Fix non-ASCII token authentication crashes

2026-09-24 23:02:28 +02:00
parent ecce09c280
commit 71a6517073
2 changed files with 28 additions and 2 deletions
@@ -181,3 +181,27 @@ def test_german_metadata_is_a_proposal_only(client):
    assert response.json()['title'] == 'Kundenanfrage höflich absagen'
    assert set(response.json()) == {'title','description','category','tags'}
    assert client.get('/api/prompts').json() == before
+
+
+@pytest.mark.parametrize('configured', ['ascii-test-token', 'synthetic-ü-token-🔐'])
+def test_mcp_non_ascii_tokens_never_crash(tmp_path, monkeypatch, configured):
+    monkeypatch.setenv('MCP_TOKEN', configured)
+    with TestClient(create_app(tmp_path)) as c:
+        initialize={'jsonrpc':'2.0','id':1,'method':'initialize','params':{'protocolVersion':'2025-03-26','capabilities':{},'clientInfo':{'name':'regression','version':'1'}}}
+        accept={'Accept':'application/json, text/event-stream'}
+        for path in ['/mcp', '/mcp/']:
+            for wrong in [b'', b'Bearer wrong', 'Bearer falsch-ä'.encode('utf-8'), b'Bearer \xff']:
+                assert c.post(path,headers={**accept,'Authorization':wrong},json=initialize).status_code == 401
+            headers={**accept,'Authorization':('Bearer '+configured).encode('utf-8')}
+            response=c.post(path,headers=headers,json=initialize)
+            assert response.status_code == 200
+            assert response.json()['result']['serverInfo']['name'] == 'CasaDePrompt'
+            listed=c.post(path,headers=headers,json={'jsonrpc':'2.0','id':2,'method':'tools/list','params':{}})
+            assert len(listed.json()['result']['tools']) == 4
+
+
+def test_web_login_with_unicode_token(tmp_path, monkeypatch):
+    monkeypatch.setenv('ADMIN_TOKEN', 'synthetic-ä-admin-🔐')
+    with TestClient(create_app(tmp_path)) as c:
+        assert c.post('/api/login',json={'token':'falsch-ü'}).status_code == 401
+        assert c.post('/api/login',json={'token':'synthetic-ä-admin-🔐'}).status_code == 200