Publish curated ITWorx_MCP_Hub source from 6c7434368ce2a594005983c5a6601a31a639e7f1

apps/web/tests/api.test.ts

@@ -10,12 +10,32 @@ describe("management API safety contracts", () => {
     await createApiClient().resource("tools", { filter: "risk:R1", limit: 25 });
     expect(fetchMock).toHaveBeenCalledWith("/api/tools?q=risk%3AR1&limit=25", expect.objectContaining({ credentials: "same-origin", headers: { Accept: "application/json" } }));
   });
-  it("maps protected client actions and never invents returned secret material", async () => {
-    const fetchMock = vi.fn().mockResolvedValue({ ok: true, json: async () => ({ clientId: "client-1", endpoint: "https://mcp.example.test/sse", scopes: ["tools:read"] }) });
+  it("projects only safe client profile fields from the generated configuration", async () => {
+    const fetchMock = vi.fn().mockResolvedValue({ ok: true, json: async () => ({
+      clientId: "client-1",
+      kind: "stdio-bridge",
+      protocolVersion: "2026-07-28",
+      endpoint: "https://mcp.example.test/mcp/ludarium/prod",
+      transport: "stdio",
+      scopes: ["tools:read"],
+      credentialReference: "authentik://mcp-client/private-reference",
+      environmentVariable: "ITWORX_MCP_ACCESS_TOKEN",
+      bridgeCommand: "itworx-mcp-bridge",
+    }) });
     vi.stubGlobal("fetch", fetchMock);
     const config = await createApiClient().generatedConfig("client-1");
-    expect(config).toEqual({ clientId: "client-1", endpoint: "https://mcp.example.test/sse", scopes: ["tools:read"] });
-    expect(JSON.stringify(config)).not.toContain("secret");
+    expect(config).toEqual({
+      clientId: "client-1",
+      kind: "stdio-bridge",
+      protocolVersion: "2026-07-28",
+      endpoint: "https://mcp.example.test/mcp/ludarium/prod",
+      transport: "stdio",
+      scopes: ["tools:read"],
+      environmentVariable: "ITWORX_MCP_ACCESS_TOKEN",
+      bridgeCommand: "itworx-mcp-bridge",
+    });
+    expect(config).not.toHaveProperty("credentialReference");
+    expect(JSON.stringify(config)).not.toContain("authentik://mcp-client/private-reference");
     expect(fetchMock.mock.calls[0]?.[1]).toEqual(expect.objectContaining({ credentials: "same-origin" }));
   });
   it("fails closed without CSRF and sends the session-bound token on writes", async () => {