| 11 | const dynamicOAuthClientId = "client_dynamic_oauth_fixture"; |
| 12 | |
| 13 | const makeVerifier = async () => { |
| 14 | const { publicKey, privateKey } = await generateKeyPair("RS256"); |
| 15 | const jwk = await exportJWK(publicKey); |
| 16 | const jwks = createLocalJWKSet({ keys: [{ ...jwk, kid: "test-key" }] }); |
| 17 | const sign = (claims: Record<string, unknown>) => |
| 18 | new SignJWT({ org_id: "org_test", ...claims }) |
| 19 | .setProtectedHeader({ alg: "RS256", kid: "test-key" }) |
| 20 | .setIssuer(issuer) |
| 21 | .setSubject("user_test") |
| 22 | .setIssuedAt() |
| 23 | .setExpirationTime("5m") |
| 24 | .sign(privateKey); |
| 25 | |
| 26 | return { jwks, sign }; |
| 27 | }; |
| 28 | |
| 29 | describe("MCP AuthKit token verification", () => { |
| 30 | it.effect("low-level verifier rejects mismatched audience when audience is required", () => |