@dpantani/tdmcp 0.4.0 → 0.6.1

package/td/tests/test_api_controller.py

@@ -1,307 +0,0 @@
-"""Unit tests for the tdmcp bridge HTTP router.
-
-The bridge normally runs inside TouchDesigner, where `td`, `op`, `app` and the
-operator classes are injected globals. To exercise the router's pure logic —
-auth, the arbitrary-code gate, request parsing, path decoding and route
-dispatch — off-TD, we install a stub `td` module before importing the package
-and replace the service layer with recorders for dispatch assertions.
-
-Run from the repo root: `python3 -m unittest discover -s td/tests`
-(or `npm run test:bridge`). No third-party dependencies — stdlib only.
-"""
-
-import os
-import sys
-import types
-import unittest
-from unittest import mock
-
-# --- Make the bridge importable without TouchDesigner --------------------------
-_HERE = os.path.dirname(os.path.abspath(__file__))
-_MODULES = os.path.abspath(os.path.join(_HERE, "..", "modules"))
-if _MODULES not in sys.path:
-    sys.path.insert(0, _MODULES)
-
-# `mcp.services.*` bind `op/app/project` from `td` at import time; a stub suffices.
-_td_stub = types.ModuleType("td")
-_td_stub.op = mock.MagicMock(name="op")
-_td_stub.app = mock.MagicMock(name="app")
-_td_stub.project = mock.MagicMock(name="project")
-sys.modules.setdefault("td", _td_stub)
-
-from mcp.controllers import api_controller as ac  # noqa: E402
-
-
-def _clear_exec_env():
-    os.environ.pop("TDMCP_BRIDGE_ALLOW_EXEC", None)
-
-
-def _clear_token_env():
-    os.environ.pop("TDMCP_BRIDGE_TOKEN", None)
-
-
-class AuthTests(unittest.TestCase):
-    def tearDown(self):
-        _clear_token_env()
-
-    def test_no_token_means_auth_off(self):
-        _clear_token_env()
-        # Should not raise even with no Authorization header.
-        ac._check_auth({"method": "GET"})
-
-    def test_valid_bearer_token_passes(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        ac._check_auth({"Authorization": "Bearer s3cret"})
-
-    def test_invalid_token_raises(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        with self.assertRaises(PermissionError):
-            ac._check_auth({"Authorization": "Bearer wrong"})
-
-    def test_missing_header_raises_when_token_required(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        with self.assertRaises(PermissionError):
-            ac._check_auth({"method": "GET"})
-
-    def test_header_lookup_is_case_insensitive_and_nested(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        # Header nested under a 'headers' dict with odd casing — must still match.
-        ac._check_auth({"headers": {"authorization": "Bearer s3cret"}})
-
-
-class ExecGateTests(unittest.TestCase):
-    def tearDown(self):
-        _clear_exec_env()
-        _clear_token_env()
-
-    def test_allowed_by_default(self):
-        _clear_exec_env()
-        self.assertTrue(ac._exec_allowed())
-
-    def test_disabled_values(self):
-        for value in ("0", "false", "FALSE", "no", "off", " Off "):
-            os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = value
-            self.assertFalse(ac._exec_allowed(), value)
-
-    def test_enabled_values(self):
-        for value in ("1", "true", "yes", "on", "", "anything"):
-            os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = value
-            self.assertTrue(ac._exec_allowed(), value)
-
-    def test_route_blocks_exec_when_disabled(self):
-        os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = "0"
-        with self.assertRaises(PermissionError):
-            ac._route("POST", "/api/exec", {}, {"script": "print(1)"})
-
-    def test_route_blocks_node_method_when_disabled(self):
-        os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = "0"
-        with self.assertRaises(PermissionError):
-            ac._route("POST", "/api/nodes/project1/geo1/method", {}, {"method": "cook"})
-
-
-class RoutingTests(unittest.TestCase):
-    """Dispatch logic, with the service layer swapped for recorders."""
-
-    def setUp(self):
-        _clear_exec_env()
-        self._saved = {
-            "api": ac.api_service,
-            "batch": ac.batch_service,
-            "analysis": ac.analysis_service,
-            "preview": ac.preview_service,
-        }
-        ac.api_service = mock.MagicMock(name="api_service")
-        ac.batch_service = mock.MagicMock(name="batch_service")
-        ac.analysis_service = mock.MagicMock(name="analysis_service")
-        ac.preview_service = mock.MagicMock(name="preview_service")
-
-    def tearDown(self):
-        ac.api_service = self._saved["api"]
-        ac.batch_service = self._saved["batch"]
-        ac.analysis_service = self._saved["analysis"]
-        ac.preview_service = self._saved["preview"]
-
-    def test_get_info(self):
-        ac._route("GET", "/api/info", {}, {})
-        ac.api_service.get_info.assert_called_once_with()
-
-    def test_create_node(self):
-        ac._route("POST", "/api/nodes", {}, {"parent_path": "/project1", "type": "noiseTOP"})
-        ac.api_service.create_node.assert_called_once()
-        self.assertEqual(ac.api_service.create_node.call_args.args[0], "/project1")
-        self.assertEqual(ac.api_service.create_node.call_args.args[1], "noiseTOP")
-
-    def test_list_nodes_uses_parent_query(self):
-        ac._route("GET", "/api/nodes", {"parent": ["/project1"]}, {})
-        ac.api_service.get_nodes.assert_called_once_with("/project1")
-
-    def test_exec_dispatch_when_allowed(self):
-        ac._route("POST", "/api/exec", {}, {"script": "x=1", "return_output": False})
-        ac.api_service.exec_script.assert_called_once_with("x=1", False)
-
-    def test_batch_dispatch(self):
-        ops = [{"action": "create", "parent_path": "/p", "type": "noiseTOP"}]
-        ac._route("POST", "/api/batch", {}, {"operations": ops})
-        ac.batch_service.run.assert_called_once_with(ops)
-
-    def test_node_get_patch_delete(self):
-        ac._route("GET", "/api/nodes/project1/noise1", {}, {})
-        ac.api_service.get_node.assert_called_once_with("/project1/noise1")
-
-        ac._route("PATCH", "/api/nodes/project1/noise1", {}, {"parameters": {"period": 4}})
-        ac.api_service.update_parameters.assert_called_once_with("/project1/noise1", {"period": 4})
-
-        ac._route("DELETE", "/api/nodes/project1/noise1", {}, {})
-        ac.api_service.delete_node.assert_called_once_with("/project1/noise1")
-
-    def test_node_method_dispatch(self):
-        ac._route(
-            "POST",
-            "/api/nodes/project1/geo1/method",
-            {},
-            {"method": "cook", "args": [1], "kwargs": {"force": True}},
-        )
-        ac.api_service.call_method.assert_called_once_with("/project1/geo1", "cook", [1], {"force": True})
-
-    def test_node_errors_dispatch(self):
-        ac._route("GET", "/api/nodes/project1/geo1/errors", {}, {})
-        ac.api_service.get_node_errors.assert_called_once_with("/project1/geo1", recursive=False)
-
-    def test_preview_dispatch_with_dimensions(self):
-        ac._route("GET", "/api/preview/project1/out1", {"width": ["800"], "height": ["600"]}, {})
-        ac.preview_service.capture.assert_called_once_with("/project1/out1", 800, 600)
-
-    def test_network_topology_dispatch(self):
-        ac._route("GET", "/api/network/project1/topology", {"recursive": ["true"]}, {})
-        ac.analysis_service.topology.assert_called_once_with("/project1", recursive=True)
-
-    def test_unknown_route_raises(self):
-        with self.assertRaises(ValueError):
-            ac._route("GET", "/api/does-not-exist", {}, {})
-
-    def test_create_node_missing_fields_raises_descriptive(self):
-        with self.assertRaises(ValueError) as cm:
-            ac._route("POST", "/api/nodes", {}, {})
-        self.assertIn("parent_path", str(cm.exception))
-        self.assertIn("type", str(cm.exception))
-
-    def test_exec_missing_script_raises_descriptive(self):
-        with self.assertRaises(ValueError) as cm:
-            ac._route("POST", "/api/exec", {}, {})
-        self.assertIn("script", str(cm.exception))
-
-
-class ParsingTests(unittest.TestCase):
-    def test_parse_body_variants(self):
-        self.assertEqual(ac._parse_body({"data": ""}), {})
-        self.assertEqual(ac._parse_body({"data": None}), {})
-        self.assertEqual(ac._parse_body({"data": '{"a": 1}'}), {"a": 1})
-        self.assertEqual(ac._parse_body({"data": b'{"b": 2}'}), {"b": 2})
-        self.assertEqual(ac._parse_body({"data": {"c": 3}}), {"c": 3})
-
-    def test_node_path_rejoins_and_restores_leading_slash(self):
-        self.assertEqual(ac._node_path(["project1", "noise1"]), "/project1/noise1")
-        # Percent-encoded segment decodes back to a slash-bearing path.
-        self.assertEqual(ac._node_path(["project1%2Fgeo1"]), "/project1/geo1")
-
-    def test_qs_returns_first_or_default(self):
-        self.assertEqual(ac._qs({"k": ["v1", "v2"]}, "k"), "v1")
-        self.assertEqual(ac._qs({}, "missing", "fallback"), "fallback")
-
-    def test_find_header_top_level_and_default(self):
-        self.assertEqual(ac._find_header({"X-Token": "abc"}, "x-token"), "abc")
-        self.assertIsNone(ac._find_header({"other": "v"}, "x-token"))
-
-    def test_find_header_accepts_list_value(self):
-        # A repeated/multi-value header may arrive as a list; take the first str.
-        self.assertEqual(ac._find_header({"Origin": ["http://x", "http://y"]}, "origin"), "http://x")
-        self.assertIsNone(ac._find_header({"Origin": []}, "origin"))
-        self.assertIsNone(ac._find_header({"Origin": [123]}, "origin"))
-
-
-class OriginTests(unittest.TestCase):
-    """The Origin guard blocks browser-driven CSRF / DNS-rebinding."""
-
-    def test_no_origin_is_allowed(self):
-        ac._check_origin({"method": "GET"})  # the Node client sends no Origin
-
-    def test_loopback_origins_allowed(self):
-        for origin in (
-            "http://127.0.0.1:9980",
-            "http://localhost",
-            "https://localhost:3000",
-            "http://[::1]:9980",
-        ):
-            ac._check_origin({"Origin": origin})  # must not raise
-
-    def test_cross_origin_rejected(self):
-        for origin in ("http://evil.com", "https://attacker.example:8443", "http://192.168.1.5"):
-            with self.assertRaises(PermissionError, msg=origin):
-                ac._check_origin({"Origin": origin})
-
-    def test_opaque_null_origin_rejected(self):
-        with self.assertRaises(PermissionError):
-            ac._check_origin({"Origin": "null"})
-
-    def test_origin_lookup_is_case_insensitive_and_nested(self):
-        with self.assertRaises(PermissionError):
-            ac._check_origin({"headers": {"origin": "http://evil.com"}})
-
-    def test_handle_rejects_cross_origin_with_403(self):
-        resp = ac.handle({"method": "GET", "uri": "/api/info", "Origin": "http://evil.com"}, {})
-        self.assertEqual(resp["statusCode"], 403)
-        self.assertIn("cross-origin", resp["data"])
-
-    def test_handle_rejects_list_valued_cross_origin(self):
-        # Some TD builds surface a header as a list; it must not slip the guard.
-        resp = ac.handle({"method": "GET", "uri": "/api/info", "Origin": ["http://evil.com"]}, {})
-        self.assertEqual(resp["statusCode"], 403)
-        self.assertIn("cross-origin", resp["data"])
-
-
-class HandleTests(unittest.TestCase):
-    def tearDown(self):
-        _clear_exec_env()
-        _clear_token_env()
-
-    def _resp(self):
-        return {}
-
-    def test_ok_envelope(self):
-        with mock.patch.object(ac, "_route", return_value={"hello": "world"}):
-            resp = ac.handle({"method": "GET", "uri": "/api/info"}, self._resp())
-        self.assertEqual(resp["statusCode"], 200)
-        self.assertIn('"ok": true', resp["data"])
-        self.assertIn("world", resp["data"])
-
-    def test_auth_failure_is_401(self):
-        os.environ["TDMCP_BRIDGE_TOKEN"] = "s3cret"
-        resp = ac.handle({"method": "GET", "uri": "/api/info"}, self._resp())
-        self.assertEqual(resp["statusCode"], 401)
-        self.assertIn('"ok": false', resp["data"])
-
-    def test_error_is_400(self):
-        with mock.patch.object(ac, "_route", side_effect=ValueError("boom")):
-            resp = ac.handle({"method": "GET", "uri": "/api/info"}, self._resp())
-        self.assertEqual(resp["statusCode"], 400)
-        self.assertIn("boom", resp["data"])
-
-    def test_exec_disabled_surfaces_as_403_with_message(self):
-        os.environ["TDMCP_BRIDGE_ALLOW_EXEC"] = "0"
-        resp = ac.handle(
-            {"method": "POST", "uri": "/api/exec", "data": '{"script": "1"}'}, self._resp()
-        )
-        self.assertEqual(resp["statusCode"], 403)
-        self.assertIn("disabled", resp["data"])
-
-    def test_missing_required_field_surfaces_as_400_with_name(self):
-        # A POST with valid JSON but a missing field gets a descriptive 400,
-        # not a bare KeyError message of just the key name.
-        resp = ac.handle({"method": "POST", "uri": "/api/nodes", "data": "{}"}, self._resp())
-        self.assertEqual(resp["statusCode"], 400)
-        self.assertIn("parent_path", resp["data"])
-        self.assertIn("Missing required field", resp["data"])
-
-
-if __name__ == "__main__":
-    unittest.main()

package/td/tests/test_services.py

@@ -1,209 +0,0 @@
-"""Unit tests for the bridge service layer: parameter validation + connect guards.
-
-Exercises api_service.update_parameters / create_node and batch_service.connect
-off-TD using lightweight fakes for TD node objects. These lock in the fixes for
-two silent-failure bugs:
-
-  * setting an unknown parameter name (e.g. `gain` on a levelTOP) used to be
-    silently dropped; it now raises (update) or warns (create).
-  * wiring two operators in different containers used to silently no-op; it now
-    raises with an actionable message.
-
-Stdlib only. Run: `python3 -m unittest discover -s td/tests` (or `npm run test:bridge`).
-"""
-
-import os
-import sys
-import types
-import unittest
-from unittest import mock
-
-# --- Make the bridge importable without TouchDesigner --------------------------
-_HERE = os.path.dirname(os.path.abspath(__file__))
-_MODULES = os.path.abspath(os.path.join(_HERE, "..", "modules"))
-if _MODULES not in sys.path:
-    sys.path.insert(0, _MODULES)
-
-# `mcp.services.*` bind `op/app/project` from `td` at import time; a stub suffices.
-_td_stub = types.ModuleType("td")
-_td_stub.op = mock.MagicMock(name="op")
-_td_stub.app = mock.MagicMock(name="app")
-_td_stub.project = mock.MagicMock(name="project")
-sys.modules.setdefault("td", _td_stub)
-
-from mcp.services import analysis_service, api_service, batch_service  # noqa: E402
-
-
-# --- Lightweight fakes for TD node objects -------------------------------------
-class FakePar:
-    def __init__(self, name, val=None):
-        self.name = name
-        self.val = val
-
-    def eval(self):
-        return self.val
-
-
-class FakeParCollection:
-    """getattr(self, name, None) -> FakePar for known names, None otherwise."""
-
-    def __init__(self, names):
-        for n in names:
-            setattr(self, n, FakePar(n))
-
-
-class FakeConnector:
-    def __init__(self):
-        self.connected_to = None
-
-    def connect(self, other):
-        self.connected_to = other
-
-
-class FakeNode:
-    def __init__(self, path, par_names=(), parent_path="/project1", n_in=1, n_out=1):
-        self.path = path
-        self.name = path.rsplit("/", 1)[-1]
-        self.OPType = "fakeTOP"
-        self.par = FakeParCollection(par_names)
-        self.inputs = []
-        self.outputs = []
-        self.inputConnectors = [FakeConnector() for _ in range(n_in)]
-        self.outputConnectors = [FakeConnector() for _ in range(n_out)]
-        self._parent_path = parent_path
-
-    def pars(self):
-        return [v for v in vars(self.par).values() if isinstance(v, FakePar)]
-
-    def parent(self):
-        return types.SimpleNamespace(path=self._parent_path)
-
-
-class UpdateParametersTests(unittest.TestCase):
-    def test_rejects_unknown_param_atomically(self):
-        node = FakeNode("/project1/lvl", ["brightness1"])
-        with mock.patch.object(api_service, "op", lambda p: node):
-            with self.assertRaises(ValueError) as cm:
-                api_service.update_parameters("/project1/lvl", {"gain": 0.5, "brightness1": 0.9})
-        self.assertIn("gain", str(cm.exception))
-        # Atomic: a valid sibling param in the same call is NOT applied either.
-        self.assertIsNone(node.par.brightness1.val)
-
-    def test_applies_known_params(self):
-        node = FakeNode("/project1/lvl", ["brightness1", "opacity"])
-        with mock.patch.object(api_service, "op", lambda p: node):
-            detail = api_service.update_parameters(
-                "/project1/lvl", {"brightness1": 0.85, "opacity": 0.5}
-            )
-        self.assertEqual(node.par.brightness1.val, 0.85)
-        self.assertEqual(node.par.opacity.val, 0.5)
-        self.assertEqual(detail["path"], "/project1/lvl")
-
-    def test_missing_node_raises(self):
-        with mock.patch.object(api_service, "op", lambda p: None):
-            with self.assertRaises(LookupError):
-                api_service.update_parameters("/nope", {"x": 1})
-
-
-class CreateNodeWarningTests(unittest.TestCase):
-    def test_failed_params_become_warnings_not_silent(self):
-        node = FakeNode("/project1/lvl", ["brightness1"])
-        parent = mock.MagicMock(name="parent")
-        parent.create.return_value = node
-        with mock.patch.object(api_service, "op", lambda p: parent), mock.patch.object(
-            api_service, "_resolve_type", lambda t: object
-        ):
-            ref = api_service.create_node(
-                "/project1", "fakeTOP", "lvl", {"gain": 1, "brightness1": 0.5}
-            )
-        # Node is still created; the bad param surfaces as a warning, not silence.
-        self.assertEqual(ref["path"], "/project1/lvl")
-        self.assertIn("gain", ref.get("parameter_warnings", []))
-        # The valid param still applied.
-        self.assertEqual(node.par.brightness1.val, 0.5)
-
-    def test_no_warnings_when_all_params_valid(self):
-        node = FakeNode("/project1/lvl", ["brightness1"])
-        parent = mock.MagicMock(name="parent")
-        parent.create.return_value = node
-        with mock.patch.object(api_service, "op", lambda p: parent), mock.patch.object(
-            api_service, "_resolve_type", lambda t: object
-        ):
-            ref = api_service.create_node("/project1", "fakeTOP", "lvl", {"brightness1": 0.5})
-        self.assertNotIn("parameter_warnings", ref)
-
-
-class ConnectGuardTests(unittest.TestCase):
-    def _patch_op(self, nodes):
-        return mock.patch.object(batch_service, "op", lambda p: nodes.get(p))
-
-    def test_rejects_cross_container(self):
-        src = FakeNode("/project1/a/x", parent_path="/project1/a")
-        dst = FakeNode("/project1/b/y", parent_path="/project1/b")
-        with self._patch_op({"/project1/a/x": src, "/project1/b/y": dst}):
-            with self.assertRaises(ValueError) as cm:
-                batch_service.connect("/project1/a/x", "/project1/b/y")
-        self.assertIn("across containers", str(cm.exception))
-        # No phantom wire was made.
-        self.assertIsNone(dst.inputConnectors[0].connected_to)
-
-    def test_same_parent_wires(self):
-        src = FakeNode("/project1/x", parent_path="/project1")
-        dst = FakeNode("/project1/y", parent_path="/project1")
-        with self._patch_op({"/project1/x": src, "/project1/y": dst}):
-            batch_service.connect("/project1/x", "/project1/y")
-        self.assertIs(dst.inputConnectors[0].connected_to, src.outputConnectors[0])
-
-    def test_bad_connector_index_raises(self):
-        src = FakeNode("/project1/x", parent_path="/project1")
-        dst = FakeNode("/project1/y", parent_path="/project1", n_in=1)
-        with self._patch_op({"/project1/x": src, "/project1/y": dst}):
-            with self.assertRaises(IndexError):
-                batch_service.connect("/project1/x", "/project1/y", target_input=3)
-
-    def test_missing_node_raises(self):
-        with self._patch_op({}):
-            with self.assertRaises(LookupError):
-                batch_service.connect("/a", "/b")
-
-
-class _PerfNode:
-    def __init__(self, path, cook_time=0.0, cook_count=0):
-        self.path = path
-        self.cookTime = cook_time
-        self.cookCount = cook_count
-
-
-class _PerfRoot:
-    """Returns direct children at depth=1, all descendants otherwise — like a TD COMP."""
-
-    def __init__(self, direct, nested):
-        self._direct = direct
-        self._nested = nested
-
-    def findChildren(self, depth=None):
-        return self._direct if depth == 1 else self._nested
-
-
-class PerformanceRecursiveTests(unittest.TestCase):
-    def _run(self, recursive):
-        direct = [_PerfNode("/p/a", 1.0)]
-        nested = [_PerfNode("/p/a", 1.0), _PerfNode("/p/sys/inner", 2.0)]
-        root = _PerfRoot(direct, nested)
-        with mock.patch.object(analysis_service, "op", lambda path: root):
-            return analysis_service.performance("/p", recursive=recursive)
-
-    def test_shallow_measures_only_direct_children(self):
-        result = self._run(recursive=False)
-        self.assertEqual([n["path"] for n in result["nodes"]], ["/p/a"])
-        self.assertEqual(result["total_cook_time_ms"], 1.0)
-
-    def test_recursive_measures_nested_nodes_too(self):
-        result = self._run(recursive=True)
-        self.assertEqual(sorted(n["path"] for n in result["nodes"]), ["/p/a", "/p/sys/inner"])
-        # Nested node's cook time is now counted in the total.
-        self.assertEqual(result["total_cook_time_ms"], 3.0)
-
-
-if __name__ == "__main__":
-    unittest.main()