@agenthippo-ai/agenthippo 0.1.1 → 1.110.9

package/out/test/data-plane.test.js

@@ -0,0 +1,311 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Data-plane gateway integration tests (secure-obo-design §3, §5, §9)
+ *
+ *  Boots the real thing end to end: TurnRegistry + CredentialBroker + a real connector
+ *  subprocess (stdio MCP over a private pipe) + the loopback streamable-HTTP gateway —
+ *  then drives it with the MCP SDK client exactly like an engine would.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+require("mocha");
+const assert = __importStar(require("assert"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const streamableHttp_js_1 = require("@modelcontextprotocol/sdk/client/streamableHttp.js");
+const data_plane_1 = require("../cli/data-plane");
+// The fixture connector must live INSIDE the extension tree so its `import` of
+// @modelcontextprotocol/sdk resolves by walking up to extensions/agentide/node_modules.
+const FIXTURE_DIR = path.join(__dirname, 'data-plane-fixture');
+const CONNECTOR_PATH = path.join(FIXTURE_DIR, 'connector.mjs');
+const CONNECTOR_SOURCE = `
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+const server = new Server({ name: 'test-connector', version: '0.0.1' }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+	tools: [{
+		name: 'whoami',
+		description: 'echo the broker-supplied turn context',
+		inputSchema: { type: 'object', properties: { probe: { type: 'string' } } },
+	}],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (req) => {
+	const turn = (req.params._meta ?? {})['ai.agenthippo/turn'] ?? null;
+	const probe = (req.params.arguments ?? {}).probe ?? '';
+	return {
+		content: [{ type: 'text', text: JSON.stringify({
+			userId: turn ? turn.userId : null,
+			credential: turn ? turn.credential : null,
+			envContainsProbe: probe ? JSON.stringify(process.env).includes(probe) : false,
+		}) }],
+	};
+});
+await server.connect(new StdioServerTransport());
+`;
+function mcpClient(url, nonce) {
+    const transport = new streamableHttp_js_1.StreamableHTTPClientTransport(new URL(url), {
+        requestInit: { headers: { Authorization: `Bearer ${nonce}` } },
+    });
+    const client = new index_js_1.Client({ name: 'test-engine', version: '0.0.1' });
+    return { client, transport };
+}
+async function callWhoami(url, nonce, probe) {
+    const { client, transport } = mcpClient(url, nonce);
+    try {
+        await client.connect(transport);
+        const res = await client.callTool({ name: 'whoami', arguments: probe ? { probe } : {} });
+        const content = res.content[0];
+        return JSON.parse(content.text);
+    }
+    finally {
+        await client.close().catch(() => undefined);
+    }
+}
+suite('data-plane: gateway + registry + broker end to end', function () {
+    this.timeout(30_000);
+    let plane;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        plane = await data_plane_1.DataPlane.start({ connectorPath: CONNECTOR_PATH, provider: 'passthrough' });
+    });
+    suiteTeardown(async () => {
+        await plane?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    test('gateway binds loopback only', () => {
+        assert.ok(plane.url.startsWith('http://127.0.0.1:'), plane.url);
+    });
+    test('a live nonce lists and calls tools as the registered user, credential selected server-side', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
+        try {
+            const { client, transport } = mcpClient(plane.url, turn.nonce);
+            await client.connect(transport);
+            const tools = await client.listTools();
+            assert.deepStrictEqual(tools.tools.map((t) => t.name), ['whoami']);
+            await client.close();
+            const who = await callWhoami(plane.url, turn.nonce);
+            assert.strictEqual(who.userId, 'alice@corp.com');
+            assert.strictEqual(who.credential, 'alice-obo-token', 'the broker must hand the connector the turn user\'s credential');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('the credential never enters the connector process env — it rides only the per-call pipe', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 'alice-obo-token' });
+        try {
+            const who = await callWhoami(plane.url, turn.nonce, 'alice-obo-token');
+            assert.strictEqual(who.envContainsProbe, false, 'raw credential must not appear anywhere in the connector env');
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('two concurrent turns each resolve their OWN user + credential (the §9.1 concurrency property)', async () => {
+        const alice = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 'sa', inboundToken: 'tok-alice' });
+        const bob = plane.registerTurn({ userId: 'bob@corp.com', sessionKey: 'sb', inboundToken: 'tok-bob' });
+        try {
+            const [a, b] = await Promise.all([
+                callWhoami(plane.url, alice.nonce),
+                callWhoami(plane.url, bob.nonce),
+            ]);
+            assert.strictEqual(a.userId, 'alice@corp.com');
+            assert.strictEqual(a.credential, 'tok-alice');
+            assert.strictEqual(b.userId, 'bob@corp.com');
+            assert.strictEqual(b.credential, 'tok-bob');
+        }
+        finally {
+            alice.release();
+            bob.release();
+        }
+    });
+    test('missing / unknown nonce → 401, fail closed', async () => {
+        await assert.rejects(() => callWhoami(plane.url, 'not-a-real-nonce'), /401|Unauthorized/i);
+    });
+    test('a released (turn-ended) nonce → 401 — a stale engine fails closed (§3.2)', async () => {
+        const turn = plane.registerTurn({ userId: 'alice@corp.com', sessionKey: 's1', inboundToken: 't' });
+        const nonce = turn.nonce;
+        const who = await callWhoami(plane.url, nonce);
+        assert.strictEqual(who.userId, 'alice@corp.com');
+        turn.release();
+        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
+    });
+    test('an expired deadline → 401 even if release() was never called (stranded-nonce backstop)', async () => {
+        const { nonce } = plane.registry.register({
+            userId: 'alice@corp.com',
+            sessionKey: 's1',
+            inboundToken: 't',
+            deadline: Date.now() - 1,
+        });
+        await assert.rejects(() => callWhoami(plane.url, nonce), /401|Unauthorized/i);
+    });
+    test('passthrough provider with no inbound token → the TOOL CALL errors, fail closed, turn itself unaffected', async () => {
+        const turn = plane.registerTurn({ userId: 'peer:telegram:123', sessionKey: 's2' });
+        try {
+            const { client, transport } = mcpClient(plane.url, turn.nonce);
+            await client.connect(transport);
+            const res = await client.callTool({ name: 'whoami', arguments: {} });
+            assert.strictEqual(res.isError, true, 'no inbound credential must fail the call closed');
+            const text = res.content[0].text;
+            assert.match(text, /fail-closed/);
+            await client.close();
+        }
+        finally {
+            turn.release();
+        }
+    });
+    test('a token-less turn fails closed even RIGHT AFTER the same user ran a turn WITH a token (no cache bridging)', async () => {
+        // Passthrough gets the platform token on every legitimate request; a broker cache
+        // that outlives the turn would let broken forwarding silently reuse the previous
+        // token for the cache TTL — the exact silent-fallback failure the provider forbids.
+        const withToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3', inboundToken: 'tok-1' });
+        try {
+            const ok = await callWhoami(plane.url, withToken.nonce);
+            assert.strictEqual(ok.credential, 'tok-1');
+        }
+        finally {
+            withToken.release();
+        }
+        const withoutToken = plane.registerTurn({ userId: 'u@corp.com', sessionKey: 's3' });
+        try {
+            const { client, transport } = mcpClient(plane.url, withoutToken.nonce);
+            await client.connect(transport);
+            const res = await client.callTool({ name: 'whoami', arguments: {} });
+            assert.strictEqual(res.isError, true, 'the cached tok-1 must not serve a token-less turn');
+            await client.close();
+        }
+        finally {
+            withoutToken.release();
+        }
+    });
+});
+suite('data-plane: TurnRegistry unit properties', () => {
+    test('raw nonces are never map keys — lookups go through sha256', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        const { nonce } = reg.register({ userId: 'u', sessionKey: 's' });
+        assert.ok(reg.resolve(nonce));
+        // resolve by the HASH must fail — only the raw nonce authenticates.
+        assert.strictEqual(reg.resolve((0, data_plane_1.hashNonce)(nonce)), undefined);
+    });
+    test('release is idempotent and deletes exactly its own entry', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        const a = reg.register({ userId: 'a', sessionKey: 's' });
+        const b = reg.register({ userId: 'b', sessionKey: 's' });
+        a.release();
+        a.release();
+        assert.strictEqual(reg.resolve(a.nonce), undefined);
+        assert.strictEqual(reg.resolve(b.nonce)?.userId, 'b');
+        b.release();
+        assert.strictEqual(reg.size, 0);
+    });
+    test('expired entries are pruned on register', () => {
+        const reg = new data_plane_1.TurnRegistry();
+        reg.register({ userId: 'a', sessionKey: 's', deadline: Date.now() - 1 });
+        assert.strictEqual(reg.size, 1);
+        reg.register({ userId: 'b', sessionKey: 's' });
+        assert.strictEqual(reg.size, 1, 'the expired entry must have been pruned');
+    });
+});
+suite('data-plane: sidecar EDGE registration (P1 fix — no forging authority in the agent container)', function () {
+    this.timeout(30_000);
+    const EDGE_TOKEN = 'edge-only-secret';
+    let sidecar;
+    let controlBase;
+    suiteSetup(async () => {
+        fs.mkdirSync(FIXTURE_DIR, { recursive: true });
+        fs.writeFileSync(CONNECTOR_PATH, CONNECTOR_SOURCE, 'utf8');
+        sidecar = await (0, data_plane_1.startDataPlaneSidecar)({
+            config: { connectorPath: CONNECTOR_PATH, provider: 'identity' },
+            registerToken: EDGE_TOKEN,
+            gatewayPort: 0,
+            controlPort: 0,
+            bindHost: '127.0.0.1',
+        });
+        controlBase = `http://127.0.0.1:${sidecar.controlPort}`;
+    });
+    suiteTeardown(async () => {
+        await sidecar?.close();
+        fs.rmSync(FIXTURE_DIR, { recursive: true, force: true });
+    });
+    async function edgeRegister(user, token = EDGE_TOKEN) {
+        // Shaped like Caddy forward_auth: GET, no body, verified identity in X-Agent-User.
+        return fetch(`${controlBase}/edge/turn`, {
+            headers: { Authorization: `Bearer ${token}`, 'X-Agent-User': user },
+        });
+    }
+    test('the edge mints a nonce for the verified user; the nonce works at the gateway as that user', async () => {
+        const res = await edgeRegister('alice@corp.com');
+        assert.strictEqual(res.status, 200);
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        assert.ok(nonce, 'nonce must ride the response header for Caddy copy_headers');
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'alice@corp.com');
+    });
+    test('edge registration without the edge token → 401 (the engine can route here but cannot forge)', async () => {
+        const res = await edgeRegister('victim@corp.com', 'stolen-or-missing');
+        assert.strictEqual(res.status, 401);
+    });
+    test('edge registration without a verified identity header → 400, fail closed', async () => {
+        const res = await fetch(`${controlBase}/edge/turn`, { headers: { Authorization: `Bearer ${EDGE_TOKEN}` } });
+        assert.strictEqual(res.status, 400);
+    });
+    test('serve releases an adopted turn via the gateway using ONLY the nonce; the nonce then fails closed', async () => {
+        const res = await edgeRegister('bob@corp.com');
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const edge = new data_plane_1.EdgeDataPlane({ gatewayUrl: sidecar.gatewayUrl });
+        const turn = edge.adoptTurn(nonce);
+        assert.strictEqual(turn.env.AGENTHIPPO_TURN_NONCE, nonce);
+        assert.strictEqual(turn.env.AGENTHIPPO_DATA_MCP_URL, sidecar.gatewayUrl);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'bob@corp.com');
+        await turn.release();
+        await assert.rejects(() => callWhoami(sidecar.gatewayUrl, nonce), /401|Unauthorized/i);
+    });
+    test('release with a bogus nonce is a harmless no-op (204) and touches no other turn', async () => {
+        const res = await edgeRegister('carol@corp.com');
+        const nonce = res.headers.get(data_plane_1.TURN_NONCE_HEADER);
+        const del = await fetch(new URL('/turn', sidecar.gatewayUrl), {
+            method: 'DELETE',
+            headers: { Authorization: 'Bearer not-a-real-nonce' },
+        });
+        assert.strictEqual(del.status, 204);
+        const who = await callWhoami(sidecar.gatewayUrl, nonce);
+        assert.strictEqual(who.userId, 'carol@corp.com', 'an unrelated release must not end a live turn');
+    });
+});