@coffeerunhobby/mcp-ha-connect 2.1.1 → 2.2.1

package/tests/ownerQuestions/tools.test.ts

@@ -0,0 +1,186 @@
+/**
+ * askOwner / getOwnerAnswer / cancelOwnerQuestion tools: input validation,
+ * RBAC, caller binding, log redaction, and a real MCP round trip.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import type { McpServer } from '@modelcontextprotocol/server';
+import { Client, InMemoryTransport } from '@modelcontextprotocol/client';
+
+import { OwnerQuestionService } from '../../src/ownerQuestions/service.js';
+import { registerOwnerQuestionTools, askOwnerSchema } from '../../src/tools/homeassistant/askOwner.js';
+import { createServer } from '../../src/server/common.js';
+import { Permission, Role } from '../../src/permissions/index.js';
+import { setLocalFullTrust } from '../../src/tools/common.js';
+import { logger } from '../../src/utils/logger.js';
+
+type Handler = (args: unknown, extra: unknown) => Promise<{ content: { text: string }[]; isError?: boolean }>;
+
+function createMockServer() {
+    const handlers = new Map<string, Handler>();
+    return {
+        registerTool: vi.fn((name: string, _config: unknown, handler: Handler) => handlers.set(name, handler)),
+        handlers,
+    } as unknown as McpServer & { handlers: Map<string, Handler> };
+}
+
+const extraFor = (sub: string, permissions: number) => ({
+    sessionId: 's',
+    http: { authInfo: { token: '', clientId: sub, scopes: [], extra: { permissions } } },
+});
+
+const parse = (result: { content: { text: string }[] }) => JSON.parse(result.content[0].text) as Record<string, unknown>;
+
+const valid = { question: 'Aprinzi lumina în baie?', target: 'mobile_app_phone_user5' };
+
+function makeService() {
+    const notify = vi.fn().mockResolvedValue([]);
+    const service = new OwnerQuestionService({ notify, subscribe: vi.fn().mockResolvedValue('s'), secret: 'k'.repeat(40) });
+    return { service, notify };
+}
+
+describe('askOwner input validation', () => {
+    it('accepts plain text including Romanian diacritics, and applies defaults', () => {
+        const parsed = askOwnerSchema.parse(valid);
+        expect(parsed.question).toBe('Aprinzi lumina în baie?');
+        expect(parsed.buttons).toBeUndefined();
+    });
+
+    it('NFC-normalizes text (a decomposed ș becomes one character)', () => {
+        expect(askOwnerSchema.parse({ ...valid, question: 'ș?' }).question).toBe('ș?');
+    });
+
+    it.each([
+        ['an emoji', { question: 'Approve? 👍' }, /U\+1F44D/],
+        ['a zero-width joiner', { question: 'ok‍ok' }, /U\+200D/],
+        ['a right-to-left override', { question: 'pay ‮evil' }, /U\+202E/],
+        ['stacked combining marks', { question: 'á́' }, /U\+0301/],
+        ['a 257-character question', { question: 'x'.repeat(257) }, /257 characters; the maximum is 256/],
+        ['a line break in the title', { title: 'two\nlines' }, /title contains a disallowed character U\+000A/],
+        ['a 61-character title', { title: 't'.repeat(61) }, /maximum is 60/],
+        ['an emoji button', { buttons: ['Yes ✅', 'No'] }, /button label/],
+        ['four buttons', { buttons: ['a', 'b', 'c', 'd'] }, /3/],
+        ['duplicate buttons', { buttons: ['Yes', 'yes'] }, /unique/],
+        ['a non-mobile target', { target: 'persistent_notification' }, /mobile app notify service/],
+        ['a timeout over 7 days', { timeoutSeconds: 7 * 24 * 3600 + 1 }, /604800/],
+        ['a timeout under a minute', { timeoutSeconds: 59 }, /60/],
+    ])('refuses %s', (_name, overrides, error) => {
+        const result = askOwnerSchema.safeParse({ ...valid, ...overrides });
+        expect(result.success).toBe(false);
+        expect(JSON.stringify(result.error!.issues)).toMatch(error);
+    });
+
+    it('accepts a 256-character question with line breaks', () => {
+        const question = `${'x'.repeat(100)}\n${'y'.repeat(155)}`;
+        expect(askOwnerSchema.parse({ ...valid, question }).question).toBe(question);
+    });
+});
+
+describe('owner question tools', () => {
+    let server: ReturnType<typeof createMockServer>;
+    let service: OwnerQuestionService;
+    let notify: ReturnType<typeof vi.fn>;
+
+    beforeEach(() => {
+        server = createMockServer();
+        ({ service, notify } = makeService());
+        registerOwnerQuestionTools(server, service);
+    });
+
+    it('registers askOwner, getOwnerAnswer and cancelOwnerQuestion', () => {
+        expect([...server.handlers.keys()]).toEqual(['askOwner', 'getOwnerAnswer', 'cancelOwnerQuestion']);
+    });
+
+    it.each(['askOwner', 'getOwnerAnswer', 'cancelOwnerQuestion'])('%s requires NOTIFY', async (tool) => {
+        const result = await server.handlers.get(tool)!({ ...valid, requestId: 'x' }, extraFor('reader', Role.READONLY));
+        expect(parse(result)).toMatchObject({ error: 'Permission denied' });
+        expect(String(parse(result).message)).toContain('NOTIFY');
+        expect(notify).not.toHaveBeenCalled();
+    });
+
+    it('askOwner applies the default title, buttons and timeout', async () => {
+        const result = await server.handlers.get('askOwner')!(valid, extraFor('approver', Permission.NOTIFY));
+
+        expect(parse(result)).toHaveProperty('requestId');
+        expect(notify.mock.calls[0][1]).toMatchObject({ title: 'Approval needed', data: { timeout: 600 } });
+        expect(notify.mock.calls[0][1].data.actions.map((a: { title: string }) => a.title)).toEqual(['Approve', 'Deny']);
+    });
+
+    it('binds the question to the asking token sub', async () => {
+        const asked = parse(await server.handlers.get('askOwner')!(valid, extraFor('approver', Permission.NOTIFY)));
+
+        const own = await server.handlers.get('getOwnerAnswer')!({ requestId: asked.requestId, waitSeconds: 0 }, extraFor('approver', Permission.NOTIFY));
+        const other = await server.handlers.get('getOwnerAnswer')!({ requestId: asked.requestId, waitSeconds: 0 }, extraFor('harvey', Permission.NOTIFY));
+
+        expect(parse(own)).toMatchObject({ status: 'pending' });
+        expect(other.isError).toBe(true);
+        expect(String(parse(other).message)).toMatch(/different client/);
+    });
+
+    it('logs tool arguments (the question text) at debug level only', async () => {
+        const info = vi.spyOn(logger, 'info');
+        const debug = vi.spyOn(logger, 'debug');
+        try {
+            await server.handlers.get('askOwner')!(
+                { ...valid, question: 'Secret plan: unlock the front door?' },
+                extraFor('approver', Permission.NOTIFY)
+            );
+            expect(JSON.stringify(info.mock.calls)).not.toContain('unlock the front door');
+            expect(JSON.stringify(info.mock.calls)).toContain('Tool invoked');
+            expect(JSON.stringify(debug.mock.calls)).toContain('unlock the front door');
+        } finally {
+            info.mockRestore();
+            debug.mockRestore();
+        }
+    });
+});
+
+describe('owner question tools over MCP', () => {
+    beforeEach(() => setLocalFullTrust(true));
+    afterEach(() => setLocalFullTrust(false));
+
+    it('are listed with a JSON Schema and callable end to end', async () => {
+        const { service, notify } = makeService();
+        const server = createServer({ haClient: {} as never, ownerQuestions: service });
+        const client = new Client({ name: 'ask-owner-test', version: '0' });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+        try {
+            const { tools } = await client.listTools();
+            const askOwner = tools.find((t) => t.name === 'askOwner');
+            expect(askOwner?.inputSchema.required).toEqual(['question', 'target']);
+            expect(tools.map((t) => t.name)).toEqual(expect.arrayContaining(['getOwnerAnswer', 'cancelOwnerQuestion']));
+
+            const asked = await client.callTool({ name: 'askOwner', arguments: { ...valid, buttons: ['Da', 'Nu'] } });
+            const { requestId } = JSON.parse((asked.content as Array<{ text: string }>)[0].text);
+            expect(notify).toHaveBeenCalledTimes(1);
+
+            const answer = await client.callTool({ name: 'getOwnerAnswer', arguments: { requestId, waitSeconds: 0 } });
+            expect(JSON.parse((answer.content as Array<{ text: string }>)[0].text)).toMatchObject({
+                status: 'pending',
+                buttons: ['Da', 'Nu'],
+            });
+
+            const refused = await client.callTool({ name: 'askOwner', arguments: { ...valid, question: 'ok 👍' } });
+            expect(refused.isError).toBe(true);
+            expect(notify).toHaveBeenCalledTimes(1);
+        } finally {
+            await client.close();
+            await server.close();
+        }
+    });
+
+    it('are not registered when no owner question service is running', async () => {
+        const server = createServer({ haClient: {} as never });
+        const client = new Client({ name: 'ask-owner-test', version: '0' });
+        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+        await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
+        try {
+            const { tools } = await client.listTools();
+            expect(tools.map((t) => t.name)).not.toContain('askOwner');
+        } finally {
+            await client.close();
+            await server.close();
+        }
+    });
+});

package/tests/tools/homeassistant/handlers.test.ts

@@ -551,9 +551,18 @@ describe('HomeAssistant Tool Handlers', () => {
       const handler = server.getHandler('getAutomationTrace')!;
       const result = await handler({ entity_id: 'automation.test' }, mockExtra);
 
-      expect(mockClient.getAutomationTrace).toHaveBeenCalledWith('automation.test');
+      expect(mockClient.getAutomationTrace).toHaveBeenCalledWith('automation.test', undefined);
       expect(result.content[0].text).toContain('trace_count');
     });
+
+    it('getAutomationTrace forwards limit', async () => {
+      mockClient.getAutomationTrace.mockResolvedValue([]);
+      registerGetAutomationTraceTool(server as any, mockClient as any);
+
+      await server.getHandler('getAutomationTrace')!({ entity_id: 'automation.test', limit: 3 }, mockExtra);
+
+      expect(mockClient.getAutomationTrace).toHaveBeenCalledWith('automation.test', 3);
+    });
   });
 
   describe('automation controls', () => {

package/tests/tools/omada/graph.test.ts

@@ -79,11 +79,11 @@ describe('Omada graph tools - registration', () => {
     expect(server.handlers.has('omada_read')).toBe(true);
   });
 
-  it('graph mode registers browse + read + 8 typed writes, and NO typed getters', () => {
+  it('graph mode registers browse + read + 9 typed writes, and NO typed getters', () => {
     const server = createMockServer();
     const client = createMockClient();
     const count = registerOmadaTools(server, client, 'graph');
-    expect(count).toBe(10);
+    expect(count).toBe(11);
     const names = [...server.handlers.keys()];
     expect(names).toContain('omada_browse');
     expect(names).toContain('omada_read');
@@ -93,10 +93,12 @@ describe('Omada graph tools - registration', () => {
     expect(names).toContain('omada_cyclePoePort');
     expect(names).toContain('omada_setSsidEnabled');
     expect(names).toContain('omada_setSiteNtpServers');
+    expect(names).toContain('omada_deleteClient');
     // Typed read getters must NOT be present in graph mode.
     expect(names).not.toContain('omada_listSites');
     expect(names).not.toContain('omada_getFirewallSetting');
     expect(names).not.toContain('omada_getSiteNtpStatus');
+    expect(names).not.toContain('omada_listBlockedClients');
   });
 
   it('eager mode (default) registers the typed getters, not the graph tools', () => {
@@ -310,6 +312,15 @@ describe('omada_read', () => {
     expect(client.getSiteNtpStatus).not.toHaveBeenCalled();
   });
 
+  it('reads /clients/known as one page of known clients (with block state)', async () => {
+    (client.readResource as ReturnType<typeof vi.fn>).mockResolvedValue({ totalRows: 1, data: [{ mac: 'AA', block: true }] });
+    await read({ path: '/clients/known', page: 3, pageSize: 20, siteId: 'site1' }, readonlyExtra);
+    expect(client.readResource).toHaveBeenCalledTimes(1);
+    expect(client.readResource).toHaveBeenCalledWith(
+      expect.objectContaining({ pathTemplate: '/sites/{siteId}/insight/clients', siteId: 'site1', paginated: true, page: 3, pageSize: 20 })
+    );
+  });
+
   it('enforces per-path permission (fail closed) for under-privileged callers', async () => {
     const { isError, data } = parseResult(await read({ path: '/sites' }, noPermsExtra));
     expect(isError).toBe(true);

package/tests/utils/redact.test.ts

@@ -0,0 +1,105 @@
+/**
+ * Secrets returned by Home Assistant / Omada never reach a tool response.
+ */
+
+import { describe, it, expect, vi } from 'vitest';
+import type { McpServer } from '@modelcontextprotocol/server';
+
+import { redactSecrets, REDACTED } from '../../src/utils/redact.js';
+import { toToolResult } from '../../src/tools/common.js';
+import { registerOmadaGraphTools } from '../../src/tools/omada/graph.js';
+import type { OmadaClient } from '../../src/omadaClient/index.js';
+
+/** Shape of an Omada SSID detail (GET .../wlans/{wlanId}/ssids/{ssidId}). */
+const ssidDetail = {
+    ssidId: 'node-s55',
+    name: 'node-s55',
+    security: 3,
+    hidePwd: true,
+    pskSetting: { versionPsk: 2, encryptionPsk: 3, gikRekeyPskEnable: false, securityKey: 'HouseWifiPassw0rd!' },
+    macFilterEnable: false,
+};
+
+describe('redactSecrets', () => {
+    it('redacts the Wi-Fi password but keeps flags and numbers with similar names', () => {
+        const out = redactSecrets(ssidDetail);
+
+        expect(out.pskSetting.securityKey).toBe(REDACTED);
+        expect(out.pskSetting.versionPsk).toBe(2);
+        expect(out.pskSetting.encryptionPsk).toBe(3);
+        expect(out.hidePwd).toBe(true);
+        expect(out.name).toBe('node-s55');
+        expect(JSON.stringify(out)).not.toContain('HouseWifiPassw0rd!');
+    });
+
+    it.each([
+        ['RADIUS profile', { authServer: [{ ip: '192.168.0.2', port: 1812, secret: 'radius-s3cret' }], accountingServerPwd: 'acct-pw', coaPassword: 'coa-pw', radiusPwd: 'rp' }],
+        ['PPSK profile', { name: 'kids', ppsk: [{ name: 'tablet', password: 'ppsk-key-1', vlanId: 20 }] }],
+        ['VPN', { preSharedKey: 'ipsec-psk', presharedKey: 'wg-psk', privateKey: 'wg-private', publicKey: 'wg-public' }],
+        ['SNMP', { snmpV1V2CEnable: true, communityString: 'snmp-community' }],
+        ['portal and hotspot', { password: 'portal-pw', authCode: 'auth-code-123', simpleKey: 'sk', md5Key: 'mk' }],
+        ['SSID variants', { psk: 'override-psk', ssidPassword: 'ssid-pw', bridgeSsidPassword: 'bridge-pw', overrideSsidPassword: 'ov-pw' }],
+        ['VRRP and certificates', { key: 'vrrp-key', keyPassword: 'ks-pw', trustPassword: 'trust-pw' }],
+        ['webhooks and tokens', { shardedSecret: 'hook-secret', authToken: 'twilio-token', accessToken: 'at', token: 'user-token' }],
+    ])('redacts every secret in a %s', (_name, input) => {
+        const text = JSON.stringify(redactSecrets(input));
+
+        for (const secret of ['radius-s3cret', 'acct-pw', 'coa-pw', 'ppsk-key-1', 'ipsec-psk', 'wg-psk', 'wg-private', 'snmp-community', 'portal-pw', 'auth-code-123', 'override-psk', 'ssid-pw', 'bridge-pw', 'ov-pw', 'vrrp-key', 'ks-pw', 'trust-pw', 'hook-secret', 'twilio-token', 'user-token']) {
+            expect(text).not.toContain(secret);
+        }
+    });
+
+    it('keeps public, non-secret values (public keys, ids, names)', () => {
+        const out = redactSecrets({ publicKey: 'wg-public', keyId: 'k1', searchKey: 'abc', ppskProfileId: 'p1' });
+        expect(out).toEqual({ publicKey: 'wg-public', keyId: 'k1', searchKey: 'abc', ppskProfileId: 'p1' });
+    });
+
+    it('masks tokens inside URLs (Home Assistant camera image)', () => {
+        const out = redactSecrets({
+            entity_picture: '/api/camera_proxy/camera.door?token=0123456789abcdef&width=640',
+            attributes: { access_token: 'cam-token' },
+        });
+        expect(out.entity_picture).toBe(`/api/camera_proxy/camera.door?token=${REDACTED}&width=640`);
+        expect(out.attributes.access_token).toBe(REDACTED);
+    });
+
+    it('leaves empty secrets empty, so "is it set?" stays answerable', () => {
+        expect(redactSecrets({ password: '', securityKey: 'x' })).toEqual({ password: '', securityKey: REDACTED });
+    });
+
+    it('does not modify its input', () => {
+        const input = structuredClone(ssidDetail);
+        redactSecrets(input);
+        expect(input).toEqual(ssidDetail);
+    });
+
+    it('handles arrays, nulls and plain strings', () => {
+        expect(redactSecrets([{ password: 'p' }, null, 3])).toEqual([{ password: REDACTED }, null, 3]);
+        expect(redactSecrets('see /x?token=abc')).toBe(`see /x?token=${REDACTED}`);
+        expect(redactSecrets(null)).toBeNull();
+    });
+});
+
+describe('tool responses are redacted', () => {
+    it('toToolResult never carries a secret', () => {
+        const result = toToolResult(ssidDetail);
+        expect(result.content[0].text).not.toContain('HouseWifiPassw0rd!');
+        expect(result.content[0].text).toContain(REDACTED);
+    });
+
+    it('omada_read /wifi/ssids (SSID detail) does not return the Wi-Fi password', async () => {
+        const handlers = new Map<string, (args: unknown, extra: unknown) => Promise<{ content: { text: string }[] }>>();
+        const server = { registerTool: vi.fn((name, _c, h) => handlers.set(name, h)) } as unknown as McpServer;
+        const client = { getSsidDetail: vi.fn().mockResolvedValue(ssidDetail), getSsidList: vi.fn() } as unknown as OmadaClient;
+        registerOmadaGraphTools(server, client);
+
+        const result = await handlers.get('omada_read')!(
+            { path: '/wifi/ssids', params: { wlanId: 'w1', ssidId: 'node-s55' } },
+            { sessionId: 's', http: { authInfo: { extra: { permissions: 0xff } } } }
+        );
+
+        expect(client.getSsidDetail).toHaveBeenCalled();
+        expect(result.content[0].text).not.toContain('HouseWifiPassw0rd!');
+        expect(JSON.parse(result.content[0].text).pskSetting.securityKey).toBe(REDACTED);
+    });
+});