Melvin StroblandClaude Fable 5
8d82d6c4ec
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Test Backend / test-backend (push) Canceled after 0s
Compose Smoke Test / test-compose (push) Canceled after 0s
Playwright Tests / merge-reports (push) Canceled after 0s
The engine now speaks MCP at /mcp, with a built-in OAuth 2.1 authorization server in front of it: an agent registers itself, sends a human to the browser to approve it, and exchanges the resulting code for a token. PKCE is required, codes are single-use and stored only as hashes, the browser is redirected to the URI that was registered rather than the one asked for, and refresh tokens rotate so that replaying a spent one revokes the whole line. Twenty tools cover reading, building, publishing and running flows, and each one calls the same REST endpoint the dashboard calls, in-process, carrying the caller's own token. That keeps one description of what a flow is and what may be done to it — validation, the draft/publish split, the version check — and means an agent can do nothing a person could not do in the browser. Agent tokens are RS256 with a keypair of their own rather than the secret that signs browser sessions, so deleting the key withdraws every agent without logging anyone out, and deps.decode_token grew the branch that trusting a second issuer will need when the hosted login arrives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
124 lines
4.3 KiB
Python
124 lines
4.3 KiB
Python
"""The MCP endpoint: who it lets in, and what happens once they are in."""
|
|
|
|
import asyncio
|
|
import uuid
|
|
from collections.abc import Awaitable, Callable
|
|
from datetime import timedelta
|
|
from typing import Any
|
|
|
|
import httpx
|
|
import pytest
|
|
from fastapi.testclient import TestClient
|
|
|
|
from app.core import security
|
|
from app.core.config import settings
|
|
from app.main import app
|
|
|
|
MCP_HEADERS = {"Accept": "application/json, text/event-stream"}
|
|
|
|
|
|
def mcp_token(user_id: uuid.UUID) -> str:
|
|
return security.create_oauth_access_token(
|
|
user_id, uuid.uuid4(), timedelta(minutes=5)
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def over_mcp(monkeypatch: pytest.MonkeyPatch):
|
|
"""Run a block of calls against a live MCP endpoint.
|
|
|
|
The session manager and the requests have to share one event loop, so the
|
|
whole exchange happens inside a single ``asyncio.run``.
|
|
"""
|
|
monkeypatch.setattr(settings, "MCP_ENABLED", True)
|
|
from app.mcp import http as mcp_http
|
|
from app.mcp import server as mcp_server
|
|
|
|
# A FastMCP instance enters its session manager once, and another test in
|
|
# the run may have built one already.
|
|
monkeypatch.setattr(mcp_server.mcp, "_session_manager", None, raising=False)
|
|
mcp_app = mcp_http.build_http_app(app)
|
|
|
|
def run(block: Callable[[httpx.AsyncClient], Awaitable[Any]]) -> Any:
|
|
async def main() -> Any:
|
|
async with mcp_server.mcp.session_manager.run():
|
|
async with httpx.AsyncClient(
|
|
transport=httpx.ASGITransport(app=mcp_app),
|
|
base_url="http://api.localhost",
|
|
) as client:
|
|
return await block(client)
|
|
|
|
return asyncio.run(main())
|
|
|
|
return run
|
|
|
|
|
|
def rpc(token: str | None, method: str, **params: Any) -> dict[str, Any]:
|
|
headers = dict(MCP_HEADERS)
|
|
if token:
|
|
headers["Authorization"] = f"Bearer {token}"
|
|
body: dict[str, Any] = {"jsonrpc": "2.0", "id": 1, "method": method}
|
|
if params:
|
|
body["params"] = params
|
|
return {"json": body, "headers": headers}
|
|
|
|
|
|
def test_an_unauthenticated_call_says_where_to_authenticate(over_mcp) -> None:
|
|
async def block(client: httpx.AsyncClient) -> httpx.Response:
|
|
return await client.post("/mcp", **rpc(None, "tools/list"))
|
|
|
|
response = over_mcp(block)
|
|
assert response.status_code == 401
|
|
assert "resource_metadata=" in response.headers.get("www-authenticate", "")
|
|
|
|
|
|
def test_the_resource_metadata_names_the_authorization_server(over_mcp) -> None:
|
|
async def block(client: httpx.AsyncClient) -> httpx.Response:
|
|
return await client.get("/.well-known/oauth-protected-resource/mcp")
|
|
|
|
document = over_mcp(block).json()
|
|
# The SDK normalises the URL, so compare without the trailing slash.
|
|
listed = [url.rstrip("/") for url in document["authorization_servers"]]
|
|
assert settings.oauth_issuer in listed
|
|
|
|
|
|
def test_a_browser_token_is_not_an_agent_token(
|
|
over_mcp, superuser_token_headers: dict[str, str]
|
|
) -> None:
|
|
session_token = superuser_token_headers["Authorization"].removeprefix("Bearer ")
|
|
|
|
async def block(client: httpx.AsyncClient) -> httpx.Response:
|
|
return await client.post("/mcp", **rpc(session_token, "tools/list"))
|
|
|
|
# It validates perfectly well against the API; it is refused here because
|
|
# it was issued for a person's session, not for an agent.
|
|
assert over_mcp(block).status_code == 401
|
|
|
|
|
|
def test_an_agent_can_list_and_call_tools(
|
|
over_mcp, client: TestClient, superuser_token_headers: dict[str, str]
|
|
) -> None:
|
|
me = client.get(
|
|
f"{settings.API_V1_STR}/users/me", headers=superuser_token_headers
|
|
).json()
|
|
token = mcp_token(uuid.UUID(me["id"]))
|
|
|
|
async def block(http: httpx.AsyncClient) -> tuple[Any, Any]:
|
|
listed = await http.post("/mcp", **rpc(token, "tools/list"))
|
|
called = await http.post(
|
|
"/mcp",
|
|
**rpc(token, "tools/call", name="list_flows", arguments={}),
|
|
)
|
|
return listed, called
|
|
|
|
listed, called = over_mcp(block)
|
|
|
|
assert listed.status_code == 200
|
|
names = {tool["name"] for tool in listed.json()["result"]["tools"]}
|
|
assert {"list_flows", "save_flow", "publish_flow", "run_flow"} <= names
|
|
|
|
# The call reached the real API, carrying the agent's own token.
|
|
assert called.status_code == 200
|
|
assert "error" not in called.json()
|
|
assert called.json()["result"]["isError"] is False
|