0 issuance surface including PKCE, refresh rotation, stolen-token family revocation, and the revocation window. No secrets are introduced; all credentials are ephemeral test values seeded by the runner.
Checklist
docs/contributing/README.mdand followed the guidelines