@coffeerunhobby/mcp-ha-connect 2.2.1 → 2.3.1

package/tests/security/configuration.test.ts

@@ -1,170 +0,0 @@
-/**
- * SEC-CONFIG — Security Misconfiguration (OWASP API8:2023 / A05:2021).
- *
- * H5  Fail-closed bind: MCP_AUTH_METHOD=none must not be combined with a
- *     non-loopback bind address — that exposes an unauthenticated server.
- * M1  docker-compose.yml must not hard-code a wildcard `MCP_HTTP_ALLOWED_ORIGINS=*`.
- * M3  DNS-rebinding Host validation is OPT-IN via MCP_HTTP_ALLOWED_HOSTS: OFF when
- *     unset (no silent upgrade break), enforcing exactly the listed host[:port]
- *     (plus loopback) when set. Default origins stay full scheme://host:port forms
- *     so the separate Origin/CORS layer matches real Origin headers.
- * M10 Dockerfile must run as a non-root USER.
- * L4  HTTP responses must carry baseline security headers.
- * L7  .env.example must use the real var (MCP_AUTH_SECRET, not MCP_AUTH_TOKEN)
- *     and ship secure defaults.
- */
-
-import { describe, it, expect } from 'vitest';
-import { readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
-import { loadConfig } from '../../src/config.js';
-import { buildTransportSecurityOptions } from '../../src/server/stream.js';
-import { applySecurityHeaders } from '../../src/server/http.js';
-
-const repoRoot = process.cwd();
-const read = (rel: string): string => readFileSync(resolve(repoRoot, rel), 'utf8');
-
-const SECRET = 'test-secret-key-32chars-minimum!';
-
-describe('SEC-CONFIG H5: refuse auth=none on a non-loopback bind', () => {
-  it('throws when MCP_AUTH_METHOD defaults to none and bind is 0.0.0.0', () => {
-    expect(() => loadConfig({ MCP_HTTP_BIND_ADDR: '0.0.0.0' } as NodeJS.ProcessEnv)).toThrow(
-      /none/i
-    );
-  });
-
-  it('allows none with an explicit loopback bind', () => {
-    const cfg = loadConfig({ MCP_HTTP_BIND_ADDR: '127.0.0.1' } as NodeJS.ProcessEnv);
-    expect(cfg.authMethod).toBe('none');
-  });
-
-  it('allows none with the default (loopback) bind', () => {
-    const cfg = loadConfig({} as NodeJS.ProcessEnv);
-    expect(cfg.authMethod).toBe('none');
-    expect(cfg.httpBindAddr).toBe('127.0.0.1');
-  });
-
-  it('allows bearer on a public bind when a strong secret is set', () => {
-    const cfg = loadConfig({
-      MCP_HTTP_BIND_ADDR: '0.0.0.0',
-      MCP_AUTH_METHOD: 'bearer',
-      MCP_AUTH_SECRET: SECRET,
-    } as NodeJS.ProcessEnv);
-    expect(cfg.authMethod).toBe('bearer');
-    expect(cfg.httpBindAddr).toBe('0.0.0.0');
-  });
-});
-
-describe('SEC-CONFIG M1: compose has no wildcard origin', () => {
-  it('docker-compose.yml does not set MCP_HTTP_ALLOWED_ORIGINS=*', () => {
-    const compose = read('docker-compose.yml');
-    expect(compose).not.toMatch(/MCP_HTTP_ALLOWED_ORIGINS\s*[:=]\s*\*/);
-  });
-});
-
-describe('SEC-CONFIG M3: opt-in DNS-rebinding Host validation', () => {
-  const base = {
-    MCP_HTTP_BIND_ADDR: '0.0.0.0',
-    MCP_AUTH_METHOD: 'bearer',
-    MCP_AUTH_SECRET: SECRET,
-  } as NodeJS.ProcessEnv;
-
-  it('default config origins are full scheme://host:port forms', () => {
-    const cfg = loadConfig({} as NodeJS.ProcessEnv);
-    expect(cfg.httpAllowedOrigins?.some((o) => /^https?:\/\/[^/]+:\d+$/.test(o))).toBe(true);
-  });
-
-  it('leaves Host validation OFF when MCP_HTTP_ALLOWED_HOSTS is unset (no upgrade break)', () => {
-    const cfg = loadConfig({} as NodeJS.ProcessEnv);
-    const opts = buildTransportSecurityOptions(cfg);
-    expect(opts.enableDnsRebindingProtection).toBe(false);
-    expect(opts.allowedHosts).toEqual([]);
-    // Origin/CORS is enforced by the HTTP layer, not the transport.
-    expect(opts.allowedOrigins).toEqual([]);
-  });
-
-  it('does NOT derive Host allowlist from CORS origins', () => {
-    // Origins are client/CORS addresses; the server host is frequently different.
-    // Setting origins alone must not turn on (or seed) Host validation.
-    const cfg = loadConfig({
-      ...base,
-      MCP_HTTP_ALLOWED_ORIGINS: 'https://client.example.com:5678',
-    } as NodeJS.ProcessEnv);
-    const opts = buildTransportSecurityOptions(cfg);
-    expect(opts.enableDnsRebindingProtection).toBe(false);
-    expect(opts.allowedHosts).toEqual([]);
-  });
-
-  it('enforces exactly the configured hosts (plus loopback) when MCP_HTTP_ALLOWED_HOSTS is set', () => {
-    const cfg = loadConfig({
-      ...base,
-      MCP_HTTP_ALLOWED_HOSTS: 'mcp.example.com,192.168.0.18:3000',
-    } as NodeJS.ProcessEnv);
-    const opts = buildTransportSecurityOptions(cfg);
-    expect(opts.enableDnsRebindingProtection).toBe(true);
-    expect(opts.allowedHosts).toContain('mcp.example.com');
-    expect(opts.allowedHosts).toContain('192.168.0.18:3000');
-    // Loopback/bind conveniences are always added so on-box access keeps working.
-    expect(opts.allowedHosts).toContain('localhost:3000');
-    expect(opts.allowedHosts).toContain('0.0.0.0:3000');
-    // A host the operator did NOT list is absent → the SDK 403s it.
-    expect(opts.allowedHosts).not.toContain('evil.attacker.test');
-  });
-
-  it('accepts a full-URL host entry and reduces it to host[:port] form', () => {
-    const cfg = loadConfig({
-      ...base,
-      MCP_HTTP_ALLOWED_HOSTS: 'https://mcp.example.com',
-    } as NodeJS.ProcessEnv);
-    const opts = buildTransportSecurityOptions(cfg);
-    expect(opts.allowedHosts).toContain('mcp.example.com');
-    // Origins are still not enforced at the transport.
-    expect(opts.allowedOrigins).toEqual([]);
-  });
-});
-
-describe('SEC-CONFIG M10: Dockerfile runs as non-root', () => {
-  it('Dockerfile declares a non-root USER', () => {
-    const dockerfile = read('Dockerfile');
-    const userLines = dockerfile.split('\n').filter((l) => /^\s*USER\s+/i.test(l));
-    expect(userLines.length).toBeGreaterThan(0);
-    // The last USER directive in effect must not be root.
-    const last = userLines[userLines.length - 1].trim().replace(/^USER\s+/i, '');
-    expect(last).not.toMatch(/^root\b/);
-    expect(last).not.toMatch(/^0\b/);
-  });
-});
-
-describe('SEC-CONFIG L4: baseline security headers', () => {
-  it('applySecurityHeaders sets nosniff, frame-deny, and a referrer policy', () => {
-    const set: Record<string, string> = {};
-    const res = {
-      setHeader(name: string, value: string) {
-        set[name] = value;
-      },
-    } as unknown as import('node:http').ServerResponse;
-
-    applySecurityHeaders(res);
-
-    expect(set['X-Content-Type-Options']).toBe('nosniff');
-    expect(set['X-Frame-Options']).toBe('DENY');
-    expect(set['Referrer-Policy']).toBeDefined();
-  });
-});
-
-describe('SEC-CONFIG L7: .env.example uses correct var + secure defaults', () => {
-  const env = read('.env.example');
-
-  it('uses MCP_AUTH_SECRET, never MCP_AUTH_TOKEN', () => {
-    expect(env).toMatch(/MCP_AUTH_SECRET/);
-    expect(env).not.toMatch(/MCP_AUTH_TOKEN/);
-  });
-
-  it('defaults HA_STRICT_SSL to true', () => {
-    expect(env).toMatch(/^HA_STRICT_SSL=true\s*$/m);
-  });
-
-  it('defaults MCP_AUTH_METHOD to bearer', () => {
-    expect(env).toMatch(/^MCP_AUTH_METHOD=bearer\s*$/m);
-  });
-});

package/tests/security/cryptoTransport.test.ts

@@ -1,172 +0,0 @@
-/**
- * SEC-CRYPTO — Cryptographic / transport-security findings.
- *
- * OWASP API8:2023 Security Misconfiguration / A02:2021 Cryptographic Failures.
- *
- * H2  Per-client TLS scoping. The Omada and HA clients must NOT toggle the
- *     process-global `NODE_TLS_REJECT_UNAUTHORIZED` env var to talk to a
- *     self-signed controller — that disables certificate validation for EVERY
- *     concurrent outbound request in the process (a TOCTOU race that silently
- *     drops TLS verification for unrelated HA/AI traffic). The insecure mode
- *     must be scoped to the single client via a per-instance undici dispatcher.
- *
- * L5  SSE client IDs must be generated with a CSPRNG (randomUUID), not
- *     Math.random(), so they are not predictable/guessable.
- */
-
-import { describe, it, expect, vi, afterEach } from 'vitest';
-import { fetch as undiciFetch } from 'undici';
-import { RequestHandler } from '../../src/omadaClient/request.js';
-import { AuthManager } from '../../src/omadaClient/auth.js';
-import { createTlsDispatcher } from '../../src/utils/tlsDispatcher.js';
-import { generateClientId } from '../../src/server/eventSubscription.js';
-
-// Partial-mock undici: real Agent (createTlsDispatcher needs it), mocked fetch —
-// dispatcher-carrying requests must route here (THE PAIRING RULE, see below).
-vi.mock('undici', async (importOriginal) => {
-  const actual = await importOriginal<typeof import('undici')>();
-  return { ...actual, fetch: vi.fn() };
-});
-
-const ENV_KEY = 'NODE_TLS_REJECT_UNAUTHORIZED';
-
-function jsonResponse(body: unknown): Response {
-  return new Response(JSON.stringify(body), {
-    status: 200,
-    headers: { 'content-type': 'application/json' },
-  });
-}
-
-describe('SEC-CRYPTO H2: per-client TLS scoping (no global env mutation)', () => {
-  const realFetch = global.fetch;
-
-  afterEach(() => {
-    global.fetch = realFetch;
-    vi.restoreAllMocks();
-    vi.mocked(undiciFetch).mockReset();
-    delete process.env[ENV_KEY];
-  });
-
-  it('Omada request with strictSsl=false never mutates global NODE_TLS_REJECT_UNAUTHORIZED', async () => {
-    let envDuringFetch: string | undefined = 'SENTINEL';
-    let dispatcherDuringFetch: unknown;
-
-    // Dispatcher requests route through UNDICI's fetch (pairing rule) — mock it.
-    vi.mocked(undiciFetch).mockImplementation((async (_url: unknown, init: unknown) => {
-      envDuringFetch = process.env[ENV_KEY];
-      dispatcherDuringFetch = (init as { dispatcher?: unknown }).dispatcher;
-      return jsonResponse({ errorCode: 0, result: {} });
-    }) as unknown as typeof undiciFetch);
-    const globalFetchSpy = vi.fn();
-    global.fetch = globalFetchSpy as unknown as typeof fetch;
-
-    const auth = {
-      getAccessToken: async () => 'access-token',
-      clearToken: () => {},
-    } as unknown as AuthManager;
-
-    const handler = new RequestHandler(
-      { baseUrl: 'https://omada.example:8043', strictSsl: false },
-      auth
-    );
-
-    await handler.get('/openapi/v1/anything');
-
-    // The env var must NOT be set at any point — it stays undefined throughout.
-    expect(envDuringFetch).toBeUndefined();
-    expect(process.env[ENV_KEY]).toBeUndefined();
-    // Insecure TLS must be carried by a per-call dispatcher instead.
-    expect(dispatcherDuringFetch).toBeDefined();
-    // THE PAIRING RULE (v1.5.5 incident regression): a dispatcher built from
-    // the npm undici package must go to undici's OWN fetch — never Node's
-    // built-in fetch, whose bundled undici drifts across majors (Node 26:
-    // "invalid onError method" -> "fetch failed" crash-loop).
-    expect(globalFetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('Omada request with strictSsl=true sends no insecure dispatcher (built-in fetch)', async () => {
-    let dispatcherDuringFetch: unknown = 'SENTINEL';
-
-    global.fetch = vi.fn(async (_url: unknown, init: unknown) => {
-      dispatcherDuringFetch = (init as { dispatcher?: unknown }).dispatcher;
-      return jsonResponse({ errorCode: 0, result: {} });
-    }) as unknown as typeof fetch;
-
-    const auth = {
-      getAccessToken: async () => 'access-token',
-      clearToken: () => {},
-    } as unknown as AuthManager;
-
-    const handler = new RequestHandler(
-      { baseUrl: 'https://omada.example:8043', strictSsl: true },
-      auth
-    );
-
-    await handler.get('/openapi/v1/anything');
-
-    expect(dispatcherDuringFetch).toBeUndefined();
-    expect(process.env[ENV_KEY]).toBeUndefined();
-    // No dispatcher -> Node's built-in fetch, undici's stays untouched.
-    expect(vi.mocked(undiciFetch)).not.toHaveBeenCalled();
-  });
-
-  it('Omada auth with strictSsl=false never mutates global NODE_TLS_REJECT_UNAUTHORIZED', async () => {
-    let envDuringFetch: string | undefined = 'SENTINEL';
-    let dispatcherDuringFetch: unknown;
-
-    vi.mocked(undiciFetch).mockImplementation((async (_url: unknown, init: unknown) => {
-      envDuringFetch = process.env[ENV_KEY];
-      dispatcherDuringFetch = (init as { dispatcher?: unknown }).dispatcher;
-      return jsonResponse({
-        errorCode: 0,
-        result: { accessToken: 'a', refreshToken: 'r', expiresIn: 3600 },
-      });
-    }) as unknown as typeof undiciFetch);
-    const globalFetchSpy = vi.fn();
-    global.fetch = globalFetchSpy as unknown as typeof fetch;
-
-    const auth = new AuthManager({
-      baseUrl: 'https://omada.example:8043',
-      clientId: 'id',
-      clientSecret: 'secret',
-      omadacId: 'omadac',
-      strictSsl: false,
-    });
-
-    const token = await auth.getAccessToken();
-
-    expect(token).toBe('a');
-    expect(envDuringFetch).toBeUndefined();
-    expect(process.env[ENV_KEY]).toBeUndefined();
-    expect(dispatcherDuringFetch).toBeDefined();
-    expect(globalFetchSpy).not.toHaveBeenCalled();
-  });
-
-  it('plain-http base with strictSsl=false carries NO dispatcher (v1.5.5 NAS config)', async () => {
-    // The exact production config that crash-looped v1.5.5: http HA +
-    // HA_STRICT_SSL=false. TLS relaxation is meaningless without TLS, so no
-    // dispatcher is built at all -> built-in fetch -> immune to undici drift.
-    expect(createTlsDispatcher(false, 'http://192.168.0.19:8123')).toBeUndefined();
-    expect(createTlsDispatcher(false, 'HTTP://UPPER.example')).toBeUndefined();
-    // https targets still get the relaxing dispatcher.
-    expect(createTlsDispatcher(false, 'https://omada.example')).toBeDefined();
-    // And with no baseUrl hint, behavior is unchanged (dispatcher created).
-    expect(createTlsDispatcher(false)).toBeDefined();
-    expect(createTlsDispatcher(true, 'https://omada.example')).toBeUndefined();
-  });
-});
-
-describe('SEC-CRYPTO L5: SSE client IDs use a CSPRNG', () => {
-  it('generateClientId returns an unpredictable UUID, not a Math.random/timestamp string', () => {
-    const id = generateClientId();
-    // RFC 4122 v4 UUID shape.
-    expect(id).toMatch(
-      /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
-    );
-  });
-
-  it('generateClientId returns distinct values across calls', () => {
-    const ids = new Set(Array.from({ length: 100 }, () => generateClientId()));
-    expect(ids.size).toBe(100);
-  });
-});

package/tests/security/dependencies.test.ts

@@ -1,152 +0,0 @@
-/**
- * SEC-DEPS — Vulnerable & Outdated Components (OWASP A06:2021)
- *
- * Finding M9: production dependency tree shipped known-vulnerable transitive
- * packages (hono / qs / path-to-regexp via the MCP SDK, plus a direct `ws`).
- *
- * These tests are the durable CI gate for that finding:
- *   1. `npm audit --omit=dev` must report ZERO high/critical advisories in the
- *      PRODUCTION dependency tree (dev-only tooling is out of scope). A small,
- *      explicitly-documented allowlist exists for unavoidable transitive advisories
- *      that have no upstream fix yet — each entry must be justified in a comment.
- *   2. After bumping the SDK/ws, re-assert the per-request transport invariant so a
- *      dependency upgrade can never silently change how transports are constructed.
- */
-
-import { describe, it, expect } from 'vitest';
-import { execFileSync } from 'node:child_process';
-import { NodeStreamableHTTPServerTransport } from '@modelcontextprotocol/node';
-
-/**
- * Advisory IDs (GHSA / npm) we knowingly accept because there is no fixed
- * upstream release reachable through our dependency tree. MUST stay empty unless
- * a transitive advisory is genuinely unfixable — add the ID with a justification.
- */
-const HIGH_CRITICAL_ALLOWLIST = new Set<string | number>([
-  // (intentionally empty — all known high/critical advisories are fixed)
-]);
-
-interface AuditAdvisory {
-  severity: string;
-  source?: number;
-  url?: string;
-  title?: string;
-  name?: string;
-}
-
-interface AuditReport {
-  vulnerabilities?: Record<
-    string,
-    {
-      severity: string;
-      via: Array<string | AuditAdvisory>;
-    }
-  >;
-  metadata?: {
-    vulnerabilities?: Record<string, number>;
-  };
-}
-
-/**
- * Run `npm audit --omit=dev --json` and return the parsed report. npm audit exits
- * NON-zero when advisories are present, so we capture stdout from the thrown error
- * too. Returns null when the registry is unreachable (offline dev) so the gate
- * skips rather than producing a false failure.
- */
-function runProdAudit(): AuditReport | null {
-  let stdout: string;
-  try {
-    stdout = execFileSync('npm', ['audit', '--omit=dev', '--json'], {
-      encoding: 'utf8',
-      shell: process.platform === 'win32', // npm is npm.cmd on Windows
-      stdio: ['ignore', 'pipe', 'ignore'],
-      maxBuffer: 32 * 1024 * 1024,
-    });
-  } catch (err) {
-    const e = err as { stdout?: string; message?: string };
-    if (typeof e.stdout === 'string' && e.stdout.trim().startsWith('{')) {
-      stdout = e.stdout;
-    } else {
-      // Could not run audit (offline / registry down) — signal skip.
-      return null;
-    }
-  }
-
-  try {
-    return JSON.parse(stdout) as AuditReport;
-  } catch {
-    return null;
-  }
-}
-
-describe('SEC-DEPS — Vulnerable & Outdated Components (M9)', () => {
-  describe('production audit gate', () => {
-    it('reports zero high/critical advisories in the production tree', () => {
-      const report = runProdAudit();
-      if (report === null) {
-        // Registry unreachable — do not fail the suite offline.
-        console.warn('SEC-DEPS: npm audit unavailable (offline?), skipping gate assertion');
-        return;
-      }
-
-      const offenders: string[] = [];
-      for (const [pkg, vuln] of Object.entries(report.vulnerabilities ?? {})) {
-        const sev = vuln.severity?.toLowerCase();
-        if (sev !== 'high' && sev !== 'critical') {
-          continue;
-        }
-        // Allow only if EVERY advisory behind this package is allowlisted.
-        const advisoryIds = vuln.via
-          .filter((v): v is AuditAdvisory => typeof v === 'object')
-          .map((v) => v.source)
-          .filter((s): s is number => typeof s === 'number');
-        const allAllowlisted =
-          advisoryIds.length > 0 && advisoryIds.every((id) => HIGH_CRITICAL_ALLOWLIST.has(id));
-        if (!allAllowlisted) {
-          offenders.push(`${pkg} (${sev}; advisories: ${advisoryIds.join(', ') || 'n/a'})`);
-        }
-      }
-
-      expect(offenders, `Unfixed high/critical prod advisories:\n${offenders.join('\n')}`).toEqual(
-        []
-      );
-    });
-
-    it('reports zero high/critical via the audit metadata summary', () => {
-      const report = runProdAudit();
-      if (report === null) {
-        console.warn('SEC-DEPS: npm audit unavailable (offline?), skipping metadata assertion');
-        return;
-      }
-      const counts = report.metadata?.vulnerabilities ?? {};
-      const high = counts.high ?? 0;
-      const critical = counts.critical ?? 0;
-      // With an empty allowlist the metadata summary must also be clean.
-      if (HIGH_CRITICAL_ALLOWLIST.size === 0) {
-        expect(high + critical).toBe(0);
-      }
-    });
-  });
-
-  describe('per-request transport invariant (post-upgrade)', () => {
-    it('SDK still exposes a constructable StreamableHTTPServerTransport', () => {
-      expect(typeof NodeStreamableHTTPServerTransport).toBe('function');
-    });
-
-    it('constructs an independent transport per call (stateless mode)', () => {
-      const make = (): NodeStreamableHTTPServerTransport =>
-        new NodeStreamableHTTPServerTransport({
-          sessionIdGenerator: undefined, // stateless: one transport per request
-          enableDnsRebindingProtection: true,
-          allowedHosts: ['localhost:3000'],
-          allowedOrigins: ['http://localhost:3000'],
-        });
-
-      const a = make();
-      const b = make();
-      expect(a).toBeInstanceOf(NodeStreamableHTTPServerTransport);
-      expect(b).toBeInstanceOf(NodeStreamableHTTPServerTransport);
-      expect(a).not.toBe(b); // distinct instances — no shared session state
-    });
-  });
-});

package/tests/security/injection.test.ts

@@ -1,117 +0,0 @@
-/**
- * SEC-INJ — Injection (path / parameter)
- * OWASP A03:2021 (Injection); overlaps SEC-SSRF (A10:2021).
- *
- * Finding covered:
- *   H4 — Home Assistant API paths interpolate user input without encoding, so an
- *        entity_id / domain / service containing "/", "..", "?" or "#" could escape
- *        the intended /api/<resource> path or inject query parameters.
- *
- * Secure behavior asserted:
- *   - Call sites percent-encode each user-controlled path segment.
- *   - The request layer refuses any path that resolves outside /api/ (traversal guard).
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import { RequestHandler } from '../../src/haClient/request.js';
-import { StateOperations } from '../../src/haClient/states.js';
-import { ServiceOperations } from '../../src/haClient/services.js';
-
-function makeHandler() {
-  return new RequestHandler({
-    baseUrl: 'http://ha.test:8123',
-    token: 'tok',
-    timeout: 30000,
-    strictSsl: true,
-  });
-}
-
-/** Capture the URL string passed to fetch and return an empty JSON response. */
-function stubFetch() {
-  const fetchMock = vi.fn(async () => ({
-    ok: true,
-    status: 200,
-    statusText: 'OK',
-    headers: { get: () => 'application/json' },
-    json: async () => ({}),
-    text: async () => '',
-  }));
-  vi.stubGlobal('fetch', fetchMock);
-  return fetchMock;
-}
-
-describe('SEC-INJ — Injection (H4: HA API path)', () => {
-  beforeEach(() => {
-    stubFetch();
-  });
-  afterEach(() => {
-    vi.unstubAllGlobals();
-    vi.restoreAllMocks();
-  });
-
-  describe('request-layer traversal guard', () => {
-    it('rejects a path that escapes /api via ".." before making any request', async () => {
-      const handler = makeHandler();
-      await expect(handler.get('/states/../../secret')).rejects.toThrow();
-      expect(fetch).not.toHaveBeenCalled();
-    });
-
-    it('allows a normal /api path', async () => {
-      const handler = makeHandler();
-      await handler.get('/states');
-      expect(fetch).toHaveBeenCalledOnce();
-      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-      expect(new URL(calledUrl).pathname).toBe('/api/states');
-    });
-  });
-
-  describe('call-site encoding — StateOperations.getState', () => {
-    it('encodes a malicious entity_id so it cannot escape /api/states', async () => {
-      const states = new StateOperations(makeHandler());
-      await states.getState('x/../../admin');
-
-      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-      const { pathname } = new URL(calledUrl);
-      // The whole id stays a single encoded segment under /api/states/.
-      expect(pathname.startsWith('/api/states/')).toBe(true);
-      expect(pathname).not.toContain('/admin');
-      expect(calledUrl).toContain('%2F'); // the slashes were encoded
-    });
-
-    it('encodes "?" so it cannot inject query parameters', async () => {
-      const states = new StateOperations(makeHandler());
-      await states.getState('light.x?evil=1');
-
-      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-      expect(new URL(calledUrl).searchParams.get('evil')).toBeNull();
-    });
-
-    it('passes a normal entity_id through unchanged', async () => {
-      const states = new StateOperations(makeHandler());
-      await states.getState('light.kitchen');
-
-      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-      expect(new URL(calledUrl).pathname).toBe('/api/states/light.kitchen');
-    });
-  });
-
-  describe('call-site encoding — ServiceOperations.callService', () => {
-    it('encodes domain and service segments', async () => {
-      const services = new ServiceOperations(makeHandler());
-      await services.callService({ domain: 'light', service: 'turn_on/../../admin' });
-
-      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-      const { pathname } = new URL(calledUrl);
-      expect(pathname.startsWith('/api/services/light/')).toBe(true);
-      expect(pathname).not.toContain('/admin');
-    });
-
-    it('passes a normal service call through unchanged', async () => {
-      const services = new ServiceOperations(makeHandler());
-      await services.callService({ domain: 'light', service: 'turn_on' });
-
-      const calledUrl = (fetch as unknown as ReturnType<typeof vi.fn>).mock.calls[0][0] as string;
-      expect(new URL(calledUrl).pathname).toBe('/api/services/light/turn_on');
-    });
-  });
-});