| 16 | const dynamicOAuthClientId = "client_dynamic_oauth_fixture"; |
| 17 | |
| 18 | const makeVerifier = async () => { |
| 19 | const { publicKey, privateKey } = await generateKeyPair("RS256"); |
| 20 | const jwk = await exportJWK(publicKey); |
| 21 | const jwks = createLocalJWKSet({ keys: [{ ...jwk, kid: "test-key" }] }); |
| 22 | const sign = (claims: Record<string, unknown>) => |
| 23 | new SignJWT({ org_id: "org_test", ...claims }) |
| 24 | .setProtectedHeader({ alg: "RS256", kid: "test-key" }) |
| 25 | .setIssuer(issuer) |
| 26 | .setSubject("user_test") |
| 27 | .setIssuedAt() |
| 28 | .setExpirationTime("5m") |
| 29 | .sign(privateKey); |
| 30 | |
| 31 | return { jwks, sign }; |
| 32 | }; |
| 33 | |
| 34 | describe("MCP AuthKit token verification", () => { |
| 35 | it.effect("low-level verifier rejects mismatched audience when audience is required", () => |