@anteros/core 0.0.20 → 0.0.22

package/tests/fixtures/mcp-tenant/mcp/tools/echo.tool.ts

@@ -0,0 +1,19 @@
+import { define, v } from "../../../../../index";
+
+export default define.McpTool({
+    name: "echo",
+    description: "Echoes the message back to the caller",
+    inputSchema: v.object({
+        msg: v.string().required().description("The message to echo"),
+        times: v.number().integer().min(1).max(5).default(1),
+    }),
+    exec: async ({ args }) => {
+        // Protocol format: { content: [...] }
+        return {
+            content: [{
+                type: "text",
+                text: JSON.stringify({ echoed: args.msg, times: args.times, at: new Date().toISOString() }),
+            }],
+        };
+    },
+});

package/tests/fixtures/metrics-worker.ts

@@ -0,0 +1,21 @@
+// Fixture: minimal worker that reports a fake metrics snapshot over IPC,
+// then stays alive so the master can supervise it.
+const payload = {
+  type: "metrics",
+  pid: process.pid,
+  metrics: {
+    pid: process.pid,
+    startedAt: Date.now(),
+    uptime: 3,
+    env: "test",
+    connections: 0,
+    pendingRequests: 0,
+    pendingWebSockets: 0,
+    requests: { total: 7, active: 0, errors: 1, byMethod: { GET: 5, POST: 2 }, byStatus: { "200": 6, "500": 1 } },
+    memory: { rss: 1024, heapUsed: 512, heapTotal: 1024, external: 64 },
+    cpu: { percent: 12.5, cores: 8, user: 100, system: 50 },
+  },
+};
+
+process.send?.(payload);
+setInterval(() => {}, 1000); // stay alive until killed

package/tests/hono.test.ts

@@ -0,0 +1,211 @@
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { createApp } from "../server/hono";
+import { cfg } from "../server/config";
+import { AppError } from "../lib/error";
+import { HTTPException } from "hono/http-exception";
+
+const base = (server: any) => server.url.href.replace(/\/$/, "");
+
+function resetServerConfig() {
+    cfg.server = {
+        ...cfg.server,
+        cors: undefined,
+        ipRestriction: undefined,
+        trustProxy: undefined,
+        rateLimit: undefined,
+    };
+}
+
+beforeEach(() => {
+    resetServerConfig();
+    delete process.env.REDIS_URL;
+    delete process.env.REDIS_HOST;
+    delete process.env.REDIS_PORT;
+    delete process.env.REDIS_PASSWORD;
+});
+
+afterEach(() => {
+    resetServerConfig();
+});
+
+// ─── Error handling (C2) ─────────────────────────────────────────────────
+// Note: these use a real Bun.serve — ipRestriction returns 403 when there is
+// no real socket address (app.request() without a server).
+
+async function bootAppWith(register: (app: any) => void) {
+    const app = createApp();
+    register(app);
+    const server = Bun.serve({ port: 0, fetch: app.fetch });
+    return { url: `${base(server)}`, server };
+}
+
+describe("onError", () => {
+    it("maps AppError to its status + code + message", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/app-error", () => {
+                throw new AppError("Validation failed", { status: 400, code: "VALIDATION_ERROR" });
+            });
+        });
+        const res = await fetch(`${url}/app-error`);
+        expect(res.status).toBe(400);
+        const body: any = await res.json();
+        expect(body.code).toBe("VALIDATION_ERROR");
+        expect(body.message).toBe("Validation failed");
+        server.stop(true);
+    });
+
+    it("lets HTTPException respond with its own status", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/exc", () => {
+                throw new HTTPException(401, { message: "Unauthorized" });
+            });
+        });
+        const res = await fetch(`${url}/exc`);
+        expect(res.status).toBe(401);
+        server.stop(true);
+    });
+
+    it("returns 500 INTERNAL_SERVER_ERROR for unexpected errors", async () => {
+        const { url, server } = await bootAppWith((app) => {
+            app.get("/crash", () => {
+                throw new Error("boom");
+            });
+        });
+        const res = await fetch(`${url}/crash`);
+        expect(res.status).toBe(500);
+        const body: any = await res.json();
+        expect(body.code).toBe("INTERNAL_SERVER_ERROR");
+        server.stop(true);
+    });
+});
+
+// ─── CORS (C1) ───────────────────────────────────────────────────────────
+
+describe("CORS origin", () => {
+    it("throws on credentials + wildcard", () => {
+        cfg.server.cors = { origin: "*", credentials: true };
+        expect(() => createApp()).toThrow(/CORS misconfiguration/);
+    });
+
+    it("accepts a string origin with credentials", () => {
+        cfg.server.cors = { origin: "https://example.com", credentials: true };
+        expect(() => createApp()).not.toThrow();
+    });
+
+    it("accepts a string[] origin", () => {
+        cfg.server.cors = { origin: ["https://a.com", "https://b.com"], credentials: true };
+        expect(() => createApp()).not.toThrow();
+    });
+
+    it("accepts a function origin", () => {
+        cfg.server.cors = {
+            origin: (ctx) => (ctx.origin === "https://ok.com" ? "https://ok.com" : "https://fallback.com"),
+            credentials: true,
+        };
+        expect(() => createApp()).not.toThrow();
+    });
+});
+
+// ─── Client IP / trustProxy (S1) ─────────────────────────────────────────
+
+describe("client IP resolution", () => {
+    it("ignores proxy headers by default (spoof-proof)", async () => {
+        const app = createApp();
+        app.get("/echo-ip", (c) => c.json({ ip: c.get("clientIp") }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+
+        cfg.server.trustProxy = false;
+        const res = await fetch(`${base(server)}/echo-ip`, { headers: { "X-Forwarded-For": "1.2.3.4" } });
+        const body: any = await res.json();
+        expect(body.ip).not.toBe("1.2.3.4");
+
+        server.stop(true);
+    });
+
+    it("uses the header when trustProxy is enabled", async () => {
+        const app = createApp();
+        app.get("/echo-ip", (c) => c.json({ ip: c.get("clientIp") }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+
+        cfg.server.trustProxy = true;
+        const res = await fetch(`${base(server)}/echo-ip`, { headers: { "X-Forwarded-For": "1.2.3.4" } });
+        const body: any = await res.json();
+        expect(body.ip).toBe("1.2.3.4");
+
+        server.stop(true);
+    });
+});
+
+// ─── Health ──────────────────────────────────────────────────────────────
+
+describe("GET /health", () => {
+    it("returns metrics + client ip", async () => {
+        const { url, server } = await bootAppWith(() => {});
+        const res = await fetch(`${url}/health`);
+        expect(res.status).toBe(200);
+        const body: any = await res.json();
+        expect(typeof body.pid).toBe("number");
+        expect(typeof body.ip).toBe("string");
+        expect(body.requests).toBeDefined();
+        expect(body.memory).toBeDefined();
+        expect(body.cpu).toBeDefined();
+        server.stop(true);
+    });
+});
+
+// ─── Rate limiting ───────────────────────────────────────────────────────
+
+describe("rate limiting (in-memory)", () => {
+    it("serves X-RateLimit-* headers and blocks after max", async () => {
+        cfg.server.rateLimit = { enabled: true, windowMs: 60_000, max: 3 };
+        const app = createApp();
+        app.get("/echo", (c) => c.json({ ok: true }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const url = `${base(server)}/echo`;
+
+        const statuses: number[] = [];
+        let first: Response | undefined;
+        for (let i = 0; i < 4; i++) {
+            const r = await fetch(url);
+            if (i === 0) first = r;
+            statuses.push(r.status);
+        }
+        expect(statuses).toEqual([200, 200, 200, 429]);
+
+        // headers present on the first request
+        expect(first!.headers.get("X-RateLimit-Limit")).toBe("3");
+        expect(first!.headers.get("X-RateLimit-Remaining")).toBe("2");
+
+        server.stop(true);
+    });
+
+    it("login limiter uses a distinct counter (not blocked by global)", async () => {
+        cfg.server.rateLimit = { enabled: true, windowMs: 60_000, max: 100, login: { max: 2 } };
+        const app = createApp();
+        app.post("/api/x/login", (c) => c.json({ ok: true }));
+        app.get("/echo", (c) => c.json({ ok: true }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const url = `${base(server)}`;
+
+        const statuses: number[] = [];
+        for (let i = 0; i < 3; i++) {
+            statuses.push((await fetch(`${url}/api/x/login`, { method: "POST" })).status);
+        }
+        expect(statuses).toEqual([200, 200, 429]);
+
+        // same IP on a normal route → still allowed (distinct key)
+        expect((await fetch(`${url}/echo`)).status).toBe(200);
+
+        server.stop(true);
+    });
+
+    it("falls back to in-memory when Redis is configured but unreachable (auto-detect)", async () => {
+        cfg.server.rateLimit = { enabled: true, max: 100, redis: { host: "localhost", port: 1 } };
+        const app = createApp();
+        app.get("/echo", (c) => c.json({ ok: true }));
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const res = await fetch(`${base(server)}/echo`);
+        expect(res.status).toBe(200);
+        server.stop(true);
+    });
+});

package/tests/mcp.test.ts

@@ -0,0 +1,186 @@
+import { describe, it, expect, beforeEach } from "bun:test";
+import { define, v } from "../index";
+import { cfg } from "../server/config";
+import { syncMcpTools } from "../lib/mcp";
+import { createApp } from "../server/hono";
+
+const TENANT = "mcp-test";
+const TENANT_DIR = "packages/core/tests/fixtures/mcp-tenant";
+
+// @hono/mcp frames every message as Server-Sent Events (MCP Streamable HTTP spec)
+function parseSSE(text: string): any[] {
+    const messages: any[] = [];
+    let data: string[] = [];
+    for (const line of text.split(/\r?\n/)) {
+        if (line.startsWith("data:")) {
+            data.push(line.slice(5).trim());
+        } else if (line === "" && data.length) {
+            messages.push(JSON.parse(data.join("\n")));
+            data = [];
+        }
+    }
+    if (data.length) messages.push(JSON.parse(data.join("\n")));
+    return messages;
+}
+
+function resetConfig() {
+    cfg.server = { ...cfg.server, rateLimit: undefined, cors: undefined, ipRestriction: undefined, trustProxy: undefined };
+    cfg.mcpTools = [];
+    cfg.tenants = [];
+}
+
+beforeEach(() => {
+    resetConfig();
+    delete process.env.REDIS_URL;
+    delete process.env.REDIS_HOST;
+    delete process.env.REDIS_PORT;
+    delete process.env.REDIS_PASSWORD;
+});
+
+describe("define.McpTool", () => {
+    it("marks the tool and enables it by default", () => {
+        const tool = define.McpTool({
+            name: "greet",
+            description: "greets",
+            inputSchema: v.object({ name: v.string().required() }),
+            exec: async () => ({ content: [{ type: "text", text: "hi" }] }),
+        });
+        expect(tool._isMcpTool_).toBe(true);
+        expect(tool.enabled).toBe(true);
+    });
+});
+
+describe("syncMcpTools", () => {
+    it("loads tools + resources from mcp/tools and mcp/resources", async () => {
+        cfg.tenants = [{ id: TENANT, dir: TENANT_DIR, database: { uri: "mongodb://localhost:27017/none" } }];
+        await syncMcpTools();
+        expect(cfg.mcpTools?.length).toBe(2);
+        expect(cfg.mcpTools?.map((t) => t.name).sort()).toEqual(["badge", "echo"]);
+        expect(cfg.mcpResources?.length).toBe(2);
+        expect(cfg.mcpResources?.map((r) => r.uri).sort()).toEqual(["orders://summary", "users://{id}"]);
+        expect(cfg.mcpTools?.[0]?._tenant_).toBe(TENANT);
+    });
+});
+
+describe("MCP protocol (GET/POST /mcp/:tenant_id)", () => {
+    it("serves tools/list and tools/call over JSON-RPC", async () => {
+        cfg.tenants = [{ id: TENANT, dir: TENANT_DIR, database: { uri: "mongodb://localhost:27017/none" } }];
+        await syncMcpTools();
+
+        const app = createApp();
+        const server = Bun.serve({ port: 0, fetch: app.fetch });
+        const url = server.url.href.replace(/\/$/, "");
+
+        // 1. tools/list
+        const listRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 1, method: "tools/list", params: {} }),
+        });
+        expect(listRes.status).toBe(200);
+        const list = parseSSE(await listRes.text())[0];
+        const tools = list?.result?.tools ?? [];
+        expect(tools.some((t: any) => t.name === "echo")).toBe(true);
+        expect(tools.some((t: any) => t.name === "badge")).toBe(true);
+
+        // 1b. resources/list — static resources
+        const resListRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 9, method: "resources/list", params: {} }),
+        });
+        const resList = parseSSE(await resListRes.text())[0];
+        const resources = resList?.result?.resources ?? [];
+        expect(resources.some((r: any) => r.uri === "orders://summary")).toBe(true);
+
+        // 1c. resources/templates/list
+        const tmplRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 10, method: "resources/templates/list", params: {} }),
+        });
+        const tmplList = parseSSE(await tmplRes.text())[0];
+        const templates = tmplList?.result?.resourceTemplates ?? [];
+        expect(templates.some((t: any) => t.uriTemplate === "users://{id}")).toBe(true);
+
+        // 1d. resources/read — static URI
+        const readRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 11, method: "resources/read", params: { uri: "orders://summary" } }),
+        });
+        const read = parseSSE(await readRes.text())[0];
+        const readText = read?.result?.contents?.[0]?.text ?? "";
+        expect(readText).toContain("\"total\":42");
+
+        // 1e. resources/read — template URI with params
+        const readTplRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 12, method: "resources/read", params: { uri: "users://abc123" } }),
+        });
+        const readTpl = parseSSE(await readTplRes.text())[0];
+        expect(readTpl?.result?.contents?.[0]?.text ?? "").toContain("\"id\":\"abc123\"");
+
+        // 1f. resources/read — unknown URI → error
+        const readBadRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 13, method: "resources/read", params: { uri: "nope://x" } }),
+        });
+        const readBad = parseSSE(await readBadRes.text())[0];
+        expect(readBad?.error).toBeDefined();
+
+        // 2. tools/call (valid args + Joi defaults)
+        const callRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                jsonrpc: "2.0", id: 2, method: "tools/call",
+                params: { name: "echo", arguments: { msg: "hello mcp" } },
+            }),
+        });
+        const call = parseSSE(await callRes.text())[0];
+        const block = call?.result?.content?.[0] ?? {};
+        expect(block.type).toBe("text");
+        expect(block.text ?? "").toContain("hello mcp");
+        // Joi default applied (times=1)
+        expect(block.text ?? "").toContain("\"times\":1");
+
+        // 2b. protocol content blocks pass through unchanged (image block)
+        const badgeRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                jsonrpc: "2.0", id: 3, method: "tools/call",
+                params: { name: "badge", arguments: {} },
+            }),
+        });
+        const badge = parseSSE(await badgeRes.text())[0];
+        expect(badge?.result?.content?.[0]?.type).toBe("image");
+        expect(badge?.result?.content?.[0]?.mimeType).toBe("image/png");
+
+        // 2b. invalid args → isError (Joi validation)
+        const badRes = await fetch(`${url}/mcp/${TENANT}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                jsonrpc: "2.0", id: 3, method: "tools/call",
+                params: { name: "echo", arguments: { msg: 123 } },
+            }),
+        });
+        const bad = parseSSE(await badRes.text())[0];
+        expect(bad?.result?.isError).toBe(true);
+        expect(bad?.result?.content?.[0]?.text ?? "").toContain("Invalid arguments");
+
+        // 3. unknown tenant → 404
+        const notFound = await fetch(`${url}/mcp/ghost`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ jsonrpc: "2.0", id: 4, method: "tools/list", params: {} }),
+        });
+        expect(notFound.status).toBe(404);
+
+        server.stop(true);
+    });
+});

package/tests/metrics-cluster.test.ts

@@ -0,0 +1,103 @@
+import { describe, it, expect } from "bun:test";
+import path from "node:path";
+import { getMetrics, registerMetrics, trackRequest } from "../server/metrics";
+import { startMaster, aggregateMetrics, type MasterMetrics } from "../server/cluster";
+
+// ─── metrics ────────────────────────────────────────────────────────────
+
+describe("metrics", () => {
+    it("returns a snapshot with pid, memory and cpu", () => {
+        const m = getMetrics();
+        expect(m.pid).toBe(process.pid);
+        expect(m.uptime).toBeGreaterThanOrEqual(0);
+        expect(typeof m.memory.rss).toBe("number");
+        expect(typeof m.cpu.percent).toBe("number");
+        expect(m.cpu.cores).toBeGreaterThanOrEqual(1);
+        expect(typeof m.requests.total).toBe("number");
+    });
+
+    it("trackRequest counts requests by method and status", () => {
+        const before = getMetrics().requests.total;
+        trackRequest(new Request("http://localhost/", { method: "POST" }), new Response("ok", { status: 201 }));
+        const after = getMetrics().requests.total;
+        expect(after).toBe(before + 1);
+        expect(getMetrics().requests.byMethod.POST).toBeGreaterThanOrEqual(1);
+        expect(getMetrics().requests.byStatus["201"]).toBeGreaterThanOrEqual(1);
+    });
+
+    it("trackRequest counts 5xx as errors", () => {
+        const before = getMetrics().requests.errors;
+        trackRequest(new Request("http://localhost/x"), new Response("boom", { status: 500 }));
+        expect(getMetrics().requests.errors).toBe(before + 1);
+    });
+
+    it("registerMetrics exposes pendingRequests", () => {
+        const server = Bun.serve({ port: 0, fetch: () => new Response("ok") });
+        registerMetrics(server as any);
+        expect(typeof getMetrics().pendingRequests).toBe("number");
+        server.stop(true);
+    });
+});
+
+// ─── aggregateMetrics ───────────────────────────────────────────────────
+
+function fakeSnapshot(pid: number, total: number, rss: number): MasterMetrics[number] {
+    return {
+        pid,
+        startedAt: Date.now(),
+        uptime: 10,
+        env: "test",
+        connections: 0,
+        pendingRequests: 0,
+        pendingWebSockets: 0,
+        requests: { total, active: 0, errors: total > 10 ? 1 : 0, byMethod: { GET: total }, byStatus: { "200": total } },
+        memory: { rss, heapUsed: rss / 2, heapTotal: rss, external: 0 },
+        cpu: { percent: 10, cores: 8, user: 100, system: 50 },
+    };
+}
+
+describe("aggregateMetrics", () => {
+    it("returns an empty aggregate without workers", () => {
+        const agg = aggregateMetrics({});
+        expect(agg.workers).toBe(0);
+        expect(agg.requests.total).toBe(0);
+        expect(agg.pids).toEqual([]);
+    });
+
+    it("sums worker snapshots", () => {
+        const agg = aggregateMetrics({ 1: fakeSnapshot(1, 5, 1000), 2: fakeSnapshot(2, 5, 1000) });
+        expect(agg.workers).toBe(2);
+        expect(agg.requests.total).toBe(10);
+        expect(agg.memory.rss).toBe(2000);
+        expect(agg.cpu.percent).toBe(10);
+        expect(agg.pids).toHaveLength(2);
+        expect(agg.requests.perSecond).toBe(1);
+    });
+});
+
+// ─── startMaster (real subprocess + IPC) ────────────────────────────────
+
+describe("startMaster", () => {
+    it("spawns workers, collects IPC metrics and shutdown kills them", async () => {
+        const workerPath = path.join(import.meta.dir, "fixtures", "metrics-worker.ts");
+        const master = startMaster({
+            workers: 1,
+            argv: [process.execPath, workerPath],
+            env: { ...(process.env as Record<string, string>) },
+        });
+
+        // Wait for the worker to start and report its metrics
+        await new Promise((r) => setTimeout(r, 1500));
+
+        expect(master.workers.length).toBe(1);
+
+        const metrics = master.metrics();
+        const pids = Object.keys(metrics);
+        expect(pids.length).toBe(1);
+        expect(metrics[Number(pids[0])]!.requests.total).toBe(7);
+
+        master.shutdown();
+        await new Promise((r) => setTimeout(r, 300));
+        expect(master.workers.length).toBe(0);
+    }, 10_000);
+});

package/tests/scripts-heavy.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect, beforeAll, afterAll } from "bun:test";
+import { MongoClient } from "mongodb";
+import { cfg } from "../server/config";
+import { runScripts } from "../lib/scripts";
+
+const DB_URI = "mongodb://localhost:27017/anteros_heavy_test";
+const TENANT_DIR = "packages/core/tests/fixtures/heavy";
+
+let mongoAvailable = false;
+let client: MongoClient;
+
+beforeAll(async () => {
+    // Gracefully skip when MongoDB is not reachable
+    try {
+        client = new MongoClient(DB_URI, { serverSelectionTimeoutMS: 1500 });
+        await client.connect();
+        mongoAvailable = true;
+    } catch {
+        mongoAvailable = false;
+    }
+});
+
+afterAll(async () => {
+    if (mongoAvailable && client) {
+        try { await client.db().dropDatabase(); } catch {}
+        await client.close();
+    }
+});
+
+describe("heavy scripts (subprocess)", () => {
+    it("runs a heavy:true script in a worker process and persists data", async () => {
+        if (!mongoAvailable) {
+            console.warn("Skipping: MongoDB unavailable");
+            return;
+        }
+
+        cfg.tenants = [{ id: "heavy-test", dir: TENANT_DIR, database: { uri: DB_URI } }];
+
+        await runScripts();
+
+        const count = await client.db().collection("items").countDocuments();
+        expect(count).toBe(20);
+
+        const sample: any = await client.db().collection("items").findOne();
+        expect(sample.name).toBeString();
+        expect(sample.createdAt).toBeInstanceOf(Date);
+        expect(sample.updatedAt).toBeInstanceOf(Date);
+    }, 30_000);
+});