mirror of
https://gitee.com/ulthon/ulthon_admin.git
synced 2026-08-30 04:35:33 +08:00
561 lines
24 KiB
PHP
561 lines
24 KiB
PHP
<?php
|
||
|
||
declare(strict_types=1);
|
||
|
||
namespace tests;
|
||
|
||
use app\common\service\McpService;
|
||
use app\mcp\service\McpDispatch;
|
||
use GuzzleHttp\Client;
|
||
use PHPUnit\Framework\TestCase;
|
||
use think\facade\Config;
|
||
use think\facade\Db;
|
||
|
||
/**
|
||
* MCP 端点端到端测试（真实 HTTP 栈：/mcp initialize / tools/list / tools/call / 401 / 403 / 审计）.
|
||
*
|
||
* ===== 方案说明（为什么不是 Guzzle 打容器 nginx 127.0.0.1:8000）=====
|
||
* 任务书期望 e2e 直打容器 nginx；但 nginx/fpm 栈读 .env 连的是开发库（ulthon），
|
||
* 而 e2e 断言要求 fixture 自包含（不依赖 orchestrator 手工夹具 key=2/3）且测试库与
|
||
* 开发库严格分离（任务 MUST NOT + ulthon-testing 技能铁律）。事务内的 fixture 对独立
|
||
* HTTP 连接永远不可见——两者在本栈里数学上不可兼得。
|
||
*
|
||
* 采用的可行方案：测试进程内拉起一个专用 php -S 服务（tests/router.php 入口），
|
||
* 该入口与 tests/bootstrap.php 共享同一套 config 级测试库覆盖（require 复用防漂移），
|
||
* 走完整 think HTTP 内核（多应用路由 / 全局中间件 / Session），fixture 提交进测试库、
|
||
* 测试结束硬删自清理。这是同时满足「真实 HTTP e2e」+「自包含 fixture」+「测试库隔离」
|
||
* 的唯一组合。真实 nginx 栈的冒烟由回归步骤（tools:http:call）另行覆盖。
|
||
* 入口文件名必须是 router.php（think-multi-app 入口白名单，见其文件头注释）。
|
||
*
|
||
* ===== 隔离策略（区别于 McpServiceTest 的事务回滚）=====
|
||
* 本类不继承 app\common\test\TestCase（事务对跨进程 HTTP 服务无意义），fixture 以
|
||
* 专有前缀（e2e_mcp_）提交进测试库：
|
||
* - setUpBeforeClass：先清扫上次异常退出可能残留的同前缀行（幂等）
|
||
* - tearDownAfterClass：删除本类全部 tracked fixture（含 mcp_log 审计行）
|
||
*
|
||
* ===== JSON-RPC 会话要求（T8 经验）=====
|
||
* initialize 先行，从响应头提取 Mcp-Session-Id，后续 tools/list / tools/call 必须携带；
|
||
* Mcp-Protocol-Version 用 initialize 返回的协商版本。
|
||
*
|
||
* ===== 超管创建者 =====
|
||
* 不造 admin id=1（seed 已存在）；用全新管理员 + 全新角色（避开 SystemAuthNode 60s
|
||
* 缓存与 adminInfo autoCache 窗口，learnings Task 4/6 的既定模式）。
|
||
*
|
||
* ===== 403 分支 =====
|
||
* mcp.enable 由控制器经 config() 读取；测试经专用入口的 X-E2E-Mcp-Disabled: 1 头
|
||
* 模拟关闭（生产代码零改动），而非动态改 .env（不可行）或 config mock（跨进程无效）。
|
||
*/
|
||
class McpEndpointTest extends TestCase
|
||
{
|
||
private const HOST = '127.0.0.1';
|
||
|
||
private const PORT = 8127;
|
||
|
||
/** 授权节点 A（quick 控制器 index，返回 code=0 JSON 信封）. */
|
||
private const NODE_A = 'system.quick/index';
|
||
|
||
/** 授权节点 B（mcp_key 控制器 index）. */
|
||
private const NODE_B = 'system.mcp_key/index';
|
||
|
||
/** 白名单内但创建者角色未授权的漂移节点（驼峰动作名）. */
|
||
private const NODE_DRIFT = 'system.auth/toggleUser';
|
||
|
||
private static ?Client $client = null;
|
||
|
||
/** @var resource|null */
|
||
private static $serverProc = null;
|
||
|
||
private static bool $serverReady = false;
|
||
|
||
/** @var array<int, int> */
|
||
private static array $createdAdminIds = [];
|
||
|
||
/** @var array<int, int> */
|
||
private static array $createdRoleIds = [];
|
||
|
||
/** @var array<int, int> */
|
||
private static array $createdKeyIds = [];
|
||
|
||
// =========================================================================
|
||
// 服务生命周期 + fixture 清理
|
||
// =========================================================================
|
||
|
||
public static function setUpBeforeClass(): void
|
||
{
|
||
// 安全护栏：本类不继承 app TestCase（无 setUp 校验），自证一次测试库
|
||
// （tests/bootstrap.php 在更早处已有全局护栏，这里是防御纵深）
|
||
$default = (string) Config::get('database.default', 'main');
|
||
$dbName = (string) Config::get('database.connections.' . $default . '.database', '');
|
||
if ($dbName === '' || stripos($dbName, 'test') === false) {
|
||
throw new \RuntimeException('Refusing e2e tests against non-test database: ' . $dbName);
|
||
}
|
||
|
||
self::sweepStaleFixtures();
|
||
self::startServer();
|
||
}
|
||
|
||
public static function tearDownAfterClass(): void
|
||
{
|
||
self::stopServer();
|
||
self::cleanupFixtures(self::$createdAdminIds, self::$createdRoleIds, self::$createdKeyIds);
|
||
self::$createdAdminIds = [];
|
||
self::$createdRoleIds = [];
|
||
self::$createdKeyIds = [];
|
||
}
|
||
|
||
protected function setUp(): void
|
||
{
|
||
if (!self::$serverReady) {
|
||
$this->markTestSkipped('e2e HTTP 服务未能启动（需在容器内运行，php -S + PHP_CLI_SERVER_WORKERS）');
|
||
}
|
||
}
|
||
|
||
/**
|
||
* 清扫上次异常退出残留的 fixture（按专有前缀识别，幂等）.
|
||
*
|
||
* 前缀 e2mcp_（6 字符）：system_auth.title 是 varchar(20)，uniqid() 13 字符，
|
||
* 前缀 + uniqid = 19 恰好放得下（e2e_mcp_ 前缀 8 字符会超长）。
|
||
*/
|
||
private static function sweepStaleFixtures(): void
|
||
{
|
||
$staleRoleIds = Db::name('system_auth')->whereLike('title', 'e2mcp_%')->column('id');
|
||
$staleKeyIds = Db::name('system_mcp_key')->whereLike('title', 'e2mcp_%')->column('id');
|
||
|
||
self::cleanupFixtures(
|
||
Db::name('system_admin')->whereLike('username', 'e2mcp_%')->column('id'),
|
||
array_map('intval', $staleRoleIds),
|
||
array_map('intval', $staleKeyIds)
|
||
);
|
||
}
|
||
|
||
/**
|
||
* 硬删 fixture（Db::name 直删不触发软删模型；顺序兼顾引用关系）.
|
||
*
|
||
* @param array<int, int> $adminIds
|
||
* @param array<int, int> $roleIds
|
||
* @param array<int, int> $keyIds
|
||
*/
|
||
private static function cleanupFixtures(array $adminIds, array $roleIds, array $keyIds): void
|
||
{
|
||
if ($roleIds !== []) {
|
||
Db::name('system_auth_node')->whereIn('auth_id', $roleIds)->delete();
|
||
Db::name('system_auth')->whereIn('id', $roleIds)->delete();
|
||
}
|
||
if ($keyIds !== []) {
|
||
Db::name('system_mcp_log')->whereIn('key_id', $keyIds)->delete();
|
||
Db::name('system_mcp_key_node')->whereIn('key_id', $keyIds)->delete();
|
||
Db::name('system_mcp_key')->whereIn('id', $keyIds)->delete();
|
||
}
|
||
if ($adminIds !== []) {
|
||
Db::name('system_admin')->whereIn('id', $adminIds)->delete();
|
||
}
|
||
}
|
||
|
||
private static function startServer(): void
|
||
{
|
||
if (self::$serverReady) {
|
||
return;
|
||
}
|
||
|
||
// 先清扫上次异常退出残留的本端口 php -S（自愈，避免端口被占导致 skip）
|
||
self::sweepServerProcesses();
|
||
|
||
$root = dirname(__DIR__);
|
||
$null = PHP_OS_FAMILY === 'Windows' ? 'NUL' : '/dev/null';
|
||
// 入口文件名必须命中 think-multi-app 入口白名单（router.php），否则应用绑定错乱
|
||
// exec 前缀：proc_open 在 Unix 经 /bin/sh -c 包装，exec 让 sh 自替换为 php，
|
||
// 保证 proc_terminate 信号直达 php -S master 而不是只杀 sh 包装
|
||
$exec = PHP_OS_FAMILY === 'Windows' ? '' : 'exec ';
|
||
$cmd = sprintf(
|
||
'%sphp -S %s:%d -t %s %s',
|
||
$exec,
|
||
self::HOST,
|
||
self::PORT,
|
||
escapeshellarg($root . DIRECTORY_SEPARATOR . 'public'),
|
||
escapeshellarg($root . DIRECTORY_SEPARATOR . 'tests' . DIRECTORY_SEPARATOR . 'router.php')
|
||
);
|
||
|
||
// PHP_CLI_SERVER_WORKERS>1：tools/call 的 /admin 自请求回环需要并发 worker（Linux/PHP>=7.4）
|
||
self::$serverProc = proc_open(
|
||
$cmd,
|
||
[0 => ['pipe', 'r'], 1 => ['file', $null, 'w'], 2 => ['file', $null, 'w']],
|
||
$pipes,
|
||
$root,
|
||
['PHP_CLI_SERVER_WORKERS' => '4', 'XDEBUG_MODE' => 'off']
|
||
);
|
||
if (!is_resource(self::$serverProc)) {
|
||
return;
|
||
}
|
||
fclose($pipes[0]);
|
||
|
||
self::$client = new Client([
|
||
'base_uri' => 'http://' . self::HOST . ':' . self::PORT,
|
||
'http_errors' => false,
|
||
'connect_timeout' => 2,
|
||
'timeout' => 30,
|
||
]);
|
||
|
||
// 就绪探测：POST /mcp 无认证 -> 期待 401（任何 HTTP 响应即视为服务已就绪）
|
||
$deadline = microtime(true) + 15.0;
|
||
while (microtime(true) < $deadline) {
|
||
$status = proc_get_status(self::$serverProc);
|
||
if (!$status['running']) {
|
||
return; // 进程早退（端口占用等），由 setUp 走 skip
|
||
}
|
||
|
||
try {
|
||
$probe = self::$client->post('/mcp', ['json' => []]);
|
||
if ($probe->getStatusCode() > 0) {
|
||
self::$serverReady = true;
|
||
|
||
return;
|
||
}
|
||
} catch (\GuzzleHttp\Exception\ConnectException) {
|
||
usleep(200_000);
|
||
}
|
||
}
|
||
}
|
||
|
||
private static function stopServer(): void
|
||
{
|
||
if (is_resource(self::$serverProc)) {
|
||
proc_terminate(self::$serverProc);
|
||
proc_close(self::$serverProc);
|
||
self::$serverProc = null;
|
||
}
|
||
// SIGTERM 只送达到 master：PHP_CLI_SERVER_WORKERS fork 出的 worker 可能成为孤儿
|
||
// 继续占住端口，强清扫兜底（幂等，无残留时无操作）
|
||
self::sweepServerProcesses();
|
||
self::$serverReady = false;
|
||
}
|
||
|
||
/**
|
||
* 清扫残留的本端口 php -S 进程（容器最小镜像无 pkill/procps，遍历 /proc 匹配 cmdline）.
|
||
*
|
||
* 识别特征：命令行同时含「php -S 127.0.0.1:8127」与本项目 tests/router.php，
|
||
* 不会误杀其它进程；无残留时无操作。
|
||
*/
|
||
private static function sweepServerProcesses(): void
|
||
{
|
||
if (PHP_OS_FAMILY === 'Windows' || !is_dir('/proc')) {
|
||
return; // 容器（Linux）路径；其它环境靠 proc_terminate 兜底
|
||
}
|
||
|
||
$signature = sprintf('php -S %s:%d', self::HOST, self::PORT);
|
||
foreach (glob('/proc/[0-9]*/cmdline') ?: [] as $cmdline) {
|
||
$raw = @file_get_contents($cmdline);
|
||
if ($raw === false) {
|
||
continue;
|
||
}
|
||
$cmd = str_replace("\0", ' ', $raw);
|
||
if (str_contains($cmd, $signature) && str_contains($cmd, 'tests' . DIRECTORY_SEPARATOR . 'router.php')) {
|
||
$pid = (int) basename(dirname($cmdline));
|
||
if ($pid > 1 && function_exists('posix_kill')) {
|
||
@posix_kill($pid, 9); // 尽力而为；失败由端口探测兜底（会走 skip 分支）
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
// =========================================================================
|
||
// fixture 工厂（提交进测试库，tracked + 前缀可清扫；列结构镜像 McpServiceTest）
|
||
// =========================================================================
|
||
|
||
/**
|
||
* 造一套完整 fixture：角色（授权 $roleNodes）+ 管理员 + 密钥（白名单 $whitelist）.
|
||
*
|
||
* @return array{key_id: int, plaintext: string, admin_id: int, role_id: int}
|
||
*/
|
||
private function createFixture(
|
||
array $roleNodes = [self::NODE_A, self::NODE_B],
|
||
array $whitelist = [self::NODE_A, self::NODE_B, self::NODE_DRIFT]
|
||
): array {
|
||
$uniq = strtolower(uniqid());
|
||
|
||
$roleId = Db::name('system_auth')->insertGetId([
|
||
'title' => 'e2mcp_' . $uniq,
|
||
'status' => 2, // system_auth 枚举：1=禁用 2=启用
|
||
'sort' => 100,
|
||
'create_time' => time(),
|
||
'update_time' => time(),
|
||
'delete_time' => 0,
|
||
]);
|
||
foreach ($roleNodes as $node) {
|
||
Db::name('system_auth_node')->insert(['auth_id' => $roleId, 'node' => $node]);
|
||
}
|
||
|
||
$adminId = Db::name('system_admin')->insertGetId([
|
||
'username' => 'e2mcp_admin_' . $uniq,
|
||
'password' => 'should-not-leak',
|
||
'auth_ids' => (string) $roleId,
|
||
'status' => 1,
|
||
'create_time' => time(),
|
||
'update_time' => time(),
|
||
'delete_time' => 0,
|
||
]);
|
||
|
||
$plaintext = 'sk-mcp-e2e-' . bin2hex(random_bytes(16));
|
||
$keyId = Db::name('system_mcp_key')->insertGetId([
|
||
'title' => 'e2mcp_key_' . $uniq,
|
||
'key' => hash('sha256', $plaintext),
|
||
'key_prefix' => substr($plaintext, 0, 11),
|
||
'bind_admin_id' => $adminId,
|
||
'status' => 1,
|
||
'remark' => 'e2e fixture',
|
||
'use_num' => 0,
|
||
'last_use_time' => 0,
|
||
'create_time' => time(),
|
||
'update_time' => time(),
|
||
'delete_time' => 0,
|
||
]);
|
||
foreach ($whitelist as $node) {
|
||
Db::name('system_mcp_key_node')->insert(['key_id' => $keyId, 'node' => $node]);
|
||
}
|
||
|
||
self::$createdRoleIds[] = (int) $roleId;
|
||
self::$createdAdminIds[] = (int) $adminId;
|
||
self::$createdKeyIds[] = (int) $keyId;
|
||
|
||
return [
|
||
'key_id' => (int) $keyId,
|
||
'plaintext' => $plaintext,
|
||
'admin_id' => (int) $adminId,
|
||
'role_id' => (int) $roleId,
|
||
];
|
||
}
|
||
|
||
// =========================================================================
|
||
// JSON-RPC 助手
|
||
// =========================================================================
|
||
|
||
/**
|
||
* 发送一次 JSON-RPC 请求.
|
||
*
|
||
* @return array{status: int, body: array, session_id: string, protocol: string, raw: string}
|
||
*/
|
||
private function rpc(string $method, array $params, ?string $bearer, ?string $sessionId = null, ?string $protocol = null, array $extraHeaders = []): array
|
||
{
|
||
$payload = [
|
||
'jsonrpc' => '2.0',
|
||
'id' => random_int(1, 1000000),
|
||
'method' => $method,
|
||
'params' => $params ?: new \stdClass(),
|
||
];
|
||
|
||
$headers = ['Accept' => 'application/json'] + $extraHeaders;
|
||
if ($bearer !== null) {
|
||
$headers['Authorization'] = 'Bearer ' . $bearer;
|
||
}
|
||
if ($sessionId !== null) {
|
||
$headers['Mcp-Session-Id'] = $sessionId;
|
||
}
|
||
if ($protocol !== null) {
|
||
$headers['Mcp-Protocol-Version'] = $protocol;
|
||
}
|
||
|
||
$response = self::$client->post('/mcp', ['headers' => $headers, 'json' => $payload]);
|
||
$raw = (string) $response->getBody();
|
||
$body = json_decode($raw, true);
|
||
|
||
return [
|
||
'status' => $response->getStatusCode(),
|
||
'body' => is_array($body) ? $body : [],
|
||
'session_id' => (string) ($response->getHeader('Mcp-Session-Id')[0] ?? ''),
|
||
'protocol' => (string) ($response->getHeader('Mcp-Protocol-Version')[0] ?? ''),
|
||
'raw' => $raw,
|
||
];
|
||
}
|
||
|
||
/**
|
||
* initialize 并返回会话上下文 [session_id, protocol, body].
|
||
*
|
||
* @return array{0: string, 1: string, 2: array}
|
||
*/
|
||
private function initialize(string $bearer, array $extraHeaders = []): array
|
||
{
|
||
$res = $this->rpc('initialize', [
|
||
'protocolVersion' => '2025-06-18',
|
||
'capabilities' => new \stdClass(),
|
||
'clientInfo' => ['name' => 'ulthon-e2e-test', 'version' => '1.0'],
|
||
], $bearer, null, null, $extraHeaders);
|
||
|
||
$this->assertSame(200, $res['status'], 'initialize 应 200，body: ' . $res['raw']);
|
||
$this->assertNotSame('', $res['session_id'], 'initialize 必须返回 Mcp-Session-Id 头');
|
||
$protocol = $res['protocol'] !== ''
|
||
? $res['protocol']
|
||
: (string) ($res['body']['result']['protocolVersion'] ?? '2025-06-18');
|
||
|
||
return [$res['session_id'], $protocol, $res['body']];
|
||
}
|
||
|
||
// =========================================================================
|
||
// 1. initialize：成功 / 401 / 403
|
||
// =========================================================================
|
||
|
||
public function test_initialize_returns_200_with_session_and_server_info(): void
|
||
{
|
||
$fx = $this->createFixture();
|
||
|
||
$res = $this->rpc('initialize', [
|
||
'protocolVersion' => '2025-06-18',
|
||
'capabilities' => new \stdClass(),
|
||
'clientInfo' => ['name' => 'ulthon-e2e-test', 'version' => '1.0'],
|
||
], $fx['plaintext']);
|
||
|
||
$this->assertSame(200, $res['status'], 'body: ' . $res['raw']);
|
||
$this->assertNotSame('', $res['session_id'], '缺少 Mcp-Session-Id 响应头');
|
||
|
||
$result = $res['body']['result'] ?? null;
|
||
$this->assertIsArray($result, '缺少 result，body: ' . $res['raw']);
|
||
$this->assertNotSame('', (string) ($result['protocolVersion'] ?? ''), '缺少 protocolVersion');
|
||
$this->assertSame('ulthon_admin', $result['serverInfo']['name'] ?? '', 'serverInfo.name 应为配置默认值');
|
||
$this->assertNotSame('', (string) ($result['serverInfo']['version'] ?? ''), '缺少 serverInfo.version');
|
||
$this->assertArrayHasKey('capabilities', $result, '缺少 capabilities（有授权工具时必须出现 tools 能力）');
|
||
$this->assertArrayHasKey('tools', $result['capabilities'], 'capabilities 应含 tools（fixture 已授权 2 个工具）');
|
||
}
|
||
|
||
public function test_initialize_rejects_missing_or_invalid_bearer_with_401(): void
|
||
{
|
||
// 缺失 Authorization
|
||
$missing = $this->rpc('initialize', ['protocolVersion' => '2025-06-18'], null);
|
||
$this->assertSame(401, $missing['status'], 'body: ' . $missing['raw']);
|
||
$this->assertSame(401, $missing['body']['code'] ?? null, 'body: ' . $missing['raw']);
|
||
$this->assertStringContainsString('无效的 MCP 密钥', (string) ($missing['body']['msg'] ?? ''), 'body: ' . $missing['raw']);
|
||
|
||
// 错误密钥
|
||
$this->createFixture(); // 确保库里有合法密钥存在（认证逻辑真实跑过一次比对）
|
||
$invalid = $this->rpc('initialize', ['protocolVersion' => '2025-06-18'], 'sk-mcp-e2e-wrong-bearer');
|
||
$this->assertSame(401, $invalid['status'], 'body: ' . $invalid['raw']);
|
||
$this->assertStringContainsString('无效的 MCP 密钥', (string) ($invalid['body']['msg'] ?? ''), 'body: ' . $invalid['raw']);
|
||
}
|
||
|
||
public function test_disabled_endpoint_returns_403(): void
|
||
{
|
||
// mcp.enable=false 由 tests/router.php 识别 X-E2E-Mcp-Disabled 头注入（生产代码零改动）
|
||
$fx = $this->createFixture();
|
||
|
||
$res = $this->rpc('initialize', ['protocolVersion' => '2025-06-18'], $fx['plaintext'], null, null, [
|
||
'X-E2E-Mcp-Disabled' => '1',
|
||
]);
|
||
|
||
$this->assertSame(403, $res['status'], 'body: ' . $res['raw']);
|
||
$this->assertSame('MCP 服务未启用', (string) ($res['body']['msg'] ?? ''), 'body: ' . $res['raw']);
|
||
}
|
||
|
||
// =========================================================================
|
||
// 2. tools/list：与授权集一致
|
||
// =========================================================================
|
||
|
||
public function test_tools_list_matches_authorized_set(): void
|
||
{
|
||
$fx = $this->createFixture();
|
||
[$sessionId, $protocol] = $this->initialize($fx['plaintext']);
|
||
|
||
$res = $this->rpc('tools/list', [], $fx['plaintext'], $sessionId, $protocol);
|
||
|
||
$this->assertSame(200, $res['status'], 'body: ' . $res['raw']);
|
||
$this->assertArrayNotHasKey('error', $res['body'], 'body: ' . $res['raw']);
|
||
|
||
$tools = $res['body']['result']['tools'] ?? null;
|
||
$this->assertIsArray($tools, 'body: ' . $res['raw']);
|
||
|
||
$names = array_column($tools, 'name');
|
||
|
||
// 白名单 [quick/index, mcp_key/index, auth/toggleUser] ∩ 创建者角色（前两者）
|
||
// —— 漂移节点 auth/toggleUser 未注册；顺序保持白名单顺序
|
||
$this->assertSame(
|
||
['system-quick--index', 'system-mcp_key--index'],
|
||
$names,
|
||
'工具集应等于授权集（编码名），漂移节点不得出现: ' . $res['raw']
|
||
);
|
||
|
||
foreach ($names as $name) {
|
||
$this->assertMatchesRegularExpression('/^[a-zA-Z0-9_-]{1,64}$/', $name);
|
||
}
|
||
|
||
// 描述里携带原始节点串（工具可读性契约）
|
||
$this->assertStringContainsString('【' . self::NODE_A . '】', (string) ($tools[0]['description'] ?? ''));
|
||
}
|
||
|
||
// =========================================================================
|
||
// 3. tools/call：成功（code=0 信封）/ 越权（SDK -32601）/ 审计
|
||
// =========================================================================
|
||
|
||
public function test_tools_call_success_returns_code0_envelope_and_audits(): void
|
||
{
|
||
$fx = $this->createFixture();
|
||
[$sessionId, $protocol] = $this->initialize($fx['plaintext']);
|
||
|
||
$res = $this->rpc('tools/call', [
|
||
'name' => 'system-quick--index',
|
||
'arguments' => new \stdClass(),
|
||
], $fx['plaintext'], $sessionId, $protocol);
|
||
|
||
$this->assertSame(200, $res['status'], 'body: ' . $res['raw']);
|
||
$this->assertArrayNotHasKey('error', $res['body'], 'body: ' . $res['raw']);
|
||
|
||
$result = $res['body']['result'] ?? [];
|
||
$this->assertFalse((bool) ($result['isError'] ?? true), 'isError 应为 false: ' . $res['raw']);
|
||
$text = (string) ($result['content'][0]['text'] ?? '');
|
||
$this->assertNotSame('', $text, 'content[0].text 不应为空');
|
||
|
||
// 信封判成功：text 本身是 JSON 且 code=0（任务验收口径）
|
||
$decoded = json_decode($text, true);
|
||
$this->assertIsArray($decoded, 'content[0].text 应为 JSON: ' . $text);
|
||
$this->assertSame(0, $decoded['code'] ?? null, '信封 code 应为 0: ' . substr($text, 0, 300));
|
||
|
||
// 审计行：成功调用落 is_success=1 日志（服务端进程提交，响应返回后即可见）
|
||
$this->assertSame(1, (int) Db::name('system_mcp_log')
|
||
->where('key_id', $fx['key_id'])
|
||
->where('node', self::NODE_A)
|
||
->where('is_success', 1)
|
||
->count(), '应存在成功审计行');
|
||
// use_num 自增
|
||
$this->assertGreaterThanOrEqual(1, (int) Db::name('system_mcp_key')
|
||
->where('id', $fx['key_id'])->value('use_num'));
|
||
}
|
||
|
||
public function test_tools_call_unauthorized_tool_rejected_by_sdk_32601(): void
|
||
{
|
||
$fx = $this->createFixture();
|
||
[$sessionId, $protocol] = $this->initialize($fx['plaintext']);
|
||
|
||
// 漂移节点在白名单内但创建者无权限 -> 未注册为工具 -> SDK 层第一道防线 -32601
|
||
$drifted = $this->rpc('tools/call', [
|
||
'name' => 'system-auth--toggleUser',
|
||
'arguments' => new \stdClass(),
|
||
], $fx['plaintext'], $sessionId, $protocol);
|
||
|
||
$this->assertSame(200, $drifted['status'], 'JSON-RPC 错误仍应 HTTP 200, body: ' . $drifted['raw']);
|
||
$this->assertSame(-32601, $drifted['body']['error']['code'] ?? null, 'SDK 应以 Tool not found 拒绝: ' . $drifted['raw']);
|
||
|
||
// 完全乱造的工具名同样 -32601
|
||
$garbage = $this->rpc('tools/call', [
|
||
'name' => 'totally_unknown_tool',
|
||
'arguments' => new \stdClass(),
|
||
], $fx['plaintext'], $sessionId, $protocol);
|
||
|
||
$this->assertSame(-32601, $garbage['body']['error']['code'] ?? null, '乱造工具名应以 -32601 拒绝: ' . $garbage['raw']);
|
||
}
|
||
|
||
public function test_dispatch_layer_rejects_and_audits_unauthorized_call(): void
|
||
{
|
||
// 纵深防御第二道防线：SDK 层之外，dispatch 对「不可还原为授权节点」的工具名
|
||
// 直接拒绝并落 is_success=0 审计（进程内直调，不经 HTTP）
|
||
$fx = $this->createFixture();
|
||
$auth = (new McpService())->authenticate($fx['plaintext']);
|
||
$this->assertNotNull($auth);
|
||
|
||
$text = (new McpDispatch())->call($auth, 'totally_unknown_tool', ['probe' => 1]);
|
||
|
||
$this->assertStringStartsWith('[ERROR]', $text);
|
||
$this->assertStringContainsString('无权限或权限已回收', $text);
|
||
|
||
$this->assertSame(1, (int) Db::name('system_mcp_log')
|
||
->where('key_id', $fx['key_id'])
|
||
->where('node', 'totally_unknown_tool')
|
||
->where('is_success', 0)
|
||
->count(), '越权调用应落失败审计行');
|
||
}
|
||
}
|