(
overrides: {
readonly idp?: Parameters<typeof serveOAuthTestServer>[0];
readonly resourceAdvertisesProfile?: boolean;
readonly resourceGrantableScopes?: readonly string[];
} = {},
)
| 47 | * (draft §5), so every test here exercises the cross-domain client_id handling |
| 48 | * rather than the degenerate same-id case. */ |
| 49 | const enterpriseFixture = ( |
| 50 | overrides: { |
| 51 | readonly idp?: Parameters<typeof serveOAuthTestServer>[0]; |
| 52 | readonly resourceAdvertisesProfile?: boolean; |
| 53 | readonly resourceGrantableScopes?: readonly string[]; |
| 54 | } = {}, |
| 55 | ) => |
| 56 | Effect.gen(function* () { |
| 57 | const idp = yield* serveOAuthTestServer({ |
| 58 | clients: { [CLIENT_AT_IDP]: null }, |
| 59 | scopes: ["mcp.read", "mcp.write"], |
| 60 | ...overrides.idp, |
| 61 | enterpriseIdp: { |
| 62 | resourceClientIds: { [CLIENT_AT_IDP]: CLIENT_AT_RESOURCE }, |
| 63 | ...overrides.idp?.enterpriseIdp, |
| 64 | }, |
| 65 | }); |
| 66 | const resource = yield* serveOAuthTestServer({ |
| 67 | clients: { [CLIENT_AT_RESOURCE]: null }, |
| 68 | scopes: ["mcp.read", "mcp.write"], |
| 69 | ...(overrides.resourceAdvertisesProfile === false |
| 70 | ? {} |
| 71 | : { |
| 72 | enterpriseResourceServer: { |
| 73 | trustedIdpIssuer: idp.issuerUrl, |
| 74 | ...(overrides.resourceGrantableScopes === undefined |
| 75 | ? {} |
| 76 | : { grantableScopes: overrides.resourceGrantableScopes }), |
| 77 | }, |
| 78 | }), |
| 79 | }); |
| 80 | const session = yield* idp.completeAuthorizationCodeTokenFlow({ |
| 81 | clientId: CLIENT_AT_IDP, |
| 82 | clientSecret: "", |
| 83 | scopes: ["mcp.read", "mcp.write"], |
| 84 | }); |
| 85 | return { idp, resource, subjectToken: session.accessToken } satisfies EnterpriseFixture; |
| 86 | }); |
| 87 | |
| 88 | const chainInput = (fixture: EnterpriseFixture, scopes: readonly string[]) => ({ |
| 89 | idp: { tokenUrl: fixture.idp.tokenEndpoint, clientId: CLIENT_AT_IDP }, |
no test coverage detected