@coffeerunhobby/mcp-ha-connect 2.2.1 → 2.4.0

package/tests/ownerQuestions/tools.test.ts

@@ -1,186 +0,0 @@
-/**
- * askOwner / getOwnerAnswer / cancelOwnerQuestion tools: input validation,
- * RBAC, caller binding, log redaction, and a real MCP round trip.
- */
-
-import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
-import type { McpServer } from '@modelcontextprotocol/server';
-import { Client, InMemoryTransport } from '@modelcontextprotocol/client';
-
-import { OwnerQuestionService } from '../../src/ownerQuestions/service.js';
-import { registerOwnerQuestionTools, askOwnerSchema } from '../../src/tools/homeassistant/askOwner.js';
-import { createServer } from '../../src/server/common.js';
-import { Permission, Role } from '../../src/permissions/index.js';
-import { setLocalFullTrust } from '../../src/tools/common.js';
-import { logger } from '../../src/utils/logger.js';
-
-type Handler = (args: unknown, extra: unknown) => Promise<{ content: { text: string }[]; isError?: boolean }>;
-
-function createMockServer() {
-    const handlers = new Map<string, Handler>();
-    return {
-        registerTool: vi.fn((name: string, _config: unknown, handler: Handler) => handlers.set(name, handler)),
-        handlers,
-    } as unknown as McpServer & { handlers: Map<string, Handler> };
-}
-
-const extraFor = (sub: string, permissions: number) => ({
-    sessionId: 's',
-    http: { authInfo: { token: '', clientId: sub, scopes: [], extra: { permissions } } },
-});
-
-const parse = (result: { content: { text: string }[] }) => JSON.parse(result.content[0].text) as Record<string, unknown>;
-
-const valid = { question: 'Aprinzi lumina în baie?', target: 'mobile_app_phone_user5' };
-
-function makeService() {
-    const notify = vi.fn().mockResolvedValue([]);
-    const service = new OwnerQuestionService({ notify, subscribe: vi.fn().mockResolvedValue('s'), secret: 'k'.repeat(40) });
-    return { service, notify };
-}
-
-describe('askOwner input validation', () => {
-    it('accepts plain text including Romanian diacritics, and applies defaults', () => {
-        const parsed = askOwnerSchema.parse(valid);
-        expect(parsed.question).toBe('Aprinzi lumina în baie?');
-        expect(parsed.buttons).toBeUndefined();
-    });
-
-    it('NFC-normalizes text (a decomposed ș becomes one character)', () => {
-        expect(askOwnerSchema.parse({ ...valid, question: 'ș?' }).question).toBe('ș?');
-    });
-
-    it.each([
-        ['an emoji', { question: 'Approve? 👍' }, /U\+1F44D/],
-        ['a zero-width joiner', { question: 'ok‍ok' }, /U\+200D/],
-        ['a right-to-left override', { question: 'pay ‮evil' }, /U\+202E/],
-        ['stacked combining marks', { question: 'á́' }, /U\+0301/],
-        ['a 257-character question', { question: 'x'.repeat(257) }, /257 characters; the maximum is 256/],
-        ['a line break in the title', { title: 'two\nlines' }, /title contains a disallowed character U\+000A/],
-        ['a 61-character title', { title: 't'.repeat(61) }, /maximum is 60/],
-        ['an emoji button', { buttons: ['Yes ✅', 'No'] }, /button label/],
-        ['four buttons', { buttons: ['a', 'b', 'c', 'd'] }, /3/],
-        ['duplicate buttons', { buttons: ['Yes', 'yes'] }, /unique/],
-        ['a non-mobile target', { target: 'persistent_notification' }, /mobile app notify service/],
-        ['a timeout over 7 days', { timeoutSeconds: 7 * 24 * 3600 + 1 }, /604800/],
-        ['a timeout under a minute', { timeoutSeconds: 59 }, /60/],
-    ])('refuses %s', (_name, overrides, error) => {
-        const result = askOwnerSchema.safeParse({ ...valid, ...overrides });
-        expect(result.success).toBe(false);
-        expect(JSON.stringify(result.error!.issues)).toMatch(error);
-    });
-
-    it('accepts a 256-character question with line breaks', () => {
-        const question = `${'x'.repeat(100)}\n${'y'.repeat(155)}`;
-        expect(askOwnerSchema.parse({ ...valid, question }).question).toBe(question);
-    });
-});
-
-describe('owner question tools', () => {
-    let server: ReturnType<typeof createMockServer>;
-    let service: OwnerQuestionService;
-    let notify: ReturnType<typeof vi.fn>;
-
-    beforeEach(() => {
-        server = createMockServer();
-        ({ service, notify } = makeService());
-        registerOwnerQuestionTools(server, service);
-    });
-
-    it('registers askOwner, getOwnerAnswer and cancelOwnerQuestion', () => {
-        expect([...server.handlers.keys()]).toEqual(['askOwner', 'getOwnerAnswer', 'cancelOwnerQuestion']);
-    });
-
-    it.each(['askOwner', 'getOwnerAnswer', 'cancelOwnerQuestion'])('%s requires NOTIFY', async (tool) => {
-        const result = await server.handlers.get(tool)!({ ...valid, requestId: 'x' }, extraFor('reader', Role.READONLY));
-        expect(parse(result)).toMatchObject({ error: 'Permission denied' });
-        expect(String(parse(result).message)).toContain('NOTIFY');
-        expect(notify).not.toHaveBeenCalled();
-    });
-
-    it('askOwner applies the default title, buttons and timeout', async () => {
-        const result = await server.handlers.get('askOwner')!(valid, extraFor('approver', Permission.NOTIFY));
-
-        expect(parse(result)).toHaveProperty('requestId');
-        expect(notify.mock.calls[0][1]).toMatchObject({ title: 'Approval needed', data: { timeout: 600 } });
-        expect(notify.mock.calls[0][1].data.actions.map((a: { title: string }) => a.title)).toEqual(['Approve', 'Deny']);
-    });
-
-    it('binds the question to the asking token sub', async () => {
-        const asked = parse(await server.handlers.get('askOwner')!(valid, extraFor('approver', Permission.NOTIFY)));
-
-        const own = await server.handlers.get('getOwnerAnswer')!({ requestId: asked.requestId, waitSeconds: 0 }, extraFor('approver', Permission.NOTIFY));
-        const other = await server.handlers.get('getOwnerAnswer')!({ requestId: asked.requestId, waitSeconds: 0 }, extraFor('harvey', Permission.NOTIFY));
-
-        expect(parse(own)).toMatchObject({ status: 'pending' });
-        expect(other.isError).toBe(true);
-        expect(String(parse(other).message)).toMatch(/different client/);
-    });
-
-    it('logs tool arguments (the question text) at debug level only', async () => {
-        const info = vi.spyOn(logger, 'info');
-        const debug = vi.spyOn(logger, 'debug');
-        try {
-            await server.handlers.get('askOwner')!(
-                { ...valid, question: 'Secret plan: unlock the front door?' },
-                extraFor('approver', Permission.NOTIFY)
-            );
-            expect(JSON.stringify(info.mock.calls)).not.toContain('unlock the front door');
-            expect(JSON.stringify(info.mock.calls)).toContain('Tool invoked');
-            expect(JSON.stringify(debug.mock.calls)).toContain('unlock the front door');
-        } finally {
-            info.mockRestore();
-            debug.mockRestore();
-        }
-    });
-});
-
-describe('owner question tools over MCP', () => {
-    beforeEach(() => setLocalFullTrust(true));
-    afterEach(() => setLocalFullTrust(false));
-
-    it('are listed with a JSON Schema and callable end to end', async () => {
-        const { service, notify } = makeService();
-        const server = createServer({ haClient: {} as never, ownerQuestions: service });
-        const client = new Client({ name: 'ask-owner-test', version: '0' });
-        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
-        await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
-        try {
-            const { tools } = await client.listTools();
-            const askOwner = tools.find((t) => t.name === 'askOwner');
-            expect(askOwner?.inputSchema.required).toEqual(['question', 'target']);
-            expect(tools.map((t) => t.name)).toEqual(expect.arrayContaining(['getOwnerAnswer', 'cancelOwnerQuestion']));
-
-            const asked = await client.callTool({ name: 'askOwner', arguments: { ...valid, buttons: ['Da', 'Nu'] } });
-            const { requestId } = JSON.parse((asked.content as Array<{ text: string }>)[0].text);
-            expect(notify).toHaveBeenCalledTimes(1);
-
-            const answer = await client.callTool({ name: 'getOwnerAnswer', arguments: { requestId, waitSeconds: 0 } });
-            expect(JSON.parse((answer.content as Array<{ text: string }>)[0].text)).toMatchObject({
-                status: 'pending',
-                buttons: ['Da', 'Nu'],
-            });
-
-            const refused = await client.callTool({ name: 'askOwner', arguments: { ...valid, question: 'ok 👍' } });
-            expect(refused.isError).toBe(true);
-            expect(notify).toHaveBeenCalledTimes(1);
-        } finally {
-            await client.close();
-            await server.close();
-        }
-    });
-
-    it('are not registered when no owner question service is running', async () => {
-        const server = createServer({ haClient: {} as never });
-        const client = new Client({ name: 'ask-owner-test', version: '0' });
-        const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
-        await Promise.all([server.connect(serverTransport), client.connect(clientTransport)]);
-        try {
-            const { tools } = await client.listTools();
-            expect(tools.map((t) => t.name)).not.toContain('askOwner');
-        } finally {
-            await client.close();
-            await server.close();
-        }
-    });
-});

package/tests/permissions/index.test.ts

@@ -1,217 +0,0 @@
-/**
- * Permission system tests
- */
-
-import { describe, it, expect } from 'vitest';
-import {
-  Permission,
-  Role,
-  getUserPermissions,
-  hasPermission,
-  getPermissionNames,
-  parsePermissionsConfig,
-  defaultRoleWarning,
-  type RoleName,
-} from '../../src/permissions/index.js';
-
-describe('Permission', () => {
-  it('should have correct bit values sorted by criticality', () => {
-    expect(Permission.ADMIN).toBe(1);      // Highest criticality
-    expect(Permission.CONFIGURE).toBe(2);
-    expect(Permission.CONTROL).toBe(4);
-    expect(Permission.QUERY).toBe(8);
-    expect(Permission.NOTIFY).toBe(16);
-    expect(Permission.AI).toBe(32);
-  });
-
-  it('should be powers of 2 for bitwise operations', () => {
-    const values = Object.values(Permission);
-    for (const v of values) {
-      expect(Math.log2(v) % 1).toBe(0); // Is power of 2
-    }
-  });
-});
-
-describe('Role', () => {
-  it('should have NONE with zero permissions', () => {
-    expect(Role.NONE).toBe(0);
-  });
-
-  it('should have READONLY with only QUERY', () => {
-    expect(Role.READONLY).toBe(Permission.QUERY);
-  });
-
-  it('should have OPERATOR with QUERY, CONTROL, NOTIFY', () => {
-    expect(hasPermission(Role.OPERATOR, Permission.QUERY)).toBe(true);
-    expect(hasPermission(Role.OPERATOR, Permission.CONTROL)).toBe(true);
-    expect(hasPermission(Role.OPERATOR, Permission.NOTIFY)).toBe(true);
-    expect(hasPermission(Role.OPERATOR, Permission.CONFIGURE)).toBe(false);
-    expect(hasPermission(Role.OPERATOR, Permission.AI)).toBe(false);
-    expect(hasPermission(Role.OPERATOR, Permission.ADMIN)).toBe(false);
-  });
-
-  it('should have CONTRIBUTOR with QUERY, CONTROL, NOTIFY, CONFIGURE', () => {
-    expect(hasPermission(Role.CONTRIBUTOR, Permission.QUERY)).toBe(true);
-    expect(hasPermission(Role.CONTRIBUTOR, Permission.CONTROL)).toBe(true);
-    expect(hasPermission(Role.CONTRIBUTOR, Permission.NOTIFY)).toBe(true);
-    expect(hasPermission(Role.CONTRIBUTOR, Permission.CONFIGURE)).toBe(true);
-    expect(hasPermission(Role.CONTRIBUTOR, Permission.AI)).toBe(false);
-    expect(hasPermission(Role.CONTRIBUTOR, Permission.ADMIN)).toBe(false);
-  });
-
-  it('should have ADMIN with all permissions', () => {
-    expect(hasPermission(Role.ADMIN, Permission.QUERY)).toBe(true);
-    expect(hasPermission(Role.ADMIN, Permission.CONTROL)).toBe(true);
-    expect(hasPermission(Role.ADMIN, Permission.NOTIFY)).toBe(true);
-    expect(hasPermission(Role.ADMIN, Permission.CONFIGURE)).toBe(true);
-    expect(hasPermission(Role.ADMIN, Permission.AI)).toBe(true);
-    expect(hasPermission(Role.ADMIN, Permission.ADMIN)).toBe(true);
-  });
-
-  it('should have SUPERUSER with 0xFF (all bits)', () => {
-    expect(Role.SUPERUSER).toBe(0xFF);
-  });
-});
-
-describe('hasPermission', () => {
-  it('should return true when permission is present', () => {
-    const mask = Permission.QUERY | Permission.CONTROL;
-    expect(hasPermission(mask, Permission.QUERY)).toBe(true);
-    expect(hasPermission(mask, Permission.CONTROL)).toBe(true);
-  });
-
-  it('should return false when permission is missing', () => {
-    const mask = Permission.QUERY | Permission.CONTROL;
-    expect(hasPermission(mask, Permission.ADMIN)).toBe(false);
-  });
-
-  it('should check combined permissions', () => {
-    const mask = Permission.QUERY | Permission.CONTROL;
-    expect(hasPermission(mask, Permission.QUERY | Permission.CONTROL)).toBe(true);
-    expect(hasPermission(mask, Permission.QUERY | Permission.ADMIN)).toBe(false);
-  });
-});
-
-describe('getPermissionNames', () => {
-  it('should return empty array for zero mask', () => {
-    expect(getPermissionNames(0)).toEqual([]);
-  });
-
-  it('should return single permission name', () => {
-    expect(getPermissionNames(Permission.QUERY)).toEqual(['QUERY']);
-  });
-
-  it('should return multiple permission names', () => {
-    const names = getPermissionNames(Permission.QUERY | Permission.CONTROL);
-    expect(names).toContain('QUERY');
-    expect(names).toContain('CONTROL');
-    expect(names).toHaveLength(2);
-  });
-});
-
-describe('getUserPermissions', () => {
-  const config = {
-    users: [
-      { sub: 'admin', role: 'ADMIN' as const },
-      { sub: 'readonly', role: 'READONLY' as const },
-      { sub: 'operator', role: 'OPERATOR' as const },
-      { sub: 'custom', mask: Permission.QUERY | Permission.AI },
-    ],
-    defaultRole: 'NONE' as const,
-  };
-
-  it('should return role permissions for known user', () => {
-    expect(getUserPermissions('admin', config)).toBe(Role.ADMIN);
-    expect(getUserPermissions('readonly', config)).toBe(Role.READONLY);
-    expect(getUserPermissions('operator', config)).toBe(Role.OPERATOR);
-  });
-
-  it('should return custom mask when specified', () => {
-    const perms = getUserPermissions('custom', config);
-    expect(hasPermission(perms, Permission.QUERY)).toBe(true);
-    expect(hasPermission(perms, Permission.AI)).toBe(true);
-    expect(hasPermission(perms, Permission.CONTROL)).toBe(false);
-  });
-
-  it('should return default role for unknown user', () => {
-    expect(getUserPermissions('unknown', config)).toBe(Role.NONE);
-  });
-
-  it('should return default role for undefined sub', () => {
-    expect(getUserPermissions(undefined, config)).toBe(Role.NONE);
-  });
-
-  it('should use default role from config', () => {
-    const configWithDefault = { ...config, defaultRole: 'READONLY' as const };
-    expect(getUserPermissions('unknown', configWithDefault)).toBe(Role.READONLY);
-  });
-
-  it('should resolve a lowercase defaultRole (case-insensitive)', () => {
-    // Real-world config commonly uses lowercase ("operator"); it must resolve to
-    // the OPERATOR mask, not silently fall through to an empty/undefined mask.
-    const cfg = { users: [], defaultRole: 'operator' as unknown as 'OPERATOR' };
-    expect(getUserPermissions('unlisted-sub', cfg)).toBe(Role.OPERATOR);
-    expect(getUserPermissions(undefined, cfg)).toBe(Role.OPERATOR);
-  });
-
-  it('should resolve a lowercase per-user role (case-insensitive)', () => {
-    const cfg = {
-      users: [{ sub: 'claude', role: 'admin' as unknown as 'ADMIN' }],
-      defaultRole: 'NONE' as const,
-    };
-    expect(getUserPermissions('claude', cfg)).toBe(Role.ADMIN);
-  });
-
-  it('should fail closed to NONE for an unrecognized role name', () => {
-    const cfg = { users: [], defaultRole: 'wizard' as unknown as 'ADMIN' };
-    expect(getUserPermissions('anyone', cfg)).toBe(Role.NONE);
-  });
-});
-
-describe('parsePermissionsConfig', () => {
-  it('should parse valid JSON', () => {
-    const json = '{"users":[{"sub":"admin","role":"ADMIN"}],"defaultRole":"READONLY"}';
-    const config = parsePermissionsConfig(json);
-    expect(config.users).toHaveLength(1);
-    expect(config.users[0].sub).toBe('admin');
-    expect(config.defaultRole).toBe('READONLY');
-  });
-
-  it('should return empty config for undefined', () => {
-    const config = parsePermissionsConfig(undefined);
-    expect(config.users).toEqual([]);
-    expect(config.defaultRole).toBe('NONE');
-  });
-
-  it('should return empty config for invalid JSON', () => {
-    const config = parsePermissionsConfig('not valid json');
-    expect(config.users).toEqual([]);
-    expect(config.defaultRole).toBe('NONE');
-  });
-
-  it('should handle missing users array', () => {
-    const config = parsePermissionsConfig('{}');
-    expect(config.users).toEqual([]);
-  });
-});
-
-describe('defaultRoleWarning', () => {
-  it('is silent when defaultRole is NONE (any case) or unset', () => {
-    expect(defaultRoleWarning({ users: [], defaultRole: 'NONE' })).toBeUndefined();
-    expect(defaultRoleWarning({ users: [], defaultRole: 'none' as RoleName })).toBeUndefined();
-    expect(defaultRoleWarning({ users: [] })).toBeUndefined();
-  });
-
-  it('is silent for an unknown role name (it resolves to NONE, fail-closed)', () => {
-    expect(defaultRoleWarning({ users: [], defaultRole: 'typo' as RoleName })).toBeUndefined();
-  });
-
-  it('warns and names the granted permissions when unmapped tokens get access', () => {
-    const msg = defaultRoleWarning({ users: [], defaultRole: 'operator' as RoleName });
-    expect(msg).toBeDefined();
-    expect(msg).toContain('"operator"');
-    expect(msg).toContain('CONTROL');
-    expect(msg).toContain('QUERY');
-    expect(msg).not.toContain('ADMIN');
-  });
-});