@avi770/testteam 1.2.0

package/agents/__tests__/06-api-exerciser.test.ts

@@ -0,0 +1,619 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { ValidatedConfig } from '../../core/config';
+
+// ---------------------------------------------------------------------------
+// Stub config
+// ---------------------------------------------------------------------------
+
+const stubConfig: ValidatedConfig = {
+  schemaVersion: 1,
+  name: 'test',
+  auth: {
+    loginUrl: 'http://localhost/login',
+    credentials: { admin: { email: 'admin@test.com', password: 'secret' } },
+  },
+  modules: [{ id: 'dashboard', route: '/dashboard', sidebarIcon: true }],
+  environments: {
+    alpha: { baseUrl: 'http://localhost:3000', seed: false },
+  },
+  portals: [],
+  breakpoints: [],
+  integrations: [],
+  workers: [],
+  workflows: [],
+  accuracy: { enabled: false, decimalPrecision: 2, currencySymbol: '$', timezone: 'UTC' },
+  tenancy: { enabled: false, isolationField: 'firmId', testFirms: [] },
+  costBudget: { maxPerRun: 100, maxPerAgent: 10, alertThreshold: 0.8, onExceeded: 'abort' },
+  agentClassification: { blocking: [], advisory: [] },
+  thresholds: {
+    unitCoverage: { lines: 80, functions: 80, branches: 80, statements: 80 },
+    lighthouse: { accessibility: 90, performance: 90, bestPractices: 90, seo: 90 },
+    apiResponseTime: 2000,
+    bundleSizeLimit: 500000,
+    maxConsoleErrors: 0,
+  },
+  disabledAgents: [],
+  disabledAgentSet: new Set<number>(),
+};
+
+// ---------------------------------------------------------------------------
+// Mock node:fs/promises (readdir + readFile)
+// ---------------------------------------------------------------------------
+
+const readdirMock = vi.fn();
+const readFileMock = vi.fn();
+
+vi.mock('node:fs/promises', () => ({
+  readdir: (...args: unknown[]) => readdirMock(...args),
+  readFile: (...args: unknown[]) => readFileMock(...args),
+}));
+
+// ---------------------------------------------------------------------------
+// Mock node:path (so join returns predictable values in tests)
+// ---------------------------------------------------------------------------
+
+vi.mock('node:path', async (importOriginal) => {
+  const original = await importOriginal<typeof import('node:path')>();
+  return { ...original };
+});
+
+// ---------------------------------------------------------------------------
+// Mock ApiClient
+// ---------------------------------------------------------------------------
+
+const getMock = vi.fn();
+const postMock = vi.fn();
+const putMock = vi.fn();
+const deleteMock = vi.fn();
+const createAuthenticatedMock = vi.fn();
+
+vi.mock('../../helpers/api-client', () => ({
+  ApiClient: class MockApiClient {
+    static createAuthenticated = (...args: unknown[]) => createAuthenticatedMock(...args);
+    get = (...args: unknown[]) => getMock(...args);
+    post = (...args: unknown[]) => postMock(...args);
+    put = (...args: unknown[]) => putMock(...args);
+    delete = (...args: unknown[]) => deleteMock(...args);
+  },
+}));
+
+// ---------------------------------------------------------------------------
+// Mock fetch (preFlight URL check)
+// ---------------------------------------------------------------------------
+
+const fetchMock = vi.fn();
+vi.stubGlobal('fetch', fetchMock);
+
+// ---------------------------------------------------------------------------
+// Dynamic import AFTER mocks
+// ---------------------------------------------------------------------------
+
+const { ApiExerciserAgent } = await import('../06-api-exerciser');
+
+function createAgent(): InstanceType<typeof ApiExerciserAgent> {
+  return new ApiExerciserAgent(stubConfig, 'beta', '/tmp/test-run');
+}
+
+function makeOkResponse(status = 200, durationMs = 50): object {
+  return { status, body: {}, headers: {}, durationMs };
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('ApiExerciserAgent', () => {
+  beforeEach(() => {
+    readdirMock.mockReset();
+    readFileMock.mockReset();
+    getMock.mockReset();
+    postMock.mockReset();
+    putMock.mockReset();
+    deleteMock.mockReset();
+    createAuthenticatedMock.mockReset();
+    fetchMock.mockReset();
+
+    // Default: preFlight succeeds
+    fetchMock.mockResolvedValue({ ok: true, status: 200 });
+
+    // Default: no route files
+    readdirMock.mockResolvedValue([]);
+
+    // Default: authenticated client creation succeeds
+    createAuthenticatedMock.mockResolvedValue({
+      get: getMock,
+      post: postMock,
+      put: putMock,
+      delete: deleteMock,
+    });
+
+    // Default: all API calls return 200 quickly
+    getMock.mockResolvedValue(makeOkResponse(200));
+    postMock.mockResolvedValue(makeOkResponse(200));
+    putMock.mockResolvedValue(makeOkResponse(200));
+    deleteMock.mockResolvedValue(makeOkResponse(200));
+  });
+
+  // -------------------------------------------------------------------------
+  // Identity
+  // -------------------------------------------------------------------------
+
+  it('has agentId 6 and agentName "API Exerciser"', () => {
+    const agent = createAgent();
+    expect(agent.agentId).toBe(6);
+    expect(agent.agentName).toBe('API Exerciser');
+  });
+
+  // -------------------------------------------------------------------------
+  // preFlight
+  // -------------------------------------------------------------------------
+
+  describe('preFlight()', () => {
+    it('fails when base URL is not reachable', async () => {
+      fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      expect(result.status).toBe('failed');
+      expect(result.findings[0].description).toMatch(/not reachable/i);
+    });
+
+    it('passes when base URL returns 200', async () => {
+      const agent = createAgent();
+      const result = await agent.run();
+
+      expect(result.findings.some(f => f.description.match(/not reachable/i))).toBe(false);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Endpoint discovery
+  // -------------------------------------------------------------------------
+
+  describe('endpoint discovery', () => {
+    it('discovers GET routes from router.get() patterns in route files', () => {
+      const agent = createAgent();
+      const content = `
+        router.get('/clients', authenticate, getClients);
+        router.get('/clients/:id', authenticate, getClient);
+      `;
+      const endpoints = agent.parseRouteFile(content, 'clients.routes.ts');
+
+      expect(endpoints.filter(e => e.method === 'GET')).toHaveLength(2);
+    });
+
+    it('discovers POST routes from router.post() patterns', () => {
+      const agent = createAgent();
+      const content = `router.post('/clients', authenticate, createClient);`;
+      const endpoints = agent.parseRouteFile(content, 'clients.routes.ts');
+
+      expect(endpoints.find(e => e.method === 'POST' && e.path === '/clients')).toBeDefined();
+    });
+
+    it('discovers PUT routes from router.put() patterns', () => {
+      const agent = createAgent();
+      const content = `router.put('/clients/:id', authenticate, updateClient);`;
+      const endpoints = agent.parseRouteFile(content, 'clients.routes.ts');
+
+      expect(endpoints.find(e => e.method === 'PUT')).toBeDefined();
+    });
+
+    it('discovers DELETE routes from router.delete() patterns', () => {
+      const agent = createAgent();
+      const content = `router.delete('/clients/:id', authenticate, deleteClient);`;
+      const endpoints = agent.parseRouteFile(content, 'clients.routes.ts');
+
+      expect(endpoints.find(e => e.method === 'DELETE')).toBeDefined();
+    });
+
+    it('discovers NestJS @Get decorator patterns', () => {
+      const agent = createAgent();
+      const content = `@Get('/invoices') findAll() {}`;
+      const endpoints = agent.parseRouteFile(content, 'invoices.controller.ts');
+
+      expect(endpoints.find(e => e.method === 'GET' && e.path === '/invoices')).toBeDefined();
+    });
+
+    it('discovers NestJS @Post decorator patterns', () => {
+      const agent = createAgent();
+      const content = `@Post('/invoices') create() {}`;
+      const endpoints = agent.parseRouteFile(content, 'invoices.controller.ts');
+
+      expect(endpoints.find(e => e.method === 'POST' && e.path === '/invoices')).toBeDefined();
+    });
+
+    it('skips .test.ts files when scanning the routes directory', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts', 'clients.routes.test.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', h);`);
+
+      const agent = createAgent();
+      await agent.run();
+
+      // readFile should only be called once (for the non-test file)
+      expect(readFileMock).toHaveBeenCalledTimes(1);
+    });
+
+    it('returns empty findings when routes directory does not exist', async () => {
+      readdirMock.mockRejectedValue(new Error('ENOENT: no such file or directory'));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      expect(result.status).toBe('passed');
+      expect(result.findings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Auth check
+  // -------------------------------------------------------------------------
+
+  describe('auth check', () => {
+    it('creates a security finding when endpoint does not return 401 for anonymous request', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', authenticate, getClients);`);
+
+      // Authenticated client returns 200; anonymous client also returns 200 (missing auth guard)
+      const authedInstance = {
+        get: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        post: postMock,
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      getMock.mockResolvedValue(makeOkResponse(200)); // anon also gets 200
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const authFinding = result.findings.find(f =>
+        f.type === 'code-bug-security' &&
+        f.description.includes('did not return 401'),
+      );
+      expect(authFinding).toBeDefined();
+      expect(authFinding!.severity).toBe('high');
+    });
+
+    it('does not create an auth finding when endpoint returns 401 for anonymous request', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', authenticate, getClients);`);
+
+      const authedInstance = {
+        get: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        post: postMock,
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      getMock.mockResolvedValue(makeOkResponse(401)); // anon gets 401
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const authFindings = result.findings.filter(f => f.type === 'code-bug-security');
+      expect(authFindings).toHaveLength(0);
+    });
+
+    it('skips auth check for /auth routes', async () => {
+      readdirMock.mockResolvedValue(['auth.routes.ts']);
+      readFileMock.mockResolvedValue(`router.post('/auth/login', loginHandler);`);
+
+      const authedInstance = {
+        get: getMock,
+        post: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      postMock.mockResolvedValue(makeOkResponse(200)); // anon also gets 200, but it's an auth route
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const authFindings = result.findings.filter(f => f.type === 'code-bug-security');
+      expect(authFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Response time
+  // -------------------------------------------------------------------------
+
+  describe('response time', () => {
+    it('creates a medium finding when response time exceeds 500ms', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', authenticate, getClients);`);
+
+      const authedInstance = {
+        get: vi.fn().mockResolvedValue(makeOkResponse(200, 600)), // 600ms > 500ms threshold
+        post: postMock,
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      getMock.mockResolvedValue(makeOkResponse(401));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const slowFinding = result.findings.find(f =>
+        f.description.includes('600ms'),
+      );
+      expect(slowFinding).toBeDefined();
+      expect(slowFinding!.severity).toBe('medium');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Validation check
+  // -------------------------------------------------------------------------
+
+  describe('validation check', () => {
+    it('creates a finding when POST with empty body returns 200 instead of 400', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.post('/clients', authenticate, createClient);`);
+
+      const authedInstance = {
+        get: getMock,
+        post: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      // Anon POST also returns 200 (no validation)
+      postMock.mockResolvedValue(makeOkResponse(200));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const validationFinding = result.findings.find(f =>
+        f.description.includes('empty body'),
+      );
+      expect(validationFinding).toBeDefined();
+      expect(validationFinding!.severity).toBe('medium');
+    });
+
+    it('does not create a validation finding when POST with empty body returns 400', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.post('/clients', authenticate, createClient);`);
+
+      const authedInstance = {
+        get: getMock,
+        post: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      postMock.mockResolvedValue(makeOkResponse(400));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const validationFindings = result.findings.filter(f =>
+        f.description.includes('empty body'),
+      );
+      expect(validationFindings).toHaveLength(0);
+    });
+
+    it('does not create a validation finding when POST returns 401 (auth guard first)', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.post('/clients', authenticate, createClient);`);
+
+      const authedInstance = {
+        get: getMock,
+        post: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      postMock.mockResolvedValue(makeOkResponse(401));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const validationFindings = result.findings.filter(f =>
+        f.description.includes('empty body'),
+      );
+      expect(validationFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Happy path: error responses
+  // -------------------------------------------------------------------------
+
+  describe('happy path', () => {
+    it('creates a finding when authenticated GET returns 500', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', authenticate, getClients);`);
+
+      const authedInstance = {
+        get: vi.fn().mockResolvedValue(makeOkResponse(500)),
+        post: postMock,
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      getMock.mockResolvedValue(makeOkResponse(401));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const happyFinding = result.findings.find(f => f.id.includes('happy'));
+      expect(happyFinding).toBeDefined();
+      expect(happyFinding!.severity).toBe('high');
+    });
+
+    it('does not create a finding for 401 or 404 in happy path', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', authenticate, getClients);`);
+
+      const authedInstance = {
+        get: vi.fn().mockResolvedValue(makeOkResponse(404)),
+        post: postMock,
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      getMock.mockResolvedValue(makeOkResponse(401));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const happyFindings = result.findings.filter(f => f.id.includes('happy'));
+      expect(happyFindings).toHaveLength(0);
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // No environment
+  // -------------------------------------------------------------------------
+
+  describe('no environment', () => {
+    it('creates a critical finding when no environment is configured', async () => {
+      const noEnvConfig: ValidatedConfig = {
+        ...stubConfig,
+        environments: {},
+      };
+      fetchMock.mockRejectedValue(new Error('No env'));
+
+      const agent = new ApiExerciserAgent(noEnvConfig, 'beta', '/tmp/test-run');
+      const result = await agent.run();
+
+      expect(result.status).toBe('failed');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Auth client creation failure
+  // -------------------------------------------------------------------------
+
+  describe('auth client creation failure', () => {
+    it('still runs auth checks with anonymous client when createAuthenticated fails', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/clients', authenticate, getClients);`);
+
+      createAuthenticatedMock.mockRejectedValue(new Error('Auth failed'));
+      getMock.mockResolvedValue(makeOkResponse(401));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      // Auth check still runs (anonymous client returns 401 — no finding)
+      expect(getMock).toHaveBeenCalled();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // PUT validation check
+  // -------------------------------------------------------------------------
+
+  describe('PUT validation check', () => {
+    it('runs validation check for PUT endpoints with empty body', async () => {
+      readdirMock.mockResolvedValue(['clients.routes.ts']);
+      readFileMock.mockResolvedValue(`router.put('/clients/:id', authenticate, updateClient);`);
+
+      const authedInstance = {
+        get: getMock,
+        post: postMock,
+        put: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      putMock.mockResolvedValue(makeOkResponse(200)); // anon also gets 200
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const validationFinding = result.findings.find(f =>
+        f.id.includes('validation') && f.description.includes('empty body'),
+      );
+      expect(validationFinding).toBeDefined();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // NestJS @Put/@Delete decorators
+  // -------------------------------------------------------------------------
+
+  describe('NestJS decorator patterns', () => {
+    it('discovers NestJS @Put decorator patterns', () => {
+      const agent = createAgent();
+      const content = `@Put('/invoices/:id') update() {}`;
+      const endpoints = agent.parseRouteFile(content, 'invoices.controller.ts');
+      expect(endpoints.find(e => e.method === 'PUT')).toBeDefined();
+    });
+
+    it('discovers NestJS @Delete decorator patterns', () => {
+      const agent = createAgent();
+      const content = `@Delete('/invoices/:id') remove() {}`;
+      const endpoints = agent.parseRouteFile(content, 'invoices.controller.ts');
+      expect(endpoints.find(e => e.method === 'DELETE')).toBeDefined();
+    });
+
+    it('handles empty path in NestJS decorators', () => {
+      const agent = createAgent();
+      const content = `@Get('') findAll() {}`;
+      const endpoints = agent.parseRouteFile(content, 'root.controller.ts');
+      expect(endpoints.find(e => e.method === 'GET' && e.path === '/')).toBeDefined();
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Path normalization
+  // -------------------------------------------------------------------------
+
+  describe('path normalization', () => {
+    it('replaces :param path parameters with placeholder', () => {
+      const agent = createAgent();
+      const content = `router.get('/clients/:clientId/invoices/:invoiceId', h);`;
+      const endpoints = agent.parseRouteFile(content, 'routes.ts');
+      // Verify normalization works through the happy path
+      expect(endpoints[0].path).toBe('/clients/:clientId/invoices/:invoiceId');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // readFile failure
+  // -------------------------------------------------------------------------
+
+  describe('readFile failure', () => {
+    it('skips route files that fail to read', async () => {
+      readdirMock.mockResolvedValue(['broken.routes.ts']);
+      readFileMock.mockRejectedValue(new Error('Permission denied'));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      // Should complete without findings
+      expect(result.status).toBe('passed');
+    });
+  });
+
+  // -------------------------------------------------------------------------
+  // Public route /health skip
+  // -------------------------------------------------------------------------
+
+  describe('public routes', () => {
+    it('skips auth check finding for /health endpoints', async () => {
+      readdirMock.mockResolvedValue(['health.routes.ts']);
+      readFileMock.mockResolvedValue(`router.get('/health/status', healthHandler);`);
+
+      const authedInstance = {
+        get: vi.fn().mockResolvedValue(makeOkResponse(200)),
+        post: postMock,
+        put: putMock,
+        delete: deleteMock,
+      };
+      createAuthenticatedMock.mockResolvedValue(authedInstance);
+      getMock.mockResolvedValue(makeOkResponse(200));
+
+      const agent = createAgent();
+      const result = await agent.run();
+
+      const authFindings = result.findings.filter(f => f.type === 'code-bug-security');
+      expect(authFindings).toHaveLength(0);
+    });
+  });
+});