admin/mcp-nextcloud
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test(login-flow): use Astrolabe's client id for management API tests

Browse Source 
The previous commit moved `mcp-login-flow`'s `ALLOWED_MGMT_CLIENT` to
`astrolabeMcpClientOAuth00000000000` so production-shaped Astrolabe
traffic actually validates. Update the management API test fixture to
match: the static OIDC client created in
`tests/server/login_flow/conftest.py:login_flow_static_client_credentials`
now uses the same id `app-hooks/before-starting/26-configure-astrolabe-oauth.sh`
provisions in real deployments, so the test path exercises the same
code as production rather than a substituted fixture-only id.

`mcp-multi-user-basic`'s allowlist is unchanged
(`nextcloudMcpServerUIPublicClient`) and the shared
`configure_astrolabe_for_mcp_server` fixture in `tests/conftest.py`
keeps that as its default, so multi-user-basic tests are unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chris Coutinho
2026-05-09 14:06:02 +02:00
co-authored by Claude Opus 4.7
parent fd8c037eea
commit d83c32a9dd
2 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/server/login_flow/conftest.py
+14 -9
View File
@@ -936,21 +936,26 @@ async def diana_login_flow_mcp_client(
# Static OIDC client used by the management API integration tests.
# Matches the value `mcp-login-flow` and `mcp-multi-user-basic` allowlist
# (`ALLOWED_MGMT_CLIENT=nextcloudMcpServerUIPublicClient`) so tokens issued
# to it pass the management API allowlist check.
STATIC_MGMT_CLIENT_ID = "nextcloudMcpServerUIPublicClient"
# Matches the `mcp-login-flow` allowlist
# (`ALLOWED_MGMT_CLIENT=astrolabeMcpClientOAuth00000000000`) — i.e. the same
# id `app-hooks/before-starting/26-configure-astrolabe-oauth.sh` provisions
# in real deployments — so tokens issued to it pass the management API
# allowlist check on `mcp-login-flow` and exercise the production-shaped
# code path.
STATIC_MGMT_CLIENT_ID = "astrolabeMcpClientOAuth00000000000"
@pytest.fixture(scope="session")
async def login_flow_static_client_credentials(anyio_backend, oauth_callback_server):
"""Pre-create the static OIDC client `nextcloudMcpServerUIPublicClient`
"""Pre-create the static OIDC client `astrolabeMcpClientOAuth00000000000`
via `occ oidc:create` with the test's OAuth callback URL.
The static client_id is allowlisted on `mcp-login-flow` (and
`mcp-multi-user-basic`) via `ALLOWED_MGMT_CLIENT`, so tokens it issues
pass the management API allowlist check. Uses a confidential JWT-token
client to match production Astrolabe configuration.
The static client_id matches the id provisioned by
`app-hooks/before-starting/26-configure-astrolabe-oauth.sh` in real
deployments, and is allowlisted on `mcp-login-flow` via
`ALLOWED_MGMT_CLIENT`, so tokens it issues pass the management API
allowlist check. Uses a confidential JWT-token client to match
production Astrolabe configuration.
Yields: (client_id, client_secret, callback_url, token_endpoint, authorization_endpoint)
"""
tests/server/login_flow/test_management_api.py
+5 -3
View File
@@ -1,9 +1,11 @@
"""Integration tests for the management API on the login-flow MCP server.
These tests drive a real OAuth flow against Nextcloud's `oidc` app using the
static `nextcloudMcpServerUIPublicClient` client (which is allowlisted on the
`mcp-login-flow` container via `ALLOWED_MGMT_CLIENT`), then hit the
management API endpoints with the resulting bearer token.
static `astrolabeMcpClientOAuth00000000000` client (which is allowlisted on
the `mcp-login-flow` container via `ALLOWED_MGMT_CLIENT` and matches the id
provisioned by `app-hooks/before-starting/26-configure-astrolabe-oauth.sh`
in real deployments), then hit the management API endpoints with the
resulting bearer token.
Regression coverage for the bug where /api/v1/apps proxied to OCS v1
/cloud/apps and always 401'd. The handler now uses /ocs/v2.php/cloud/capabilities,