test(oauth): device flow integration tests + docs migration (#202)#206
Merged
Conversation
Add integration tests that verify the Worker's bespoke OAuth device-flow implementation (worker/test/oauth.test.ts) covering legacy 410 Gone endpoints, metadata, dynamic registration, device authorization + token exchange, refresh rotation invalidating prior tokens, process-restart token persistence, and the 503 response when the upstream GitHub App has device flow disabled. Add client-side migration contract tests (mcp-server/test/migration.test.mjs) that lock in the tokens-file flow marker convention used to detect legacy pre-v0.11.0 files. Refresh README and docs/installation (EN/JA) for device flow: remove stale Callback URL guidance, document the "Enable Device Flow" toggle on the GitHub App, describe the stderr user_code prompt the MCP client surfaces, and add migration + troubleshooting entries for the `/oauth/authorize` 410 Gone transition. Wire both test suites into CI so every PR exercises the flow. device flow 移行 (#198) の Step 4。Worker 側は自動統合テストで covered、 クライアント側の実ブラウザ承認を伴うシナリオは Master の実機確認待ち。 Closes #202 Part of #198
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
github-webhook-mcp | 68a2a0c | Apr 20 2026, 06:16 AM |
This was referenced Apr 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #202
Device flow 移行 (#198) の Step 4。Worker 側 OAuth エンドポイントは自動統合テストで網羅し、README/docs を device flow 前提に書き換え。既存 user migration と onboarding を 3rd party でも追えるようにした。
自動テスト (CI で実行)
Worker 側 (
worker/test/oauth.test.ts, 10 tests)/oauth/authorize+/oauth/callbackは 410 Gone/.well-known/oauth-authorization-serverメタデータが device_code + refresh_token を広告Client 側 (
mcp-server/test/migration.test.mjs, 5 tests)クライアント側のフルな E2E (実ブラウザで user_code 入力) は手動確認に残す。Worker 側とクライアント側の contract は KV/ファイルレイヤーで automated に cover してある。
ドキュメント更新
docs/installation.md+.ja.md: GitHub App 作成手順で "Enable Device Flow" チェックボックスの ON を必須として明示、Callback URL を削除、シークレット設定から Client Secret を optional 扱いへ降格、troubleshooting に 503 device_flow_disabled / 410 Gone / stderr device code 未表示 / legacy token 削除の項目を追加docs/installation.md+.ja.md: MCP クライアント設定の先頭に「初回認証（OAuth Device Flow）」セクションを追加し、Claude Code ログに流れる stderr サンプルを掲載mcp-server/README.md(npm package landing): "browser-based localhost callback" 記述を device flow に差し替え、migration ノート + "Enable Device Flow" 誘導を追加、authentication flow の 8 ステップ再記述、troubleshooting を device flow 用に更新CI
.github/workflows/ci.ymlにmcp-serverとworker両方の test ステップを追加。worker/はnpm ci時点で tsx devDep が入るので tests が動く。Master の手動確認待ち (release 前の gate)
以下は実ブラウザで
https://github.com/login/deviceに user_code を入力する必要があり、CI では実行していません:~/.github-webhook-mcp/oauth-tokens.jsonを v0.10.x 時代のものに戻した状態で新 mcp-server を起動 → stderr に legacy 移行通知が出る → device code を入力 → 再認証完了 → 旧ファイルが置換されていること~/.github-webhook-mcp/空) から起動 → stderr に user_code が出る →https://github.com/login/deviceで入力 →get_pending_statusが応答するget_pending_statusが通る--dangerously-load-development-channels server:github-webhook-mcp起動 → 実 PR へ comment → channel 通知が届くdocs/installation.mdの手順通り GitHub App を作成 → "Enable Device Flow" 有効化漏れがないか確認 (503 が返る) → 有効化後に再試行で成功release は CD green + Master の上記手動検証 pass を gate としてください。
Part of #198