Function runBearerScoping

e2e/desktop/local-auth-mcp.test.ts:209–255

(runDir: string)

);

const runBearerScoping = async (runDir: string) => {
  const home = mkdtempSync(join(tmpdir(), "executor-desktop-scope-"));
  const app = await launchDesktop(home, runDir);
  try {
    const page = await app.firstWindow({ timeout: 120_000 });
    await page.getByText("Settings").first().waitFor({ timeout: 120_000 });

    const { origin } = readSidecar(home);
    const gatedUrl = `${origin}/api/scope`;

    // The app's OWN window: the main process injects the bearer → not 401.
    const mainStatus = await page.evaluate(
      (url) =>
        fetch(url)
          .then((r) => r.status)
          .catch(() => -1),
      gatedUrl,
    );
    expect(mainStatus, "app window: injected bearer reaches the gated endpoint").not.toBe(401);

    // A non-app BrowserWindow (what an OAuth popup is) in the SAME session: its
    // requests to the sidecar must NOT get the bearer auto-attached → 401.
    const popupStatus = await app.evaluate(
      async ({ BrowserWindow }, { origin: o, gatedUrl: g }) => {
        const popup = new BrowserWindow({
          show: false,
          webPreferences: { contextIsolation: true, nodeIntegration: false, sandbox: true },
        });
        // Load the SPA (served unauthenticated) so the fetch has the right origin.
        await popup.loadURL(`${o}/`);
        const status = await popup.webContents.executeJavaScript(
          `fetch(${JSON.stringify(g)}).then((r) => r.status).catch(() => -1)`,
        );
        popup.destroy();
        return status as number;
      },
      { origin, gatedUrl },
    );
    expect(popupStatus, "popup webContents: no bearer injected → gated endpoint rejects it").toBe(
      401,
    );

    await page.screenshot({ path: join(runDir, "01-bearer-scoping.png") });
  } finally {
    await closeWithVideo(app, runDir, home);
  }
};