@coffeerunhobby/mcp-ha-connect 2.2.1 → 2.4.0

package/tests/resources/index.test.ts

@@ -1,288 +0,0 @@
-/**
- * Unit tests for MCP resources
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { McpServer } from '@modelcontextprotocol/server';
-import type { HaClient } from '../../src/haClient/index.js';
-import { registerAllResources } from '../../src/resources/index.js';
-
-// Create mock server that captures registered resources
-function createMockServer() {
-  const resources = new Map<string, { config: unknown; handler: (...args: unknown[]) => unknown }>();
-  return {
-    registerResource: vi.fn((name: string, uriOrTemplate: unknown, config: unknown, handler: (...args: unknown[]) => unknown) => {
-      resources.set(name, { config, handler });
-    }),
-    resources,
-  } as unknown as McpServer & { resources: Map<string, { config: unknown; handler: (...args: unknown[]) => unknown }> };
-}
-
-// Create mock HaClient
-function createMockClient() {
-  return {
-    getStates: vi.fn(),
-    getState: vi.fn(),
-    getEntitiesByDomain: vi.fn(),
-    searchEntities: vi.fn(),
-  } as unknown as HaClient;
-}
-
-describe('MCP Resources', () => {
-  let server: ReturnType<typeof createMockServer>;
-  let client: ReturnType<typeof createMockClient>;
-
-  beforeEach(() => {
-    server = createMockServer();
-    client = createMockClient();
-    vi.clearAllMocks();
-  });
-
-  describe('Registration', () => {
-    it('should register all 5 resources', () => {
-      registerAllResources(server, client);
-      expect(server.registerResource).toHaveBeenCalledTimes(5);
-    });
-
-    it('should register All Entities resource', () => {
-      registerAllResources(server, client);
-      expect(server.resources.has('All Entities')).toBe(true);
-    });
-
-    it('should register Entity State resource', () => {
-      registerAllResources(server, client);
-      expect(server.resources.has('Entity State')).toBe(true);
-    });
-
-    it('should register Entity Detailed resource', () => {
-      registerAllResources(server, client);
-      expect(server.resources.has('Entity Detailed')).toBe(true);
-    });
-
-    it('should register Domain Entities resource', () => {
-      registerAllResources(server, client);
-      expect(server.resources.has('Domain Entities')).toBe(true);
-    });
-
-    it('should register Search Entities resource', () => {
-      registerAllResources(server, client);
-      expect(server.resources.has('Search Entities')).toBe(true);
-    });
-  });
-
-  describe('All Entities Resource', () => {
-    it('should return entities grouped by domain', async () => {
-      const mockEntities = [
-        { entity_id: 'light.living_room', state: 'on', attributes: { friendly_name: 'Living Room Light' } },
-        { entity_id: 'light.bedroom', state: 'off', attributes: { friendly_name: 'Bedroom Light' } },
-        { entity_id: 'sensor.temperature', state: '22', attributes: { friendly_name: 'Temperature' } },
-      ];
-      (client.getStates as ReturnType<typeof vi.fn>).mockResolvedValue(mockEntities);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('All Entities')!.handler;
-      const result = await handler();
-
-      expect(client.getStates).toHaveBeenCalled();
-      expect(result.contents).toHaveLength(1);
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.total).toBe(3);
-      expect(content.domains).toBe(2);
-      expect(content.entities.light).toHaveLength(2);
-      expect(content.entities.sensor).toHaveLength(1);
-    });
-
-    it('should handle empty entity list', async () => {
-      (client.getStates as ReturnType<typeof vi.fn>).mockResolvedValue([]);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('All Entities')!.handler;
-      const result = await handler();
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.total).toBe(0);
-      expect(content.domains).toBe(0);
-      expect(content.entities).toEqual({});
-    });
-  });
-
-  describe('Entity State Resource', () => {
-    it('should return entity state', async () => {
-      const mockEntity = {
-        entity_id: 'light.living_room',
-        state: 'on',
-        attributes: { friendly_name: 'Living Room Light', brightness: 255 },
-        last_changed: '2024-01-01T00:00:00Z',
-      };
-      (client.getState as ReturnType<typeof vi.fn>).mockResolvedValue(mockEntity);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Entity State')!.handler;
-      const uri = new URL('hass://entities/light.living_room');
-      const result = await handler(uri, { entity_id: 'light.living_room' });
-
-      expect(client.getState).toHaveBeenCalledWith('light.living_room');
-      expect(result.contents).toHaveLength(1);
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.entity_id).toBe('light.living_room');
-      expect(content.state).toBe('on');
-      expect(content.friendly_name).toBe('Living Room Light');
-    });
-
-    it('should return error for non-existent entity', async () => {
-      (client.getState as ReturnType<typeof vi.fn>).mockResolvedValue(null);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Entity State')!.handler;
-      const uri = new URL('hass://entities/light.nonexistent');
-      const result = await handler(uri, { entity_id: 'light.nonexistent' });
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.error).toBe('Entity not found');
-      expect(content.entity_id).toBe('light.nonexistent');
-    });
-  });
-
-  describe('Entity Detailed Resource', () => {
-    it('should return detailed entity info', async () => {
-      const mockEntity = {
-        entity_id: 'light.living_room',
-        state: 'on',
-        attributes: { friendly_name: 'Living Room Light', brightness: 255, supported_features: 1 },
-        last_changed: '2024-01-01T00:00:00Z',
-        last_updated: '2024-01-01T00:00:01Z',
-        context: { id: 'abc123', parent_id: null, user_id: null },
-      };
-      (client.getState as ReturnType<typeof vi.fn>).mockResolvedValue(mockEntity);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Entity Detailed')!.handler;
-      const uri = new URL('hass://entities/light.living_room/detailed');
-      const result = await handler(uri, { entity_id: 'light.living_room' });
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.entity_id).toBe('light.living_room');
-      expect(content.attributes).toHaveProperty('brightness');
-      expect(content.attributes).toHaveProperty('supported_features');
-      expect(content.last_updated).toBeDefined();
-      expect(content.context).toBeDefined();
-    });
-
-    it('should return error for non-existent entity', async () => {
-      (client.getState as ReturnType<typeof vi.fn>).mockResolvedValue(null);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Entity Detailed')!.handler;
-      const uri = new URL('hass://entities/light.nonexistent/detailed');
-      const result = await handler(uri, { entity_id: 'light.nonexistent' });
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.error).toBe('Entity not found');
-    });
-  });
-
-  describe('Domain Entities Resource', () => {
-    it('should return all entities for a domain', async () => {
-      const mockEntities = [
-        { entity_id: 'light.living_room', state: 'on', attributes: { friendly_name: 'Living Room' } },
-        { entity_id: 'light.bedroom', state: 'off', attributes: { friendly_name: 'Bedroom' } },
-      ];
-      (client.getEntitiesByDomain as ReturnType<typeof vi.fn>).mockResolvedValue(mockEntities);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Domain Entities')!.handler;
-      const uri = new URL('hass://entities/domain/light');
-      const result = await handler(uri, { domain: 'light' });
-
-      expect(client.getEntitiesByDomain).toHaveBeenCalledWith('light');
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.domain).toBe('light');
-      expect(content.count).toBe(2);
-      expect(content.entities).toHaveLength(2);
-    });
-
-    it('should handle domain with no entities', async () => {
-      (client.getEntitiesByDomain as ReturnType<typeof vi.fn>).mockResolvedValue([]);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Domain Entities')!.handler;
-      const uri = new URL('hass://entities/domain/vacuum');
-      const result = await handler(uri, { domain: 'vacuum' });
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.domain).toBe('vacuum');
-      expect(content.count).toBe(0);
-      expect(content.entities).toEqual([]);
-    });
-  });
-
-  describe('Search Entities Resource', () => {
-    it('should search entities with query and limit', async () => {
-      const mockEntities = [
-        { entity_id: 'light.living_room', state: 'on', attributes: { friendly_name: 'Living Room Light' } },
-        { entity_id: 'light.living_lamp', state: 'off', attributes: { friendly_name: 'Living Lamp' } },
-      ];
-      (client.searchEntities as ReturnType<typeof vi.fn>).mockResolvedValue(mockEntities);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Search Entities')!.handler;
-      const uri = new URL('hass://search/living/10');
-      const result = await handler(uri, { query: 'living', limit: '10' });
-
-      expect(client.searchEntities).toHaveBeenCalledWith('living');
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.query).toBe('living');
-      expect(content.limit).toBe(10);
-      expect(content.count).toBe(2);
-    });
-
-    it('should apply limit to search results', async () => {
-      const mockEntities = Array.from({ length: 100 }, (_, i) => ({
-        entity_id: `sensor.test_${i}`,
-        state: 'on',
-        attributes: { friendly_name: `Test ${i}` },
-      }));
-      (client.searchEntities as ReturnType<typeof vi.fn>).mockResolvedValue(mockEntities);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Search Entities')!.handler;
-      const uri = new URL('hass://search/test/5');
-      const result = await handler(uri, { query: 'test', limit: '5' });
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.count).toBe(5);
-      expect(content.entities).toHaveLength(5);
-    });
-
-    it('should decode URL-encoded query', async () => {
-      (client.searchEntities as ReturnType<typeof vi.fn>).mockResolvedValue([]);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Search Entities')!.handler;
-      const uri = new URL('hass://search/living%20room/50');
-      const result = await handler(uri, { query: 'living%20room', limit: '50' });
-
-      expect(client.searchEntities).toHaveBeenCalledWith('living room');
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.query).toBe('living room');
-    });
-
-    it('should use default limit when not specified', async () => {
-      (client.searchEntities as ReturnType<typeof vi.fn>).mockResolvedValue([]);
-
-      registerAllResources(server, client);
-      const handler = server.resources.get('Search Entities')!.handler;
-      const uri = new URL('hass://search/test/50');
-      // Simulate undefined limit
-      const result = await handler(uri, { query: 'test', limit: undefined });
-
-      const content = JSON.parse(result.contents[0].text);
-      expect(content.limit).toBe(50);
-    });
-  });
-});

package/tests/scripts/generateJwt.test.ts

@@ -1,44 +0,0 @@
-/**
- * Output contract of scripts/generate-jwt.ts: stdout is exactly one bare JWT.
- *
- * Callers capture it with `TOKEN=$(npm run -s generate:jwt -- ...)`. A banner or a
- * second copy of the token on stdout (the pre-1.7.5 behavior) corrupts that capture,
- * so this test runs the real script as a subprocess and checks both streams.
- */
-
-import { describe, it, expect } from 'vitest';
-import { spawnSync } from 'node:child_process';
-import { resolve } from 'node:path';
-import { verifyJwt } from '../../src/utils/jwt.js';
-
-const ROOT = resolve(__dirname, '../..');
-const TSX_CLI = resolve(ROOT, 'node_modules/tsx/dist/cli.mjs');
-const SCRIPT = resolve(ROOT, 'scripts/generate-jwt.ts');
-const SECRET = 'dummy-secret-for-generate-jwt-test-0123456789';
-
-function run(args: string[]): { status: number | null; stdout: string; stderr: string } {
-  const result = spawnSync(process.execPath, [TSX_CLI, SCRIPT, ...args], {
-    cwd: ROOT,
-    // Never inherit a real secret from the developer's environment.
-    env: { ...process.env, MCP_AUTH_SECRET: '' },
-    encoding: 'utf8',
-  });
-  return { status: result.status, stdout: result.stdout, stderr: result.stderr };
-}
-
-describe('generate-jwt output contract', () => {
-  it('prints exactly one valid JWT on stdout; details go to stderr', () => {
-    const { status, stdout, stderr } = run(['--sub', 'contract-test', '--exp', '5m', '--secret', SECRET]);
-    expect(status).toBe(0);
-
-    const lines = stdout.split(/\r?\n/).filter((l) => l.trim() !== '');
-    expect(lines).toHaveLength(1);
-
-    const result = verifyJwt(lines[0], SECRET);
-    expect(result.valid).toBe(true);
-    expect(result.payload?.sub).toBe('contract-test');
-
-    expect(stderr).toContain('Subject: contract-test');
-    expect(stderr).not.toContain(lines[0]);
-  }, 30_000);
-});

package/tests/security/accessControl.test.ts

@@ -1,223 +0,0 @@
-/**
- * SEC-AC — Access Control / Authorization
- * OWASP A01:2021 (Broken Access Control), API1/API5:2023 (BOLA/BFLA)
- *
- * Findings covered:
- *   H1 — REST /api/* routes bypass RBAC (authenticated but no permission check).
- *
- * These tests assert the SECURE behavior: every REST route is gated on the same
- * Permission.* bit as its MCP-tool twin, and a token lacking that bit is rejected
- * with 403 BEFORE any Home Assistant call is made.
- */
-
-import { describe, it, expect, vi } from 'vitest';
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { HaClient } from '../../src/haClient/index.js';
-import { Permission } from '../../src/permissions/index.js';
-import { requiredRestPermission, handleRestApi } from '../../src/server/http.js';
-import { handleEventSubscription, getClientCount } from '../../src/server/eventSubscription.js';
-import type { EventSubscriber } from '../../src/haClient/events.js';
-import type { AuthenticatedRequest } from '../../src/server/auth.js';
-
-/** Build a mock request carrying a permission mask in auth.extra. */
-function mockReq(
-  method: string,
-  url: string,
-  permissions: number,
-  body?: unknown
-): AuthenticatedRequest {
-  const listeners: Record<string, ((arg?: unknown) => void)[]> = {};
-  const req = {
-    method,
-    url,
-    headers: { host: 'mcp.test:3000' },
-    auth: { token: 't', clientId: 'u', scopes: [], extra: { permissions } },
-    on(event: string, cb: (arg?: unknown) => void) {
-      (listeners[event] ??= []).push(cb);
-      // Drive the body stream synchronously on the next tick for POST parseBody().
-      if (event === 'end') {
-        queueMicrotask(() => {
-          if (body !== undefined) {
-            for (const d of listeners['data'] ?? []) d(Buffer.from(JSON.stringify(body)));
-          }
-          for (const e of listeners['end'] ?? []) e();
-        });
-      }
-      return req;
-    },
-  } as unknown as AuthenticatedRequest;
-  return req;
-}
-
-/** Capture status code and JSON body written to the response. */
-function mockRes(): ServerResponse & { _status?: number; _body?: unknown } {
-  const res = {
-    statusCode: 200,
-    headersSent: false,
-    setHeader: vi.fn(),
-    end: vi.fn(function (this: { _body?: unknown }, payload?: unknown) {
-      if (typeof payload === 'string') {
-        try {
-          this._body = JSON.parse(payload);
-        } catch {
-          this._body = payload;
-        }
-      }
-      return this;
-    }),
-  } as unknown as ServerResponse & { _status?: number; _body?: unknown };
-  // mirror statusCode into _status when sendJson sets it
-  Object.defineProperty(res, '_status', {
-    get() {
-      return res.statusCode;
-    },
-    configurable: true,
-  });
-  return res;
-}
-
-describe('SEC-AC — Access Control', () => {
-  describe('H1: REST route → permission mapping (mirrors MCP-tool twins)', () => {
-    it('maps read routes to QUERY', () => {
-      expect(requiredRestPermission('GET', '/api/states')).toBe(Permission.QUERY);
-      expect(requiredRestPermission('GET', '/api/states/light.kitchen')).toBe(Permission.QUERY);
-      expect(requiredRestPermission('GET', '/api/sensors')).toBe(Permission.QUERY);
-      expect(requiredRestPermission('GET', '/api/entities/light')).toBe(Permission.QUERY);
-      expect(requiredRestPermission('GET', '/api/search')).toBe(Permission.QUERY);
-      expect(requiredRestPermission('GET', '/api/history/sensor.temp')).toBe(Permission.QUERY);
-      expect(requiredRestPermission('GET', '/api/version')).toBe(Permission.QUERY);
-    });
-
-    it('maps the service-call route to CONTROL', () => {
-      expect(requiredRestPermission('POST', '/api/services/light/turn_on')).toBe(Permission.CONTROL);
-    });
-
-    it('returns null for unknown routes (fall through to 404, no auth needed)', () => {
-      expect(requiredRestPermission('GET', '/api/unknown')).toBeNull();
-      expect(requiredRestPermission('DELETE', '/api/states')).toBeNull();
-    });
-  });
-
-  describe('H1: enforcement — insufficient permission is rejected with 403', () => {
-    it('blocks GET /api/states without QUERY and never calls the client', async () => {
-      const client = { getStates: vi.fn().mockResolvedValue([]) } as unknown as HaClient;
-      const req = mockReq('GET', '/api/states', Permission.CONTROL); // CONTROL, not QUERY
-      const res = mockRes();
-
-      await handleRestApi(req, res, '/api/states', client);
-
-      expect(res.statusCode).toBe(403);
-      expect(client.getStates).not.toHaveBeenCalled();
-    });
-
-    it('blocks POST /api/services without CONTROL and never calls the service', async () => {
-      const client = { callService: vi.fn().mockResolvedValue({ ok: true }) } as unknown as HaClient;
-      const req = mockReq('POST', '/api/services/light/turn_on', Permission.QUERY, {
-        entity_id: 'light.kitchen',
-      });
-      const res = mockRes();
-
-      await handleRestApi(req, res, '/api/services/light/turn_on', client);
-
-      expect(res.statusCode).toBe(403);
-      expect(client.callService).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('H1: enforcement — sufficient permission is allowed', () => {
-    it('allows GET /api/states with QUERY', async () => {
-      const client = { getStates: vi.fn().mockResolvedValue([{ entity_id: 'light.x' }]) } as unknown as HaClient;
-      const req = mockReq('GET', '/api/states', Permission.QUERY);
-      const res = mockRes();
-
-      await handleRestApi(req, res, '/api/states', client);
-
-      expect(res.statusCode).toBe(200);
-      expect(client.getStates).toHaveBeenCalledOnce();
-    });
-
-    it('allows POST /api/services with CONTROL', async () => {
-      const client = { callService: vi.fn().mockResolvedValue({ ok: true }) } as unknown as HaClient;
-      const req = mockReq('POST', '/api/services/light/turn_on', Permission.CONTROL, {
-        entity_id: 'light.kitchen',
-      });
-      const res = mockRes();
-
-      await handleRestApi(req, res, '/api/services/light/turn_on', client);
-
-      expect(res.statusCode).toBe(200);
-      expect(client.callService).toHaveBeenCalledOnce();
-    });
-
-    it('treats SUPERUSER (0xFF) as allowed everywhere', async () => {
-      const client = { getStates: vi.fn().mockResolvedValue([]) } as unknown as HaClient;
-      const req = mockReq('GET', '/api/states', 0xff);
-      const res = mockRes();
-
-      await handleRestApi(req, res, '/api/states', client);
-
-      expect(res.statusCode).toBe(200);
-    });
-  });
-
-  describe('L2: SSE /subscribe_events requires QUERY permission', () => {
-    /** Minimal SSE-capable response mock. */
-    function sseRes() {
-      return {
-        writableEnded: false,
-        writeHead: vi.fn(),
-        write: vi.fn(),
-        end: vi.fn(),
-      } as unknown as ServerResponse & { writeHead: ReturnType<typeof vi.fn> };
-    }
-
-    /** Request mock that captures the 'close' handler so we can tear down timers. */
-    function sseReq(permissions: number) {
-      const handlers: Record<string, (arg?: unknown) => void> = {};
-      const req = {
-        url: '/subscribe_events',
-        headers: {},
-        auth: { token: 't', clientId: 'u', scopes: [], extra: { permissions } },
-        on(event: string, cb: (arg?: unknown) => void) {
-          handlers[event] = cb;
-          return req;
-        },
-      } as unknown as AuthenticatedRequest;
-      return { req, handlers };
-    }
-
-    it('rejects a subscriber lacking QUERY with 403 and creates no client', async () => {
-      const before = getClientCount();
-      const { req } = sseReq(Permission.CONTROL); // CONTROL, not QUERY
-      const res = sseRes();
-      const subscriber = { isConnected: vi.fn() } as unknown as EventSubscriber;
-
-      await handleEventSubscription(req, res, subscriber);
-
-      expect(res.writeHead).toHaveBeenCalledWith(403, expect.anything());
-      expect(getClientCount()).toBe(before); // no leak
-      expect(subscriber.isConnected).not.toHaveBeenCalled();
-    });
-
-    it('allows a subscriber with QUERY to open the stream', async () => {
-      const { req, handlers } = sseReq(Permission.QUERY);
-      const res = sseRes();
-      const subscriber = {
-        isConnected: vi.fn().mockReturnValue(true),
-        subscribeEventType: vi.fn().mockResolvedValue('sub-1'),
-        unsubscribe: vi.fn().mockResolvedValue(undefined),
-      } as unknown as EventSubscriber;
-
-      await handleEventSubscription(req, res, subscriber);
-
-      // 200 stream opened, not 403
-      expect(res.writeHead).toHaveBeenCalledWith(200, expect.objectContaining({
-        'Content-Type': 'text/event-stream',
-      }));
-      expect(subscriber.subscribeEventType).toHaveBeenCalled();
-
-      // tear down the keep-alive interval the handler registered
-      handlers['close']?.();
-    });
-  });
-});

package/tests/security/authentication.test.ts

@@ -1,117 +0,0 @@
-/**
- * SEC-AUTHN — Authentication & Session
- * OWASP A07:2021 (Identification & Authentication Failures), API2:2023
- *
- * Findings covered:
- *   H3 — tokens without `exp` never expire; expiry is optional and unenforceable.
- *   M8 — JWT secret strength is not enforced at startup.
- *   L6 — no `iss` / `aud` / `nbf` / clock-skew validation.
- *
- * Secure behavior asserted here:
- *   - verifyJwt can REQUIRE exp (opt-in), validate nbf, and check iss/aud when configured.
- *   - The default (no options) stays backward-compatible: a token without exp is accepted.
- *   - loadConfig refuses a bearer secret shorter than 32 chars.
- */
-
-import { describe, it, expect } from 'vitest';
-import { createJwt, verifyJwt } from '../../src/utils/jwt.js';
-import { loadConfig } from '../../src/config.js';
-
-const SECRET = 'test-secret-key-32chars-minimum!';
-const now = () => Math.floor(Date.now() / 1000);
-
-describe('SEC-AUTHN — Authentication', () => {
-  describe('H3: enforce token expiry (opt-in via requireExp)', () => {
-    it('rejects a token without exp when requireExp is set', () => {
-      const token = createJwt({ sub: 'service' }, SECRET);
-      const result = verifyJwt(token, SECRET, { requireExp: true });
-      expect(result.valid).toBe(false);
-      expect(result.error).toMatch(/exp/i);
-    });
-
-    it('accepts a token with a future exp when requireExp is set', () => {
-      const token = createJwt({ sub: 'u', exp: now() + 3600 }, SECRET);
-      expect(verifyJwt(token, SECRET, { requireExp: true }).valid).toBe(true);
-    });
-
-    it('still rejects an expired token when requireExp is set', () => {
-      const token = createJwt({ sub: 'u', exp: now() - 100 }, SECRET);
-      expect(verifyJwt(token, SECRET, { requireExp: true }).valid).toBe(false);
-    });
-
-    it('default (no options) remains backward-compatible: accepts no-exp token', () => {
-      const token = createJwt({ sub: 'service' }, SECRET);
-      expect(verifyJwt(token, SECRET).valid).toBe(true);
-    });
-  });
-
-  describe('L6: nbf (not-before) validation', () => {
-    it('rejects a token whose nbf is in the future', () => {
-      const token = createJwt({ sub: 'u', nbf: now() + 3600 }, SECRET);
-      const result = verifyJwt(token, SECRET);
-      expect(result.valid).toBe(false);
-      expect(result.error).toMatch(/not yet valid|nbf/i);
-    });
-
-    it('accepts a token whose nbf is in the past', () => {
-      const token = createJwt({ sub: 'u', nbf: now() - 100 }, SECRET);
-      expect(verifyJwt(token, SECRET).valid).toBe(true);
-    });
-
-    it('tolerates small clock skew on nbf', () => {
-      const token = createJwt({ sub: 'u', nbf: now() + 30 }, SECRET);
-      expect(verifyJwt(token, SECRET, { clockSkewSec: 60 }).valid).toBe(true);
-    });
-  });
-
-  describe('L6: issuer / audience validation (only when configured)', () => {
-    it('rejects a token with the wrong issuer', () => {
-      const token = createJwt({ sub: 'u', iss: 'evil' }, SECRET);
-      const result = verifyJwt(token, SECRET, { issuer: 'mcp-ha-connect' });
-      expect(result.valid).toBe(false);
-      expect(result.error).toMatch(/issuer/i);
-    });
-
-    it('accepts a token with the expected issuer', () => {
-      const token = createJwt({ sub: 'u', iss: 'mcp-ha-connect' }, SECRET);
-      expect(verifyJwt(token, SECRET, { issuer: 'mcp-ha-connect' }).valid).toBe(true);
-    });
-
-    it('rejects a token whose audience does not match', () => {
-      const token = createJwt({ sub: 'u', aud: 'other' }, SECRET);
-      const result = verifyJwt(token, SECRET, { audience: 'mcp' });
-      expect(result.valid).toBe(false);
-      expect(result.error).toMatch(/audience/i);
-    });
-
-    it('accepts a token whose audience array contains the expected value', () => {
-      const token = createJwt({ sub: 'u', aud: ['mcp', 'other'] }, SECRET);
-      expect(verifyJwt(token, SECRET, { audience: 'mcp' }).valid).toBe(true);
-    });
-
-    it('ignores iss/aud when not configured (backward-compatible)', () => {
-      const token = createJwt({ sub: 'u', iss: 'whatever', aud: 'whatever' }, SECRET);
-      expect(verifyJwt(token, SECRET).valid).toBe(true);
-    });
-  });
-
-  describe('M8: bearer secret strength enforced at startup', () => {
-    const base = { MCP_SERVER_USE_HTTP: 'true', MCP_AUTH_METHOD: 'bearer' };
-
-    it('rejects a bearer secret shorter than 32 characters', () => {
-      expect(() =>
-        loadConfig({ ...base, MCP_AUTH_SECRET: 'too-short' } as NodeJS.ProcessEnv)
-      ).toThrow(/32|secret/i);
-    });
-
-    it('accepts a bearer secret of at least 32 characters', () => {
-      expect(() =>
-        loadConfig({ ...base, MCP_AUTH_SECRET: 'a'.repeat(32) } as NodeJS.ProcessEnv)
-      ).not.toThrow();
-    });
-
-    it('does not require a secret when auth method is none', () => {
-      expect(() => loadConfig({ MCP_AUTH_METHOD: 'none' } as NodeJS.ProcessEnv)).not.toThrow();
-    });
-  });
-});