|
| 1 | +# A client that arrives holding nothing cannot be told to bring a credential |
| 2 | +# without also being told where one comes from. RFC 9728 publishes that at a |
| 3 | +# well-known location derived from the resource identifier, and this instance |
| 4 | +# declares a `jwt` policy over the MCP endpoint whose audience is that |
| 5 | +# identifier, so there is an authorization server it can honestly name. |
| 6 | +# https://datatracker.ietf.org/doc/html/rfc9728 |
| 7 | + |
| 8 | +# The document is readable with no credential, on an instance where everything |
| 9 | +# else demands one. That is the whole point rather than an oversight: gating it |
| 10 | +# would leave it reachable only by somebody who no longer needs to ask |
| 11 | +GET {{base}}/.well-known/oauth-protected-resource/self/v1/mcp |
| 12 | +HTTP 200 |
| 13 | +Content-Type: application/json |
| 14 | +Access-Control-Allow-Origin: * |
| 15 | +Access-Control-Expose-Headers: Link, ETag |
| 16 | +Link: </self/v1/schemas/mcp/protected-resource-metadata/response>; rel="describedby" |
| 17 | +[Captures] |
| 18 | +document_body: body |
| 19 | +document_schema: header "Link" regex "<([^>]+)>" |
| 20 | +{ |
| 21 | + "resource": "{{base}}/self/v1/mcp", |
| 22 | + "authorization_servers": [ "https://keycloak:8443/realms/main" ], |
| 23 | + "bearer_methods_supported": [ "header" ] |
| 24 | +} |
| 25 | + |
| 26 | +POST {{base}}/self/v1/api/schemas/evaluate{{document_schema}} |
| 27 | +Authorization: Bearer full-secret-key |
| 28 | +``` |
| 29 | +{{document_body}} |
| 30 | +``` |
| 31 | +HTTP 200 |
| 32 | +[Asserts] |
| 33 | +jsonpath "$.valid" == true |
| 34 | + |
| 35 | +# The instance is otherwise closed, so the contrast is what proves the |
| 36 | +# exemption rather than a missing policy |
| 37 | +GET {{base}}/catalog/example.json |
| 38 | +HTTP 401 |
| 39 | +Cache-Control: no-store |
| 40 | +Content-Type: application/problem+json |
| 41 | +WWW-Authenticate: Bearer realm="registry" |
| 42 | +Link: </self/v1/schemas/api/error>; rel="describedby" |
| 43 | +[Captures] |
| 44 | +denied_body: body |
| 45 | +error_schema: header "Link" regex "<([^>]+)>" |
| 46 | +{ |
| 47 | + "type": "urn:sourcemeta:one:authentication-required", |
| 48 | + "title": "Unauthorized", |
| 49 | + "status": 401, |
| 50 | + "detail": "This resource requires authentication" |
| 51 | +} |
| 52 | + |
| 53 | +POST {{base}}/self/v1/api/schemas/evaluate{{error_schema}} |
| 54 | +Authorization: Bearer full-secret-key |
| 55 | +``` |
| 56 | +{{denied_body}} |
| 57 | +``` |
| 58 | +HTTP 200 |
| 59 | +[Asserts] |
| 60 | +jsonpath "$.valid" == true |
| 61 | + |
| 62 | +# Presenting a credential changes nothing, since the document describes the |
| 63 | +# resource rather than the caller |
| 64 | +GET {{base}}/.well-known/oauth-protected-resource/self/v1/mcp |
| 65 | +Authorization: Bearer full-secret-key |
| 66 | +HTTP 200 |
| 67 | +Content-Type: application/json |
| 68 | +{ |
| 69 | + "resource": "{{base}}/self/v1/mcp", |
| 70 | + "authorization_servers": [ "https://keycloak:8443/realms/main" ], |
| 71 | + "bearer_methods_supported": [ "header" ] |
| 72 | +} |
| 73 | + |
| 74 | +# A credential that belongs to no policy is not a reason to withhold it either |
| 75 | +GET {{base}}/.well-known/oauth-protected-resource/self/v1/mcp |
| 76 | +Authorization: Bearer not-any-key |
| 77 | +HTTP 200 |
| 78 | +Content-Type: application/json |
| 79 | +{ |
| 80 | + "resource": "{{base}}/self/v1/mcp", |
| 81 | + "authorization_servers": [ "https://keycloak:8443/realms/main" ], |
| 82 | + "bearer_methods_supported": [ "header" ] |
| 83 | +} |
| 84 | + |
| 85 | +# Per RFC 9110 a HEAD carries the same headers and no body |
| 86 | +HEAD {{base}}/.well-known/oauth-protected-resource/self/v1/mcp |
| 87 | +HTTP 200 |
| 88 | +Content-Type: application/json |
| 89 | +Access-Control-Allow-Origin: * |
| 90 | +Link: </self/v1/schemas/mcp/protected-resource-metadata/response>; rel="describedby" |
| 91 | +[Asserts] |
| 92 | +bytes count == 0 |
| 93 | + |
| 94 | +# A browser-based client fetches this cross-origin, so the preflight has to |
| 95 | +# admit it |
| 96 | +OPTIONS {{base}}/.well-known/oauth-protected-resource/self/v1/mcp |
| 97 | +Origin: http://example.com |
| 98 | +Access-Control-Request-Method: GET |
| 99 | +HTTP 204 |
| 100 | +Cache-Control: no-store |
| 101 | +Access-Control-Allow-Origin: * |
| 102 | +Access-Control-Allow-Methods: GET, HEAD, OPTIONS |
| 103 | +[Asserts] |
| 104 | +bytes count == 0 |
| 105 | + |
| 106 | +# The document is read, never written |
| 107 | +POST {{base}}/.well-known/oauth-protected-resource/self/v1/mcp |
| 108 | +HTTP 405 |
| 109 | +Cache-Control: no-store |
| 110 | +Content-Type: application/problem+json |
| 111 | +Allow: GET, HEAD, OPTIONS |
| 112 | +Link: </self/v1/schemas/api/error>; rel="describedby" |
| 113 | +[Captures] |
| 114 | +method_body: body |
| 115 | +{ |
| 116 | + "type": "urn:sourcemeta:one:method-not-allowed", |
| 117 | + "title": "Method Not Allowed", |
| 118 | + "status": 405, |
| 119 | + "detail": "This HTTP method is invalid for this URL" |
| 120 | +} |
| 121 | + |
| 122 | +POST {{base}}/self/v1/api/schemas/evaluate{{error_schema}} |
| 123 | +Authorization: Bearer full-secret-key |
| 124 | +``` |
| 125 | +{{method_body}} |
| 126 | +``` |
| 127 | +HTTP 200 |
| 128 | +[Asserts] |
| 129 | +jsonpath "$.valid" == true |
| 130 | + |
| 131 | +# The endpoint the document describes still refuses an anonymous caller, so |
| 132 | +# publishing where a token comes from did not hand one out |
| 133 | +POST {{base}}/self/v1/mcp |
| 134 | +MCP-Protocol-Version: 2025-11-25 |
| 135 | +Content-Type: application/json |
| 136 | +``` |
| 137 | +{ "jsonrpc": "2.0", "id": 1, "method": "ping" } |
| 138 | +``` |
| 139 | +HTTP 401 |
| 140 | +Cache-Control: no-store |
| 141 | +WWW-Authenticate: Bearer realm="registry" |
| 142 | +[Asserts] |
| 143 | +jsonpath "$.type" == "urn:sourcemeta:one:authentication-required" |
| 144 | +jsonpath "$.status" == 401 |
0 commit comments