mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-20 04:24:17 +02:00
3a9717e6beCo-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com> Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com> Co-authored-by: voidborne-d <voidborne-d@users.noreply.github.com> Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: d 🔹 <258577966+voidborne-d@users.noreply.github.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Bill Easton <strawgate@users.noreply.github.com> Co-authored-by: Sumanshu Nankana <sumanshunankana@gmail.com> Co-authored-by: Eric Robinson <ericrobinson@indeed.com> Co-authored-by: Martim Santos <martimfasantos@gmail.com> Co-authored-by: d 🔹 <liusway405@gmail.com> Co-authored-by: Matthieu B <66959271+mtthidoteu@users.noreply.github.com> Co-authored-by: Sascha Buehrle <47737812+saschabuehrle@users.noreply.github.com> Co-authored-by: Hakancan <142545736+hkc5@users.noreply.github.com> Co-authored-by: nightcityblade <jackchen@haloailabs.com> Co-authored-by: Matt Hallowell <17804673+mhallo@users.noreply.github.com> Co-authored-by: nate nowack <thrast36@gmail.com> Co-authored-by: Bill Easton <williamseaston@gmail.com> Co-authored-by: Marcus Shu <46469249+shulkx@users.noreply.github.com> Co-authored-by: Rushabh Doshi <radoshi@gmail.com> Co-authored-by: AIKAWA Shigechika <shige@aikawa.jp> Co-authored-by: Jeremy Simon <simonjer805@gmail.com> Co-authored-by: Miguel Miranda Dias <7780875+pandego@users.noreply.github.com> Co-authored-by: Anthony James Padavano <padavano.anthony@gmail.com> Co-authored-by: Mostafa Kamal <hiremostafa@gmail.com> Fix auto-close MRE script posting comment without closing (#3386) Fix WorkOS token scope verification bypass 🤖 Generated with Codex (#3407) Fix initialize McpError fallthrough 🤖 Generated with Codex (#3413) Fix transform arg collisions with passthrough params (#3431) Fix get_* returning None when latest version is disabled (#3439) Fix get_* returning None when latest version is disabled (#3421) Fix server lifespan overlap teardown (#3415) Fix $ref output schema object detection regression (#3420) resolved annotations (#3429) Fix async partial callables rejected by iscoroutinefunction (#3438) Fix async partial callables rejected by iscoroutinefunction (#3423) fix: add version to components (#3458) fix: use intent-based flag for OIDC scope patch in load_access_token (#3465) Fixes #3461 fix: normalize Google scope shorthands and surface valid_scopes (#3477) fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481) fix: shield lifespan teardown from cancellation (#3480) fix: forward custom_route endpoints from mounted servers (#3462) fix updates _get_additional_http_routes() to traverse providers, Fixes #3457 fix: remove hardcoded version from CLI help text (#3456) fix: monty 0.0.8 compatibility, drop external_functions from constructor (#3468) fix: task test teardown hanging 5s per test (#3499) Closes #3498 fix: validate workspace path is a directory before cursor install (#3440) Fixes #3426 fix: handle re.error from malformed URI templates in build_regex (#3501) fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503) fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502) fix warnings and timeouts (#3504) close upgrade check issue when build passes (#3505) Closes #3484 fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507) fix: prevent path traversal in skill download (#3493) fix: prefer IdP-granted scopes over client-requested scopes in OAuthProxy (#3492) fix: remove unrelated transform and http.py changes from PR scope fix: remove forced follow_redirects from httpx_client_factory calls (#3496) fix: stop passing follow_redirects to httpx_client_factory fix: restore follow_redirects=True for custom httpx client factories Closes #3509 fix: CSRF double-submit cookie check in consent flow (#3519) fix: validate server names in install commands (#3522) fix: use raw strings for regex in pytest.raises match (#3523) fix: reject refresh tokens used as Bearer access tokens (#3524) fix: route ResourcesAsTools/PromptsAsTools through server middleware (#3495) fix: resolve Pyright "Module is not callable" on @tool, @resource, @prompt decorators (#3540) fix: filter warnings by message in KEY_PREFIX test (#3549) fix: suppress output schema for ToolResult subclass annotations (#3548) fix: increase sleep duration in proxy cache tests (#3567) fix: store absolute token expiry to prevent stale expires_in on reload (#3572) fix: preserve tool properties named 'title' during schema compression (#3582) Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589) Fix app tool routing: visibility check and middleware propagation (#3591) Fix query parameter serialization to respect OpenAPI explode/style settings (#3595) Fix dev apps form: union types, textarea support, JSON parsing (#3597) fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603) fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609) fix(docs): correct misleading stateless_http header (#3622) fix: filesystem provider import machinery (#3626) Closes #3625 (issues 2, 3, 6) fix: recover StdioTransport after subprocess exits (#3630) fix(server): preserve mounted tool task metadata (#3632) fix: scope deprecation warning filter to FastMCPDeprecationWarning (#3649) fix imports, add PrefabAppConfig (#3650) fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651) Fix blocking docs issues: chart imports, Select API, Rx consistency (#3652) closed by default (#3657) Fix prompt caching middleware missing wrap/unwrap round-trip (#3666) fix: serialize object query params per OpenAPI style/explode rules (#3662) Fixes #2857 fix: HTTP request headers not accessible in background task workers (#3631) fix: restore HTTP headers in worker execution path for background tasks (#3681) fix: strip discriminator after dereferencing schemas (#3682) fix: remove stale ty:ignore directives for ty 0.0.26 (#3684) Fix docs gaps in app provider pages (#3690) fix: dev apps log panel UX improvements (#3698) fix dev server empty string args (#3700)
119 lines
4.4 KiB
Python
119 lines
4.4 KiB
Python
"""Tests for OAuth proxy UI and error page rendering."""
|
|
|
|
from unittest.mock import Mock
|
|
|
|
from key_value.aio.stores.memory import MemoryStore
|
|
from starlette.requests import Request
|
|
from starlette.responses import HTMLResponse
|
|
|
|
from fastmcp.server.auth.oauth_proxy import OAuthProxy
|
|
from fastmcp.server.auth.oauth_proxy.ui import create_consent_html, create_error_html
|
|
from fastmcp.server.auth.providers.jwt import JWTVerifier
|
|
|
|
|
|
class TestErrorPageRendering:
|
|
"""Test error page rendering for OAuth callback errors."""
|
|
|
|
def test_create_error_html_basic(self):
|
|
"""Test basic error page generation."""
|
|
|
|
html = create_error_html(
|
|
error_title="Test Error",
|
|
error_message="This is a test error message",
|
|
)
|
|
|
|
# Verify it's valid HTML
|
|
assert "<!DOCTYPE html>" in html
|
|
assert "<title>Test Error</title>" in html
|
|
assert "This is a test error message" in html
|
|
assert 'class="info-box error"' in html
|
|
|
|
def test_create_error_html_with_details(self):
|
|
"""Test error page with error details."""
|
|
|
|
html = create_error_html(
|
|
error_title="OAuth Error",
|
|
error_message="Authentication failed",
|
|
error_details={
|
|
"Error Code": "invalid_scope",
|
|
"Description": "Requested scope does not exist",
|
|
},
|
|
)
|
|
|
|
# Verify error details are included
|
|
assert "Error Details" in html
|
|
assert "Error Code" in html
|
|
assert "invalid_scope" in html
|
|
assert "Description" in html
|
|
assert "Requested scope does not exist" in html
|
|
|
|
def test_create_error_html_escapes_user_input(self):
|
|
"""Test that error page properly escapes HTML in user input."""
|
|
|
|
html = create_error_html(
|
|
error_title="Error <script>alert('xss')</script>",
|
|
error_message="Message with <b>HTML</b> tags",
|
|
error_details={"Key<script>": "Value<img>"},
|
|
)
|
|
|
|
# Verify HTML is escaped
|
|
assert "<script>alert('xss')</script>" not in html
|
|
assert "<script>" in html
|
|
assert "<b>HTML</b>" not in html
|
|
assert "<b>HTML</b>" in html
|
|
|
|
async def test_callback_error_returns_html_page(self):
|
|
"""Test that OAuth callback errors return styled HTML instead of data: URLs."""
|
|
# Create a minimal OAuth proxy
|
|
provider = OAuthProxy(
|
|
upstream_authorization_endpoint="https://idp.example.com/authorize",
|
|
upstream_token_endpoint="https://idp.example.com/token",
|
|
upstream_client_id="test-client",
|
|
upstream_client_secret="test-secret",
|
|
token_verifier=JWTVerifier(
|
|
jwks_uri="https://idp.example.com/.well-known/jwks.json",
|
|
issuer="https://idp.example.com",
|
|
audience="test-client",
|
|
),
|
|
base_url="http://localhost:8000",
|
|
jwt_signing_key="test-signing-key",
|
|
client_storage=MemoryStore(),
|
|
)
|
|
|
|
# Mock a request with an error from the IdP
|
|
mock_request = Mock(spec=Request)
|
|
mock_request.query_params = {
|
|
"error": "invalid_scope",
|
|
"error_description": "The application asked for scope 'read' that doesn't exist",
|
|
"state": "test-state",
|
|
}
|
|
|
|
# Call the callback handler
|
|
response = await provider._handle_idp_callback(mock_request)
|
|
|
|
# Verify we get an HTMLResponse, not a RedirectResponse
|
|
assert isinstance(response, HTMLResponse)
|
|
assert response.status_code == 400
|
|
|
|
# Verify the response contains the error message
|
|
assert b"invalid_scope" in response.body
|
|
assert b"doesn't exist" in response.body # HTML-escaped apostrophe
|
|
assert b"OAuth Error" in response.body
|
|
|
|
|
|
class TestConsentPageRendering:
|
|
"""Test consent page rendering and escaping."""
|
|
|
|
def test_create_consent_html_escapes_client_id_in_details(self):
|
|
"""Test that Application ID is escaped in advanced details."""
|
|
|
|
html = create_consent_html(
|
|
client_id='evil<img src=x onerror=alert("xss")>',
|
|
redirect_uri="https://example.com/callback",
|
|
scopes=["read"],
|
|
txn_id="txn",
|
|
csrf_token="csrf",
|
|
)
|
|
|
|
assert 'evil<img src=x onerror=alert("xss")>' not in html
|
|
assert "evil<img src=x onerror=alert("xss")>" in html
|