obsidian-mcp-server/docs/testing/manual-integration-test-checklist.md

Manual Integration Testing Checklist

Task 9: CORS Simplification and Mandatory Auth

Date: 2025-10-25 Implementation Plan: docs/plans/2025-10-25-simplify-cors-mandatory-auth.md Purpose: Verify that all code changes work correctly in a real Obsidian environment

---

Test 1: Fresh Install Test

Prerequisites

• Access to a test vault
• Built plugin files (main.js, manifest.json, styles.css)

Steps

1. ✅ Remove plugin from test vault (if exists): rm -rf .obsidian/plugins/obsidian-mcp-server/
2. ✅ Build plugin: npm run build
3. ✅ Copy built plugin files to vault: .obsidian/plugins/obsidian-mcp-server/
4. ✅ Enable plugin in Obsidian Settings → Community Plugins
5. ✅ Open browser console (Ctrl+Shift+I)
6. ✅ Verify log message: "Generating new API key..."
7. ✅ Check .obsidian/plugins/obsidian-mcp-server/data.json:
   • Key should be present
   • Key should start with "encrypted:" (if encryption available)
8. ✅ Verify server starts successfully (check plugin settings or console)

Expected Results

• API key auto-generated on first install
• Key is encrypted in data.json
• No CORS settings in data.json
• Server starts without errors
• No "enableCORS" or "allowedOrigins" fields in data.json

---

Test 2: Migration Test

Prerequisites

• Test vault with plugin already installed
• Access to data.json file

Steps

1. ✅ Stop Obsidian
2. ✅ Manually edit .obsidian/plugins/obsidian-mcp-server/data.json:

   {
     "port": 3000,
     "enableCORS": true,
     "allowedOrigins": ["*"],
     "enableAuth": false,
     "apiKey": "old-plaintext-key",
     "autoStart": false
   }
   

3. ✅ Save file
4. ✅ Start Obsidian
5. ✅ Open browser console
6. ✅ Verify log message: "Migrating legacy CORS settings..."
7. ✅ Check updated data.json:
   • "enableCORS" should be removed
   • "allowedOrigins" should be removed
   • "enableAuth" should be true
   • "apiKey" should be encrypted
8. ✅ Verify server still works

Expected Results

• Legacy CORS settings removed from data.json
• enableAuth set to true
• API key encrypted (if not already)
• Other settings preserved (port, autoStart, notifications)
• Server functionality not affected

---

Test 3: API Key Encryption Test

Prerequisites

• Plugin installed and running
• Access to plugin settings UI

Steps

1. ✅ Open plugin settings in Obsidian
2. ✅ Locate "API Key Management" section
3. ✅ Click "Copy Key" button
4. ✅ Note the plaintext key (save to clipboard)
5. ✅ Stop Obsidian completely
6. ✅ Open .obsidian/plugins/obsidian-mcp-server/data.json
7. ✅ Verify apiKey field starts with "encrypted:" (or is plaintext if encryption unavailable)
8. ✅ Restart Obsidian
9. ✅ Open plugin settings
10. ✅ Verify API key display shows the same plaintext key from step 4
11. ✅ Verify server starts and accepts the key

Expected Results

• API key displayed in plaintext in UI
• API key encrypted in data.json file
• Same key works after restart
• "Copy Key" button copies plaintext key
• Encryption status indicator shows correct state

---

Test 4: API Key Regeneration Test

Prerequisites

• Plugin installed with existing API key
• Access to plugin settings UI

Steps

1. ✅ Open plugin settings
2. ✅ Copy current API key (note it down)
3. ✅ Click "Regenerate Key" button
4. ✅ Verify success notification
5. ✅ Verify displayed key has changed
6. ✅ Copy new key
7. ✅ Verify old key ≠ new key
8. ✅ Stop Obsidian
9. ✅ Check data.json - verify encrypted key has changed
10. ✅ Restart Obsidian
11. ✅ Verify new key is displayed correctly
12. ✅ Verify server restart prompt if server was running

Expected Results

• Regenerate button generates a new key
• New key is different from old key
• New key is properly encrypted on disk
• New key persists across restart
• Server restart prompted if needed

---

Test 5: Authentication Test

Prerequisites

• Plugin installed and server running
• curl or similar HTTP client

Steps

1. ✅ Start MCP server from plugin settings
2. ✅ Copy API key from settings UI
3. ✅ Try request WITHOUT auth:

   curl -X POST http://127.0.0.1:3000/mcp \
     -H "Content-Type: application/json" \
     -d '{"jsonrpc":"2.0","method":"ping","id":1}'
   

4. ✅ Verify response is 401 Unauthorized
5. ✅ Try request WITH correct Bearer token:

   curl -X POST http://127.0.0.1:3000/mcp \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_API_KEY_HERE" \
     -d '{"jsonrpc":"2.0","method":"ping","id":1}'
   

6. ✅ Verify response is 200 OK with pong result
7. ✅ Try request with WRONG Bearer token:

   curl -X POST http://127.0.0.1:3000/mcp \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer wrong-token" \
     -d '{"jsonrpc":"2.0","method":"ping","id":1}'
   

8. ✅ Verify response is 401 Unauthorized

Expected Results

• Requests without auth rejected (401)
• Requests with invalid token rejected (401)
• Requests with valid token accepted (200)
• No way to bypass authentication

---

Test 6: CORS Test (Optional - Requires Web Client)

Prerequisites

• MCP server running
• Simple HTML file or local web server

Steps

1. ✅ Create test HTML file:

   <!DOCTYPE html>
   <html>
   <body>
     <button onclick="testCORS()">Test CORS</button>
     <div id="result"></div>
     <script>
       async function testCORS() {
         const apiKey = 'YOUR_API_KEY_HERE';
         try {
           const response = await fetch('http://localhost:3000/mcp', {
             method: 'POST',
             headers: {
               'Content-Type': 'application/json',
               'Authorization': `Bearer ${apiKey}`
             },
             body: JSON.stringify({"jsonrpc":"2.0","method":"ping","id":1})
           });
           document.getElementById('result').innerText =
             `Success: ${response.status} ${await response.text()}`;
         } catch(e) {
           document.getElementById('result').innerText = `Error: ${e.message}`;
         }
       }
     </script>
   </body>
   </html>
   

2. ✅ Serve HTML from localhost:8080: python3 -m http.server 8080
3. ✅ Open http://localhost:8080 in browser
4. ✅ Update apiKey in HTML with actual key
5. ✅ Click "Test CORS" button
6. ✅ Verify request succeeds (CORS allowed from localhost:8080)
7. ✅ Try accessing from non-localhost origin (if possible)
8. ✅ Verify CORS blocks non-localhost origins

Expected Results

• Requests from localhost origins succeed
• Requests from 127.0.0.1 origins succeed
• Requests from non-localhost origins blocked by CORS
• HTTPS localhost origins also work

---

Test 7: Settings UI Verification

Prerequisites

• Plugin installed
• Access to plugin settings

Steps

1. ✅ Open Obsidian Settings → Community Plugins → Obsidian MCP Server
2. ✅ Verify NO "Enable CORS" toggle is visible
3. ✅ Verify NO "Allowed origins" text input is visible
4. ✅ Verify NO "Enable authentication" toggle is visible
5. ✅ Verify "Authentication" heading is present
6. ✅ Verify description text mentions "mandatory" and "encrypted"
7. ✅ Verify encryption status indicator is displayed:
   • 🔒 "Encryption: Available" OR
   • ⚠️ "Encryption: Unavailable"
8. ✅ Verify "API Key Management" section is always visible
9. ✅ Verify API key is displayed in monospace font
10. ✅ Verify "Copy Key" and "Regenerate Key" buttons are visible
11. ✅ Verify "MCP Client Configuration" section always includes Authorization header

Expected Results

• No CORS configuration options visible
• No authentication toggle (always enabled)
• Clear messaging about mandatory auth
• Encryption status displayed
• API key section always visible
• Configuration snippet includes auth header

---

Test 8: No Regressions Test

Prerequisites

• Plugin installed and server running
• Test vault with notes

Steps

1. ✅ Test all MCP tools work:
   • read_note - Read an existing note
   • create_note - Create a new note
   • update_note - Modify a note
   • delete_note - Delete a note
   • list - List notes in vault
   • search - Search for text
   • Other tools as applicable
2. ✅ Test notifications (if enabled):
   • Enable notifications in settings
   • Call an MCP tool
   • Verify notification appears in Obsidian
3. ✅ Test server controls:
   • Stop server
   • Start server
   • Restart server
4. ✅ Test settings save/load:
   • Change port number
   • Toggle autoStart
   • Restart Obsidian
   • Verify settings preserved

Expected Results

• All MCP tools function correctly
• No errors in console related to CORS/auth changes
• Notifications work as before
• Server controls work correctly
• Settings persist across restarts
• No functionality regressions

---

Test 9: Error Handling Test

Prerequisites

• Plugin installed

Steps

1. ✅ Test empty API key scenario:
   • Stop Obsidian
   • Edit data.json to set apiKey: ""
   • Start Obsidian
   • Verify new key is auto-generated
2. ✅ Test decryption failure:
   • Stop Obsidian
   • Edit data.json to set apiKey: "encrypted:invalid-base64!!!"
   • Start Obsidian
   • Verify error notice displayed
   • Verify user prompted to regenerate key
3. ✅ Test server start with no API key:
   • Stop Obsidian
   • Edit data.json to remove apiKey field entirely
   • Start Obsidian
   • Verify key auto-generated
   • Verify server can start

Expected Results

• Empty API key triggers auto-generation
• Invalid encrypted key shows error notice
• User can recover from decryption failures
• Server doesn't start with invalid key state

---

Summary Checklist

After completing all tests above, verify:

• Fresh install generates and encrypts API key
• Legacy CORS settings are migrated correctly
• API keys are encrypted at rest
• API key regeneration works
• Authentication is mandatory and enforced
• CORS allows localhost origins only
• Settings UI shows correct options (no CORS, no auth toggle)
• Encryption status is displayed
• All existing MCP tools work correctly
• No console errors related to changes
• Error scenarios handled gracefully

---

Test Results

Tester: [Name] Date: [Date] Obsidian Version: [Version] Plugin Version: [Version] Platform: [Windows/macOS/Linux]

Overall Status: [ ] PASS / [ ] FAIL Notes: