hado/core/tests/Feature/McpAuthTest.php

<?php

namespace Tests\Feature;

use App\Models\AgentToken;
use App\Models\User;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

class McpAuthTest extends TestCase
{
    use RefreshDatabase;

    private const INITIALIZE = [
        'jsonrpc' => '2.0', 'id' => 1, 'method' => 'initialize',
        'params' => ['protocolVersion' => '2025-06-18', 'capabilities' => [], 'clientInfo' => ['name' => 'test', 'version' => '0']],
    ];

    public function test_requires_agent_token(): void
    {
        $this->postJson('/mcp', self::INITIALIZE)->assertStatus(401)->assertJsonPath('message', 'Нужен Bearer-токен агента');
        $this->postJson('/mcp', self::INITIALIZE, ['Authorization' => 'Bearer nope'])->assertStatus(401)->assertJsonPath('message', 'Неизвестный токен агента');
    }

    public function test_remote_user_header_is_not_enough(): void
    {
        $this->postJson('/mcp', self::INITIALIZE, ['X-Remote-User' => 'nikita'])->assertStatus(401);
    }

    public function test_valid_token_reaches_the_server(): void
    {
        $user = User::create(['login' => 'nikita', 'tz' => 'UTC']);
        AgentToken::create(['user_id' => $user->id, 'token_hash' => hash('sha256', 'secret')]);

        $this->postJson('/mcp', self::INITIALIZE, ['Authorization' => 'Bearer secret'])
            ->assertOk()
            ->assertJsonPath('result.serverInfo.name', 'Hado');
    }
}