# `AttestoMCP.Test.Factory`
[🔗](https://github.com/XukuLLC/attesto_mcp/blob/v1.0.5/lib/attesto_mcp/test/factory.ex#L2)

Test fixtures for exercising a host MCP server's Attesto pipeline.

This factory mints access tokens and DPoP proofs for host application test
suites, including the shipped `AttestoMCP.Test.DPoPAssertions` helpers. It is
built entirely on Attesto's published API (`Attesto.Test.DPoP`,
`Attesto.Token.mint/3`, `Attesto.PrincipalKind.new/3`,
`Attesto.Config.new/1`, `Attesto.Keystore.Static`) plus JOSE, so it has no
dependency on any Attesto-internal test scaffolding.

The module compiles only when `ExUnit` is loaded (it registers an
`ExUnit.Callbacks.on_exit/1` cleanup in `config/0`), so it adds nothing to a
host's production build.

    defmodule MyApp.MCPAuthTest do
      use ExUnit.Case
      import AttestoMCP.Test.DPoPAssertions

      setup do
        %{config: AttestoMCP.Test.Factory.config()}
      end
    end

# `access_token`

```elixir
@spec access_token(
  Attesto.Config.t(),
  keyword()
) :: String.t()
```

Mint a signed access token for `config`.

Options:

  * `:scopes` - scopes granted to the token (default `[AttestoMCP.Scopes.tools_call()]`).
  * `:audience` - scalar or array-valued `aud` claim override. Attesto
    deduplicates the array and collapses a single remaining member to a
    scalar when minting.
  * `:dpop_jkt` - JWK thumbprint to bind the token to (RFC 9449 `cnf.jkt`).
  * `:mtls_cert_thumbprint` - certificate thumbprint to bind the token to (RFC 8705).

# `config`

```elixir
@spec config() :: Attesto.Config.t()
```

Build an `Attesto.Config` backed by an in-memory `Attesto.Keystore.Static`.

The signing key is registered into the `:attesto` application environment and
removed again via `ExUnit.Callbacks.on_exit/1`, so each test gets an isolated
keystore.

# `dpop_jwk`

```elixir
@spec dpop_jwk() :: JOSE.JWK.t()
```

Generate a fresh P-256 JWK for use as a DPoP proof key.

# `dpop_proof`

```elixir
@spec dpop_proof(
  String.t(),
  keyword()
) :: {String.t(), String.t()}
```

Build a DPoP proof JWT bound to `access_token` and return `{proof, jkt}`.

`jkt` is the RFC 7638 thumbprint of the proof key, suitable for passing as
`:dpop_jkt` to `access_token/2`. Options:

  * `:jwk` - reuse a specific key (default a fresh P-256 key).
  * `:htm` - the proof `htm` claim (default `"POST"`).
  * `:htu` - the proof `htu` claim (default the factory audience).

# `htu`

```elixir
@spec htu() :: String.t()
```

The audience the factory mints tokens for, usable as the request `htu`.

# `self_signed_cert_der`

```elixir
@spec self_signed_cert_der() :: binary()
```

Build a self-signed certificate (DER) for exercising mTLS sender constraints.

---

*Consult [api-reference.md](api-reference.md) for complete listing*