docs: add implementation plan and manual testing checklist

2025-10-25 21:41:22 -04:00
parent f22404957b
commit 6edb380234
2 changed files with 1615 additions and 0 deletions
--- a/docs/plans/2025-10-25-simplify-cors-mandatory-auth.md
+++ b/docs/plans/2025-10-25-simplify-cors-mandatory-auth.md
--- a/docs/testing/manual-integration-test-checklist.md
+++ b/docs/testing/manual-integration-test-checklist.md
@@ -0,0 +1,355 @@
+# Manual Integration Testing Checklist
+## Task 9: CORS Simplification and Mandatory Auth
+
+**Date:** 2025-10-25
+**Implementation Plan:** docs/plans/2025-10-25-simplify-cors-mandatory-auth.md
+**Purpose:** Verify that all code changes work correctly in a real Obsidian environment
+
+---
+
+## Test 1: Fresh Install Test
+
+### Prerequisites
+- Access to a test vault
+- Built plugin files (main.js, manifest.json, styles.css)
+
+### Steps
+1. ✅ Remove plugin from test vault (if exists): `rm -rf .obsidian/plugins/obsidian-mcp-server/`
+2. ✅ Build plugin: `npm run build`
+3. ✅ Copy built plugin files to vault: `.obsidian/plugins/obsidian-mcp-server/`
+4. ✅ Enable plugin in Obsidian Settings → Community Plugins
+5. ✅ Open browser console (Ctrl+Shift+I)
+6. ✅ Verify log message: "Generating new API key..."
+7. ✅ Check `.obsidian/plugins/obsidian-mcp-server/data.json`:
+   - Key should be present
+   - Key should start with "encrypted:" (if encryption available)
+8. ✅ Verify server starts successfully (check plugin settings or console)
+
+### Expected Results
+- [ ] API key auto-generated on first install
+- [ ] Key is encrypted in data.json
+- [ ] No CORS settings in data.json
+- [ ] Server starts without errors
+- [ ] No "enableCORS" or "allowedOrigins" fields in data.json
+
+---
+
+## Test 2: Migration Test
+
+### Prerequisites
+- Test vault with plugin already installed
+- Access to data.json file
+
+### Steps
+1. ✅ Stop Obsidian
+2. ✅ Manually edit `.obsidian/plugins/obsidian-mcp-server/data.json`:
+   ```json
+   {
+     "port": 3000,
+     "enableCORS": true,
+     "allowedOrigins": ["*"],
+     "enableAuth": false,
+     "apiKey": "old-plaintext-key",
+     "autoStart": false
+   }
+   ```
+3. ✅ Save file
+4. ✅ Start Obsidian
+5. ✅ Open browser console
+6. ✅ Verify log message: "Migrating legacy CORS settings..."
+7. ✅ Check updated data.json:
+   - "enableCORS" should be removed
+   - "allowedOrigins" should be removed
+   - "enableAuth" should be true
+   - "apiKey" should be encrypted
+8. ✅ Verify server still works
+
+### Expected Results
+- [ ] Legacy CORS settings removed from data.json
+- [ ] enableAuth set to true
+- [ ] API key encrypted (if not already)
+- [ ] Other settings preserved (port, autoStart, notifications)
+- [ ] Server functionality not affected
+
+---
+
+## Test 3: API Key Encryption Test
+
+### Prerequisites
+- Plugin installed and running
+- Access to plugin settings UI
+
+### Steps
+1. ✅ Open plugin settings in Obsidian
+2. ✅ Locate "API Key Management" section
+3. ✅ Click "Copy Key" button
+4. ✅ Note the plaintext key (save to clipboard)
+5. ✅ Stop Obsidian completely
+6. ✅ Open `.obsidian/plugins/obsidian-mcp-server/data.json`
+7. ✅ Verify apiKey field starts with "encrypted:" (or is plaintext if encryption unavailable)
+8. ✅ Restart Obsidian
+9. ✅ Open plugin settings
+10. ✅ Verify API key display shows the same plaintext key from step 4
+11. ✅ Verify server starts and accepts the key
+
+### Expected Results
+- [ ] API key displayed in plaintext in UI
+- [ ] API key encrypted in data.json file
+- [ ] Same key works after restart
+- [ ] "Copy Key" button copies plaintext key
+- [ ] Encryption status indicator shows correct state
+
+---
+
+## Test 4: API Key Regeneration Test
+
+### Prerequisites
+- Plugin installed with existing API key
+- Access to plugin settings UI
+
+### Steps
+1. ✅ Open plugin settings
+2. ✅ Copy current API key (note it down)
+3. ✅ Click "Regenerate Key" button
+4. ✅ Verify success notification
+5. ✅ Verify displayed key has changed
+6. ✅ Copy new key
+7. ✅ Verify old key ≠ new key
+8. ✅ Stop Obsidian
+9. ✅ Check data.json - verify encrypted key has changed
+10. ✅ Restart Obsidian
+11. ✅ Verify new key is displayed correctly
+12. ✅ Verify server restart prompt if server was running
+
+### Expected Results
+- [ ] Regenerate button generates a new key
+- [ ] New key is different from old key
+- [ ] New key is properly encrypted on disk
+- [ ] New key persists across restart
+- [ ] Server restart prompted if needed
+
+---
+
+## Test 5: Authentication Test
+
+### Prerequisites
+- Plugin installed and server running
+- curl or similar HTTP client
+
+### Steps
+1. ✅ Start MCP server from plugin settings
+2. ✅ Copy API key from settings UI
+3. ✅ Try request WITHOUT auth:
+   ```bash
+   curl -X POST http://127.0.0.1:3000/mcp \
+     -H "Content-Type: application/json" \
+     -d '{"jsonrpc":"2.0","method":"ping","id":1}'
+   ```
+4. ✅ Verify response is 401 Unauthorized
+5. ✅ Try request WITH correct Bearer token:
+   ```bash
+   curl -X POST http://127.0.0.1:3000/mcp \
+     -H "Content-Type: application/json" \
+     -H "Authorization: Bearer YOUR_API_KEY_HERE" \
+     -d '{"jsonrpc":"2.0","method":"ping","id":1}'
+   ```
+6. ✅ Verify response is 200 OK with pong result
+7. ✅ Try request with WRONG Bearer token:
+   ```bash
+   curl -X POST http://127.0.0.1:3000/mcp \
+     -H "Content-Type: application/json" \
+     -H "Authorization: Bearer wrong-token" \
+     -d '{"jsonrpc":"2.0","method":"ping","id":1}'
+   ```
+8. ✅ Verify response is 401 Unauthorized
+
+### Expected Results
+- [ ] Requests without auth rejected (401)
+- [ ] Requests with invalid token rejected (401)
+- [ ] Requests with valid token accepted (200)
+- [ ] No way to bypass authentication
+
+---
+
+## Test 6: CORS Test (Optional - Requires Web Client)
+
+### Prerequisites
+- MCP server running
+- Simple HTML file or local web server
+
+### Steps
+1. ✅ Create test HTML file:
+   ```html
+   <!DOCTYPE html>
+   <html>
+   <body>
+     <button onclick="testCORS()">Test CORS</button>
+     <div id="result"></div>
+     <script>
+       async function testCORS() {
+         const apiKey = 'YOUR_API_KEY_HERE';
+         try {
+           const response = await fetch('http://localhost:3000/mcp', {
+             method: 'POST',
+             headers: {
+               'Content-Type': 'application/json',
+               'Authorization': `Bearer ${apiKey}`
+             },
+             body: JSON.stringify({"jsonrpc":"2.0","method":"ping","id":1})
+           });
+           document.getElementById('result').innerText =
+             `Success: ${response.status} ${await response.text()}`;
+         } catch(e) {
+           document.getElementById('result').innerText = `Error: ${e.message}`;
+         }
+       }
+     </script>
+   </body>
+   </html>
+   ```
+2. ✅ Serve HTML from localhost:8080: `python3 -m http.server 8080`
+3. ✅ Open http://localhost:8080 in browser
+4. ✅ Update apiKey in HTML with actual key
+5. ✅ Click "Test CORS" button
+6. ✅ Verify request succeeds (CORS allowed from localhost:8080)
+7. ✅ Try accessing from non-localhost origin (if possible)
+8. ✅ Verify CORS blocks non-localhost origins
+
+### Expected Results
+- [ ] Requests from localhost origins succeed
+- [ ] Requests from 127.0.0.1 origins succeed
+- [ ] Requests from non-localhost origins blocked by CORS
+- [ ] HTTPS localhost origins also work
+
+---
+
+## Test 7: Settings UI Verification
+
+### Prerequisites
+- Plugin installed
+- Access to plugin settings
+
+### Steps
+1. ✅ Open Obsidian Settings → Community Plugins → Obsidian MCP Server
+2. ✅ Verify NO "Enable CORS" toggle is visible
+3. ✅ Verify NO "Allowed origins" text input is visible
+4. ✅ Verify NO "Enable authentication" toggle is visible
+5. ✅ Verify "Authentication" heading is present
+6. ✅ Verify description text mentions "mandatory" and "encrypted"
+7. ✅ Verify encryption status indicator is displayed:
+   - 🔒 "Encryption: Available" OR
+   - ⚠️ "Encryption: Unavailable"
+8. ✅ Verify "API Key Management" section is always visible
+9. ✅ Verify API key is displayed in monospace font
+10. ✅ Verify "Copy Key" and "Regenerate Key" buttons are visible
+11. ✅ Verify "MCP Client Configuration" section always includes Authorization header
+
+### Expected Results
+- [ ] No CORS configuration options visible
+- [ ] No authentication toggle (always enabled)
+- [ ] Clear messaging about mandatory auth
+- [ ] Encryption status displayed
+- [ ] API key section always visible
+- [ ] Configuration snippet includes auth header
+
+---
+
+## Test 8: No Regressions Test
+
+### Prerequisites
+- Plugin installed and server running
+- Test vault with notes
+
+### Steps
+1. ✅ Test all MCP tools work:
+   - `read_note` - Read an existing note
+   - `create_note` - Create a new note
+   - `update_note` - Modify a note
+   - `delete_note` - Delete a note
+   - `list` - List notes in vault
+   - `search` - Search for text
+   - Other tools as applicable
+2. ✅ Test notifications (if enabled):
+   - Enable notifications in settings
+   - Call an MCP tool
+   - Verify notification appears in Obsidian
+3. ✅ Test server controls:
+   - Stop server
+   - Start server
+   - Restart server
+4. ✅ Test settings save/load:
+   - Change port number
+   - Toggle autoStart
+   - Restart Obsidian
+   - Verify settings preserved
+
+### Expected Results
+- [ ] All MCP tools function correctly
+- [ ] No errors in console related to CORS/auth changes
+- [ ] Notifications work as before
+- [ ] Server controls work correctly
+- [ ] Settings persist across restarts
+- [ ] No functionality regressions
+
+---
+
+## Test 9: Error Handling Test
+
+### Prerequisites
+- Plugin installed
+
+### Steps
+1. ✅ Test empty API key scenario:
+   - Stop Obsidian
+   - Edit data.json to set `apiKey: ""`
+   - Start Obsidian
+   - Verify new key is auto-generated
+2. ✅ Test decryption failure:
+   - Stop Obsidian
+   - Edit data.json to set `apiKey: "encrypted:invalid-base64!!!"`
+   - Start Obsidian
+   - Verify error notice displayed
+   - Verify user prompted to regenerate key
+3. ✅ Test server start with no API key:
+   - Stop Obsidian
+   - Edit data.json to remove apiKey field entirely
+   - Start Obsidian
+   - Verify key auto-generated
+   - Verify server can start
+
+### Expected Results
+- [ ] Empty API key triggers auto-generation
+- [ ] Invalid encrypted key shows error notice
+- [ ] User can recover from decryption failures
+- [ ] Server doesn't start with invalid key state
+
+---
+
+## Summary Checklist
+
+After completing all tests above, verify:
+
+- [ ] Fresh install generates and encrypts API key
+- [ ] Legacy CORS settings are migrated correctly
+- [ ] API keys are encrypted at rest
+- [ ] API key regeneration works
+- [ ] Authentication is mandatory and enforced
+- [ ] CORS allows localhost origins only
+- [ ] Settings UI shows correct options (no CORS, no auth toggle)
+- [ ] Encryption status is displayed
+- [ ] All existing MCP tools work correctly
+- [ ] No console errors related to changes
+- [ ] Error scenarios handled gracefully
+
+---
+
+## Test Results
+
+**Tester:** [Name]
+**Date:** [Date]
+**Obsidian Version:** [Version]
+**Plugin Version:** [Version]
+**Platform:** [Windows/macOS/Linux]
+
+**Overall Status:** [ ] PASS / [ ] FAIL
+**Notes:**