@avi770/testteam 1.2.0 → 3.0.0

package/agents/__tests__/42-graphql-tester.test.ts

@@ -0,0 +1,252 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: { loginUrl: 'http://localhost/login', credentials: {} },
+    modules: [],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [42] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { GraphqlTesterAgent } = await import('../42-graphql-tester');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof GraphqlTesterAgent> {
+  return new GraphqlTesterAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('GraphqlTesterAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset();
+  });
+
+  it('has agentId 42 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(42);
+    expect(agent.agentName).toBe('GraphQL Tester');
+  });
+
+  it('produces low finding when no GraphQL endpoint found', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 404 });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noGql = result.findings.find(f => f.id.includes('no-graphql'));
+    expect(noGql).toBeDefined();
+    expect(noGql!.severity).toBe('low');
+  });
+
+  it('detects enabled introspection', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: true, status: 200 }); // discover endpoint
+      if (callCount === 3) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ data: { __schema: { types: [] } } }),
+      }); // introspection
+      return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const introFinding = result.findings.find(f => f.id.includes('introspection-enabled'));
+    expect(introFinding).toBeDefined();
+    expect(introFinding!.severity).toBe('medium');
+  });
+
+  it('detects missing depth limit', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: true, status: 200 }); // discover
+      if (callCount === 3) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ data: {} }), // no __schema = introspection disabled
+      });
+      if (callCount === 4) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ data: { __typename: 'Query' } }), // no errors = no depth limit
+      });
+      return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const depthFinding = result.findings.find(f => f.id.includes('no-depth-limit'));
+    expect(depthFinding).toBeDefined();
+    expect(depthFinding!.severity).toBe('high');
+  });
+
+  it('detects missing field-level auth', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: true, status: 200 }); // discover
+      if (callCount === 3) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ data: {} }),
+      });
+      if (callCount === 4) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ errors: [{ message: 'too deep' }] }),
+      });
+      if (callCount === 5) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ data: { users: [{ id: '1', email: 'a@b.com' }] } }),
+      });
+      return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const authFinding = result.findings.find(f => f.id.includes('no-field-auth'));
+    expect(authFinding).toBeDefined();
+    expect(authFinding!.severity).toBe('high');
+  });
+
+  it('does not flag when introspection is disabled', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 }); // env check
+      if (callCount === 2) return Promise.resolve({ ok: true, status: 200 }); // discover
+      if (callCount === 3) return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ errors: [{ message: 'introspection disabled' }] }),
+      });
+      return Promise.resolve({ ok: true, status: 200, json: () => Promise.resolve({}) });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const introFinding = result.findings.find(f => f.id.includes('introspection-enabled'));
+    expect(introFinding).toBeUndefined();
+  });
+
+  it('handles fetch errors during discovery', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockRejectedValue(new Error('Connection refused'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const noGql = result.findings.find(f => f.id.includes('no-graphql'));
+    expect(noGql).toBeDefined();
+  });
+
+  it('records evidence for each test', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 });
+      if (callCount === 2) return Promise.resolve({ ok: true, status: 200 });
+      return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({}),
+      });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    expect(result.evidence.length).toBeGreaterThan(0);
+  });
+
+  it('tries both /graphql and /api/graphql paths', async () => {
+    fetchMock
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // env check
+      .mockResolvedValueOnce({ ok: false, status: 404 }) // /graphql
+      .mockResolvedValueOnce({ ok: true, status: 200 }) // /api/graphql
+      .mockResolvedValue({ ok: true, status: 200, json: () => Promise.resolve({}) });
+
+    const agent = createAgent();
+    await agent.run();
+
+    const gqlCalls = fetchMock.mock.calls.filter(
+      (call: unknown[]) => typeof call[0] === 'string' && (call[0] as string).includes('graphql'),
+    );
+    expect(gqlCalls.length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('resolves environment in preFlight', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 404 });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+
+  it('does not flag field auth when users query returns empty', async () => {
+    let callCount = 0;
+    fetchMock.mockImplementation(() => {
+      callCount++;
+      if (callCount <= 1) return Promise.resolve({ ok: true, status: 200 });
+      if (callCount === 2) return Promise.resolve({ ok: true, status: 200 });
+      return Promise.resolve({
+        ok: true, status: 200,
+        json: () => Promise.resolve({ data: { users: [] } }),
+      });
+    });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const authFinding = result.findings.find(f => f.id.includes('no-field-auth'));
+    expect(authFinding).toBeUndefined();
+  });
+});

package/agents/__tests__/43-data-consistency-checker.test.ts

@@ -0,0 +1,232 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+import type { Phase } from '../../core/types';
+
+// ---------------------------------------------------------------------------
+// Stub config helpers
+// ---------------------------------------------------------------------------
+
+function makeConfig(overrides: Partial<ValidatedConfig> = {}): ValidatedConfig {
+  return {
+    schemaVersion: 1,
+    name: 'test',
+    auth: {
+      loginUrl: 'http://localhost/login',
+      credentials: {
+        admin: { email: 'admin@test.com', password: 'secret' },
+      },
+    },
+    modules: [{ id: 'tasks', route: '/tasks', sidebarIcon: true }],
+    environments: {
+      alpha: { baseUrl: 'http://localhost:3000', seed: false },
+    },
+    portals: [],
+    breakpoints: [],
+    integrations: [],
+    workers: [],
+    workflows: [],
+    accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+    tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+    costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+    agentClassification: { blocking: [], advisory: [43] },
+    thresholds: {
+      unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+      lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+      apiResponseTime: 2000,
+      bundleSizeLimit: 500000,
+      maxConsoleErrors: 0,
+    },
+    disabledAgents: [],
+    disabledAgentSet: new Set<number>(),
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Mock fetch
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Mock ApiClient
+// ---------------------------------------------------------------------------
+
+const mockPost = vi.fn();
+const mockGet = vi.fn();
+const mockPut = vi.fn();
+const mockDelete = vi.fn();
+
+vi.mock('../../helpers/api-client', () => ({
+  ApiClient: {
+    createAuthenticated: vi.fn().mockImplementation(async () => ({
+      post: mockPost,
+      get: mockGet,
+      put: mockPut,
+      delete: mockDelete,
+    })),
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { DataConsistencyCheckerAgent } = await import('../43-data-consistency-checker');
+
+function createAgent(
+  config: ValidatedConfig = makeConfig(),
+  phase: Phase = 'beta',
+): InstanceType<typeof DataConsistencyCheckerAgent> {
+  return new DataConsistencyCheckerAgent(config, phase, '/tmp/test-run');
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('DataConsistencyCheckerAgent', () => {
+  beforeEach(() => {
+    fetchMock.mockReset().mockResolvedValue({ ok: true, status: 200 });
+    mockPost.mockReset();
+    mockGet.mockReset();
+    mockPut.mockReset();
+    mockDelete.mockReset();
+  });
+
+  it('has agentId 43 and correct agentName', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(43);
+    expect(agent.agentName).toBe('Data Consistency Checker');
+  });
+
+  it('detects read-back mismatch after create', async () => {
+    mockPost.mockResolvedValue({ status: 201, body: { id: '1', name: 'test' } });
+    mockGet.mockResolvedValue({ status: 200, body: { id: '1', name: 'WRONG' } });
+    mockPut.mockResolvedValue({ status: 200, body: {} });
+    mockDelete.mockResolvedValue({ status: 204, body: {} });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const mismatch = result.findings.find(f => f.id.includes('read-mismatch'));
+    expect(mismatch).toBeDefined();
+    expect(mismatch!.severity).toBe('high');
+  });
+
+  it('detects read failure after create', async () => {
+    mockPost.mockResolvedValue({ status: 201, body: { id: '1' } });
+    mockGet.mockResolvedValue({ status: 500, body: {} });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const readFailed = result.findings.find(f => f.id.includes('read-failed'));
+    expect(readFailed).toBeDefined();
+    expect(readFailed!.severity).toBe('high');
+  });
+
+  it('detects update mismatch', async () => {
+    mockPost.mockResolvedValue({ status: 201, body: { id: '1', name: 'test' } });
+    mockGet
+      .mockResolvedValueOnce({ status: 200, body: { id: '1', name: 'test' } }) // read after create
+      .mockResolvedValueOnce({ status: 200, body: { id: '1', name: 'NOT-UPDATED' } }) // read after update
+      .mockResolvedValue({ status: 404, body: {} });
+    mockPut.mockResolvedValue({ status: 200, body: {} });
+    mockDelete.mockResolvedValue({ status: 204, body: {} });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const updateMismatch = result.findings.find(f => f.id.includes('update-mismatch'));
+    expect(updateMismatch).toBeDefined();
+  });
+
+  it('detects delete not returning 404', async () => {
+    mockPost.mockResolvedValue({ status: 201, body: { id: '1', name: 'test' } });
+    mockGet.mockResolvedValue({ status: 200, body: { id: '1', name: 'test' } }); // always 200 even after delete
+    mockPut.mockResolvedValue({ status: 200, body: {} });
+    mockDelete.mockResolvedValue({ status: 204, body: {} });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const deleteNotFound = result.findings.find(f => f.id.includes('delete-not-404'));
+    expect(deleteNotFound).toBeDefined();
+    expect(deleteNotFound!.severity).toBe('high');
+  });
+
+  it('handles create failure gracefully', async () => {
+    mockPost.mockResolvedValue({ status: 500, body: {} });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const createFailed = result.findings.find(f => f.id.includes('create-failed'));
+    expect(createFailed).toBeDefined();
+    expect(createFailed!.severity).toBe('low');
+  });
+
+  it('handles auth failure gracefully', async () => {
+    const { ApiClient } = await import('../../helpers/api-client');
+    (ApiClient.createAuthenticated as ReturnType<typeof vi.fn>).mockRejectedValueOnce(
+      new Error('Auth failed'),
+    );
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const authFailed = result.findings.find(f => f.id.includes('auth-failed'));
+    expect(authFailed).toBeDefined();
+    expect(authFailed!.severity).toBe('medium');
+  });
+
+  it('passes when all CRUD operations are consistent', async () => {
+    const testName = expect.stringContaining('consistency-test-');
+    mockPost.mockResolvedValue({ status: 201, body: { id: '1', name: 'consistency-test-123' } });
+    mockGet
+      .mockResolvedValueOnce({ status: 200, body: { id: '1', name: 'consistency-test-123' } })
+      .mockResolvedValueOnce({ status: 200, body: { id: '1', name: expect.stringContaining('updated-') } })
+      .mockResolvedValue({ status: 404, body: {} });
+    mockPut.mockResolvedValue({ status: 200, body: {} });
+    mockDelete.mockResolvedValue({ status: 204, body: {} });
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const highFindings = result.findings.filter(f => f.severity === 'high' || f.severity === 'critical');
+    // May have update-mismatch since mock won't match exact timestamp
+    expect(result.status).toBeDefined();
+  });
+
+  it('handles create error exception gracefully', async () => {
+    mockPost.mockRejectedValue(new Error('Network error'));
+
+    const agent = createAgent();
+    const result = await agent.run();
+
+    const createError = result.findings.find(f => f.id.includes('create-error'));
+    expect(createError).toBeDefined();
+  });
+
+  it('resolves environment in preFlight', async () => {
+    mockPost.mockResolvedValue({ status: 500, body: {} });
+    const agent = createAgent();
+    const result = await agent.run();
+    expect(result.findings.every(f => !f.description.includes('preFlight'))).toBe(true);
+  });
+
+  it('works without credentials', async () => {
+    const config = makeConfig({
+      auth: { loginUrl: 'http://localhost/login', credentials: {} },
+    });
+    mockPost.mockResolvedValue({ status: 500, body: {} });
+
+    const agent = createAgent(config);
+    const result = await agent.run();
+
+    // Should not crash — should use unauthenticated client
+    expect(result.status).toBeDefined();
+  });
+});