test: MCP auth — URL validation, token expiry, client secret lifecycle

[anandgupta42]

What does this PR do?

Adds 13 new tests for MCP OAuth credential management — an area with only 6 existing tests across two files, none of which covered the core persistence and validation logic.

1. McpAuth.getForUrl — src/mcp/auth.ts (5 new tests)

This function is the security gate that validates cached OAuth credentials are still for the correct server URL. Zero tests existed. A regression here (e.g., dropping the URL comparison) would cause credentials for server A to be sent to server B when a user reconfigures their MCP server URL — a credential leak. New coverage includes:

• Returns undefined when no entry exists
• Returns undefined when entry has no serverUrl (old version migration path)
• Returns undefined when URL has changed (credential safety — the critical path)
• Returns the entry when URL matches exactly
• Full CRUD lifecycle: set → getForUrl → updateTokens → getForUrl with URL mismatch

2. McpAuth.isTokenExpired — src/mcp/auth.ts (4 new tests)

Controls whether tokens get refreshed. Uses an unusual three-valued return (null / false / true) and compares Unix seconds (expiresAt < Date.now() / 1000), making unit-conversion errors plausible. New coverage includes:

• Returns null when no tokens exist for the MCP name
• Returns false when tokens have no expiry set (never expires)
• Returns false when token expiry is in the future
• Returns true when token has expired (expiresAt in the past)

3. McpOAuthProvider.clientInformation() — src/mcp/oauth-provider.ts (4 new tests)

When a dynamically registered client secret expires, this method must return undefined to trigger re-registration. If it returns stale credentials, users get cryptic OAuth server rejections instead of clean re-registration. New coverage includes:

• Returns config-based client info when clientId is set in config (short-circuit path)
• Returns stored client info when available and not expired
• Returns undefined when stored client secret has expired (triggers re-registration)
• Returns undefined when no stored credentials and no config (triggers dynamic registration)

Type of change

• New feature (non-breaking change which adds functionality)

Issue for this PR

N/A — proactive test coverage for security-critical MCP OAuth code paths

How did you verify your code works?

bun test test/mcp/auth.test.ts       # 13 pass, 22 expect() calls

Checklist

• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

https://claude.ai/code/session_01CqcvvXp5hUVsNU441DFTwb

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[coderabbitai]

Warning

Rate limit exceeded

@anandgupta42 has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 13 minutes and 35 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 13 minutes and 35 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: b01bd5ff-0498-4f03-9c5c-21b36c118ffc

📥 Commits

Reviewing files that changed from the base of the PR and between bb722b8 and 4ca066f.

📒 Files selected for processing (1)

• packages/opencode/test/mcp/auth.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/hourly-20260327-1609

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[anandgupta42]

Consolidated into #545