mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-07 19:32:17 +00:00
kevinveenbirkenbachandClaude Opus 5
a0dd564955
Each of these specs declared the service it exercises and then, as its first action, signed in through the dashboard's OIDC button. In a round that ships no identity provider that button does not exist, so the spec spent its whole timeout waiting for it and reported the missing login rather than anything about MCP. The junit already said as much, carrying the SSO_SERVICE_ENABLED flag as the skip reason on the neighbouring tests. Nine specs in the directory sign in that way; two already declared sso. The other seven now do too, through the same gate they already imported. Signing in as the deployed identity instead was not open to us: that helper authenticates as the administrator whatever username it is handed, which contradicts the non-member spec asserting the very endpoint the administrator is asserted to reach. Nor can a native member stand in, because the account is created by the OIDC login itself, so a round without one has no members to grant anything to. This buys the honest label at a price worth naming: a round that ships seaweedfs without sso now reports green with no seaweedfs coverage, where it used to report red for the wrong reason. Covering that needs a sign-in the suite does not have yet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
49 lines
1.7 KiB
JavaScript
49 lines
1.7 KiB
JavaScript
const { test, expect } = require("@playwright/test");
|
|
const { resolveTimeout } = require("./timeouts");
|
|
const { skipUnlessServiceEnabled } = require("./service-gating");
|
|
|
|
exports.register = function (shared) {
|
|
test("biber: a user outside the mcp group reaches no MCP tool", async ({ page }) => {
|
|
skipUnlessServiceEnabled("mcp");
|
|
skipUnlessServiceEnabled("sso");
|
|
test.setTimeout(resolveTimeout(120_000));
|
|
|
|
await shared.signInViaDashboardOidc(
|
|
page,
|
|
shared.env.biberUsername,
|
|
shared.env.biberPassword,
|
|
"biber"
|
|
);
|
|
|
|
const token = await page.evaluate(() => window.localStorage.getItem("token"));
|
|
expect(token, "OpenWebUI must store a session token for biber").toBeTruthy();
|
|
|
|
const base = shared.env.openwebuiBaseUrl.replace(/\/+$/, "");
|
|
const config = await page.request.get(`${base}/api/v1/configs/tool_servers`, {
|
|
headers: { Authorization: `Bearer ${token}` },
|
|
failOnStatusCode: false,
|
|
});
|
|
expect(
|
|
config.status(),
|
|
"the tool-server configuration is an administrator surface and must refuse a plain user"
|
|
).toBeGreaterThanOrEqual(400);
|
|
|
|
const response = await page.request.get(`${base}/api/v1/tools/`, {
|
|
headers: { Authorization: `Bearer ${token}` },
|
|
});
|
|
expect(response.ok(), `the tool list must answer biber (HTTP ${response.status()})`).toBeTruthy();
|
|
|
|
const expected = (shared.env.mcpExpectedServers || "")
|
|
.split(",")
|
|
.map((s) => s.trim())
|
|
.filter(Boolean);
|
|
const visible = JSON.stringify(await response.json());
|
|
for (const id of expected) {
|
|
expect(
|
|
visible,
|
|
`${id} is granted to its mcp group, which biber is not in, so its tools must not be listed`
|
|
).not.toContain(id);
|
|
}
|
|
});
|
|
};
|