sh-mcp/packages/calendar/test/calendar.test.ts

418 lines
14 KiB
TypeScript
Raw Normal View History

Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
/**
* @sh-mcp/calendar — unit tests
*
* All tests inject a mock CalendarClient and a mock AuthContext.
* No real network calls. No AWS calls at import time.
*
* Covers:
* - happy path for each tool
* - empty result
* - API error propagation
* - throttle / retryable error path
* - scope enforcement (missing scope → ScopeError)
* - external-attendee flagging on create_calendar_event
*/
import { describe, it, expect, vi, beforeEach } from 'vitest';
import type { AuthContext } from '@sh-mcp/shared';
import { buildCalendarTools } from '../src/tools.js';
import type { CalendarClient, CalendarEvent, AvailabilityResult } from '../src/client.js';
import { CalendarClientError } from '../src/client.js';
// ---------------------------------------------------------------------------
// Fixtures
// ---------------------------------------------------------------------------
const MOCK_CTX: AuthContext = {
sub: 'lauren@seahavenind.com',
scopes: ['ops:read', 'ops:tasks', 'gmail:self', 'calendar:self'],
aud: 'sh-mcp-ops',
};
const CTX_NO_CALENDAR: AuthContext = {
sub: 'other@seahavenind.com',
scopes: ['ops:read'],
aud: 'sh-mcp-ops',
};
const INTERNAL_EVENT: CalendarEvent = {
id: 'event-001',
summary: 'Team standup',
start: '2026-06-11T09:00:00-04:00',
end: '2026-06-11T09:15:00-04:00',
attendees: [
{ email: 'lauren@seahavenind.com', self: true, responseStatus: 'accepted' },
{ email: 'adam@seahavenind.com', responseStatus: 'accepted' },
],
status: 'confirmed',
};
const EXTERNAL_EVENT: CalendarEvent = {
id: 'event-002',
summary: 'Vendor call',
start: '2026-06-11T14:00:00-04:00',
end: '2026-06-11T15:00:00-04:00',
attendees: [
{ email: 'lauren@seahavenind.com', self: true, responseStatus: 'accepted' },
{ email: 'vendor@externalco.com', responseStatus: 'needsAction' },
],
status: 'confirmed',
};
const AVAILABILITY: AvailabilityResult = {
busy: [{ start: '2026-06-11T09:00:00Z', end: '2026-06-11T09:15:00Z' }],
free: [
{ start: '2026-06-11T08:00:00Z', end: '2026-06-11T09:00:00Z' },
{ start: '2026-06-11T09:15:00Z', end: '2026-06-11T17:00:00Z' },
],
};
// ---------------------------------------------------------------------------
// Mock client builder
// ---------------------------------------------------------------------------
function buildMockClient(overrides: Partial<CalendarClient> = {}): CalendarClient {
return {
getEvents: vi.fn().mockResolvedValue([INTERNAL_EVENT]),
checkAvailability: vi.fn().mockResolvedValue(AVAILABILITY),
createEvent: vi.fn().mockResolvedValue(INTERNAL_EVENT),
...overrides,
};
}
// ---------------------------------------------------------------------------
// get_calendar_events
// ---------------------------------------------------------------------------
describe('get_calendar_events', () => {
let mockClient: CalendarClient;
let tools: ReturnType<typeof buildCalendarTools>;
beforeEach(() => {
mockClient = buildMockClient();
tools = buildCalendarTools(mockClient);
});
const getTool = (ts: ReturnType<typeof buildCalendarTools>) =>
ts.find((t) => t.name === 'get_calendar_events')!;
it('happy path — returns events with count', async () => {
const tool = getTool(tools);
const result = await tool.handler(
{ timeMin: '2026-06-11T00:00:00Z', timeMax: '2026-06-11T23:59:59Z' },
MOCK_CTX,
);
expect(result.count).toBe(1);
expect(result.events[0].id).toBe('event-001');
expect(mockClient.getEvents).toHaveBeenCalledWith(
MOCK_CTX.sub,
expect.objectContaining({
timeMin: '2026-06-11T00:00:00Z',
timeMax: '2026-06-11T23:59:59Z',
singleEvents: true,
orderBy: 'startTime',
}),
);
});
it('empty result — returns count 0', async () => {
mockClient = buildMockClient({ getEvents: vi.fn().mockResolvedValue([]) });
tools = buildCalendarTools(mockClient);
const result = await getTool(tools).handler(
{ timeMin: '2026-06-12T00:00:00Z', timeMax: '2026-06-12T23:59:59Z' },
MOCK_CTX,
);
expect(result.count).toBe(0);
expect(result.events).toHaveLength(0);
});
it('non-retryable API error is re-thrown as-is', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
getEvents: vi.fn().mockRejectedValue(new CalendarClientError('Forbidden', 403, false)),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
await expect(
getTool(tools).handler(
{ timeMin: '2026-06-11T00:00:00Z', timeMax: '2026-06-11T23:59:59Z' },
MOCK_CTX,
),
).rejects.toThrow('Forbidden');
});
it('retryable/throttle error is wrapped with user-friendly message', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
getEvents: vi.fn().mockRejectedValue(new CalendarClientError('Rate limited', 429, true)),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
await expect(
getTool(tools).handler(
{ timeMin: '2026-06-11T00:00:00Z', timeMax: '2026-06-11T23:59:59Z' },
MOCK_CTX,
),
).rejects.toThrow(/temporarily unavailable.*retryable/i);
});
it('missing calendar:self scope throws ScopeError', async () => {
await expect(
getTool(tools).handler(
{ timeMin: '2026-06-11T00:00:00Z', timeMax: '2026-06-11T23:59:59Z' },
CTX_NO_CALENDAR,
),
).rejects.toThrow();
// getEvents should never have been called
expect(mockClient.getEvents).not.toHaveBeenCalled();
});
it('flags external attendees on returned events', async () => {
mockClient = buildMockClient({
getEvents: vi.fn().mockResolvedValue([EXTERNAL_EVENT]),
});
tools = buildCalendarTools(mockClient);
const result = await getTool(tools).handler(
{ timeMin: '2026-06-11T00:00:00Z', timeMax: '2026-06-11T23:59:59Z' },
MOCK_CTX,
);
expect(result.events[0].hasExternalAttendees).toBe(true);
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
expect(
(result.events[0] as { externalAttendeeWarning?: string }).externalAttendeeWarning,
).toContain('vendor@externalco.com');
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
it('defines correct tool metadata', () => {
const tool = getTool(tools);
expect(tool.name).toBe('get_calendar_events');
expect(tool.tier).toBe('ops');
expect(tool.requiredScope).toBe('calendar:self');
});
});
// ---------------------------------------------------------------------------
// check_availability
// ---------------------------------------------------------------------------
describe('check_availability', () => {
let mockClient: CalendarClient;
let tools: ReturnType<typeof buildCalendarTools>;
beforeEach(() => {
mockClient = buildMockClient();
tools = buildCalendarTools(mockClient);
});
const getTool = (ts: ReturnType<typeof buildCalendarTools>) =>
ts.find((t) => t.name === 'check_availability')!;
it('happy path — returns busy and free blocks with echoed window', async () => {
const input = {
timeMin: '2026-06-11T08:00:00Z',
timeMax: '2026-06-11T17:00:00Z',
};
const result = await getTool(tools).handler(input, MOCK_CTX);
expect(result.busy).toHaveLength(1);
expect(result.free).toHaveLength(2);
expect(result.timeMin).toBe(input.timeMin);
expect(result.timeMax).toBe(input.timeMax);
});
it('empty availability — no busy blocks', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
checkAvailability: vi.fn().mockResolvedValue({
busy: [],
free: [{ start: '2026-06-11T08:00:00Z', end: '2026-06-11T17:00:00Z' }],
}),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
const result = await getTool(tools).handler(
{ timeMin: '2026-06-11T08:00:00Z', timeMax: '2026-06-11T17:00:00Z' },
MOCK_CTX,
);
expect(result.busy).toHaveLength(0);
expect(result.free).toHaveLength(1);
});
it('non-retryable error is re-thrown', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
checkAvailability: vi
.fn()
.mockRejectedValue(new CalendarClientError('Not found', 404, false)),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
await expect(
getTool(tools).handler(
{ timeMin: '2026-06-11T08:00:00Z', timeMax: '2026-06-11T17:00:00Z' },
MOCK_CTX,
),
).rejects.toThrow('Not found');
});
it('throttle/retryable error wraps with user-friendly message', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
checkAvailability: vi
.fn()
.mockRejectedValue(new CalendarClientError('Quota exceeded', 429, true)),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
await expect(
getTool(tools).handler(
{ timeMin: '2026-06-11T08:00:00Z', timeMax: '2026-06-11T17:00:00Z' },
MOCK_CTX,
),
).rejects.toThrow(/temporarily unavailable.*retryable/i);
});
it('missing calendar:self scope throws before calling client', async () => {
await expect(
getTool(tools).handler(
{ timeMin: '2026-06-11T08:00:00Z', timeMax: '2026-06-11T17:00:00Z' },
CTX_NO_CALENDAR,
),
).rejects.toThrow();
expect(mockClient.checkAvailability).not.toHaveBeenCalled();
});
it('defines correct tool metadata', () => {
const tool = getTool(tools);
expect(tool.name).toBe('check_availability');
expect(tool.tier).toBe('ops');
expect(tool.requiredScope).toBe('calendar:self');
});
});
// ---------------------------------------------------------------------------
// create_calendar_event
// ---------------------------------------------------------------------------
describe('create_calendar_event', () => {
let mockClient: CalendarClient;
let tools: ReturnType<typeof buildCalendarTools>;
beforeEach(() => {
mockClient = buildMockClient();
tools = buildCalendarTools(mockClient);
});
const getTool = (ts: ReturnType<typeof buildCalendarTools>) =>
ts.find((t) => t.name === 'create_calendar_event')!;
it('happy path — internal attendees only, hasExternalAttendees=false', async () => {
const input = {
summary: 'Sprint planning',
start: '2026-06-15T10:00:00-04:00',
end: '2026-06-15T11:00:00-04:00',
attendees: [{ email: 'adam@seahavenind.com' }],
};
const result = await getTool(tools).handler(input, MOCK_CTX);
expect(result.id).toBe('event-001');
expect(result.hasExternalAttendees).toBe(false);
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
expect(
(result as { externalAttendeeWarning?: string }).externalAttendeeWarning,
).toBeUndefined();
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
expect(mockClient.createEvent).toHaveBeenCalledWith(
MOCK_CTX.sub,
expect.objectContaining({ summary: 'Sprint planning' }),
);
});
it('external attendee — hasExternalAttendees=true with warning', async () => {
mockClient = buildMockClient({
createEvent: vi.fn().mockResolvedValue(EXTERNAL_EVENT),
});
tools = buildCalendarTools(mockClient);
const input = {
summary: 'Vendor call',
start: '2026-06-11T14:00:00-04:00',
end: '2026-06-11T15:00:00-04:00',
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
attendees: [{ email: 'lauren@seahavenind.com' }, { email: 'vendor@externalco.com' }],
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
};
const result = await getTool(tools).handler(input, MOCK_CTX);
expect(result.hasExternalAttendees).toBe(true);
expect(result.externalAttendeeWarning).toContain('vendor@externalco.com');
expect(result.externalAttendeeWarning).toContain('seahavenind.com');
});
it('non-retryable error is re-thrown', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
createEvent: vi.fn().mockRejectedValue(new CalendarClientError('Conflict', 409, false)),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
await expect(
getTool(tools).handler(
{ summary: 'Test', start: '2026-06-11T10:00:00Z', end: '2026-06-11T11:00:00Z' },
MOCK_CTX,
),
).rejects.toThrow('Conflict');
});
it('throttle/retryable error wraps with user-friendly message', async () => {
mockClient = buildMockClient({
Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
createEvent: vi.fn().mockRejectedValue(new CalendarClientError('Rate limited', 429, true)),
Phase 0b slice: monorepo scaffold + @sh-mcp/shared core + integration packages (#2) * Phase 0b slice: monorepo scaffold + shared core + integration packages The 0a-INDEPENDENT code slice (one-shot via af-0b-package-slice workflow: Haiku scaffold + Sonnet packages, Sonnet fix-to-green). Nothing deploys; no CDK/servers. - Monorepo scaffold: npm workspaces, strict TS (NodeNext), vitest (80% gate), eslint 9 flat config, prettier; ci.yaml/deploy.yaml callers (Node 24, enable-qemu). - @sh-mcp/shared: transport-agnostic core — Scope/AuthContext/ToolDef, ToolRegistry, redact()+maskValue() (PII), OpenAPI 3.1 generator. AUTH STUBBED behind an AuthProvider interface (TODO auth-layer-0a); JWT/aud/client_id/JWKS/deny-list deferred per design.md §2. - 9 integration packages (qbo, google-maps, internal-data, payments, knowledge-base, gmail, calendar, tasks, reminders): tools against shared, external deps mocked behind injected client interfaces; finance handlers call redact(). Verified green: tsc -b clean, vitest 245/245, eslint 0 errors. Auth mechanism intentionally deferred until the 0a spike resolves it (G16/§0.4). * Complete Cognito auth provider + Phase 1 build brief Finish the WIP CognitoAuthProvider (client_id allow-list as audience boundary, finance TTL ceiling, deny-list, scope-prefix stripping) with its test suite, and check in docs/build-plan-phase-1.md so the Phase 1 work has its governing brief in-tree (design.md §2.5). * ci: disable cdk synth for Phase 0b (no CDK app yet) The reusable ci-typescript-cdk workflow defaults run-cdk-synth: true, but the Phase 0b package scaffold has no cdk.json or stacks, so cdk synth fails with '--app is required'. Disable it here; Phase 1 re-enables it with the server CDK stubs.
2026-06-26 12:42:17 -04:00
});
tools = buildCalendarTools(mockClient);
await expect(
getTool(tools).handler(
{ summary: 'Test', start: '2026-06-11T10:00:00Z', end: '2026-06-11T11:00:00Z' },
MOCK_CTX,
),
).rejects.toThrow(/temporarily unavailable.*retryable/i);
});
it('missing calendar:self scope throws before calling client', async () => {
await expect(
getTool(tools).handler(
{ summary: 'Test', start: '2026-06-11T10:00:00Z', end: '2026-06-11T11:00:00Z' },
CTX_NO_CALENDAR,
),
).rejects.toThrow();
expect(mockClient.createEvent).not.toHaveBeenCalled();
});
it('event with no attendees — hasExternalAttendees=false', async () => {
mockClient = buildMockClient({
createEvent: vi.fn().mockResolvedValue({
...INTERNAL_EVENT,
attendees: [],
}),
});
tools = buildCalendarTools(mockClient);
const result = await getTool(tools).handler(
{ summary: 'Solo block', start: '2026-06-11T13:00:00Z', end: '2026-06-11T14:00:00Z' },
MOCK_CTX,
);
expect(result.hasExternalAttendees).toBe(false);
});
it('defines correct tool metadata', () => {
const tool = getTool(tools);
expect(tool.name).toBe('create_calendar_event');
expect(tool.tier).toBe('ops');
expect(tool.requiredScope).toBe('calendar:self');
});
});
// ---------------------------------------------------------------------------
// Index / registry shape
// ---------------------------------------------------------------------------
describe('buildCalendarTools registry', () => {
it('returns exactly 3 tools with distinct names', () => {
const mockClient = buildMockClient();
const tools = buildCalendarTools(mockClient);
expect(tools).toHaveLength(3);
const names = tools.map((t) => t.name);
expect(names).toContain('get_calendar_events');
expect(names).toContain('check_availability');
expect(names).toContain('create_calendar_event');
// all distinct
expect(new Set(names).size).toBe(3);
});
it('all tools are ops tier with calendar:self scope', () => {
const mockClient = buildMockClient();
const tools = buildCalendarTools(mockClient);
for (const tool of tools) {
expect(tool.tier).toBe('ops');
expect(tool.requiredScope).toBe('calendar:self');
}
});
});