test(gateway): full inbound OAuth E2E proves auth-enabled flow is intact

Adds a real end-to-end test of the AUTH-REQUIRED path so we can guarantee the
"disable auth" feature never silently regresses real OAuth. It drives the
actual production handlers over HTTP against a gateway with inbound auth
required + a JWT secret configured:

  DCR register → authorize (consent page, request_id) → consent approve
  (redirect with code) → token exchange (PKCE S256) → authenticated /mcp
  handshake returns 200; the same handshake with no token returns 401.

To mount the flow in a self-contained harness, expose the OAuth handlers
(oauth_register/authorize/token/consent_approve) from the server module, the
same way the discovery handlers were already exposed for tests.

Together with the disabled-side coverage (anonymous real handshake + list_tools,
discovery 404 incl. the RFC 9728 /mcp sub-path), both auth modes are now proven
end to end.

Claude-Session: https://claude.ai/code/session_01Baan9JmzR43uxxRUh7CAMF
Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

Cargo.lock

@@ -13,9 +13,14 @@ mod startup;
 mod state;
 
 // Exposed for integration tests that mount these routes against a real
-// ServiceContainer (e.g. asserting the OAuth-discovery endpoints 404 when
-// inbound auth is disabled). AppState is also used throughout this module.
-pub use handlers::{oauth_metadata, resource_metadata, AppState};
+// ServiceContainer — e.g. asserting the OAuth-discovery endpoints 404 when
+// inbound auth is disabled, and driving the full inbound OAuth flow
+// (register → authorize → consent → token → authenticated /mcp) end to end.
+// AppState is also used throughout this module.
+pub use handlers::{
+    oauth_authorize, oauth_consent_approve, oauth_metadata, oauth_register, oauth_token,
+    resource_metadata, AppState,
+};
 
 pub use dependencies::{DependenciesBuilder, GatewayDependencies};
 pub use handlers::PendingAuthorization;

crates/mcpmux-gateway/src/server/mod.rs

@@ -46,6 +46,11 @@ reqwest = { version = "0.13", features = ["json"] }
 # URL parsing for OAuth tests
 url = "2.5"
 
+# PKCE + JWT-secret material for the inbound-OAuth end-to-end test
+base64 = "0.22"
+sha2 = "0.10"
+zeroize = "1.8"
+
 # Sync primitives for tests
 parking_lot = "0.12"