Initial commit: MCP Hub Community Edition v3.0.0

Community edition generated from private repo via sync pipeline.
Includes 9 plugins (WordPress, WooCommerce, WP Advanced, Gitea, n8n,
Supabase, OpenPanel, Appwrite, Directus) with ~587 tools.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tests/test_oauth_token_manager.py

@@ -0,0 +1,78 @@
+import os
+import tempfile
+
+import jwt
+import pytest
+
+from core.oauth.token_manager import SecurityError, TokenManager
+
+
+@pytest.fixture
+def token_manager():
+    os.environ["OAUTH_JWT_SECRET_KEY"] = "test_secret_key"
+    # Use temporary directory for storage
+    with tempfile.TemporaryDirectory() as tmpdir:
+        os.environ["OAUTH_STORAGE_PATH"] = tmpdir
+        yield TokenManager()
+
+
+def test_generate_access_token(token_manager):
+    """Test access token generation"""
+    token = token_manager.generate_access_token(
+        client_id="test_client", scope="read write", user_id="user_123"
+    )
+
+    # Should be valid JWT
+    assert len(token.split(".")) == 3
+
+    # Validate
+    payload = token_manager.validate_access_token(token)
+    assert payload["client_id"] == "test_client"
+    assert payload["scope"] == "read write"
+    assert payload["sub"] == "user_123"
+
+
+def test_access_token_expiry(token_manager):
+    """Test expired token"""
+    # Generate with short TTL
+    token_manager.access_token_ttl = 1
+    token = token_manager.generate_access_token("client", "read")
+
+    import time
+
+    time.sleep(2)
+
+    # Should raise
+    with pytest.raises(jwt.ExpiredSignatureError):
+        token_manager.validate_access_token(token)
+
+
+def test_refresh_token_rotation(token_manager):
+    """Test refresh token rotation"""
+    # Generate initial tokens
+    access_token = token_manager.generate_access_token("client", "read")
+    refresh_token = token_manager.generate_refresh_token("client", access_token)
+
+    # Rotate
+    new_tokens = token_manager.rotate_refresh_token(refresh_token, "client")
+
+    assert "access_token" in new_tokens
+    assert "refresh_token" in new_tokens
+    assert new_tokens["refresh_token"] != refresh_token
+
+    # Old token should be revoked - reuse triggers SecurityError
+    with pytest.raises(SecurityError, match="reuse detected"):
+        token_manager.rotate_refresh_token(refresh_token, "client")
+
+
+def test_refresh_token_reuse_detection(token_manager):
+    """Test reuse detection"""
+    access_token = token_manager.generate_access_token("client", "read")
+    refresh_token = token_manager.generate_refresh_token("client", access_token)
+
+    # First rotation
+    token_manager.rotate_refresh_token(refresh_token, "client")
+
+    # Attempt reuse
+    with pytest.raises(SecurityError, match="reuse detected"):
+        token_manager.rotate_refresh_token(refresh_token, "client")