@digital-science-dsl/dimensions-analytics-mcp 0.5.3

package/test/client/integration/auth-providers.integration.test.ts

@@ -0,0 +1,186 @@
+/**
+ * Integration tests for auth providers.
+ * Tests against real APIs using credentials from .dimensions.config.json
+ *
+ * @module core/test/integration/auth-providers
+ */
+
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { beforeAll, describe, expect, it } from "vitest";
+import { withCaching } from "../../../src/client/auth/decorators/with-caching.js";
+import { createAuthProvider } from "../../../src/client/auth/factory.js";
+import { JwtAuthProvider } from "../../../src/client/auth/providers/jwt-auth-provider.js";
+import type { JwtAuthConfig } from "../../../src/client/auth/types.js";
+
+interface DslConfig {
+  apiKey: string;
+  baseUrl: string;
+}
+
+interface ConfigFile {
+  dsl?: DslConfig;
+}
+
+/**
+ * Load test configuration from .dimensions.config.json
+ */
+function loadConfig(): DslConfig | null {
+  const configPath = path.resolve(process.cwd(), ".dimensions.config.json");
+
+  if (!fs.existsSync(configPath)) {
+    return null;
+  }
+
+  const content = fs.readFileSync(configPath, "utf-8");
+  const parsed = JSON.parse(content) as ConfigFile;
+
+  if (parsed.dsl?.apiKey && parsed.dsl?.baseUrl) {
+    return parsed.dsl;
+  }
+
+  return null;
+}
+
+describe("Auth Providers Integration Tests", () => {
+  let config: DslConfig | null;
+
+  beforeAll(() => {
+    config = loadConfig();
+  });
+
+  describe("JWT Provider", () => {
+    it.skipIf(!loadConfig())("authenticates against real Dimensions API", async () => {
+      const jwtConfig: JwtAuthConfig = {
+        type: "jwt",
+        apiKey: config!.apiKey,
+        authUrl: `${config!.baseUrl}/api/auth.json`,
+      };
+
+      const provider = new JwtAuthProvider(jwtConfig);
+      const headers = await provider.getHeaders();
+
+      expect(headers).toHaveProperty("Authorization");
+      expect(headers.Authorization).toMatch(/^JWT /);
+      // Token should be a non-empty string
+      expect(headers.Authorization.length).toBeGreaterThan(4);
+    });
+
+    it.skipIf(!loadConfig())("token format is valid JWT", async () => {
+      const jwtConfig: JwtAuthConfig = {
+        type: "jwt",
+        apiKey: config!.apiKey,
+        authUrl: `${config!.baseUrl}/api/auth.json`,
+      };
+
+      const provider = new JwtAuthProvider(jwtConfig);
+      const headers = await provider.getHeaders();
+
+      const token = headers.Authorization.replace("JWT ", "");
+      // JWT tokens have 3 parts separated by dots
+      const parts = token.split(".");
+      expect(parts.length).toBe(3);
+    });
+
+    it.skipIf(!loadConfig())("refresh fetches a new token", async () => {
+      const jwtConfig: JwtAuthConfig = {
+        type: "jwt",
+        apiKey: config!.apiKey,
+        authUrl: `${config!.baseUrl}/api/auth.json`,
+      };
+
+      const provider = new JwtAuthProvider(jwtConfig);
+
+      // Get initial token
+      const headers1 = await provider.getHeaders();
+      const token1 = headers1.Authorization;
+
+      // Force refresh
+      await provider.refresh();
+
+      // Get new token
+      const headers2 = await provider.getHeaders();
+      const token2 = headers2.Authorization;
+
+      // Both should be valid JWT format
+      expect(token1).toMatch(/^JWT /);
+      expect(token2).toMatch(/^JWT /);
+      // Tokens might be different (depends on server implementation)
+      // but at least both calls should succeed
+    });
+
+    it.skipIf(!loadConfig())("invalidate clears state and forces refresh", async () => {
+      const jwtConfig: JwtAuthConfig = {
+        type: "jwt",
+        apiKey: config!.apiKey,
+        authUrl: `${config!.baseUrl}/api/auth.json`,
+      };
+
+      const provider = new JwtAuthProvider(jwtConfig);
+
+      // Get initial token
+      await provider.getHeaders();
+
+      // Invalidate
+      provider.invalidate();
+
+      // Should be able to get headers again after invalidation
+      const headers = await provider.getHeaders();
+      expect(headers.Authorization).toMatch(/^JWT /);
+    });
+  });
+
+  describe("JWT Provider with Caching", () => {
+    it.skipIf(!loadConfig())("caches token and reuses it", async () => {
+      const jwtConfig: JwtAuthConfig = {
+        type: "jwt",
+        apiKey: config!.apiKey,
+        authUrl: `${config!.baseUrl}/api/auth.json`,
+      };
+
+      const baseProvider = new JwtAuthProvider(jwtConfig);
+      const cachedProvider = withCaching(baseProvider, {
+        cacheDurationMs: 300000, // 5 minutes
+      });
+
+      // First call - should hit the API
+      const start1 = Date.now();
+      const headers1 = await cachedProvider.getHeaders();
+      const duration1 = Date.now() - start1;
+
+      // Second call - should be instant from cache
+      const start2 = Date.now();
+      const headers2 = await cachedProvider.getHeaders();
+      const duration2 = Date.now() - start2;
+
+      // Both should return same token
+      expect(headers1.Authorization).toBe(headers2.Authorization);
+
+      // Second call should be significantly faster (cached)
+      // First call involves network, second should be < 5ms
+      expect(duration2).toBeLessThan(duration1);
+      expect(duration2).toBeLessThan(10); // Cached response should be very fast
+    });
+  });
+
+  describe("createAuthProvider factory", () => {
+    it.skipIf(!loadConfig())("creates working JWT provider with caching", async () => {
+      const provider = createAuthProvider({
+        type: "jwt",
+        apiKey: config!.apiKey,
+        authUrl: `${config!.baseUrl}/api/auth.json`,
+      });
+
+      expect(provider.type).toBe("jwt");
+
+      const headers = await provider.getHeaders();
+      expect(headers.Authorization).toMatch(/^JWT /);
+
+      // Verify caching is applied - second call should be very fast
+      const start = Date.now();
+      await provider.getHeaders();
+      const duration = Date.now() - start;
+      expect(duration).toBeLessThan(10);
+    });
+  });
+});

package/test/client/internal-dsl-client.test.ts

@@ -0,0 +1,76 @@
+/**
+ * Tests for internal dsl-service client.
+ * @module test/client/internal-dsl-client
+ */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { QuerySyntaxError } from "../../src/client/errors.js";
+import { InternalDslClient } from "../../src/client/internal-dsl-client.js";
+import { mockFetchJson } from "./helpers/mock-fetch.js";
+
+const CONFIG = {
+  serviceUrl: "https://dsl.example.com",
+  username: "svc",
+  password: "secret",
+  dslSchema: "external",
+  host: "app.example.com",
+  variant: "standard",
+};
+
+describe("InternalDslClient", () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    vi.restoreAllMocks();
+  });
+
+  it("posts JSON query with service auth and user header", async () => {
+    const responseBody = { publications: [] };
+    const mock = mockFetchJson(responseBody);
+
+    const client = new InternalDslClient({
+      config: CONFIG,
+      userEmail: "user@example.com",
+      clientIp: "198.51.100.4",
+    });
+
+    const result = await client.query("search publications return publications limit 1");
+
+    expect(result).toEqual(responseBody);
+    expect(mock).toHaveBeenCalledWith(
+      "https://dsl.example.com/query",
+      expect.objectContaining({
+        method: "POST",
+        headers: expect.objectContaining({
+          "Content-Type": "application/json",
+          "X-DIMENSIONS-USER": "user@example.com",
+          "X-Forwarded-For": "198.51.100.4",
+          Authorization: `Basic ${Buffer.from("svc:secret").toString("base64")}`,
+        }),
+        body: JSON.stringify({
+          query: "search publications return publications limit 1",
+          dsl_schema: "external",
+          host: "app.example.com",
+          variant: "standard",
+          additional_logging_info: {
+            user: "user@example.com",
+            product_variant: "standard",
+            source: "dimensions-analytics-mcp-hosted",
+          },
+        }),
+      }),
+    );
+  });
+
+  it("maps 400 responses to QuerySyntaxError", async () => {
+    mockFetchJson({ error: "syntax error" }, { ok: false, status: 400 });
+
+    const client = new InternalDslClient({
+      config: CONFIG,
+      userEmail: "user@example.com",
+    });
+
+    await expect(client.query("bad query")).rejects.toBeInstanceOf(QuerySyntaxError);
+  });
+});

package/test/client/rate-limiter.test.ts

@@ -0,0 +1,204 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { RateLimiter } from "../../src/client/rate-limiter.js";
+
+describe("RateLimiter", () => {
+  let limiter: RateLimiter;
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    limiter = new RateLimiter({ maxRequests: 3, windowMs: 1000 });
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe("constructor validation", () => {
+    it("throws on zero maxRequests", () => {
+      expect(() => new RateLimiter({ maxRequests: 0, windowMs: 1000 })).toThrow(
+        "maxRequests must be positive",
+      );
+    });
+
+    it("throws on negative maxRequests", () => {
+      expect(() => new RateLimiter({ maxRequests: -1, windowMs: 1000 })).toThrow(
+        "maxRequests must be positive",
+      );
+    });
+
+    it("throws on zero windowMs", () => {
+      expect(() => new RateLimiter({ maxRequests: 3, windowMs: 0 })).toThrow(
+        "windowMs must be positive",
+      );
+    });
+
+    it("throws on negative windowMs", () => {
+      expect(() => new RateLimiter({ maxRequests: 3, windowMs: -100 })).toThrow(
+        "windowMs must be positive",
+      );
+    });
+  });
+
+  it("allows requests under limit", () => {
+    expect(limiter.canMakeRequest()).toBe(true);
+    limiter.recordRequest();
+    expect(limiter.canMakeRequest()).toBe(true);
+    limiter.recordRequest();
+    expect(limiter.canMakeRequest()).toBe(true);
+  });
+
+  it("blocks requests over limit", () => {
+    limiter.recordRequest();
+    limiter.recordRequest();
+    limiter.recordRequest();
+    expect(limiter.canMakeRequest()).toBe(false);
+  });
+
+  it("returns remaining requests", () => {
+    expect(limiter.getRemainingRequests()).toBe(3);
+    limiter.recordRequest();
+    expect(limiter.getRemainingRequests()).toBe(2);
+  });
+
+  it("resets after window expires", () => {
+    limiter.recordRequest();
+    limiter.recordRequest();
+    limiter.recordRequest();
+    expect(limiter.canMakeRequest()).toBe(false);
+
+    vi.advanceTimersByTime(1100);
+    expect(limiter.canMakeRequest()).toBe(true);
+  });
+
+  describe("waitIfNeeded", () => {
+    it("resolves immediately when under limit", async () => {
+      await limiter.waitIfNeeded();
+      // No timer advancement needed — resolves synchronously when under limit
+    });
+
+    it("waits when rate limited", async () => {
+      const fastLimiter = new RateLimiter({ maxRequests: 2, windowMs: 200 });
+      fastLimiter.recordRequest();
+      fastLimiter.recordRequest();
+
+      const promise = fastLimiter.waitIfNeeded();
+      vi.advanceTimersByTime(200);
+      await promise;
+
+      // After waiting, a new slot should be available
+      expect(fastLimiter.canMakeRequest()).toBe(true);
+    });
+  });
+
+  describe("getRetryDelayMs", () => {
+    it("returns minimum slot spacing when under limit", () => {
+      // 30 req/min → ~2000ms spacing + 50ms buffer
+      const apiLimiter = new RateLimiter({ maxRequests: 30, windowMs: 60_000 });
+      expect(apiLimiter.getRetryDelayMs()).toBe(2050);
+    });
+
+    it("returns time until oldest request expires when at limit", () => {
+      const fastLimiter = new RateLimiter({ maxRequests: 2, windowMs: 200 });
+      fastLimiter.recordRequest();
+      fastLimiter.recordRequest();
+
+      const delay = fastLimiter.getRetryDelayMs();
+      expect(delay).toBeGreaterThan(50);
+      expect(delay).toBeLessThanOrEqual(250);
+    });
+  });
+
+  describe("getTimeUntilNextSlot", () => {
+    it("returns 0 when under limit", () => {
+      expect(limiter.getTimeUntilNextSlot()).toBe(0);
+    });
+
+    it("returns time until oldest request expires", () => {
+      limiter.recordRequest();
+      limiter.recordRequest();
+      limiter.recordRequest();
+
+      const waitTime = limiter.getTimeUntilNextSlot();
+      expect(waitTime).toBeGreaterThan(0);
+      expect(waitTime).toBeLessThanOrEqual(1000);
+    });
+
+    it("returns 0 after window has passed", () => {
+      limiter.recordRequest();
+      limiter.recordRequest();
+      limiter.recordRequest();
+
+      vi.advanceTimersByTime(1100);
+
+      expect(limiter.getTimeUntilNextSlot()).toBe(0);
+    });
+  });
+
+  describe("reset", () => {
+    it("clears all timestamps", () => {
+      limiter.recordRequest();
+      limiter.recordRequest();
+      limiter.recordRequest();
+
+      expect(limiter.canMakeRequest()).toBe(false);
+
+      limiter.reset();
+
+      expect(limiter.canMakeRequest()).toBe(true);
+      expect(limiter.getRemainingRequests()).toBe(3);
+    });
+
+    it("allows fresh rate limiting after reset", () => {
+      limiter.recordRequest();
+      limiter.recordRequest();
+      limiter.reset();
+
+      limiter.recordRequest();
+      limiter.recordRequest();
+      limiter.recordRequest();
+
+      expect(limiter.canMakeRequest()).toBe(false);
+      expect(limiter.getRemainingRequests()).toBe(0);
+    });
+  });
+
+  describe("edge cases", () => {
+    it("handles rapid sequential requests", () => {
+      for (let i = 0; i < 3; i++) {
+        expect(limiter.canMakeRequest()).toBe(true);
+        limiter.recordRequest();
+      }
+      expect(limiter.canMakeRequest()).toBe(false);
+    });
+
+    it("handles partial window expiration", () => {
+      // Record first request at time 0
+      limiter.recordRequest();
+      expect(limiter.getRemainingRequests()).toBe(2);
+
+      // Advance to time 500ms, record second request
+      vi.advanceTimersByTime(500);
+      limiter.recordRequest();
+      expect(limiter.getRemainingRequests()).toBe(1);
+
+      // Advance to time 600ms, record third request
+      vi.advanceTimersByTime(100);
+      limiter.recordRequest();
+      expect(limiter.getRemainingRequests()).toBe(0);
+      expect(limiter.canMakeRequest()).toBe(false);
+
+      // Advance to time 1100ms - first request (at time 0) should now be expired
+      vi.advanceTimersByTime(500);
+      expect(limiter.canMakeRequest()).toBe(true);
+      expect(limiter.getRemainingRequests()).toBe(1);
+    });
+
+    it("never returns negative remaining requests", () => {
+      limiter.recordRequest();
+      limiter.recordRequest();
+      limiter.recordRequest();
+
+      expect(limiter.getRemainingRequests()).toBeGreaterThanOrEqual(0);
+    });
+  });
+});

package/test/client/resolve-api-key-user.test.ts

@@ -0,0 +1,87 @@
+/**
+ * Tests for API key user resolution via Radar auth.json.
+ * @module test/client/resolve-api-key-user
+ */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { AuthenticationError } from "../../src/client/errors.js";
+import {
+  JWT_API_KEY_SUB_PREFIX,
+  parseBearerToken,
+  resolveUserFromApiKey,
+} from "../../src/client/resolve-api-key-user.js";
+import { mockFetchJson } from "./helpers/mock-fetch.js";
+
+function jwtWithSub(sub: string): string {
+  const header = Buffer.from(JSON.stringify({ alg: "HS256" })).toString("base64url");
+  const payload = Buffer.from(JSON.stringify({ sub })).toString("base64url");
+  return `${header}.${payload}.signature`;
+}
+
+describe("parseBearerToken", () => {
+  it("extracts token from Bearer header", () => {
+    expect(parseBearerToken("Bearer abc123")).toBe("abc123");
+  });
+
+  it("throws when header is missing", () => {
+    expect(() => parseBearerToken(undefined)).toThrow(AuthenticationError);
+  });
+
+  it("throws when header is not Bearer", () => {
+    expect(() => parseBearerToken("Basic abc")).toThrow(AuthenticationError);
+  });
+});
+
+describe("resolveUserFromApiKey", () => {
+  const originalFetch = globalThis.fetch;
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch;
+    vi.restoreAllMocks();
+  });
+
+  it("returns user email from JWT sub claim", async () => {
+    const token = jwtWithSub("user@example.com");
+    const mock = mockFetchJson({ token });
+
+    const email = await resolveUserFromApiKey({
+      apiKey: "user-key",
+      authUrl: "https://app.example.com",
+      clientIp: "203.0.113.10",
+    });
+
+    expect(email).toBe("user@example.com");
+    expect(mock).toHaveBeenCalledWith(
+      "https://app.example.com/api/auth.json",
+      expect.objectContaining({
+        method: "POST",
+        headers: expect.objectContaining({
+          "X-Forwarded-For": "203.0.113.10",
+        }),
+        body: JSON.stringify({ key: "user-key" }),
+      }),
+    );
+  });
+
+  it("rejects internal service API keys", async () => {
+    mockFetchJson({ token: jwtWithSub(`${JWT_API_KEY_SUB_PREFIX}internal`) });
+
+    await expect(
+      resolveUserFromApiKey({
+        apiKey: "internal-key",
+        authUrl: "https://app.example.com",
+      }),
+    ).rejects.toThrow("Internal API keys cannot be used with hosted MCP");
+  });
+
+  it("throws on auth failure", async () => {
+    mockFetchJson({}, { ok: false, status: 401 });
+
+    await expect(
+      resolveUserFromApiKey({
+        apiKey: "bad-key",
+        authUrl: "https://app.example.com",
+      }),
+    ).rejects.toThrow(AuthenticationError);
+  });
+});