@axiom-lattice/pg-stores 5.0.0 → 5.0.1

package/src/__tests__/PostgreSQLMcpServerConfigStore.integration.test.ts

@@ -0,0 +1,258 @@
+import { randomUUID } from "node:crypto";
+import { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import type { McpServerConfig } from "@axiom-lattice/protocols";
+import { decrypt } from "@axiom-lattice/core";
+import { PostgreSQLMcpServerConfigStore } from "../stores/PostgreSQLMcpServerConfigStore";
+
+const TEST_DATABASE_URL = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = TEST_DATABASE_URL ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLMcpServerConfigStore integration", () => {
+  let store: PostgreSQLMcpServerConfigStore;
+  let pool: Pool;
+
+  beforeAll(async () => {
+    store = new PostgreSQLMcpServerConfigStore({
+      poolConfig: TEST_DATABASE_URL!,
+      autoMigrate: true,
+    });
+    await store.initialize();
+    pool = new Pool({ connectionString: TEST_DATABASE_URL });
+  });
+
+  const tenants = new Set<string>();
+
+  afterEach(async () => {
+    if (tenants.size === 0) {
+      return;
+    }
+    await pool.query(
+      "DELETE FROM lattice_mcp_server_configs WHERE tenant_id = ANY($1::text[])",
+      [[...tenants]],
+    );
+    tenants.clear();
+  });
+
+  afterAll(async () => {
+    await pool.end();
+    await store.dispose();
+  });
+
+  function tenantId(): string {
+    const id = `mcp-config-${randomUUID()}`;
+    tenants.add(id);
+    return id;
+  }
+
+  function config(overrides: Partial<McpServerConfig> = {}): McpServerConfig {
+    return {
+      name: "filesystem",
+      version: "1.0.0",
+      transport: "streamable_http",
+      url: "https://mcp.example.com/mcp",
+      env: { API_TOKEN: "env-secret" },
+      headers: { Authorization: "Bearer header-secret" },
+      timeout: 5000,
+      ...overrides,
+    };
+  }
+
+  async function createConfig(tenant: string) {
+    const id = randomUUID();
+    const key = `key-${randomUUID()}`;
+    const entry = await store.createConfig(tenant, id, {
+      key,
+      name: "Filesystem MCP",
+      description: "Filesystem server",
+      config: config(),
+      selectedTools: ["read_file", "write_file"],
+    });
+    return { id, key, entry };
+  }
+
+  it("creates and reads a config by id and by key", async () => {
+    const tenant = tenantId();
+    const { id, key, entry } = await createConfig(tenant);
+
+    expect(entry).toMatchObject({
+      id,
+      tenantId: tenant,
+      key,
+      name: "Filesystem MCP",
+      description: "Filesystem server",
+      selectedTools: ["read_file", "write_file"],
+      isEnvEncrypted: true,
+      status: "disconnected",
+    });
+    expect(entry.config.transport).toBe("streamable_http");
+
+    const byId = await store.getConfigById(tenant, id);
+    expect(byId?.id).toBe(id);
+    expect(byId?.config.timeout).toBe(5000);
+
+    const byKey = await store.getConfigByKey(tenant, key);
+    expect(byKey?.id).toBe(id);
+  });
+
+  it("encrypts env and header values at rest and decrypts them on read", async () => {
+    const tenant = tenantId();
+    const { id } = await createConfig(tenant);
+
+    const raw = await pool.query<{
+      config: { env: Record<string, string>; headers: Record<string, string> };
+      is_env_encrypted: boolean;
+    }>(
+      "SELECT config, is_env_encrypted FROM lattice_mcp_server_configs WHERE tenant_id = $1 AND id = $2",
+      [tenant, id],
+    );
+
+    expect(raw.rows[0].is_env_encrypted).toBe(true);
+    expect(raw.rows[0].config.env.API_TOKEN).not.toBe("env-secret");
+    expect(raw.rows[0].config.headers.Authorization).not.toBe("Bearer header-secret");
+    expect(decrypt(raw.rows[0].config.env.API_TOKEN)).toBe("env-secret");
+    expect(decrypt(raw.rows[0].config.headers.Authorization)).toBe(
+      "Bearer header-secret",
+    );
+
+    const read = await store.getConfigById(tenant, id);
+    expect(read?.config.env).toEqual({ API_TOKEN: "env-secret" });
+    expect(read?.config.headers).toEqual({
+      Authorization: "Bearer header-secret",
+    });
+  });
+
+  it("lists a tenant's configs and includes them in the cross-tenant listing", async () => {
+    const tenant = tenantId();
+    const first = await createConfig(tenant);
+    const second = await createConfig(tenant);
+
+    const listed = await store.getAllConfigs(tenant);
+    expect(listed.map((entry) => entry.id).sort()).toEqual([first.id, second.id].sort());
+
+    const all = await store.getAllConfigsWithoutTenant();
+    const ids = all.map((entry) => entry.id);
+    expect(ids).toContain(first.id);
+    expect(ids).toContain(second.id);
+    expect(all.find((entry) => entry.id === first.id)?.config.env).toEqual({
+      API_TOKEN: "env-secret",
+    });
+  });
+
+  it("updates fields, selected tools, status, and config secrets", async () => {
+    const tenant = tenantId();
+    const { id, key } = await createConfig(tenant);
+
+    const updated = await store.updateConfig(tenant, id, {
+      name: "Renamed",
+      description: "Updated description",
+      selectedTools: ["read_file"],
+      status: "connected",
+      config: config({
+        env: { API_TOKEN: "rotated-env-secret" },
+        headers: { Authorization: "Bearer rotated-header-secret" },
+      }),
+    });
+
+    expect(updated).toMatchObject({
+      id,
+      key,
+      name: "Renamed",
+      description: "Updated description",
+      selectedTools: ["read_file"],
+      status: "connected",
+    });
+    expect(updated?.config.env).toEqual({ API_TOKEN: "rotated-env-secret" });
+    expect(updated?.config.headers).toEqual({
+      Authorization: "Bearer rotated-header-secret",
+    });
+
+    // The rewritten secrets are re-encrypted at rest, not stored as plaintext.
+    const raw = await pool.query<{
+      config: { env: Record<string, string>; headers: Record<string, string> };
+      is_env_encrypted: boolean;
+    }>(
+      "SELECT config, is_env_encrypted FROM lattice_mcp_server_configs WHERE tenant_id = $1 AND id = $2",
+      [tenant, id],
+    );
+    expect(raw.rows[0].is_env_encrypted).toBe(true);
+    expect(raw.rows[0].config.env.API_TOKEN).not.toBe("rotated-env-secret");
+    expect(raw.rows[0].config.headers.Authorization).not.toBe(
+      "Bearer rotated-header-secret",
+    );
+    expect(decrypt(raw.rows[0].config.env.API_TOKEN)).toBe("rotated-env-secret");
+    expect(decrypt(raw.rows[0].config.headers.Authorization)).toBe(
+      "Bearer rotated-header-secret",
+    );
+  });
+
+  it("keeps encrypted env and headers when a partial update omits config", async () => {
+    const tenant = tenantId();
+    const { id } = await createConfig(tenant);
+
+    const updated = await store.updateConfig(tenant, id, { name: "Only renamed" });
+
+    expect(updated?.name).toBe("Only renamed");
+    expect(updated?.config.env).toEqual({ API_TOKEN: "env-secret" });
+    expect(updated?.config.headers).toEqual({
+      Authorization: "Bearer header-secret",
+    });
+
+    const raw = await pool.query<{
+      config: { env: Record<string, string>; headers: Record<string, string> };
+      is_env_encrypted: boolean;
+    }>(
+      "SELECT config, is_env_encrypted FROM lattice_mcp_server_configs WHERE tenant_id = $1 AND id = $2",
+      [tenant, id],
+    );
+    expect(raw.rows[0].is_env_encrypted).toBe(true);
+    expect(raw.rows[0].config.env.API_TOKEN).not.toBe("env-secret");
+    expect(decrypt(raw.rows[0].config.env.API_TOKEN)).toBe("env-secret");
+    expect(decrypt(raw.rows[0].config.headers.Authorization)).toBe(
+      "Bearer header-secret",
+    );
+  });
+
+  it("reports has and deletes a config", async () => {
+    const tenant = tenantId();
+    const { id } = await createConfig(tenant);
+
+    expect(await store.hasConfig(tenant, id)).toBe(true);
+    expect(await store.deleteConfig(tenant, id)).toBe(true);
+    expect(await store.hasConfig(tenant, id)).toBe(false);
+    expect(await store.getConfigById(tenant, id)).toBeNull();
+    expect(await store.deleteConfig(tenant, id)).toBe(false);
+  });
+
+  it("isolates configs by tenant", async () => {
+    const tenantA = tenantId();
+    const tenantB = tenantId();
+    const key = `shared-${randomUUID()}`;
+    const idA = randomUUID();
+    const idB = randomUUID();
+
+    await store.createConfig(tenantA, idA, { key, config: config() });
+    await store.createConfig(tenantB, idB, { key, config: config() });
+
+    expect(await store.getConfigById(tenantA, idB)).toBeNull();
+    expect((await store.getConfigByKey(tenantA, key))?.id).toBe(idA);
+    expect((await store.getAllConfigs(tenantA)).map((entry) => entry.id)).toEqual([idA]);
+  });
+
+  it("returns absent results for an unknown config", async () => {
+    const tenant = tenantId();
+    const missing = randomUUID();
+
+    expect(await store.getConfigById(tenant, missing)).toBeNull();
+    expect(await store.getConfigByKey(tenant, "missing")).toBeNull();
+    expect(await store.updateConfig(tenant, missing, { name: "x" })).toBeNull();
+    expect(await store.hasConfig(tenant, missing)).toBe(false);
+    expect(await store.deleteConfig(tenant, missing)).toBe(false);
+  });
+});

package/src/__tests__/PostgreSQLMetricsServerConfigStore.integration.test.ts

@@ -0,0 +1,216 @@
+import { randomUUID } from "node:crypto";
+import { Pool } from "pg";
+
+// The @axiom-lattice/core barrel cannot load under jest in this package (ESM-only
+// transitive deps), so mock it with the real encryption module — node:crypto only.
+jest.mock("@axiom-lattice/core", () => ({
+  ...jest.requireActual("../../../core/src/util/encryption"),
+}));
+
+import type { MetricsServerConfig } from "@axiom-lattice/protocols";
+import { decrypt } from "@axiom-lattice/core";
+import { PostgreSQLMetricsServerConfigStore } from "../stores/PostgreSQLMetricsServerConfigStore";
+
+const TEST_DATABASE_URL = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = TEST_DATABASE_URL ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLMetricsServerConfigStore integration", () => {
+  let store: PostgreSQLMetricsServerConfigStore;
+  let pool: Pool;
+
+  beforeAll(async () => {
+    store = new PostgreSQLMetricsServerConfigStore({
+      poolConfig: TEST_DATABASE_URL!,
+      autoMigrate: true,
+    });
+    await store.initialize();
+    pool = new Pool({ connectionString: TEST_DATABASE_URL });
+  });
+
+  const tenants = new Set<string>();
+
+  afterEach(async () => {
+    if (tenants.size === 0) {
+      return;
+    }
+    await pool.query(
+      "DELETE FROM lattice_metrics_configs WHERE tenant_id = ANY($1::text[])",
+      [[...tenants]],
+    );
+    tenants.clear();
+  });
+
+  afterAll(async () => {
+    await pool.end();
+    await store.dispose();
+  });
+
+  function tenantId(): string {
+    const id = `metrics-config-${randomUUID()}`;
+    tenants.add(id);
+    return id;
+  }
+
+  function config(overrides: Partial<MetricsServerConfig> = {}): MetricsServerConfig {
+    return {
+      type: "prometheus",
+      serverUrl: "https://metrics.example.com",
+      apiKey: "metrics-api-key",
+      username: "metrics-user",
+      password: "metrics-password",
+      timeout: 15000,
+      ...overrides,
+    };
+  }
+
+  async function createConfig(tenant: string) {
+    const id = randomUUID();
+    const key = `key-${randomUUID()}`;
+    const entry = await store.createConfig(tenant, id, {
+      key,
+      name: "Prometheus",
+      description: "Primary metrics server",
+      config: config(),
+    });
+    return { id, key, entry };
+  }
+
+  it("creates and reads a config by id and by key", async () => {
+    const tenant = tenantId();
+    const { id, key, entry } = await createConfig(tenant);
+
+    expect(entry).toMatchObject({
+      id,
+      tenantId: tenant,
+      key,
+      name: "Prometheus",
+      description: "Primary metrics server",
+    });
+    expect(entry.config.serverUrl).toBe("https://metrics.example.com");
+
+    const byId = await store.getConfigById(tenant, id);
+    expect(byId?.id).toBe(id);
+    expect(byId?.config.timeout).toBe(15000);
+
+    const byKey = await store.getConfigByKey(tenant, key);
+    expect(byKey?.id).toBe(id);
+  });
+
+  it("encrypts apiKey and password at rest and decrypts them on read", async () => {
+    const tenant = tenantId();
+    const { id } = await createConfig(tenant);
+
+    const raw = await pool.query<{ config: { apiKey: string; password: string } }>(
+      "SELECT config FROM lattice_metrics_configs WHERE tenant_id = $1 AND id = $2",
+      [tenant, id],
+    );
+
+    expect(raw.rows[0].config.apiKey).not.toBe("metrics-api-key");
+    expect(raw.rows[0].config.password).not.toBe("metrics-password");
+    expect(decrypt(raw.rows[0].config.apiKey)).toBe("metrics-api-key");
+    expect(decrypt(raw.rows[0].config.password)).toBe("metrics-password");
+
+    const read = await store.getConfigById(tenant, id);
+    expect(read?.config.apiKey).toBe("metrics-api-key");
+    expect(read?.config.password).toBe("metrics-password");
+  });
+
+  it("lists a tenant's configs and includes them in the cross-tenant listing", async () => {
+    const tenant = tenantId();
+    const first = await createConfig(tenant);
+    const second = await createConfig(tenant);
+
+    const listed = await store.getAllConfigs(tenant);
+    expect(listed.map((entry) => entry.id).sort()).toEqual([first.id, second.id].sort());
+
+    const all = await store.getAllConfigsWithoutTenant();
+    const ids = all.map((entry) => entry.id);
+    expect(ids).toContain(first.id);
+    expect(ids).toContain(second.id);
+    expect(all.find((entry) => entry.id === first.id)?.config.apiKey).toBe("metrics-api-key");
+  });
+
+  it("updates fields and re-encrypts rotated secrets", async () => {
+    const tenant = tenantId();
+    const { id, key } = await createConfig(tenant);
+
+    const updated = await store.updateConfig(tenant, id, {
+      name: "Renamed",
+      description: "Updated description",
+      config: config({ apiKey: "rotated-api-key", password: "rotated-password" }),
+    });
+
+    expect(updated).toMatchObject({
+      id,
+      key,
+      name: "Renamed",
+      description: "Updated description",
+    });
+    expect(updated?.config.apiKey).toBe("rotated-api-key");
+    expect(updated?.config.password).toBe("rotated-password");
+
+    const raw = await pool.query<{ config: { apiKey: string; password: string } }>(
+      "SELECT config FROM lattice_metrics_configs WHERE tenant_id = $1 AND id = $2",
+      [tenant, id],
+    );
+    expect(decrypt(raw.rows[0].config.apiKey)).toBe("rotated-api-key");
+    expect(decrypt(raw.rows[0].config.password)).toBe("rotated-password");
+  });
+
+  it("keeps encrypted secrets when a partial update omits config", async () => {
+    const tenant = tenantId();
+    const { id } = await createConfig(tenant);
+
+    const updated = await store.updateConfig(tenant, id, { name: "Only renamed" });
+
+    expect(updated?.name).toBe("Only renamed");
+    expect(updated?.config.apiKey).toBe("metrics-api-key");
+    expect(updated?.config.password).toBe("metrics-password");
+
+    const raw = await pool.query<{ config: { apiKey: string; password: string } }>(
+      "SELECT config FROM lattice_metrics_configs WHERE tenant_id = $1 AND id = $2",
+      [tenant, id],
+    );
+    expect(raw.rows[0].config.apiKey).not.toBe("metrics-api-key");
+    expect(raw.rows[0].config.password).not.toBe("metrics-password");
+    expect(decrypt(raw.rows[0].config.apiKey)).toBe("metrics-api-key");
+    expect(decrypt(raw.rows[0].config.password)).toBe("metrics-password");
+  });
+
+  it("reports has and deletes a config", async () => {
+    const tenant = tenantId();
+    const { id } = await createConfig(tenant);
+
+    expect(await store.hasConfig(tenant, id)).toBe(true);
+    expect(await store.deleteConfig(tenant, id)).toBe(true);
+    expect(await store.hasConfig(tenant, id)).toBe(false);
+    expect(await store.getConfigById(tenant, id)).toBeNull();
+    expect(await store.deleteConfig(tenant, id)).toBe(false);
+  });
+
+  it("isolates configs by tenant", async () => {
+    const tenantA = tenantId();
+    const tenantB = tenantId();
+    const key = `shared-${randomUUID()}`;
+    const idA = randomUUID();
+    const idB = randomUUID();
+
+    await store.createConfig(tenantA, idA, { key, config: config() });
+    await store.createConfig(tenantB, idB, { key, config: config() });
+
+    expect(await store.getConfigById(tenantA, idB)).toBeNull();
+    expect((await store.getConfigByKey(tenantA, key))?.id).toBe(idA);
+    expect((await store.getAllConfigs(tenantA)).map((entry) => entry.id)).toEqual([idA]);
+  });
+
+  it("returns absent results for an unknown config", async () => {
+    const tenant = tenantId();
+    const missing = randomUUID();
+
+    expect(await store.getConfigById(tenant, missing)).toBeNull();
+    expect(await store.getConfigByKey(tenant, "missing")).toBeNull();
+    expect(await store.updateConfig(tenant, missing, { name: "x" })).toBeNull();
+    expect(await store.hasConfig(tenant, missing)).toBe(false);
+    expect(await store.deleteConfig(tenant, missing)).toBe(false);
+  });
+});