@avi770/testteam 1.2.0 → 2.0.0

package/agents/__tests__/39-api-contract-tester.test.ts

@@ -0,0 +1,312 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: { loginUrl: 'http://localhost/login', credentials: {} },
+    modules: [{ id: 'tasks', route: '/tasks', sidebarIcon: true }],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [39] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch & fs
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+const mockReadFile = vi.fn();
+vi.mock('node:fs/promises', () => ({
+  readFile: (...args: unknown[]) => mockReadFile(...args),
+}));
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { ApiContractTesterAgent } = await import('../39-api-contract-tester');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof ApiContractTesterAgent> {
+  return new ApiContractTesterAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('ApiContractTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+    mockReadFile.mockReset();
+  });
+
+  it('has agentId 39 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(39);
+    expect(agent.agentName).toBe('API Contract Tester');
+  });
+
+  it('produces low finding when no spec found', async () => {
+    mockReadFile.mockRejectedValue(new Error('ENOENT'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noSpec = result.findings.find(f => f.id.includes('no-spec'));
+    expect(noSpec).toBeDefined();
+    expect(noSpec!.severity).toBe('low');
+  });
+
+  it('detects missing required fields in response', async () => {
+    const spec = {
+      paths: {
+        '/api/tasks': {
+          get: {
+            responses: {
+              '200': {
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: { id: { type: 'string' }, name: { type: 'string' } },
+                      required: ['id', 'name'],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    fetchMock.mockImplementation((url: string, opts?: Record<string, unknown>) => {
+      if (opts?.method === 'HEAD') return Promise.resolve({ ok: true, status: 200 }); // env check
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        headers: new Map([['content-type', 'application/json']]),
+        json: () => Promise.resolve({ id: '1' }), // missing 'name'
+      });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const missingField = result.findings.find(f => f.id.includes('missing-field'));
+    expect(missingField).toBeDefined();
+    expect(missingField!.severity).toBe('medium');
+  });
+
+  it('detects wrong field types in response', async () => {
+    const spec = {
+      paths: {
+        '/api/tasks': {
+          get: {
+            responses: {
+              '200': {
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: { count: { type: 'number' } },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    fetchMock.mockImplementation((url: string, opts?: Record<string, unknown>) => {
+      if (opts?.method === 'HEAD') return Promise.resolve({ ok: true, status: 200 });
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        headers: new Map([['content-type', 'application/json']]),
+        json: () => Promise.resolve({ count: 'not-a-number' }),
+      });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const wrongType = result.findings.find(f => f.id.includes('wrong-type'));
+    expect(wrongType).toBeDefined();
+    expect(wrongType!.severity).toBe('high');
+  });
+
+  it('passes when response matches schema', async () => {
+    const spec = {
+      paths: {
+        '/api/tasks': {
+          get: {
+            responses: {
+              '200': {
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: { id: { type: 'string' } },
+                      required: ['id'],
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    fetchMock.mockImplementation((url: string, opts?: Record<string, unknown>) => {
+      if (opts?.method === 'HEAD') return Promise.resolve({ ok: true, status: 200 });
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        headers: new Map([['content-type', 'application/json']]),
+        json: () => Promise.resolve({ id: '1' }),
+      });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const schemaFindings = result.findings.filter(f => f.id.includes('missing-field') || f.id.includes('wrong-type'));
+    expect(schemaFindings.length).toBe(0);
+  });
+
+  it('handles request failures gracefully', async () => {
+    const spec = { paths: { '/api/tasks': { get: { responses: {} } } } };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+    fetchMock.mockRejectedValue(new Error('Connection refused'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    // Should not crash
+    expect(result.status).toBeDefined();
+  });
+
+  it('skips non-HTTP methods in spec', async () => {
+    const spec = {
+      paths: {
+        '/api/tasks': {
+          'x-custom': { responses: {} },
+          parameters: [],
+        },
+      },
+    };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.status).toBeDefined();
+  });
+
+  it('records evidence with spec path', async () => {
+    const spec = { paths: {} };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.some(e => e.description.includes('OpenAPI spec'))).toBe(true);
+  });
+
+  it('handles spec with empty paths', async () => {
+    const spec = { paths: {} };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noSpec = result.findings.find(f => f.id.includes('no-spec'));
+    expect(noSpec).toBeUndefined();
+  });
+
+  it('treats integer type as number for validation', async () => {
+    const spec = {
+      paths: {
+        '/api/tasks': {
+          get: {
+            responses: {
+              '200': {
+                content: {
+                  'application/json': {
+                    schema: {
+                      type: 'object',
+                      properties: { count: { type: 'integer' } },
+                    },
+                  },
+                },
+              },
+            },
+          },
+        },
+      },
+    };
+    mockReadFile.mockResolvedValue(JSON.stringify(spec));
+
+    fetchMock.mockImplementation((url: string, opts?: Record<string, unknown>) => {
+      if (opts?.method === 'HEAD') return Promise.resolve({ ok: true, status: 200 });
+      return Promise.resolve({
+        ok: true,
+        status: 200,
+        headers: new Map([['content-type', 'application/json']]),
+        json: () => Promise.resolve({ count: 42 }),
+      });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const wrongType = result.findings.find(f => f.id.includes('wrong-type'));
+    expect(wrongType).toBeUndefined();
+  });
+
+  it('resolves environment in preFlight', async () => {
+    mockReadFile.mockRejectedValue(new Error('ENOENT'));
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+});

package/agents/__tests__/40-rate-limit-tester.test.ts

@@ -0,0 +1,192 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: { loginUrl: 'http://localhost/login', credentials: {} },
+    modules: [{ id: 'tasks', route: '/tasks', sidebarIcon: true }],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [40] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { RateLimitTesterAgent } = await import('../40-rate-limit-tester');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof RateLimitTesterAgent> {
+  return new RateLimitTesterAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('RateLimitTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+  });
+
+  it('has agentId 40 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(40);
+    expect(agent.agentName).toBe('Rate Limit Tester');
+  });
+
+  it('produces medium finding when no 429 received', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noRateLimit = result.findings.find(f => f.id.includes('no-rate-limit'));
+    expect(noRateLimit).toBeDefined();
+    expect(noRateLimit!.severity).toBe('medium');
+  });
+
+  it('does not flag when 429 is received', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount <= 30) return Promise.resolve({ ok: true, status: 200 });
+      return Promise.resolve({ ok: false, status: 429 });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noRateLimit = result.findings.find(f => f.id.includes('no-rate-limit'));
+    expect(noRateLimit).toBeUndefined();
+  });
+
+  it('sends 50 rapid requests per endpoint', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'test', route: '/test', sidebarIcon: true }],
+    });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    // env check + 50 requests
+    expect(fetchMock.mock.calls.length).toBeGreaterThanOrEqual(50);
+  });
+
+  it('uses module routes for endpoints', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'invoices', route: '/invoices', sidebarIcon: true }],
+    });
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const invoiceCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/invoices'),
+    );
+    expect(invoiceCalls.length).toBeGreaterThan(0);
+  });
+
+  it('falls back to default endpoints when no modules', async () => {
+    const config = makeConfig({ modules: undefined as unknown as ValidatedConfig['modules'] });
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const authCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/auth/login'),
+    );
+    expect(authCalls.length).toBeGreaterThan(0);
+  });
+
+  it('handles fetch errors gracefully', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockRejectedValue(new Error('Connection refused'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    // Should not crash
+    expect(result.status).toBeDefined();
+  });
+
+  it('records evidence for each endpoint', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.length).toBeGreaterThan(0);
+    expect(result.evidence.some(e => e.description.includes('Rate limit test'))).toBe(true);
+  });
+
+  it('resolves environment in preFlight', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+
+  it('uses GET method for rate limit testing', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    await agent.run();
+
+    const getCalls = fetchMock.mock.calls.filter((call: unknown[]) => {
+      const opts = call[1] as Record<string, unknown> | undefined;
+      return opts?.method === 'GET';
+    });
+    expect(getCalls.length).toBeGreaterThan(0);
+  });
+
+  it('includes endpoint name in finding description', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noRateLimit = result.findings.find(f => f.id.includes('no-rate-limit'));
+    expect(noRateLimit?.description).toContain('/api/tasks');
+  });
+});

package/agents/__tests__/41-api-pagination-tester.test.ts

@@ -0,0 +1,198 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: { loginUrl: 'http://localhost/login', credentials: {} },
+    modules: [{ id: 'tasks', route: '/tasks', sidebarIcon: true }],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [41] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { ApiPaginationTesterAgent } = await import('../41-api-pagination-tester');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof ApiPaginationTesterAgent> {
+  return new ApiPaginationTesterAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('ApiPaginationTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+  });
+
+  it('has agentId 41 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(41);
+    expect(agent.agentName).toBe('API Pagination Tester');
+  });
+
+  it('flags server errors (5xx) on edge-case pagination', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockResolvedValue({ ok: false, status: 500 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const crashFinding = result.findings.find(f => f.id.includes('crash'));
+    expect(crashFinding).toBeDefined();
+    expect(crashFinding!.severity).toBe('high');
+  });
+
+  it('does not flag successful responses', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const crashFindings = result.findings.filter(f => f.id.includes('crash'));
+    expect(crashFindings.length).toBe(0);
+  });
+
+  it('does not flag 400 responses (proper validation)', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockResolvedValue({ ok: false, status: 400 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const crashFindings = result.findings.filter(f => f.id.includes('crash'));
+    expect(crashFindings.length).toBe(0);
+  });
+
+  it('tests 5 pagination edge cases per endpoint', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'test', route: '/test', sidebarIcon: true }],
+    });
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    // env check + 5 pagination tests
+    const queryCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('?'),
+    );
+    expect(queryCalls.length).toBe(5);
+  });
+
+  it('tests page=0, page=-1, page=99999, limit=0, limit=10000', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    await agent.run();
+
+    const urls = fetchMock.mock.calls
+      .map((call: unknown[]) => call[0] as string)
+      .filter((u: string) => u.includes('?'));
+
+    expect(urls.some((u: string) => u.includes('page=0'))).toBe(true);
+    expect(urls.some((u: string) => u.includes('page=-1'))).toBe(true);
+    expect(urls.some((u: string) => u.includes('page=99999'))).toBe(true);
+    expect(urls.some((u: string) => u.includes('limit=0'))).toBe(true);
+    expect(urls.some((u: string) => u.includes('limit=10000'))).toBe(true);
+  });
+
+  it('handles fetch errors gracefully', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockRejectedValue(new Error('Network error'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const errorFinding = result.findings.find(f => f.id.includes('error'));
+    expect(errorFinding).toBeDefined();
+    expect(errorFinding!.severity).toBe('low');
+  });
+
+  it('records evidence for each test', async () => {
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.length).toBeGreaterThan(0);
+  });
+
+  it('uses module routes for list endpoints', async () => {
+    const config = makeConfig({
+      modules: [{ id: 'invoices', route: '/invoices', sidebarIcon: true }],
+    });
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const invoiceCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/invoices'),
+    );
+    expect(invoiceCalls.length).toBeGreaterThan(0);
+  });
+
+  it('falls back to defaults when no modules', async () => {
+    const config = makeConfig({ modules: undefined as unknown as ValidatedConfig['modules'] });
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    const agent = createAgent(config);
+    await agent.run();
+
+    const tasksCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('/api/tasks'),
+    );
+    expect(tasksCalls.length).toBeGreaterThan(0);
+  });
+
+  it('resolves environment in preFlight', async () => {
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+});