|
| 1 | +/** |
| 2 | + * ObjectUI |
| 3 | + * Copyright (c) 2024-present ObjectStack Inc. |
| 4 | + * |
| 5 | + * This source code is licensed under the MIT license found in the |
| 6 | + * LICENSE file in the root directory of this source tree. |
| 7 | + */ |
| 8 | + |
| 9 | +/** |
| 10 | + * OAuthConsentPage names every MCP scope the spec declares, in every built-in |
| 11 | + * language, and announces any other scope as unrecognised (objectstack#26587). |
| 12 | + * |
| 13 | + * `metadata:write` reached the consent screen as its raw spelling: the page |
| 14 | + * mapped the three older agent scopes by hand and had no case for the fourth, |
| 15 | + * so the one scope that lets an agent build in the user's environment was the |
| 16 | + * only one left unexplained. The walk below takes its subjects from |
| 17 | + * `MCP_OAUTH_SCOPES`, so a scope the spec adds is a subject here the moment it |
| 18 | + * lands, and its English is pinned to `MCP_OAUTH_SCOPE_CONSENT_COPY`, the |
| 19 | + * sentence the spec declares beside the scope. |
| 20 | + * |
| 21 | + * Each language's catalogue is loaded BEFORE the instance is created, so the |
| 22 | + * rows are read from that language's pack, never from the `en` fallback a |
| 23 | + * missing key would render through. |
| 24 | + */ |
| 25 | + |
| 26 | +import { describe, it, expect, vi, afterEach } from 'vitest'; |
| 27 | +import { render, screen, cleanup } from '@testing-library/react'; |
| 28 | +import { MemoryRouter, Route, Routes } from 'react-router-dom'; |
| 29 | +import { MCP_OAUTH_SCOPE_CONSENT_COPY, MCP_OAUTH_SCOPES } from '@objectstack/spec/ai'; |
| 30 | +import { AuthProvider } from '@object-ui/auth'; |
| 31 | +import type { AuthClient } from '@object-ui/auth'; |
| 32 | +import { BUILT_IN_LANGUAGE_CODES, createI18n, en, loadBuiltInLocale } from '@object-ui/i18n'; |
| 33 | +import { OAuthConsentPage } from '../OAuthConsentPage'; |
| 34 | + |
| 35 | +const CLIENT_ID = 'mcp-client'; |
| 36 | + |
| 37 | +afterEach(() => { |
| 38 | + cleanup(); |
| 39 | + vi.unstubAllGlobals(); |
| 40 | +}); |
| 41 | + |
| 42 | +function authClient(): AuthClient { |
| 43 | + return { |
| 44 | + getSession: vi |
| 45 | + .fn() |
| 46 | + .mockResolvedValue({ user: { id: 'u1', email: 'me@example.com' }, session: {} }), |
| 47 | + getConfig: vi.fn().mockResolvedValue({ features: {} }), |
| 48 | + } as unknown as AuthClient; |
| 49 | +} |
| 50 | + |
| 51 | +function stubPublicClient() { |
| 52 | + vi.stubGlobal( |
| 53 | + 'fetch', |
| 54 | + vi.fn(() => |
| 55 | + Promise.resolve({ |
| 56 | + ok: true, |
| 57 | + status: 200, |
| 58 | + json: async () => ({ client_id: CLIENT_ID, client_name: 'Claude Code' }), |
| 59 | + }), |
| 60 | + ), |
| 61 | + ); |
| 62 | +} |
| 63 | + |
| 64 | +async function renderConsent(scope: string, language: string) { |
| 65 | + await loadBuiltInLocale(language); |
| 66 | + createI18n({ defaultLanguage: language, detectBrowserLanguage: false }); |
| 67 | + stubPublicClient(); |
| 68 | + const search = `?client_id=${CLIENT_ID}&scope=${encodeURIComponent(scope)}&sig=s1`; |
| 69 | + window.history.replaceState({}, '', `/oauth/consent${search}`); |
| 70 | + return render( |
| 71 | + <AuthProvider authUrl="/api/v1/auth" client={authClient()}> |
| 72 | + <MemoryRouter initialEntries={[`/oauth/consent${search}`]}> |
| 73 | + <Routes> |
| 74 | + <Route path="/oauth/consent" element={<OAuthConsentPage />} /> |
| 75 | + </Routes> |
| 76 | + </MemoryRouter> |
| 77 | + </AuthProvider>, |
| 78 | + ); |
| 79 | +} |
| 80 | + |
| 81 | +/** The consent list's rows, in the order the page draws them. */ |
| 82 | +async function scopeRows(): Promise<string[]> { |
| 83 | + const list = await screen.findByRole('list'); |
| 84 | + return Array.from(list.querySelectorAll('li')).map((li) => li.textContent ?? ''); |
| 85 | +} |
| 86 | + |
| 87 | +const UNKNOWN_SCOPE = 'reports:export'; |
| 88 | +const UNRECOGNISED_EN = en.oauth.consent.scope.unrecognised; |
| 89 | + |
| 90 | +describe('OAuthConsentPage — every MCP scope in words (objectstack#26587)', () => { |
| 91 | + it('names each MCP scope in en with the sentence the spec declares for it', async () => { |
| 92 | + await renderConsent(MCP_OAUTH_SCOPES.join(' '), 'en'); |
| 93 | + |
| 94 | + expect(await scopeRows()).toEqual( |
| 95 | + MCP_OAUTH_SCOPES.map((scope) => MCP_OAUTH_SCOPE_CONSENT_COPY[scope]), |
| 96 | + ); |
| 97 | + }); |
| 98 | + |
| 99 | + it.each(BUILT_IN_LANGUAGE_CODES.filter((language) => language !== 'en'))( |
| 100 | + 'names each MCP scope from the %s pack, never as its raw spelling', |
| 101 | + async (language) => { |
| 102 | + await renderConsent(MCP_OAUTH_SCOPES.join(' '), language); |
| 103 | + const rows = await scopeRows(); |
| 104 | + |
| 105 | + expect(rows).toHaveLength(MCP_OAUTH_SCOPES.length); |
| 106 | + MCP_OAUTH_SCOPES.forEach((scope, index) => { |
| 107 | + expect(rows[index]).not.toContain(scope); |
| 108 | + // The `en` sentence here would mean the key is missing from this pack |
| 109 | + // and the row fell back to English. |
| 110 | + expect(rows[index]).not.toBe(MCP_OAUTH_SCOPE_CONSENT_COPY[scope]); |
| 111 | + }); |
| 112 | + }, |
| 113 | + ); |
| 114 | + |
| 115 | + it('announces a scope the page does not name as unrecognised, never as the bare string', async () => { |
| 116 | + await renderConsent(`data:read ${UNKNOWN_SCOPE}`, 'en'); |
| 117 | + |
| 118 | + expect(await scopeRows()).toEqual([ |
| 119 | + MCP_OAUTH_SCOPE_CONSENT_COPY['data:read'], |
| 120 | + UNRECOGNISED_EN.replace('{{scope}}', UNKNOWN_SCOPE), |
| 121 | + ]); |
| 122 | + }); |
| 123 | + |
| 124 | + it('announces an unrecognised scope in the user language too', async () => { |
| 125 | + await renderConsent(UNKNOWN_SCOPE, 'zh'); |
| 126 | + const [row] = await scopeRows(); |
| 127 | + |
| 128 | + expect(row).not.toBe(UNKNOWN_SCOPE); |
| 129 | + expect(row).toContain(UNKNOWN_SCOPE); |
| 130 | + expect(row).not.toBe(UNRECOGNISED_EN.replace('{{scope}}', UNKNOWN_SCOPE)); |
| 131 | + }); |
| 132 | +}); |
0 commit comments