sh-mcp/packages/tasks/test/dev-client.test.ts

120 lines
4.8 KiB
TypeScript
Raw Normal View History

Phase 1: runnable MCP + OpenAPI servers (ops + finance) (#3) * Add shared transport: dispatch, MCP + OpenAPI adapters, local auth Add the single authoritative tool-execution path (executeTool) plus the two universal interfaces over it (design.md §2.5, §7.3): - dispatch.ts: scope enforcement, ajv input validation, rate limiting, finance egress redaction (redactDeep), and structured audit emission on one path. - audit.ts / rate-limit.ts: injected AuditLogger + RateLimiter abstractions. - mcp.ts: low-level MCP Server with scope-filtered tools/list (tool-hiding) and tools/call routed through executeTool. - http.ts: Express host mounting /mcp, /openapi.json, POST /tools/:name, /healthz. - openapi.ts: buildOpenApiDocument wraps the existing path generator into a full OpenAPI 3.1 document. - local-auth.ts: LocalAuthProvider (dev bearer tokens) that refuses to construct outside SH_MCP_ENV=local and enforces audience binding (design.md §3, §6). * Add in-memory dev clients; make package tool exports lazy Add an in-memory Client implementation per integration package (seeded fake data, no network) selected when SH_MCP_ENV=local (build-plan §4). Gmail/calendar/ tasks dev clients partition by ctx.sub; payments/qbo seed sensitive-looking fields so the redaction egress path has real targets to mask. Make the eager default-tool exports in tasks/reminders/qbo LAZY (getDefaultTools) so importing a package barrel no longer constructs an AWS client at module load (build-plan §7 'no I/O at import time') — the previous eager construction broke server startup. Fix payments tsconfig rootDir (src, was '.') so its declarations resolve under dist/index.d.ts like the other 8 packages. * Add runnable sh-mcp-ops and sh-mcp-finance servers Two thin composition-root servers over the shared transport (design.md §3): - ops: internal-data, knowledge-base, google-maps, gmail, calendar, tasks, reminders. finance: qbo, payments (audited + redacted on egress). - config from env only (no hardcoded ids/issuer/tables); SH_MCP_ENV selects LocalAuthProvider + dev clients (local) vs CognitoAuthProvider + real stubs (aws). Finance applies the 15-min finance-token TTL ceiling (design.md §2.5). - index.ts is the only place .listen() is called; a Lambda handler placeholder is exported but not depended on. - synth-only CDK stubs (no real IAM/Cognito/WAF) so 'cdk synth' has a valid app (build-plan §6); READMEs document local run, dev tokens, curl, MCP Inspector. * Add security-weighted test suite + coverage gate; wire tooling Add tests for the highest-risk surface (build-plan §5, design.md §7.3): tool-hiding, server-side scope enforcement (incl. forced hidden calls), audience binding, input-schema validation, finance redaction on egress, audit emission with hashed args, prompt-injection regression (tool output is data), rate limiting, MCP conformance (in-memory transport round-trip), OpenAPI 3.1 validity, and local-auth safety. Add HTTP integration tests (supertest) for both servers and per-package dev-client tests. 405 tests pass. Wire the coverage gate into vitest.config.ts: 80% overall, with per-file thresholds on the auth + dispatch crown jewels; exclude deferred real client stubs, entrypoints, cdk apps, and aws-only config from the gate (documented). Extend eslint flat config + add .prettierignore to cover servers/. Commit the updated package-lock.json. * Suppress pre-existing dev-tooling + out-of-scope scanner findings Add written-justification suppressions for the 4 confirmed crit/high pre-push scanner findings, none of which are in this PR's Phase 1 production code: - npmaudit vitest / @vitest/coverage-v8 / vite: dev/test-only deps that never run in the deployed server/Lambda runtime (pins carried from Phase 0b; Dependabot will bump). - gitleaks docs/agentforce-plan.md secret: that file is not on this branch and not in this changeset; flagged for the maintainer to scrub on its own branch. The deep agentic /sh-security-review (required for this auth/authz-touching PR) was NOT run by the agent and is flagged outstanding in the PR body. * Address CodeQL findings: bound ajv error work + edge rate limiting GHAS code-scanning alerts on this PR: - dispatch.ts (js/resource-exhaustion): ajv ran with allErrors:true on untrusted input, letting a crafted payload force unbounded error enumeration. Switch to allErrors:false (default) so validation short-circuits on the first failure; the 400 still names that path. - http.ts (js/missing-rate-limiting): the authenticated routes (/mcp, /tools/:name) had no edge throttle — auth/JWT verification ran on every request before the per-sub dispatch limiter could apply. Add an IP-keyed express-rate-limit in front of authenticate (120/60s default, configurable), returning the standard 429 shape. Defense-in-depth over the per-sub + per-tool limiter in executeTool; API GW/WAF remains the production edge. Tests: +2 cases proving the edge limiter throttles before auth (429, not 401) on /tools and /mcp. 407 pass; tsc/eslint/prettier clean. * Fix polynomial ReDoS in Bearer-token extraction (CodeQL js/polynomial-redos) extractBearerToken matched /^Bearer\s+(.+)$/ — \s and . both match a space, so the two quantifiers overlap and a crafted header can drive polynomial backtracking. Require the capture to start with a non-whitespace char (/^Bearer\s+(\S.*)$/), removing the ambiguity → linear match. Behavior is unchanged for real tokens; +2 regression tests. * Harden auth + finance redaction (sh-security-review confirmed mediums) Two confirmed medium findings from the agentic security review: - Fail-open SH_MCP_ENV: config defaulted to 'local' when the var was unset, so a deploy that forgot SH_MCP_ENV=aws would silently run LocalAuthProvider and accept static dev bearer tokens (dev-finance-admin -> finance:admin). Now fail-closed: SH_MCP_ENV must be explicitly 'local' or 'aws' or the server refuses to start. Plus an independent guard in LocalAuthProvider that refuses to construct in an AWS runtime (AWS_LAMBDA_FUNCTION_NAME / AWS_EXECUTION_ENV present), regardless of the env flag. - Finance egress redaction gap: redactDeep only wholesale-masked a sensitive key when its value was a scalar; an object/array under a sensitive key was recursed into, letting a bare nested value (e.g. {account:{number:...}}) escape the keyword-gated pattern matcher. Now the entire subtree under a sensitive key is masked. No current finance tool emitted such shapes (all flat strings), so this closes a latent hole in the universal safety net. +4 tests (subtree redaction, AWS-runtime guard). 411 pass; coverage gate green. Review also produced lows (memo free-text digits, unsalted argsHash, unauth /openapi.json by-design, session-cap no-reset by-design) tracked separately; 0 confirmed critical/high — review verdict PASS.
2026-06-26 13:33:21 -04:00
import { describe, it, expect } from 'vitest';
import { InMemoryTasksClient } from '../src/dev-client.js';
const LAUREN = 'lauren@seahavenind.com';
const ADAM = 'adam@seahavenind.com';
describe('InMemoryTasksClient', () => {
describe('createTask', () => {
it('returns a task with a generated id and completed:false', async () => {
const client = new InMemoryTasksClient();
const task = await client.createTask({ sub: LAUREN, title: 'Buy gloves' });
expect(task.taskId).toMatch(/^task-\d{4}$/);
expect(task.sub).toBe(LAUREN);
expect(task.title).toBe('Buy gloves');
expect(task.completed).toBe(false);
expect(task.createdAt).toBeDefined();
expect(task.description).toBeUndefined();
});
it('carries an optional description through', async () => {
const client = new InMemoryTasksClient();
const task = await client.createTask({ sub: LAUREN, title: 'T', description: 'detail' });
expect(task.description).toBe('detail');
});
it('a task created for sub A is not visible to sub B (partitioned)', async () => {
const client = new InMemoryTasksClient();
const task = await client.createTask({ sub: LAUREN, title: 'Lauren only' });
const adamTasks = await client.listTasks({ sub: ADAM, includeCompleted: true });
expect(adamTasks.map((t) => t.taskId)).not.toContain(task.taskId);
const laurenTasks = await client.listTasks({ sub: LAUREN, includeCompleted: true });
expect(laurenTasks.map((t) => t.taskId)).toContain(task.taskId);
});
it('creates a task for a previously-unknown sub', async () => {
const client = new InMemoryTasksClient();
const task = await client.createTask({ sub: 'fresh@seahavenind.com', title: 'First' });
const tasks = await client.listTasks({
sub: 'fresh@seahavenind.com',
includeCompleted: true,
});
expect(tasks.map((t) => t.taskId)).toEqual([task.taskId]);
});
});
describe('listTasks', () => {
it('omits completed tasks by default', async () => {
const client = new InMemoryTasksClient();
const tasks = await client.listTasks({ sub: LAUREN });
const ids = tasks.map((t) => t.taskId);
expect(ids).toContain('task-0001'); // open
expect(ids).not.toContain('task-0002'); // completed
});
it('includes completed tasks when includeCompleted is true', async () => {
const client = new InMemoryTasksClient();
const tasks = await client.listTasks({ sub: LAUREN, includeCompleted: true });
const ids = tasks.map((t) => t.taskId);
expect(ids).toContain('task-0001');
expect(ids).toContain('task-0002');
});
it('returns an empty list for an unknown sub', async () => {
const client = new InMemoryTasksClient();
expect(await client.listTasks({ sub: 'nobody@example.com' })).toEqual([]);
});
});
describe('completeTask', () => {
it('sets completed and completedAt', async () => {
const client = new InMemoryTasksClient();
const completed = await client.completeTask({ sub: LAUREN, taskId: 'task-0001' });
expect(completed.completed).toBe(true);
expect(completed.completedAt).toBeDefined();
// now omitted from the default (open-only) listing
const open = await client.listTasks({ sub: LAUREN });
expect(open.map((t) => t.taskId)).not.toContain('task-0001');
});
it('throws for an unknown taskId', async () => {
const client = new InMemoryTasksClient();
await expect(client.completeTask({ sub: LAUREN, taskId: 'task-missing' })).rejects.toThrow(
/not found/,
);
});
it('throws when the task belongs to another sub', async () => {
const client = new InMemoryTasksClient();
await expect(client.completeTask({ sub: ADAM, taskId: 'task-0001' })).rejects.toThrow(
/not found/,
);
});
});
describe('deleteTask', () => {
it('removes the task so subsequent listings omit it', async () => {
const client = new InMemoryTasksClient();
await client.deleteTask({ sub: LAUREN, taskId: 'task-0001' });
const tasks = await client.listTasks({ sub: LAUREN, includeCompleted: true });
expect(tasks.map((t) => t.taskId)).not.toContain('task-0001');
});
it('is a no-op for an unknown taskId', async () => {
const client = new InMemoryTasksClient();
await expect(
client.deleteTask({ sub: LAUREN, taskId: 'task-missing' }),
).resolves.toBeUndefined();
const tasks = await client.listTasks({ sub: LAUREN, includeCompleted: true });
expect(tasks).toHaveLength(2);
});
it('is a no-op for an unknown sub', async () => {
const client = new InMemoryTasksClient();
await expect(
client.deleteTask({ sub: 'nobody@example.com', taskId: 'task-0001' }),
).resolves.toBeUndefined();
});
});
});