@bevel-software/platform-core-backend 0.15.1 → 0.20.0

package/src/modules/mcp/__tests__/manual-failure-memo.test.ts

@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest';
 import { ManualFailureMemo } from '../manual-failure-memo.js';
 
+type Internals = { pairClears: Map<string, unknown>; userClears: Map<string, unknown>; inFlight: Map<number, number> };
+const internals = (memo: ManualFailureMemo) => memo as unknown as Internals;
+
 describe('ManualFailureMemo', () => {
   it('remembers a failure per (user, manual) until the TTL expires', () => {
     let now = 0;
@@ -45,21 +48,110 @@ describe('ManualFailureMemo', () => {
 
   it('an out-of-order completion after a clear cannot resurrect the failure', () => {
     const memo = new ManualFailureMemo(60_000, () => 0);
-    // A registration attempt captures the generation, then awaits its (slow)
-    // network call…
-    const generation = memo.currentGeneration;
+    // A registration attempt begins, then awaits its (slow) network call…
+    const generation = memo.beginAttempt();
     // …meanwhile the user repairs their credential (secrets change → clear).
     memo.clearUser('u1');
     // The stale attempt completes with a failure from the OLD credential —
     // recording against the captured generation is a no-op.
     memo.recordFailure('u1', 'notion', 'invalid_token (stale)', generation);
+    memo.endAttempt(generation);
     expect(memo.recentFailure('u1', 'notion')).toBeUndefined();
-    // A FRESH attempt (current generation) records normally.
-    memo.recordFailure('u1', 'notion', 'still broken', memo.currentGeneration);
+    // A FRESH attempt records normally.
+    const fresh = memo.beginAttempt();
+    memo.recordFailure('u1', 'notion', 'still broken', fresh);
+    memo.endAttempt(fresh);
     expect(memo.recentFailure('u1', 'notion')).toBe('still broken');
   });
 
-  it('prunes expired entries so the map stays bounded', () => {
+  it("a concurrent success of ANOTHER manual does not discard this manual's failure", () => {
+    const memo = new ManualFailureMemo(60_000, () => 0);
+    const generation = memo.beginAttempt();
+    // Manuals register concurrently: granola succeeds while notion is in flight…
+    memo.clear('u1', 'granola');
+    // …and another user's secrets change.
+    memo.clearUser('u2');
+    // notion's failure is still current — nothing covering (u1, notion) was cleared.
+    memo.recordFailure('u1', 'notion', 'invalid_token', generation);
+    memo.endAttempt(generation);
+    expect(memo.recentFailure('u1', 'notion')).toBe('invalid_token');
+  });
+
+  it('a concurrent success of the SAME pair still discards the out-of-order failure', () => {
+    const memo = new ManualFailureMemo(60_000, () => 0);
+    const generation = memo.beginAttempt();
+    memo.clear('u1', 'notion');
+    memo.recordFailure('u1', 'notion', 'transient', generation);
+    memo.endAttempt(generation);
+    expect(memo.recentFailure('u1', 'notion')).toBeUndefined();
+  });
+
+  it('clearAll() discards every in-flight failure', () => {
+    const memo = new ManualFailureMemo(60_000, () => 0);
+    const generation = memo.beginAttempt();
+    memo.clearAll();
+    memo.recordFailure('u1', 'notion', 'x', generation);
+    memo.recordFailure('u2', 'granola', 'y', generation);
+    memo.endAttempt(generation);
+    expect(memo.recentFailure('u1', 'notion')).toBeUndefined();
+    expect(memo.recentFailure('u2', 'granola')).toBeUndefined();
+  });
+
+  it('an attempt that outlives the TTL still records its failure when only unrelated clears happened', () => {
+    let now = 0;
+    const memo = new ManualFailureMemo(1000, () => now);
+    const slow = memo.beginAttempt();
+    memo.clear('u2', 'granola'); // unrelated
+    now = 10_000; // far past the TTL, with lookups running meanwhile
+    memo.recentFailure('u9', 'anything');
+    memo.recordFailure('u1', 'notion', 'invalid_token', slow);
+    memo.endAttempt(slow);
+    expect(memo.recentFailure('u1', 'notion')).toBe('invalid_token');
+  });
+
+  it('keeps a clear record exactly while an attempt that predates it is in flight', () => {
+    let now = 0;
+    const memo = new ManualFailureMemo(1000, () => now);
+    const slow = memo.beginAttempt();
+    for (let i = 0; i < 50; i++) memo.clear(`u${i}`, 'notion');
+    memo.clearUser('u0');
+    now = 10_000; // time alone never drops a record an attempt still needs
+    memo.recentFailure('u0', 'notion');
+    expect(internals(memo).pairClears.size).toBe(50);
+    // …so the slow attempt covered by a clear stays discarded.
+    memo.recordFailure('u7', 'notion', 'from before the clear', slow);
+    expect(memo.recentFailure('u7', 'notion')).toBeUndefined();
+
+    memo.endAttempt(slow);
+    expect(internals(memo).pairClears.size).toBe(0);
+    expect(internals(memo).userClears.size).toBe(0);
+    expect(internals(memo).inFlight.size).toBe(0);
+  });
+
+  it('with no attempt in flight, a clear leaves no record behind', () => {
+    const memo = new ManualFailureMemo(60_000, () => 0);
+    memo.clear('u1', 'notion');
+    memo.clearUser('u2');
+    expect(internals(memo).pairClears.size).toBe(0);
+    expect(internals(memo).userClears.size).toBe(0);
+  });
+
+  it('endAttempt is balanced per attempt: overlapping attempts at one generation each count', () => {
+    const memo = new ManualFailureMemo(60_000, () => 0);
+    const a = memo.beginAttempt();
+    const b = memo.beginAttempt();
+    expect(a).toBe(b);
+    memo.clear('u1', 'notion');
+    memo.endAttempt(a);
+    // b is still in flight and predates the clear: the record must survive.
+    memo.recordFailure('u1', 'notion', 'stale', b);
+    expect(memo.recentFailure('u1', 'notion')).toBeUndefined();
+    memo.endAttempt(b);
+    memo.endAttempt(b); // extra end is a no-op
+    expect(internals(memo).pairClears.size).toBe(0);
+  });
+
+  it('prunes expired failures so the map stays bounded', () => {
     let now = 0;
     const memo = new ManualFailureMemo(1000, () => now);
     for (let i = 0; i < 50; i++) memo.recordFailure(`u${i}`, 'notion', 'x');

package/src/modules/mcp/__tests__/mcp-auth.middleware.test.ts

@@ -48,6 +48,8 @@ function makeExternalApiKeyService(
 
 function makeOAuthProvider(
   verify?: (t: string) => Promise<{ extra?: Record<string, unknown> }>,
+  /** Whether an agent connection still admits requests — true unless a test says otherwise. */
+  live?: (connectionId: string) => Promise<boolean>,
 ) {
   return {
     looksLikeAccessToken: (t: string) => typeof t === 'string' && t.startsWith('bevel-mcp_'),
@@ -57,6 +59,8 @@ function makeOAuthProvider(
           throw new InvalidTokenError('unknown token');
         }),
     ),
+    isConnectionLive: vi.fn(live ?? (async () => true)),
+    noteConnectionUse: vi.fn(),
   } as unknown as BevelOAuthProvider;
 }
 
@@ -140,20 +144,23 @@ describe('createMcpAuthMiddleware', () => {
     expect((auth as any).verifyToken).not.toHaveBeenCalled();
   });
 
-  it('401s with WWW-Authenticate when a bevel_ token is unknown or revoked', async () => {
+  it('401s a bevel_ token that is unknown or revoked with a plain invalid_token challenge — no resource_metadata', async () => {
     const mw = makeMw({ keys: makeExternalApiKeyService(async () => null) });
     const { req, res, next, setHeader, status, json } = makeReqRes('Bearer bevel_revoked');
 
     await mw(req, res, next);
 
+    // A caller who configured a key is not invited into a browser sign-in:
+    // signing in does not repair the key.
+    expect(setHeader).toHaveBeenCalledTimes(1);
     expect(setHeader).toHaveBeenCalledWith(
       'WWW-Authenticate',
-      expect.stringContaining('Bearer'),
+      'Bearer error="invalid_token", error_description="Invalid or revoked connection key"',
     );
     expect(status).toHaveBeenCalledWith(401);
-    expect(json).toHaveBeenCalledWith(
-      expect.objectContaining({ error: expect.stringMatching(/connection key/i) }),
-    );
+    expect(json).toHaveBeenCalledWith({
+      error: 'Invalid or revoked connection key. Mint a new one in External agent access.',
+    });
     expect(next).not.toHaveBeenCalled();
   });
 
@@ -176,7 +183,7 @@ describe('createMcpAuthMiddleware', () => {
     const auth = makeAuthService();
     const externalApiKeys = makeExternalApiKeyService();
     const oauth = makeOAuthProvider(async () => ({
-      extra: { userId: 'user-5', userEmail: 'eve@example.com' },
+      extra: { userId: 'user-5', userEmail: 'eve@example.com', connectionId: 'conn-5' },
     }));
     const mw = makeMw({ auth, keys: externalApiKeys, oauth });
     const { req, res, next } = makeReqRes('Bearer bevel-mcp_token123');
@@ -185,14 +192,28 @@ describe('createMcpAuthMiddleware', () => {
 
     expect(req.userId).toBe('user-5');
     expect(req.userEmail).toBe('eve@example.com');
-    // OAuth sessions are unmetered like JWT sessions — no connection key id.
+    // OAuth sessions are unmetered like JWT sessions — no connection key id…
     expect(req.externalApiKeyId).toBeUndefined();
+    // …but they ARE attributed to the agent behind the grant, for the Audit log.
+    expect(req.agentConnectionId).toBe('conn-5');
     expect(next).toHaveBeenCalled();
     // Neither the connection-key nor the JWT path may see this token shape.
     expect((externalApiKeys as any).verifyAndLoadToken).not.toHaveBeenCalled();
     expect((auth as any).verifyToken).not.toHaveBeenCalled();
   });
 
+  it('binds no agent for an OAuth token minted before connections existed, and still admits it', async () => {
+    const oauth = makeOAuthProvider(async () => ({
+      extra: { userId: 'user-5', userEmail: 'eve@example.com', connectionId: null },
+    }));
+    const mw = makeMw({ oauth });
+    const { req, res, next } = makeReqRes('Bearer bevel-mcp_token123');
+    await mw(req, res, next);
+    expect(req.userId).toBe('user-5');
+    expect(req.agentConnectionId).toBeUndefined();
+    expect(next).toHaveBeenCalled();
+  });
+
   it('401s with the discovery challenge when the OAuth token is invalid/expired/revoked', async () => {
     const mw = makeMw();
     const { req, res, next, setHeader, status } = makeReqRes('Bearer bevel-mcp_expired');
@@ -273,6 +294,46 @@ describe('createMcpAuthMiddleware', () => {
       expect(next).toHaveBeenCalled();
       expect(req.userId).toBe('user-7');
       expect(req.userEmail).toBe('seven@example.com');
+      // A plain loopback identity names no agent.
+      expect(req.agentConnectionId).toBeUndefined();
+    });
+
+    it('carries the agent connection of an exchanged grant, so the local server stays attributed', async () => {
+      const token = internal.mint({ userId: 'user-7', externalProxy: true, connectionId: 'conn-7' }, 60_000);
+      const auth = makeAuthService();
+      (auth.getUserById as ReturnType<typeof vi.fn>) = vi.fn(async () => ({
+        id: 'user-7',
+        email: 'seven@example.com',
+      }));
+      const oauth = makeOAuthProvider();
+      const mw = makeMw({ internal, auth, oauth });
+      const { req, res, next } = makeReqRes(`Bearer ${token}`);
+      await mw(req, res, next);
+      expect(next).toHaveBeenCalled();
+      expect(req.agentConnectionId).toBe('conn-7');
+      // Every request through the exchanged grant asks whether the
+      // connection still admits one, and counts as a use of it.
+      expect((oauth as any).isConnectionLive).toHaveBeenCalledWith('conn-7');
+      expect((oauth as any).noteConnectionUse).toHaveBeenCalledWith('conn-7');
+    });
+
+    it('401s an exchanged grant whose agent connection was revoked — the token is stateless, the connection is not', async () => {
+      const token = internal.mint({ userId: 'user-7', externalProxy: true, connectionId: 'conn-7' }, 60_000);
+      const auth = makeAuthService();
+      (auth.getUserById as ReturnType<typeof vi.fn>) = vi.fn(async () => ({
+        id: 'user-7',
+        email: 'seven@example.com',
+      }));
+      const oauth = makeOAuthProvider(undefined, async () => false);
+      const mw = makeMw({ internal, auth, oauth });
+      const { req, res, next, status, setHeader } = makeReqRes(`Bearer ${token}`);
+      await mw(req, res, next);
+      expect(next).not.toHaveBeenCalled();
+      expect(status).toHaveBeenCalledWith(401);
+      expect(setHeader).toHaveBeenCalledWith('WWW-Authenticate', expect.stringContaining('resource_metadata'));
+      expect(req.agentConnectionId).toBeUndefined();
+      // A refused request is no use of the connection.
+      expect((oauth as any).noteConnectionUse).not.toHaveBeenCalled();
     });
 
     it('401s an expired internal token', async () => {

package/src/modules/mcp/__tests__/mcp-routes-harness.ts

@@ -59,9 +59,7 @@ export async function mountMcpRoutes(deps: McpRoutesDeps = {}): Promise<string>
   app.use(
     '/api',
     createMcpRoutes(
-      // `createMcpRoutes` calls `onSessionEvicted` at CONSTRUCTION, so unlike
-      // the others this one needs a real function even when unused.
-      (deps.mcpService ?? { onSessionEvicted: () => {} }) as never,
+      (deps.mcpService ?? stub) as never,
       (deps.externalApiKeyService ?? stub) as never,
       fakeAuth,
       fakeAuth,