fix: adds e2e tests for mcp headers auth, oauth and per-user oauth

[sammaji]

Summary

Adds end-to-end test coverage for MCP header-based authentication, OAuth 2.0, and Per-User OAuth 2.0 auth flows. This includes new test data factories, test suites exercising the full authorization flow (including popup-based browser consent), and global setup automation to build and start the required demo servers (auth-demo-server on port 3002 and oauth-demo-server on port 3003).

Changes

• Added createHeadersAuthClientData, createOAuthClientData, and createPerUserOAuthClientData factory functions in mcp-registry.data.ts for use in auth-related test scenarios.
• Added three new test.describe blocks covering header auth UI visibility, header auth client creation and tool discovery, OAuth 2.0 field display and full browser popup authorization flow, and Per-User OAuth 2.0 field display and consent-then-popup authorization flow.
• Removed the redundant "should require name for client" test that duplicated coverage already provided by the name format validation test.
• Fixed selectAuthType to convert underscores to hyphens when resolving data-testid attributes (e.g., per_user_oauth → auth-type-per-user-oauth).
• Extended OAuth config form-filling to handle both oauth and per_user_oauth auth types, which share the same input fields.
• Increased clientExists wait time from 500 ms to 5000 ms to accommodate the latency introduced by OAuth redirect flows.
• Extended global-setup.ts to automatically build (if not already built) and spawn auth-demo-server and oauth-demo-server as background processes before the test suite runs, with graceful warnings if either server fails to start.
• Added per_user_oauth to the MCPAuthType union type.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI
• Tests

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs
• Tests

How to test

Ensure the demo servers are available under examples/mcps/auth-demo-server and examples/mcps/oauth-demo-server. The global setup will build and start them automatically.

# Run the full e2e suite (global setup handles server lifecycle)
cd tests/e2e
pnpm exec playwright test features/mcp-registry/mcp-registry.spec.ts

For the OAuth and Per-User OAuth tests, the suite opens a browser popup and completes a login form on the oauth-demo-server using the credentials demo-user. Ensure the server is reachable at http://localhost:3003/mcp before running.

For header auth tests, the auth-demo-server must be reachable at http://localhost:3002/ and configured to accept X-API-Key: super-secret-key and X-Tool-Token: tool-exec-secret.

Breaking changes

• Yes
• No

Related issues

Security considerations

Test credentials (super-secret-key, tool-exec-secret, demo-user) are hardcoded exclusively for local demo servers used in the e2e test environment and are not used in any production path.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7c513748-b905-4f5c-bf87-da0c5d9c3c24

📥 Commits

Reviewing files that changed from the base of the PR and between 46c15e2 and 8bd0b92.

📒 Files selected for processing (4)

• tests/e2e/features/mcp-registry/mcp-registry.data.ts
• tests/e2e/features/mcp-registry/mcp-registry.spec.ts
• tests/e2e/features/mcp-registry/pages/mcp-registry.page.ts
• tests/e2e/global-setup.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• tests/e2e/global-setup.ts
• tests/e2e/features/mcp-registry/mcp-registry.data.ts

---

📝 Walkthrough

Summary by CodeRabbit

• Tests
  • Expanded end-to-end coverage for MCP registry auth flows: headers, OAuth 2.0, and per-user OAuth 2.0 — includes UI field checks, inline validation assertions, and full creation flows.
  • Added reusable test client factories to simplify creating clients for each auth mode.
• Chores
  • Enhanced test setup to start local demo servers during e2e runs to validate auth and registration behavior.

Walkthrough

Adds page-object support for per-user OAuth, refactors client action flows, updates MCP registry specs with display/cancel and full creation tests for headers, OAuth, and per-user OAuth, and adjusts form validation assertions and test imports.

Changes

MCP Authentication E2E Test Coverage

Layer / File(s)	Summary
Page-object: auth type plumbing & actions tests/e2e/features/mcp-registry/pages/mcp-registry.page.ts	Extend MCPAuthType with per_user_oauth; make clientExists use visibility assertion; normalize selectAuthType testid construction; run OAuth field filling for per_user_oauth; refactor reconnectClient and deleteClient to use row actions menu.
Spec imports & form validation updates tests/e2e/features/mcp-registry/mcp-registry.spec.ts	Import new client-data factories; remove the "require name" test; change name-format and connection-URL validations to submit the form and assert inline error messages.
Header-auth display + E2E tests/e2e/features/mcp-registry/mcp-registry.spec.ts	Add headers-auth display-fields + cancel test and a full header-auth client creation test that verifies the client and checks tools in client details.
OAuth 2.0 display + E2E tests/e2e/features/mcp-registry/mcp-registry.spec.ts	Add OAuth display-fields + cancel test and a full OAuth client creation test that opens the auth popup, completes login, and verifies the client appears in the registry.
Per-user OAuth display + E2E tests/e2e/features/mcp-registry/mcp-registry.spec.ts	Add per-user OAuth display-fields + cancel test and a full per-user OAuth creation test that uses test-login confirmation and the auth popup, then verifies the client in the registry.

sequenceDiagram
  participant Runner as Test Runner
  participant Setup as Global Setup
  participant Registry as Registry App
  participant Browser as Browser/Popup
  participant AuthDemo as Auth Demo Server (3002)
  participant OAuthDemo as OAuth Demo Server (3003)

  Runner->>Setup: runMCPSetup
  Setup->>AuthDemo: start auth-demo-server (3002)
  Setup->>OAuthDemo: start oauth-demo-server (3003)
  Runner->>Registry: open MCP registry UI
  Runner->>Browser: trigger create-client flows
  Browser->>Registry: submit client creation (headers / oauth / per_user_oauth)
  alt headers auth
    Registry->>AuthDemo: request tools with headers
    AuthDemo-->>Registry: return tool list
  else oauth / per_user_oauth
    Browser->>OAuthDemo: open auth popup / authorize
    OAuthDemo-->>Browser: complete login & redirect
    Browser->>Registry: popup closed, registry refreshed
  end
  Registry-->>Runner: client appears in registry

Loading

🎯 4 (Complex) | ⏱️ ~45 minutes

"🐰
Two servers hum at dawn,
Headers, OAuth — popups spawn,
Tests hop through fields with glee,
Clients found — a tasty tree! 🥕"

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: adding e2e tests for three MCP authentication types (headers auth, OAuth, and per-user OAuth).
Description check	✅ Passed	The description comprehensively covers all required template sections: summary, changes, type of change, affected areas, testing instructions, security considerations, and a complete checklist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 05-13-fix_adds_e2e_tests_for_mcp_headers_auth_oauth_and_per-user_oauth

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sammaji]

• fix: adds e2e tests for mcp headers auth, oauth and per-user oauth #3467 👈 (View in Graphite)
• fix: updates e2e ui tests for provider management #3463
• fix: updates e2e ui tests for virtual keys management #3460
• feat: updates playwright config to support enterprise ui tests and allow clipboard #3488
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/e2e/features/mcp-registry/mcp-registry.spec.ts`:
- Around line 409-436: The test is swallowing popup-close failures and only
checks client row existence (mcpRegistryPage.clientExists), causing false
positives; remove the .catch() on popup.waitForEvent('close') and await it
properly (e.g., await popup.waitForEvent('close', { timeout: 15000 })) so
failures surface, and replace or augment the simple existence assertion with a
post-auth success assertion (e.g., call a helper like
mcpRegistryPage.getClientStatus or mcpRegistryPage.clientIsConnected, or assert
a specific table cell/text such as "Connected" or presence of tools/actions for
that client row) after mcpRegistryPage.createClient and the popup flow to ensure
OAuth actually completed.

In `@tests/e2e/global-setup.ts`:
- Around line 324-392: The startup code for auth-demo-server and
oauth-demo-server currently only checks authServer.pid/oauthServer.pid and waits
1s, which can miss early failures; modify the blocks that spawn authServer
(symbol: authServer, auth-demo-server) and oauthServer (symbol: oauthServer,
oauth-demo-server) to call the existing checkServerReady function for ports 3002
and 3003 respectively after spawn and before logging success, and only push the
process into MCP_SERVERS and log "started" once checkServerReady resolves; keep
the existing pid/unref logic but wrap it so failures in binding cause the catch
branch to run and include these servers in the same readiness pattern used for
port 3001.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 92d25dc9-17a0-40dc-a4b2-ac4e80535132

📥 Commits

Reviewing files that changed from the base of the PR and between 6bea147 and 32cc6f3.

📒 Files selected for processing (4)

• tests/e2e/features/mcp-registry/mcp-registry.data.ts
• tests/e2e/features/mcp-registry/mcp-registry.spec.ts
• tests/e2e/features/mcp-registry/pages/mcp-registry.page.ts
• tests/e2e/global-setup.ts

[greptile-apps]

Confidence Score: 5/5

Test-only changes with no impact on production code; safe to merge once the open reliability concerns from earlier review rounds are resolved.

All changes are confined to the e2e test layer. The new test suites, data factories, and page-object helpers are well-structured. The known reliability issues (missing readiness polling for the new demo servers, unhandled error events on spawned processes, swallowed popup-close timeout, and the getToolsCount race) were identified and flagged in prior review rounds; no new blocking issues were found in this pass.

The open items in global-setup.ts (readiness polling, error-event handlers) and mcp-registry.spec.ts (popup-close assertion, tool-load race) are the areas most likely to cause intermittent CI failures and deserve a follow-up before this suite is relied upon in a CI gate.

Important Files Changed

Filename	Overview
tests/e2e/features/mcp-registry/mcp-registry.data.ts	Adds three new factory functions (createHeadersAuthClientData, createOAuthClientData, createPerUserOAuthClientData) for MCP auth test scenarios; clean additions with no issues.
tests/e2e/features/mcp-registry/mcp-registry.spec.ts	Adds three new test suites for header auth, OAuth 2.0, and Per-User OAuth 2.0; removes a redundant test; popup-close timeout is silently swallowed and getToolsCount() snapshots before tools have loaded (both previously flagged).
tests/e2e/features/mcp-registry/pages/mcp-registry.page.ts	Adds per_user_oauth to the auth type union, fixes selectAuthType kebab-case conversion, upgrades clientExists to a Playwright assertion, extracts openClientActions helper, and migrates reconnectClient/deleteClient to the new actions menu; the fixed 5 s timeout in clientExists was previously flagged.
tests/e2e/global-setup.ts	Extends global setup to build and spawn auth-demo-server and oauth-demo-server; missing readiness polling and error event handlers were both previously flagged, and the file is missing a trailing newline.

_{Reviews (8): Last reviewed commit: "fix: adds e2e tests for mcp headers auth..." | Re-trigger Greptile}

[coderabbitai]

♻️ Duplicate comments (1)

tests/e2e/global-setup.ts (1)

343-347: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Gate auth/oauth server startup on actual readiness before marking success.

Line 343 and Line 378 only gate on pid + sleep, so early bind failures can still be reported as “started,” and Line 388-391 then reports “ready” unconditionally. This can make the new auth/OAuth E2E flows flaky.

Suggested patch

+  let authReady = false
+  let oauthReady = false
+
   // Build and start auth-demo-server on port 3002
   try {
@@
     console.log('Starting auth-demo-server on port 3002...')
     const authServer = spawn(authServerExec, [], {
       cwd: authServerDir,
       detached: true,
       stdio: ['ignore', 'pipe', 'pipe'],
     })
     authServer.stdout?.on('data', (data) => console.log(`[Auth Server] ${data.toString().trim()}`))
     authServer.stderr?.on('data', (data) => console.error(`[Auth Server Error] ${data.toString().trim()}`))
-    if (authServer.pid) {
-      authServer.unref()
-      MCP_SERVERS.push(authServer)
-      await setTimeout(1000)
-      console.log('✓ auth-demo-server started on http://localhost:3002/')
-    }
+    if (!authServer.pid) throw new Error('Failed to start auth-demo-server - no PID assigned')
+    authReady = await checkServerReady(3002, 20)
+    if (!authReady) throw new Error('auth-demo-server failed readiness check on :3002')
+    authServer.unref()
+    MCP_SERVERS.push(authServer)
+    console.log('✓ auth-demo-server started on http://localhost:3002/')
   } catch (err) {
     console.warn(`⚠️  Failed to start auth-demo-server (header auth tests may skip): ${(err as Error).message}`)
   }
@@
     console.log('Starting oauth-demo-server on port 3003...')
     const oauthServer = spawn(oauthServerExec, [], {
       cwd: oauthServerDir,
       detached: true,
       stdio: ['ignore', 'pipe', 'pipe'],
     })
     oauthServer.stdout?.on('data', (data) => console.log(`[OAuth Server] ${data.toString().trim()}`))
     oauthServer.stderr?.on('data', (data) => console.error(`[OAuth Server Error] ${data.toString().trim()}`))
-    if (oauthServer.pid) {
-      oauthServer.unref()
-      MCP_SERVERS.push(oauthServer)
-      await setTimeout(1000)
-      console.log('✓ oauth-demo-server started on http://localhost:3003/')
-    }
+    if (!oauthServer.pid) throw new Error('Failed to start oauth-demo-server - no PID assigned')
+    oauthReady = await checkServerReady(3003, 20)
+    if (!oauthReady) throw new Error('oauth-demo-server failed readiness check on :3003')
+    oauthServer.unref()
+    MCP_SERVERS.push(oauthServer)
+    console.log('✓ oauth-demo-server started on http://localhost:3003/')
   } catch (err) {
     console.warn(`⚠️  Failed to start oauth-demo-server (OAuth tests may fail): ${(err as Error).message}`)
   }
@@
   console.log('✓ MCP servers ready')
   console.log('  - HTTP/SSE server: http://localhost:3001/')
-  console.log('  - Auth demo server: http://localhost:3002/')
-  console.log('  - OAuth demo server: http://localhost:3003/')
+  if (authReady) console.log('  - Auth demo server: http://localhost:3002/')
+  if (oauthReady) console.log('  - OAuth demo server: http://localhost:3003/')
   console.log('  - STDIO server: test-tools-server/dist/index.js')

Also applies to: 378-383, 388-391

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/e2e/global-setup.ts` around lines 343 - 347, The startup check
currently only verifies authServer.pid and waits a fixed timeout (authServer,
MCP_SERVERS, await setTimeout) which can falsely report success; instead gate
success on actual readiness by waiting for the child/server to emit a listening
event or by polling the server (e.g., an HTTP GET to http://localhost:3002/
until it responds 200 within a timeout) before pushing to MCP_SERVERS and
logging success; update all similar blocks (the ones around authServer usage at
the earlier and later ranges) to use the same readiness probe and fail/timeout
with a clear error if the probe does not succeed.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@tests/e2e/global-setup.ts`:
- Around line 343-347: The startup check currently only verifies authServer.pid
and waits a fixed timeout (authServer, MCP_SERVERS, await setTimeout) which can
falsely report success; instead gate success on actual readiness by waiting for
the child/server to emit a listening event or by polling the server (e.g., an
HTTP GET to http://localhost:3002/ until it responds 200 within a timeout)
before pushing to MCP_SERVERS and logging success; update all similar blocks
(the ones around authServer usage at the earlier and later ranges) to use the
same readiness probe and fail/timeout with a clear error if the probe does not
succeed.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7346eb59-dc9e-4a40-b014-27076a62437d

📥 Commits

Reviewing files that changed from the base of the PR and between 32cc6f3 and 444c1e7.

📒 Files selected for processing (4)

• tests/e2e/features/mcp-registry/mcp-registry.data.ts
• tests/e2e/features/mcp-registry/mcp-registry.spec.ts
• tests/e2e/features/mcp-registry/pages/mcp-registry.page.ts
• tests/e2e/global-setup.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• tests/e2e/features/mcp-registry/pages/mcp-registry.page.ts
• tests/e2e/features/mcp-registry/mcp-registry.spec.ts

[akshaydeo]

Merge activity

• May 15, 5:50 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• May 15, 5:52 AM UTC: Graphite couldn't merge this pull request because a downstack PR fix: updates e2e ui tests for virtual keys management #3460 failed to merge.
• May 15, 5:54 AM UTC: @akshaydeo merged this pull request with Graphite.

The base branch was changed.