Function TestMCPHTTP_E2E_UnauthenticatedAccess

coderd/mcp/mcp_e2e_test.go:165–221

(t *testing.T)

}

func TestMCPHTTP_E2E_UnauthenticatedAccess(t *testing.T) {
	t.Parallel()

	// Setup Coder server
	_, closer, api := coderdtest.NewWithAPI(t, nil)
	defer closer.Close()

	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
	defer cancel()

	// Test direct HTTP request to verify 401 status code
	mcpURL := api.AccessURL.String() + mcpserver.MCPEndpoint

	// Make a POST request without authentication (MCP over HTTP uses POST)
	//nolint:gosec // Test code using controlled localhost URL
	req, err := http.NewRequestWithContext(ctx, "POST", mcpURL, strings.NewReader(`{"jsonrpc":"2.0","method":"initialize","params":{},"id":1}`))
	require.NoError(t, err, "Should be able to create HTTP request")
	req.Header.Set("Content-Type", "application/json")

	client := &http.Client{}
	resp, err := client.Do(req)
	require.NoError(t, err, "Should be able to make HTTP request")
	defer resp.Body.Close()

	// Verify we get 401 Unauthorized
	require.Equal(t, http.StatusUnauthorized, resp.StatusCode, "Should get HTTP 401 for unauthenticated access")

	// Also test with MCP client to ensure it handles the error gracefully
	mcpClient, err := mcpclient.NewStreamableHttpClient(mcpURL)
	require.NoError(t, err, "Should be able to create MCP client without authentication")
	defer func() {
		if closeErr := mcpClient.Close(); closeErr != nil {
			t.Logf("Failed to close MCP client: %v", closeErr)
		}
	}()

	// Start client and try to initialize - this should fail due to authentication
	err = mcpClient.Start(ctx)
	if err != nil {
		// Authentication failed at transport level - this is expected
		t.Logf("Unauthenticated access test successful: Transport-level authentication error: %v", err)
		return
	}

	initReq := mcp.InitializeRequest{
		Params: mcp.InitializeParams{
			ProtocolVersion: mcp.LATEST_PROTOCOL_VERSION,
			ClientInfo: mcp.Implementation{
				Name:    "test-client-unauth",
				Version: "1.0.0",
			},
		},
	}

	_, err = mcpClient.Initialize(ctx, initReq)
	require.Error(t, err, "Should fail during MCP initialization without authentication")
}