Function TestMCPHTTP_E2E_RFC6750_UnauthenticatedRequest

coderd/mcp/mcp_e2e_test.go:429–458

(t *testing.T)

}

func TestMCPHTTP_E2E_RFC6750_UnauthenticatedRequest(t *testing.T) {
	t.Parallel()

	// Setup Coder server
	_, closer, api := coderdtest.NewWithAPI(t, nil)
	defer closer.Close()

	// Make a request without any authentication headers
	req := &http.Request{
		Method: "POST",
		URL:    mustParseURL(t, api.AccessURL.String()+mcpserver.MCPEndpoint),
		Header: make(http.Header),
	}

	client := &http.Client{}
	resp, err := client.Do(req)
	require.NoError(t, err)
	defer resp.Body.Close()

	// Should get 401 Unauthorized
	require.Equal(t, http.StatusUnauthorized, resp.StatusCode)

	// RFC 6750 requires WWW-Authenticate header on 401 responses
	wwwAuth := resp.Header.Get("WWW-Authenticate")
	require.NotEmpty(t, wwwAuth, "RFC 6750 requires WWW-Authenticate header for 401 responses")
	require.Contains(t, wwwAuth, "Bearer", "WWW-Authenticate header should indicate Bearer authentication")
	require.Contains(t, wwwAuth, `realm="coder"`, "WWW-Authenticate header should include realm")

	t.Logf("RFC 6750 WWW-Authenticate header test successful: %s", wwwAuth)
}

func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
	t.Parallel()