@copilotkit/runtime 1.55.0-next.8 → 1.55.0

package/src/v2/runtime/__tests__/fetch-handler-validation.test.ts

@@ -0,0 +1,372 @@
+import { describe, it, expect, vi } from "vitest";
+import { createCopilotRuntimeHandler } from "../core/fetch-handler";
+import { CopilotRuntime } from "../core/runtime";
+import type { AbstractAgent } from "@ag-ui/client";
+
+/* ------------------------------------------------------------------------------------------------
+ * Helpers
+ * --------------------------------------------------------------------------------------------- */
+
+const createMockAgent = () => {
+  const agent: unknown = {
+    execute: vi.fn().mockResolvedValue({ events: [] }),
+  };
+  (agent as { clone: () => unknown }).clone = () => createMockAgent();
+  return agent as AbstractAgent;
+};
+
+const createRuntime = (
+  agents: Record<string, AbstractAgent> = { default: createMockAgent() },
+) => new CopilotRuntime({ agents });
+
+const post = (url: string, body?: unknown) =>
+  new Request(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+
+/* ------------------------------------------------------------------------------------------------
+ * Single-route: malformed JSON
+ * --------------------------------------------------------------------------------------------- */
+
+describe("fetch-handler validation — single-route malformed input", () => {
+  const runtime = createRuntime();
+  const handler = createCopilotRuntimeHandler({
+    runtime,
+    basePath: "/api",
+    mode: "single-route",
+  });
+
+  it("returns 400 for completely invalid JSON body", async () => {
+    const request = new Request("http://localhost/api", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "not valid json{{{",
+    });
+    const response = await handler(request);
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body).toHaveProperty("error");
+  });
+
+  it("returns 400 for empty string body", async () => {
+    const request = new Request("http://localhost/api", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: "",
+    });
+    const response = await handler(request);
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 415 for no Content-Type header", async () => {
+    const request = new Request("http://localhost/api", {
+      method: "POST",
+      body: JSON.stringify({ method: "info" }),
+    });
+    const response = await handler(request);
+    expect(response.status).toBe(415);
+  });
+
+  it("returns 415 for text/plain Content-Type", async () => {
+    const request = new Request("http://localhost/api", {
+      method: "POST",
+      headers: { "Content-Type": "text/plain" },
+      body: JSON.stringify({ method: "info" }),
+    });
+    const response = await handler(request);
+    expect(response.status).toBe(415);
+  });
+
+  it("accepts application/json with charset", async () => {
+    const request = new Request("http://localhost/api", {
+      method: "POST",
+      headers: { "Content-Type": "application/json; charset=utf-8" },
+      body: JSON.stringify({ method: "info" }),
+    });
+    const response = await handler(request);
+    expect(response.status).toBe(200);
+  });
+
+  it("returns 400 when method is null", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: null }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 when method is a number", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: 42 }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 when method is wrong case (INFO vs info)", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: "INFO" }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 for typo in method name", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: "agent/rn" }),
+    );
+    expect(response.status).toBe(400);
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * Single-route: missing required params
+ * --------------------------------------------------------------------------------------------- */
+
+describe("fetch-handler validation — single-route missing params", () => {
+  const runtime = createRuntime();
+  const handler = createCopilotRuntimeHandler({
+    runtime,
+    basePath: "/api",
+    mode: "single-route",
+  });
+
+  it("returns 400 for agent/run without agentId param", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/run",
+        params: {},
+        body: { threadId: "t1", runId: "r1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.message).toContain("agentId");
+  });
+
+  it("returns 400 for agent/run with empty agentId", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/run",
+        params: { agentId: "" },
+        body: { threadId: "t1", runId: "r1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 for agent/run with whitespace-only agentId", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/run",
+        params: { agentId: "   " },
+        body: { threadId: "t1", runId: "r1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 for agent/run with no params at all", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/run",
+        body: { threadId: "t1", runId: "r1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 for agent/connect without agentId param", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/connect",
+        params: {},
+        body: { threadId: "t1", runId: "r1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.message).toContain("agentId");
+  });
+
+  it("returns 400 for agent/stop without agentId param", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/stop",
+        params: { threadId: "t1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.message).toContain("agentId");
+  });
+
+  it("returns 400 for agent/stop without threadId param", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/stop",
+        params: { agentId: "default" },
+      }),
+    );
+    expect(response.status).toBe(400);
+    const body = await response.json();
+    expect(body.message).toContain("threadId");
+  });
+
+  it("returns 400 for agent/stop with no params", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: "agent/stop" }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("returns 400 for agent/run with non-string agentId", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "agent/run",
+        params: { agentId: 123 },
+        body: { threadId: "t1", runId: "r1" },
+      }),
+    );
+    expect(response.status).toBe(400);
+  });
+
+  it("info method works without params", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: "info" }),
+    );
+    expect(response.status).toBe(200);
+    const body = await response.json();
+    expect(body).toHaveProperty("version");
+  });
+
+  it("transcribe method without body returns 400 (body required for transcribe)", async () => {
+    const response = await handler(
+      post("http://localhost/api", { method: "transcribe" }),
+    );
+    // In single-route mode, transcribe requires a body via createJsonRequest
+    expect(response.status).toBe(400);
+  });
+
+  it("transcribe method with body dispatches correctly", async () => {
+    const response = await handler(
+      post("http://localhost/api", {
+        method: "transcribe",
+        body: { audio: "data" },
+      }),
+    );
+    // Route matched — not a param validation error
+    expect(response.status).not.toBe(400);
+  });
+});
+
+/* ------------------------------------------------------------------------------------------------
+ * Multi-route: edge cases
+ * --------------------------------------------------------------------------------------------- */
+
+describe("fetch-handler validation — multi-route edge cases", () => {
+  const runtime = createRuntime();
+
+  it("handles request with no body on a POST route gracefully", async () => {
+    const handler = createCopilotRuntimeHandler({
+      runtime,
+      basePath: "/api",
+    });
+    const request = new Request("http://localhost/api/agent/default/run", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+    });
+    const response = await handler(request);
+    // Should not crash — may return 400 or 500 but not a Node crash
+    expect(response).toBeInstanceOf(Response);
+    expect(response.status).toBeGreaterThanOrEqual(400);
+  });
+
+  it("CORS headers present on error responses too", async () => {
+    const handler = createCopilotRuntimeHandler({
+      runtime,
+      basePath: "/api",
+      cors: true,
+    });
+    const response = await handler(
+      new Request("http://localhost/api/unknown", { method: "GET" }),
+    );
+    expect(response.status).toBe(404);
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+  });
+
+  it("CORS headers present on 405 responses", async () => {
+    const handler = createCopilotRuntimeHandler({
+      runtime,
+      basePath: "/api",
+      cors: true,
+    });
+    const response = await handler(
+      new Request("http://localhost/api/info", { method: "POST" }),
+    );
+    expect(response.status).toBe(405);
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+  });
+
+  it("CORS headers present on 500 error responses", async () => {
+    const agent: unknown = {
+      execute: vi.fn().mockRejectedValue(new Error("boom")),
+      clone: () => agent,
+    };
+    const errorRuntime = createRuntime({ default: agent as AbstractAgent });
+    const handler = createCopilotRuntimeHandler({
+      runtime: errorRuntime,
+      basePath: "/api",
+      cors: true,
+    });
+
+    const response = await handler(
+      post("http://localhost/api/agent/default/run", {
+        threadId: "t1",
+        runId: "r1",
+      }),
+    );
+    expect(response).toBeInstanceOf(Response);
+    expect(response.headers.get("Access-Control-Allow-Origin")).toBe("*");
+  });
+
+  it("error response does not leak error details to clients", async () => {
+    const handler = createCopilotRuntimeHandler({
+      runtime,
+      basePath: "/api",
+      hooks: {
+        onRequest: () => {
+          throw new Error("sensitive internal detail: /home/user/db.sqlite");
+        },
+      },
+    });
+
+    const response = await handler(
+      new Request("http://localhost/api/info", { method: "GET" }),
+    );
+    expect(response.status).toBe(500);
+    const body = await response.json();
+    expect(body.error).toBe("internal_error");
+    // Error message should NOT be exposed to the client
+    expect(body.message).toBeUndefined();
+  });
+
+  it("error response returns internal_error for non-Error throws", async () => {
+    const handler = createCopilotRuntimeHandler({
+      runtime,
+      basePath: "/api",
+      hooks: {
+        onRequest: () => {
+          throw "string error";
+        },
+      },
+    });
+
+    const response = await handler(
+      new Request("http://localhost/api/info", { method: "GET" }),
+    );
+    expect(response.status).toBe(500);
+    const body = await response.json();
+    expect(body.error).toBe("internal_error");
+    expect(body.message).toBeUndefined();
+  });
+});