1
# frozen_string_literal: true
2

3
require 'msf/core/mcp'
4
require 'webmock/rspec'
5

6
RSpec.describe 'JSON-RPC Authentication Flow Integration' do
7
  # Disable real HTTP connections for integration tests
8
  before(:all) do
9
    WebMock.disable_net_connect!(allow_localhost: false)
10
  end
11

12
  after(:all) do
13
    WebMock.allow_net_connect!
14
  end
15

16
  let(:host) { 'localhost' }
17
  let(:port) { 8081 }
18
  let(:endpoint) { '/api/v1/json-rpc' }
19
  let(:token) { 'test_bearer_token_12345' }
20
  let(:jsonrpc_url) { "https://#{host}:#{port}#{endpoint}" }
21

22
  describe 'Bearer Token Authentication' do
23
    it 'uses bearer token in HTTP headers' do
24
      # Stub HTTP endpoint and verify Authorization header
25
      stub = stub_request(:post, jsonrpc_url)
26
        .with(
27
          headers: {
28
            'Authorization' => "Bearer #{token}",
29
            'Content-Type' => 'application/json'
30
          }
31
        )
32
        .to_return(
33
          status: 200,
34
          body: { jsonrpc: '2.0', result: { modules: [] }, id: 1 }.to_json,
35
          headers: { 'Content-Type' => 'application/json' }
36
        )
37

38
      client = Msf::MCP::Metasploit::JsonRpcClient.new(
39
        host: host,
40
        port: port,
41
        endpoint: endpoint,
42
        token: token
43
      )
44

45
      client.call_api('module.search', ['smb'])
46

47
      # Verify the HTTP request was made with correct Authorization header
48
      expect(stub).to have_been_requested.once
49
    end
50

51
    it 'follows stateless request pattern (no session management)' do
52
      client = Msf::MCP::Metasploit::JsonRpcClient.new(
53
        host: host,
54
        port: port,
55
        endpoint: endpoint,
56
        token: token
57
      )
58

59
      # No session storage should exist (only token)
60
      expect(client.instance_variable_defined?(:@session_id)).to eq(false)
61
      expect(client.instance_variable_defined?(:@session_token)).to eq(false)
62

63
      # Has token stored
64
      expect(client.instance_variable_get(:@token)).to eq(token)
65

66
      # No session state (only token which is stateless)
67
      expect(client.instance_variables.grep(/@session/)).to be_empty
68
    end
69
  end
70
end
71

72