Development

Development

Testing

bun test

180 tests covering the crypto primitives, the full paste-back flow, session and CSRF handling, silent renewal (including the concurrent-refresh race and a refused renewal), SSE/JSON-RPC parsing, the device-pairing state machine, saved address resolution, and every one of the 26 route-to-tool mappings against their required arguments.

The suite runs against mock/upstream.ts, which enforces PKCE S256, single-use codes, redirect_uri consistency, bearer auth, SSE framing, and — critically — the same refresh-token rotation the real endpoint does, rejecting a spent token with a 401. A forgiving mock there would hide exactly the bug this design exists to prevent.

The OAuth and token-lifetime behaviour has been confirmed against the live DoorDash endpoints via bun run inspect-token, and the tool surface against bun run list-tools. Individual tool calls have not been exercised live, and their responses are passed through rather than validated.

To drive the mock manually:

bun run mock

DD_IDENTITY_BASE=http://127.0.0.1:8788 DD_TOKEN_BASE=http://127.0.0.1:8788 DD_MCP_BASE=http://127.0.0.1:8788 bun run dev

Layout

src/
  config.ts            env parsing and validation
  crypto/               AES-256-GCM primitives, sealing, split-key handles
  auth/                PKCE, token exchange, login tickets, session middleware
  session/             SQLite store and the renewal coordinator
  pairing/             device-flow codes, store and lifecycle
  mcp/                 JSON-RPC + SSE client; tool names and intent strings
  routes/              auth flow, pairing, the 26 tool routes, and the /docs UI
  schemas/common.ts    shared input objects
mock/upstream.ts       stand-in for DoorDash Identity + MCP gateway