tests: add OAuth2 issuance, JWT verification, consent, discovery, sessions, and MCP auth unit tests

[Pratham-Mishra04]

Summary

Adds a comprehensive test suite for the OAuth2/MCP authentication layer, covering the configstore persistence layer, HTTP handler logic, JWT issuance and verification, consent flows, session management, and discovery endpoints.

Changes

• Added configstore tests validating the OAuth2 signing key auto-generation and stability, authorize request atomic state transitions (pending → consented → code_issued), single-use code enforcement, expired code rejection, refresh token rotation and replay detection, family-wide revocation, token and client sweep/GC behavior, and the identity filter OR-group parenthesization in ListOauthUserTokens.
• Added handler tests for getMCPServerForRequest covering the JWT path (vk/user/session modes, active/inactive VK checks, session validation matching, auth enforcement gating) and the header/anonymous path (header VK acceptance and rejection, anonymous fallback, OAuth strict mode WWW-Authenticate responses).
• Added JWT verification tests covering all valid modes, a full matrix of rejection cases (expired, nbf in future, missing claims, issuer/audience mismatch, wrong kid, wrong signing key, non-RS256 algorithms, alg:none, malformed tokens), and infrastructure fault isolation (nil store, unavailable signing key).
• Added consent flow tests for flowDetail (pending, missing, empty id, expired, already-consented) and flowSubmit across VK (active, inactive, unknown, empty, double-submit), session (enforced vs. not enforced), user (no resolver, resolved, no session), and VK-to-user upgrade binding (matching owner, mismatched owner, not signed in).
• Added OAuth2 issuance handler tests for DCR registration, the authorize endpoint (happy path, loopback port flexibility, unknown client, unregistered redirect, protocol error redirects), token endpoint authorization code exchange (happy path, PKCE mismatch, single-use, expired, client_id mismatch, missing fields, unsupported grant), and refresh token rotation and replay guard.
• Added session management handler tests for listing grants and revoking grants with identity-gated authorization (vk mode unrestricted, user mode caller-match, mismatch, unauthenticated).
• Added discovery handler tests verifying that headers mode returns 404 on all discovery endpoints, while oauth and both modes serve PRM, AS metadata, and JWKS with correct field values.
• Added utility tests for matchRedirectURI (exact match, loopback port flexibility, path/scheme enforcement, malformed input), oauth2IssuerURL (configured vs. request-host fallback), and oauth2ServerCfg default TTL values.
• Introduced shared test infrastructure: mockOAuth2Store, newTestSigningKey, newTestOAuth2Config, mintTestToken, newTestMCPHandler, and real SQLite-backed store helpers for issuance tests that require actual atomic semantics.

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

go test ./framework/configstore/... ./transports/bifrost-http/handlers/...

All new test files are self-contained and use in-memory SQLite or mock stores; no external services are required.

Screenshots/Recordings

N/A

Breaking changes

• No

Related issues

N/A

Security considerations

Tests explicitly cover security-critical paths: JWT algorithm confusion (alg:none, HS256, RS384), replay detection for authorization codes and refresh tokens, family-wide token revocation on replay, inactive VK rejection, identity mismatch on session revocation, and WWW-Authenticate header presence on OAuth strict mode rejections.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Pratham-Mishra04]

• tests: add MCP auth e2e collection covering discovery, credential matrix, OAuth issuance, refresh rotation, revocation window, and runtime mode flip #4525 : 2 dependent PRs (#4744 , #4750 )
• tests: add MCP auth mode e2e collection and Newman runner for headers/both/oauth #4524
• tests: add OAuth2 issuance, JWT verification, consent, discovery, sessions, and MCP auth unit tests #4523 👈 (View in Graphite)
• feat: add mcp_server_auth_mode and OAuth 2.1 gateway auth docs with gateway-auth page #4522
• ui: add OAuth Grants page and identity exact-match filter for MCP sessions #4511
• ui: add OAuth2 consent page and MCP server auth mode settings #4510
• feat: add OAuth2 session listing, revocation, family-revocation, VK liveness check, and sweep worker #4509
• feat: add JWT Bearer authentication path for /mcp with session validation and context injection #4508
• feat: add OAuth2ConsentHandler with VK, session, and user identity resolution modes #4507
• feat: add OAuth2 issuance endpoints (DCR, authorize, token) with PKCE and refresh token rotation #4506
• feat: add OAuth2 AS discovery endpoints, signing key management, and MCPServerAuthMode config #4505
• refactor: rename MCP handler files to remove underscores and drop redundant prefixes #4747
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ff4a60b9-c28c-46d3-aeab-9e6814fe0ffe

📥 Commits

Reviewing files that changed from the base of the PR and between 619d270 and 582cdb3.

📒 Files selected for processing (10)

• framework/configstore/rdb_mcp_sessions_identity_test.go
• framework/configstore/rdb_oauth2_test.go
• transports/bifrost-http/handlers/mcpoauth2consent_test.go
• transports/bifrost-http/handlers/mcpoauth2discovery_test.go
• transports/bifrost-http/handlers/mcpoauth2issuance_test.go
• transports/bifrost-http/handlers/mcpoauth2jwt_test.go
• transports/bifrost-http/handlers/mcpoauth2sessions_test.go
• transports/bifrost-http/handlers/mcpoauth2utils_test.go
• transports/bifrost-http/handlers/mcpserver_auth_test.go
• transports/bifrost-http/handlers/providers_test.go

📝 Walkthrough

Walkthrough

Adds OAuth2 and MCP auth test coverage across config-store behavior, handler flows, JWT verification, discovery, consent, issuance, sessions, and server routing, plus a small provider fixture cleanup.

Changes

ConfigStore OAuth2 and MCP Sessions Tests

Layer / File(s)	Summary
OAuth2 store setup and consent tests framework/configstore/rdb_oauth2_test.go	Defines the OAuth2 test store and helpers, then tests signing-key generation, consent transitions, and authorize-request consumption with expiry handling.
Refresh token and sweep tests framework/configstore/rdb_oauth2_test.go	Tests refresh-token rotation and replay guards, family revocation, sweep behavior, orphaned-client cleanup, expired authorize-request sweeping, and mode-scoped revocation.
Session listing and identity filters framework/configstore/rdb_oauth2_test.go, framework/configstore/rdb_mcp_sessions_identity_test.go	Tests OAuth2 session listing and revocation behavior, plus MCP session identity exact-match filtering and auth-mode composition.

HTTP Handler OAuth2 Tests

Layer / File(s)	Summary
JWT test store and signing helpers transports/bifrost-http/handlers/mcpoauth2jwt_test.go	Defines the OAuth2 store stub, deterministic RSA signing helpers, config setup, and JWT minting helpers used by the JWT handler tests.
Bearer extraction and JWT verification tests transports/bifrost-http/handlers/mcpoauth2jwt_test.go	Tests bearer extraction, JWT verification acceptance and rejection paths, config-fault error labeling, and JWT context injection by bf_mode.
OAuth2 utility and discovery tests transports/bifrost-http/handlers/mcpoauth2utils_test.go, transports/bifrost-http/handlers/mcpoauth2discovery_test.go	Tests redirect URI matching, issuer URL fallback behavior, default OAuth2 server TTL population, discovery endpoint gating, metadata JSON, and JWKS output.
Consent flow detail, modes, and submission tests transports/bifrost-http/handlers/mcpoauth2consent_test.go	Introduces consent handler scaffolding and tests flow detail retrieval, available modes, VK/session/user submission paths, and VK-to-user binding upgrade behavior.
Token issuance handler integration tests transports/bifrost-http/handlers/mcpoauth2issuance_test.go	Sets up a SQLite-backed store for issuance tests and covers DCR registration, authorization redirects, authorization-code token exchange, and refresh-token rotation and replay revocation.
Session and MCP server auth routing tests transports/bifrost-http/handlers/mcpoauth2sessions_test.go, transports/bifrost-http/handlers/mcpserver_auth_test.go	Tests session listing and revocation behavior, then covers MCP server selection for JWT, header-VK, anonymous, and strict OAuth auth modes.

Provider Test Fixture Cleanup

Layer / File(s)	Summary
Disabled-key fixture cleanup transports/bifrost-http/handlers/providers_test.go	Deletes the boolPtr helper and updates two provider tests to construct disabled-key booleans inline.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Suggested reviewers

• akshaydeo

Poem

A bunny nibbled code all day,
On OAuth carrots bright and gray.
JWT hops and tokens spin,
While consent bells chime within.
🐇🥕

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 26.17% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding OAuth2/MCP authentication tests across handlers, configstore, and JWT flows.
Description check	✅ Passed	The description follows the template well and includes a clear summary, detailed changes, testing, affected areas, security notes, and checklist items.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-18-feat_adds_unit_tests_for_mcp_oauth_server

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

Test-only additions with no production code changes; all new tests are self-contained and use in-memory SQLite or mock stores.

The three comments are coverage suggestions for edge-case security properties not yet asserted. None represent a defect in the tests already written; the shared infrastructure and real-store issuance tests are well-designed.

No files require special attention; coverage gaps noted are optional improvements in mcpoauth2issuance_test.go and mcpoauth2consent_test.go.

Important Files Changed

Filename	Overview
framework/configstore/rdb_oauth2_test.go	New file. Real SQLite-backed tests for OAuth2 store operations: signing key stability, authorize-request state machine, single-use code, refresh-token rotation/replay/family-revocation, and sweep/GC ordering.
framework/configstore/rdb_mcp_sessions_identity_test.go	New file. Pins ListOauthUserTokens SQL OR-group parenthesization so the identity filter correctly ANDs with the auth_mode filter.
transports/bifrost-http/handlers/mcpoauth2jwt_test.go	New file. Shared test infrastructure and full JWT rejection matrix including algorithm confusion (alg:none, HS256, RS384), wrong kid, wrong key, and infrastructure fault isolation.
transports/bifrost-http/handlers/mcpserver_auth_test.go	New file. Tests getMCPServerForRequest across all auth branches: JWT vk/user/session modes, inactive/unknown VK rejection, session validation, header VK, anonymous fallback, and OAuth strict WWW-Authenticate.
transports/bifrost-http/handlers/mcpoauth2consent_test.go	New file. Tests flowDetail and flowSubmit across all VK/session/user modes, double-submit, and VK-to-user upgrade binding.
transports/bifrost-http/handlers/mcpoauth2issuance_test.go	New file. Real SQLite store for issuance handler tests: DCR, authorize, token exchange, refresh rotation and replay with family revocation.
transports/bifrost-http/handlers/mcpoauth2sessions_test.go	New file. Tests listSessions and revokeSession with authorization delegated to the store's scoped read.
transports/bifrost-http/handlers/mcpoauth2discovery_test.go	New file. Tests discovery gating by auth mode and validates PRM, AS metadata, and JWKS field values.
transports/bifrost-http/handlers/mcpoauth2utils_test.go	New file. Tests matchRedirectURI, oauth2IssuerURL, and oauth2ServerCfg default TTL values.
transports/bifrost-http/handlers/providers_test.go	Removes boolPtr helper and replaces two call sites with new(false); Go's built-in new takes a type argument, not a value literal.

_{Reviews (23): Last reviewed commit: "feat: adds unit tests for mcp oauth serv..." | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@transports/bifrost-http/handlers/mcpoauth2jwt_test.go`:
- Around line 311-340: The algorithm rejection subtests in verifyMCPJWT are not
isolating the alg check because they omit baseline time claims and can fail
earlier for missing claims. Update the test cases in mcpoauth2jwt_test.go to
start from the same valid claim set used by mintTestToken(), then vary only the
algorithm and signature details for the HS256, RS384, and alg=none cases. This
keeps the other claims valid so the tests specifically verify algorithm
rejection behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 618b8931-087e-4313-9fec-0ae1dabf3d73

📥 Commits

Reviewing files that changed from the base of the PR and between 5ac5266 and 074f31b.

📒 Files selected for processing (10)

• framework/configstore/rdb_mcp_sessions_identity_test.go
• framework/configstore/rdb_oauth2_test.go
• transports/bifrost-http/handlers/mcpoauth2consent_test.go
• transports/bifrost-http/handlers/mcpoauth2discovery_test.go
• transports/bifrost-http/handlers/mcpoauth2issuance_test.go
• transports/bifrost-http/handlers/mcpoauth2jwt_test.go
• transports/bifrost-http/handlers/mcpoauth2sessions_test.go
• transports/bifrost-http/handlers/mcpoauth2utils_test.go
• transports/bifrost-http/handlers/mcpserver_auth_test.go
• transports/bifrost-http/handlers/providers_test.go

🚧 Files skipped from review as they are similar to previous changes (8)

• framework/configstore/rdb_mcp_sessions_identity_test.go
• transports/bifrost-http/handlers/mcpoauth2discovery_test.go
• transports/bifrost-http/handlers/providers_test.go
• transports/bifrost-http/handlers/mcpoauth2sessions_test.go
• transports/bifrost-http/handlers/mcpoauth2issuance_test.go
• transports/bifrost-http/handlers/mcpoauth2consent_test.go
• transports/bifrost-http/handlers/mcpoauth2utils_test.go
• framework/configstore/rdb_oauth2_test.go

[Pratham-Mishra04]

Merge activity

• Jun 30, 1:53 PM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jun 30, 2:20 PM UTC: Graphite rebased this pull request as part of a merge.
• Jun 30, 2:21 PM UTC: @Pratham-Mishra04 merged this pull request with Graphite.

The base branch was changed.