@creedspace/sdk 1.0.0

package/src/index.test.ts

@@ -0,0 +1,400 @@
+/**
+ * Creed Space SDK Tests
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import {
+  createClient,
+  CreedError,
+  computeArgsHash,
+  isTokenExpired,
+  type DecideRequest,
+  type AllowDecision,
+  type DenyDecision,
+} from './index';
+
+// Mock fetch for testing
+const mockFetch = vi.fn();
+
+describe('createClient', () => {
+  beforeEach(() => {
+    mockFetch.mockClear();
+  });
+
+  it('throws error if API key is missing', () => {
+    expect(() => createClient({ apiKey: '' })).toThrow(CreedError);
+    expect(() => createClient({ apiKey: '' })).toThrow('API key is required');
+  });
+
+  it('creates client with valid API key', () => {
+    const client = createClient({ apiKey: 'crd_test_123' });
+    expect(client).toBeDefined();
+    expect(client.decide).toBeDefined();
+    expect(client.authorize).toBeDefined();
+    expect(client.audit).toBeDefined();
+    expect(client.status).toBeDefined();
+  });
+
+  it('uses default baseUrl when not specified', () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetch,
+    });
+
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ service: 'creed-pdp', version: '1.0.0' }),
+    });
+
+    client.status();
+
+    expect(mockFetch).toHaveBeenCalledWith(
+      'https://api.creed.space/v1/status',
+      expect.any(Object)
+    );
+  });
+
+  it('uses custom baseUrl when specified', () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      baseUrl: 'https://custom.api.com',
+      fetch: mockFetch,
+    });
+
+    mockFetch.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve({ service: 'creed-pdp' }),
+    });
+
+    client.status();
+
+    expect(mockFetch).toHaveBeenCalledWith(
+      'https://custom.api.com/v1/status',
+      expect.any(Object)
+    );
+  });
+});
+
+describe('client.decide', () => {
+  const mockFetchLocal = vi.fn();
+
+  beforeEach(() => {
+    mockFetchLocal.mockClear();
+  });
+
+  it('sends correct request format', async () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    const allowResponse: AllowDecision = {
+      decision: 'ALLOW',
+      runId: 'run_123',
+      actionId: 'action_456',
+      toolCallId: 'tc_789',
+      argsHash: 'sha256:abc123',
+      risk: { score: 0.1, labels: [] },
+      decisionToken: 'eyJ...',
+      expiresAt: '2025-01-01T00:05:00Z',
+    };
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve(allowResponse),
+    });
+
+    await client.decide({
+      toolName: 'send_email',
+      arguments: { to: 'user@example.com' },
+    });
+
+    expect(mockFetchLocal).toHaveBeenCalledWith(
+      'https://api.creed.space/v1/decide',
+      expect.objectContaining({
+        method: 'POST',
+        headers: expect.objectContaining({
+          'Content-Type': 'application/json',
+          Authorization: 'Bearer crd_test_123',
+          'X-Creed-SDK': 'typescript/1.0.0',
+        }),
+      })
+    );
+
+    const callBody = JSON.parse(mockFetchLocal.mock.calls[0][1].body);
+    expect(callBody).toEqual({
+      tool_name: 'send_email',
+      arguments: { to: 'user@example.com' },
+      constitution_id: 'default',
+      context: {},
+    });
+  });
+
+  it('invokes onAllow callback for ALLOW decision', async () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    const allowResponse: AllowDecision = {
+      decision: 'ALLOW',
+      runId: 'run_123',
+      actionId: 'action_456',
+      toolCallId: 'tc_789',
+      argsHash: 'sha256:abc123',
+      risk: { score: 0.1, labels: [] },
+      decisionToken: 'eyJ...',
+      expiresAt: '2025-01-01T00:05:00Z',
+    };
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve(allowResponse),
+    });
+
+    const onAllow = vi.fn();
+    const onDeny = vi.fn();
+
+    await client.decide({
+      toolName: 'send_email',
+      arguments: { to: 'user@example.com' },
+      onAllow,
+      onDeny,
+    });
+
+    expect(onAllow).toHaveBeenCalledWith(allowResponse);
+    expect(onDeny).not.toHaveBeenCalled();
+  });
+
+  it('invokes onDeny callback for DENY decision', async () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    const denyResponse: DenyDecision = {
+      decision: 'DENY',
+      runId: 'run_123',
+      actionId: 'action_456',
+      toolCallId: 'tc_789',
+      argsHash: 'sha256:abc123',
+      risk: { score: 0.9, labels: ['high_risk'] },
+      reasons: ['Tool not allowed by constitution'],
+      guidance: {
+        message: 'This tool is blocked',
+        suggestion: 'Use a different approach',
+      },
+    };
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve(denyResponse),
+    });
+
+    const onAllow = vi.fn();
+    const onDeny = vi.fn();
+
+    await client.decide({
+      toolName: 'delete_all',
+      arguments: {},
+      onAllow,
+      onDeny,
+    });
+
+    expect(onDeny).toHaveBeenCalledWith(denyResponse);
+    expect(onAllow).not.toHaveBeenCalled();
+  });
+
+  it('returns result even without callbacks', async () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    const allowResponse: AllowDecision = {
+      decision: 'ALLOW',
+      runId: 'run_123',
+      actionId: 'action_456',
+      toolCallId: 'tc_789',
+      argsHash: 'sha256:abc123',
+      risk: { score: 0.1, labels: [] },
+      decisionToken: 'eyJ...',
+      expiresAt: '2025-01-01T00:05:00Z',
+    };
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: true,
+      json: () => Promise.resolve(allowResponse),
+    });
+
+    const result = await client.decide({
+      toolName: 'send_email',
+      arguments: { to: 'user@example.com' },
+    });
+
+    expect(result).toEqual(allowResponse);
+  });
+});
+
+describe('client.authorize', () => {
+  const mockFetchLocal = vi.fn();
+
+  it('sends correct authorization request', async () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          authorized: true,
+          claims: {
+            actionId: 'action_456',
+            toolName: 'send_email',
+            toolCallId: 'tc_789',
+            argsHash: 'sha256:abc123',
+            runId: 'run_123',
+            decision: 'ALLOW',
+            issuedAt: '2025-01-01T00:00:00Z',
+            expiresAt: '2025-01-01T00:05:00Z',
+          },
+          message: 'Token is valid',
+        }),
+    });
+
+    const result = await client.authorize({
+      decisionToken: 'eyJ...',
+      toolName: 'send_email',
+    });
+
+    expect(result.authorized).toBe(true);
+    expect(result.claims?.toolName).toBe('send_email');
+  });
+});
+
+describe('client.audit', () => {
+  const mockFetchLocal = vi.fn();
+
+  it('sends correct audit request', async () => {
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: true,
+      json: () =>
+        Promise.resolve({
+          runId: 'run_123',
+          eventCount: 2,
+          events: [
+            { seq: 0, type: 'action_created', timestamp: '2025-01-01T00:00:00Z', data: {}, hash: 'abc' },
+            { seq: 1, type: 'decision_made', timestamp: '2025-01-01T00:00:01Z', data: {}, hash: 'def' },
+          ],
+          integrity: { chain: 'sha256:...', verified: true },
+        }),
+    });
+
+    const result = await client.audit({
+      runId: 'run_123',
+      limit: 10,
+    });
+
+    expect(result.runId).toBe('run_123');
+    expect(result.events).toHaveLength(2);
+    expect(result.integrity.verified).toBe(true);
+  });
+});
+
+describe('error handling', () => {
+  it('throws CreedError on non-OK response', async () => {
+    const mockFetchLocal = vi.fn();
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    mockFetchLocal.mockResolvedValueOnce({
+      ok: false,
+      status: 401,
+      text: () => Promise.resolve('Unauthorized'),
+    });
+
+    try {
+      await client.status();
+      expect.fail('Should have thrown');
+    } catch (error) {
+      expect(error).toBeInstanceOf(CreedError);
+      expect((error as CreedError).code).toBe('REQUEST_FAILED');
+      expect((error as CreedError).statusCode).toBe(401);
+    }
+  });
+
+  it('throws CreedError on network error', async () => {
+    const mockFetchLocal = vi.fn();
+    const client = createClient({
+      apiKey: 'crd_test_123',
+      fetch: mockFetchLocal,
+    });
+
+    mockFetchLocal.mockRejectedValueOnce(new Error('Network failure'));
+
+    try {
+      await client.status();
+      expect.fail('Should have thrown');
+    } catch (error) {
+      expect(error).toBeInstanceOf(CreedError);
+      expect((error as CreedError).code).toBe('NETWORK_ERROR');
+    }
+  });
+});
+
+describe('computeArgsHash', () => {
+  it('produces consistent hash for same arguments', async () => {
+    const args = { to: 'user@example.com', subject: 'Hello' };
+    const hash1 = await computeArgsHash(args);
+    const hash2 = await computeArgsHash(args);
+    expect(hash1).toBe(hash2);
+  });
+
+  it('produces different hash for different arguments', async () => {
+    const hash1 = await computeArgsHash({ a: 1 });
+    const hash2 = await computeArgsHash({ a: 2 });
+    expect(hash1).not.toBe(hash2);
+  });
+
+  it('hash starts with sha256: prefix', async () => {
+    const hash = await computeArgsHash({ test: true });
+    expect(hash.startsWith('sha256:')).toBe(true);
+  });
+
+  it('produces canonical hash regardless of key order', async () => {
+    const hash1 = await computeArgsHash({ a: 1, b: 2 });
+    const hash2 = await computeArgsHash({ b: 2, a: 1 });
+    expect(hash1).toBe(hash2);
+  });
+});
+
+describe('isTokenExpired', () => {
+  it('returns true for malformed tokens', () => {
+    expect(isTokenExpired('')).toBe(true);
+    expect(isTokenExpired('invalid')).toBe(true);
+    expect(isTokenExpired('a.b')).toBe(true);
+  });
+
+  it('returns true for expired tokens', () => {
+    // Create a JWT with expired timestamp
+    const payload = { exp: Math.floor(Date.now() / 1000) - 3600 }; // 1 hour ago
+    const fakeToken = `header.${btoa(JSON.stringify(payload))}.signature`;
+    expect(isTokenExpired(fakeToken)).toBe(true);
+  });
+
+  it('returns false for valid tokens', () => {
+    // Create a JWT with future timestamp
+    const payload = { exp: Math.floor(Date.now() / 1000) + 3600 }; // 1 hour from now
+    const fakeToken = `header.${btoa(JSON.stringify(payload))}.signature`;
+    expect(isTokenExpired(fakeToken)).toBe(false);
+  });
+});