@hed-hog/core 0.0.398 → 0.0.400

package/src/mcp/filters/mcp-challenge.filter.spec.ts

@@ -0,0 +1,76 @@
+import { afterEach, describe, expect, it, jest } from '@jest/globals';
+import {
+  ForbiddenException,
+  UnauthorizedException,
+} from '@nestjs/common';
+import { McpChallengeFilter } from './mcp-challenge.filter';
+
+const ISSUER = 'https://hub-api.example.com';
+const METADATA_URL = `${ISSUER}/.well-known/oauth-protected-resource/mcp`;
+
+const makeFilter = () => {
+  const metadata = { getIssuer: jest.fn<any>().mockResolvedValue(ISSUER) };
+  const response: any = {
+    setHeader: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+    json: jest.fn().mockReturnThis(),
+  };
+  const host: any = { switchToHttp: () => ({ getResponse: () => response }) };
+  return { filter: new McpChallengeFilter(metadata as any), response, host };
+};
+
+describe('McpChallengeFilter', () => {
+  afterEach(() => jest.clearAllMocks());
+
+  // O passo 1 de todo fluxo OAuth de cliente MCP: bater sem token e ler daqui
+  // onde estao os metadados do recurso.
+  it('desafia o 401 com resource_metadata', async () => {
+    const { filter, response, host } = makeFilter();
+
+    await filter.catch(new UnauthorizedException('Access denied.'), host);
+
+    expect(response.setHeader).toHaveBeenCalledWith(
+      'WWW-Authenticate',
+      `Bearer resource_metadata="${METADATA_URL}", error="invalid_token"`,
+    );
+    expect(response.status).toHaveBeenCalledWith(401);
+  });
+
+  it('pede reautorizacao quando falta o escopo mcp', async () => {
+    const { filter, response, host } = makeFilter();
+
+    await filter.catch(
+      new ForbiddenException("MCP: token is missing the 'mcp' scope"),
+      host,
+    );
+
+    const [, value] = response.setHeader.mock.calls[0];
+    expect(value).toContain('error="insufficient_scope"');
+    expect(value).toContain('scope="mcp"');
+    expect(response.status).toHaveBeenCalledWith(403);
+  });
+
+  // 403 por falta de papel numa tool nao se resolve reautorizando: mandar
+  // insufficient_scope poria o cliente num laco de reautorizacao sem fim.
+  it('nao desafia 403 de permissao de tool', async () => {
+    const { filter, response, host } = makeFilter();
+
+    await filter.catch(
+      new ForbiddenException("Access denied to MCP tool 'core.users.list'"),
+      host,
+    );
+
+    expect(response.setHeader).not.toHaveBeenCalled();
+    expect(response.status).toHaveBeenCalledWith(403);
+  });
+
+  it('preserva o corpo original da excecao', async () => {
+    const { filter, response, host } = makeFilter();
+
+    await filter.catch(new UnauthorizedException('Access denied.'), host);
+
+    expect(response.json).toHaveBeenCalledWith(
+      expect.objectContaining({ message: 'Access denied.' }),
+    );
+  });
+});

package/src/mcp/filters/mcp-challenge.filter.ts

@@ -0,0 +1,70 @@
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  HttpStatus,
+} from '@nestjs/common';
+import { Response } from 'express';
+import { OAuthMetadataService } from '../../authorize/oauth-metadata.service';
+import { MCP_SCOPE } from '../guards/mcp-auth.guard';
+
+/**
+ * O desafio `WWW-Authenticate` do /mcp — o primeiro passo de todo fluxo OAuth de
+ * um cliente MCP (RFC 9728 §5.1): ele bate sem token, lê deste cabeçalho onde
+ * estão os metadados do recurso, e só então sabe a quem pedir autorização.
+ *
+ * Precisa ser um ExceptionFilter, e não um trecho dentro do McpAuthGuard, porque
+ * o caso que mais importa nem chega ao McpAuthGuard: numa requisição SEM token,
+ * quem lança o 401 é o AuthGuard global, que roda antes. Um filtro declarado no
+ * controller captura tambem o que os guards lançam, e por isso cobre os dois.
+ */
+@Catch(HttpException)
+export class McpChallengeFilter implements ExceptionFilter {
+  constructor(private readonly metadata: OAuthMetadataService) {}
+
+  async catch(exception: HttpException, host: ArgumentsHost): Promise<void> {
+    const ctx = host.switchToHttp();
+    const response = ctx.getResponse<Response>();
+    const status = exception.getStatus();
+
+    if (status === HttpStatus.UNAUTHORIZED) {
+      response.setHeader(
+        'WWW-Authenticate',
+        `Bearer resource_metadata="${await this.resourceMetadataUrl()}", error="invalid_token"`,
+      );
+    } else if (status === HttpStatus.FORBIDDEN) {
+      // 403 aqui pode ser falta de escopo (o token não foi autorizado para o MCP)
+      // ou falta de papel numa tool específica. Só o primeiro é recuperável por
+      // uma nova autorização, e é o único que ganha o desafio de escopo — mandar
+      // `insufficient_scope` no segundo caso faria o cliente entrar num laço de
+      // reautorização que nunca resolve.
+      if (this.isScopeError(exception)) {
+        response.setHeader(
+          'WWW-Authenticate',
+          `Bearer error="insufficient_scope", scope="${MCP_SCOPE}", resource_metadata="${await this.resourceMetadataUrl()}"`,
+        );
+      }
+    }
+
+    const body = exception.getResponse();
+    response
+      .status(status)
+      .json(
+        typeof body === 'string'
+          ? { statusCode: status, message: body }
+          : body,
+      );
+  }
+
+  private isScopeError(exception: HttpException): boolean {
+    const body = exception.getResponse() as any;
+    const message =
+      typeof body === 'string' ? body : String(body?.message ?? '');
+    return message.includes(`'${MCP_SCOPE}' scope`);
+  }
+
+  private async resourceMetadataUrl(): Promise<string> {
+    return `${await this.metadata.getIssuer()}/.well-known/oauth-protected-resource/mcp`;
+  }
+}

package/src/mcp/guards/mcp-auth.guard.spec.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
-import { UnauthorizedException } from '@nestjs/common';
+import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
 import { McpAuthGuard } from './mcp-auth.guard';
 
 const makeContext = (request: any) => ({
@@ -10,14 +10,20 @@ const makeDeps = () => {
   const tokenService = { verify: jest.fn() };
   const prisma = { mcp_api_key: { findFirst: jest.fn(), update: jest.fn() } };
   const security = { hashWithPepper: jest.fn().mockReturnValue('hash') };
-  return { tokenService, prisma, security };
+  const oauthMetadata = {
+    getMcpResource: jest.fn<any>().mockResolvedValue(MCP_RESOURCE),
+  };
+  return { tokenService, prisma, security, oauthMetadata };
 };
 
+const MCP_RESOURCE = 'https://hub-api.example.com/mcp';
+
 const makeService = (deps = makeDeps()) => ({
   guard: new McpAuthGuard(
     deps.tokenService as any,
     deps.prisma as any,
     deps.security as any,
+    deps.oauthMetadata as any,
   ),
   deps,
 });
@@ -40,6 +46,49 @@ describe('McpAuthGuard', () => {
       true,
     );
     expect(request.auth).toEqual({ sub: 4 });
+    // O recurso e passado para o verify — e dele que sai a recusa de um token
+    // emitido para outra audiencia.
+    expect(deps.tokenService.verify).toHaveBeenCalledWith(
+      expect.anything(),
+      'tok',
+      MCP_RESOURCE,
+    );
+  });
+
+  it('aceita token OAuth que traz o escopo mcp', async () => {
+    const { guard, deps } = makeService();
+    deps.tokenService.verify.mockResolvedValue({
+      sub: 4,
+      aud: MCP_RESOURCE,
+      scope: 'mcp',
+    });
+    const request: any = { headers: { authorization: 'Bearer tok' } };
+    await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+      true,
+    );
+  });
+
+  it('nega token OAuth sem o escopo mcp', async () => {
+    const { guard, deps } = makeService();
+    deps.tokenService.verify.mockResolvedValue({
+      sub: 4,
+      aud: MCP_RESOURCE,
+      scope: 'profile',
+    });
+    const request: any = { headers: { authorization: 'Bearer tok' } };
+    await expect(
+      guard.canActivate(makeContext(request) as any),
+    ).rejects.toThrow(ForbiddenException);
+  });
+
+  // O JWT de login nunca teve `scope`; exigi-lo quebraria o uso interno do /mcp.
+  it('nao exige escopo de token sem audiencia', async () => {
+    const { guard, deps } = makeService();
+    deps.tokenService.verify.mockResolvedValue({ sub: 4 });
+    const request: any = { headers: { authorization: 'Bearer tok' } };
+    await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+      true,
+    );
   });
 
   it('autentica com api key mcp válida', async () => {

package/src/mcp/guards/mcp-auth.guard.ts

@@ -2,19 +2,24 @@ import { PrismaService } from '@hed-hog/api-prisma';
 import {
   CanActivate,
   ExecutionContext,
+  ForbiddenException,
   Injectable,
   UnauthorizedException,
 } from '@nestjs/common';
 import { Request } from 'express';
+import { MCP_SCOPE, OAuthMetadataService } from '../../authorize/oauth-metadata.service';
 import { SecurityService } from '../../security/security.service';
 import { TokenService } from '../../token/token.service';
 
+export { MCP_SCOPE };
+
 @Injectable()
 export class McpAuthGuard implements CanActivate {
   constructor(
     private readonly tokenService: TokenService,
     private readonly prisma: PrismaService,
     private readonly security: SecurityService,
+    private readonly oauthMetadata: OAuthMetadataService,
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -31,7 +36,25 @@ export class McpAuthGuard implements CanActivate {
       return this.verifyApiKey(request, token);
     }
 
-    request['auth'] = await this.tokenService.verify(locale, token);
+    const payload = await this.tokenService.verify(
+      locale,
+      token,
+      await this.oauthMetadata.getMcpResource(),
+    );
+
+    // Token emitido pelo fluxo OAuth carrega `scope`; o JWT de login, nao. So o
+    // primeiro precisa provar que o usuario consentiu com o acesso ao MCP — exigir
+    // escopo de um token de sessao quebraria o uso interno, que nunca teve escopo.
+    if (payload.aud !== undefined) {
+      const scopes = String(payload.scope ?? '').split(/\s+/).filter(Boolean);
+      if (!scopes.includes(MCP_SCOPE)) {
+        throw new ForbiddenException(
+          `MCP: token is missing the '${MCP_SCOPE}' scope`,
+        );
+      }
+    }
+
+    request['auth'] = payload;
     return true;
   }
 

package/src/mcp/guards/mcp-permission.guard.spec.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, beforeEach, afterEach, jest } from '@jest/globals';
+import { afterEach, describe, expect, it, jest } from '@jest/globals';
 import { ForbiddenException } from '@nestjs/common';
 import { McpPermissionGuard } from './mcp-permission.guard';
 
@@ -6,9 +6,11 @@ const makeContext = (request: any) => ({
   switchToHttp: () => ({ getRequest: () => request }),
 });
 
-const makeService = () => {
-  const prisma = { route: { count: jest.fn() } };
-  return { guard: new McpPermissionGuard(prisma as any), prisma };
+const makeService = (allowed: string[] = []) => {
+  const permissions = {
+    getAllowedToolNames: jest.fn<any>().mockResolvedValue(new Set(allowed)),
+  };
+  return { guard: new McpPermissionGuard(permissions as any), permissions };
 };
 
 describe('McpPermissionGuard', () => {
@@ -22,18 +24,17 @@ describe('McpPermissionGuard', () => {
   });
 
   it('permite POST sem tools/call (ex.: tools/list)', async () => {
-    const { guard, prisma } = makeService();
+    const { guard, permissions } = makeService();
     await expect(
       guard.canActivate(
         makeContext({ method: 'POST', body: { method: 'tools/list' } }) as any,
       ),
     ).resolves.toBe(true);
-    expect(prisma.route.count).not.toHaveBeenCalled();
+    expect(permissions.getAllowedToolNames).not.toHaveBeenCalled();
   });
 
   it('permite tools/call quando usuário tem permissão', async () => {
-    const { guard, prisma } = makeService();
-    prisma.route.count.mockResolvedValue(1);
+    const { guard, permissions } = makeService(['my_tool']);
     const request = {
       method: 'POST',
       body: { method: 'tools/call', params: { name: 'my_tool' } },
@@ -42,16 +43,11 @@ describe('McpPermissionGuard', () => {
     await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
       true,
     );
-    expect(prisma.route.count).toHaveBeenCalledWith(
-      expect.objectContaining({
-        where: expect.objectContaining({ tool_name: 'my_tool' }),
-      }),
-    );
+    expect(permissions.getAllowedToolNames).toHaveBeenCalledWith(2, false);
   });
 
   it('nega tools/call sem permissão', async () => {
-    const { guard, prisma } = makeService();
-    prisma.route.count.mockResolvedValue(0);
+    const { guard } = makeService([]);
     const request = {
       method: 'POST',
       body: { method: 'tools/call', params: { name: 'secret_tool' } },
@@ -61,4 +57,102 @@ describe('McpPermissionGuard', () => {
       ForbiddenException,
     );
   });
+
+  /**
+   * O teto so vale para cliente OAuth externo. O token interno (chave
+   * hedhog_mcp_, JWT de login) nao tem `aud`, e ali quem chama e o proprio
+   * operador, com a tela na frente.
+   */
+  describe('origem da chamada', () => {
+    it('marca como conector quando o token tem aud', async () => {
+      const { guard, permissions } = makeService(['my_tool']);
+      const request = {
+        method: 'POST',
+        body: { method: 'tools/call', params: { name: 'my_tool' } },
+        auth: { sub: 2, aud: 'https://hub-api.example.com/mcp' },
+      };
+      await guard.canActivate(makeContext(request) as any);
+      expect(permissions.getAllowedToolNames).toHaveBeenCalledWith(2, true);
+    });
+
+    it('nao marca como conector sem aud', async () => {
+      const { guard, permissions } = makeService(['my_tool']);
+      const request = {
+        method: 'POST',
+        body: { method: 'tools/call', params: { name: 'my_tool' } },
+        auth: { sub: 2 },
+      };
+      await guard.canActivate(makeContext(request) as any);
+      expect(permissions.getAllowedToolNames).toHaveBeenCalledWith(2, false);
+    });
+  });
+
+  /**
+   * REGRESSAO: o transporte do SDK aceita batch JSON-RPC (corpo array) e despacha
+   * cada mensagem para o mesmo handler. Lendo so `body.method`, um `tools/call`
+   * envolvido em colchetes fazia `toolName` virar undefined, o guard liberava, e
+   * o handler executava a tool sem checar papel nenhum — bypass completo da
+   * autorizacao, reproduzido com o SDK instalado.
+   */
+  describe('batch JSON-RPC (corpo array)', () => {
+    it('nega tool sem permissão dentro de um lote', async () => {
+      const { guard } = makeService(['permitida']);
+      const request = {
+        method: 'POST',
+        body: [
+          { jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'proibida' } },
+        ],
+        auth: { sub: 2 },
+      };
+      await expect(
+        guard.canActivate(makeContext(request) as any),
+      ).rejects.toThrow(ForbiddenException);
+    });
+
+    it('nega o lote inteiro se UMA das mensagens não é permitida', async () => {
+      const { guard } = makeService(['permitida']);
+      const request = {
+        method: 'POST',
+        body: [
+          { method: 'tools/call', params: { name: 'permitida' } },
+          { method: 'tools/list' },
+          { method: 'tools/call', params: { name: 'proibida' } },
+        ],
+        auth: { sub: 2 },
+      };
+      await expect(
+        guard.canActivate(makeContext(request) as any),
+      ).rejects.toThrow(/proibida/);
+    });
+
+    it('permite lote em que toda tool é concedida', async () => {
+      const { guard, permissions } = makeService(['a', 'b']);
+      const request = {
+        method: 'POST',
+        body: [
+          { method: 'tools/call', params: { name: 'a' } },
+          { method: 'tools/call', params: { name: 'b' } },
+        ],
+        auth: { sub: 2 },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+      // Uma consulta so para o lote inteiro.
+      expect(permissions.getAllowedToolNames).toHaveBeenCalledTimes(1);
+    });
+
+    it('lote sem nenhum tools/call passa sem consultar permissão', async () => {
+      const { guard, permissions } = makeService();
+      const request = {
+        method: 'POST',
+        body: [{ method: 'initialize' }, { method: 'tools/list' }],
+        auth: { sub: 2 },
+      };
+      await expect(guard.canActivate(makeContext(request) as any)).resolves.toBe(
+        true,
+      );
+      expect(permissions.getAllowedToolNames).not.toHaveBeenCalled();
+    });
+  });
 });

package/src/mcp/guards/mcp-permission.guard.ts

@@ -1,51 +1,76 @@
-import { PrismaService } from '@hed-hog/api-prisma';
-import {
-  CanActivate,
-  ExecutionContext,
-  ForbiddenException,
-  Injectable,
-} from '@nestjs/common';
-import { Request } from 'express';
-
-@Injectable()
-export class McpPermissionGuard implements CanActivate {
-  constructor(private readonly prisma: PrismaService) {}
-
-  async canActivate(context: ExecutionContext): Promise<boolean> {
-    const request = context.switchToHttp().getRequest<Request>();
-
-    // Only POST requests carry tool invocations
-    if (request.method !== 'POST') return true;
-
-    const body = request.body as any;
-    const toolName: string | undefined =
-      body?.method === 'tools/call' ? body?.params?.name : undefined;
-
-    // tools/list, initialize, ping, etc. — no per-tool permission check needed
-    if (!toolName) return true;
-
-    const userId = (request as any)?.auth?.sub;
-
-    const count = await this.prisma.route.count({
-      where: {
-        type: 'MCP' as any,
-        tool_name: toolName,
-        role_route: {
-          some: {
-            role: {
-              role_user: {
-                some: { user_id: userId },
-              },
-            },
-          },
-        },
-      },
-    });
-
-    if (count === 0) {
-      throw new ForbiddenException(`Access denied to MCP tool '${toolName}'`);
-    }
-
-    return true;
-  }
-}
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Request } from 'express';
+import { McpPermissionService } from '../mcp-permission.service';
+
+/**
+ * A trava de verdade do `tools/call`.
+ *
+ * O `tools/list` também filtra pelas mesmas permissões, mas aquilo é
+ * apresentação: nada impede um cliente de chamar uma tool que ele nunca viu na
+ * lista. Por isso os dois consultam o mesmo `McpPermissionService` e este guard
+ * continua existindo.
+ *
+ * O corpo pode ser UM objeto JSON-RPC ou um ARRAY deles — o transporte do SDK
+ * aceita batch (`if (Array.isArray(rawMessage))`) e despacha cada mensagem para o
+ * mesmo handler. Ler só `body.method` deixava passar qualquer chamada envolvida em
+ * colchetes: `body.method` fica `undefined`, o guard liberava, e o handler de
+ * `CallToolRequestSchema` executa sem olhar papel nenhum. Toda mensagem do lote
+ * precisa ser inspecionada.
+ */
+@Injectable()
+export class McpPermissionGuard implements CanActivate {
+  constructor(private readonly permissions: McpPermissionService) {}
+
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<Request>();
+
+    // Only POST requests carry tool invocations
+    if (request.method !== 'POST') return true;
+
+    const toolNames = this.extractToolNames(request.body);
+
+    // tools/list, initialize, ping, etc. — no per-tool permission check needed
+    if (toolNames.length === 0) return true;
+
+    const auth = (request as any)?.auth;
+    const userId = auth?.sub;
+    // Token de cliente OAuth externo carrega `aud`; o interno, nao. O teto de
+    // permissao so vale para o primeiro.
+    const viaConnector = auth?.aud !== undefined;
+
+    // Uma consulta só: o service resolve o conjunto inteiro de uma vez e o cache
+    // atende as demais mensagens do lote.
+    const allowed = await this.permissions.getAllowedToolNames(
+      userId,
+      viaConnector,
+    );
+
+    for (const toolName of toolNames) {
+      if (!allowed.has(toolName)) {
+        throw new ForbiddenException(`Access denied to MCP tool '${toolName}'`);
+      }
+    }
+
+    return true;
+  }
+
+  /**
+   * Nomes de tool de toda mensagem `tools/call` do corpo, seja ele um objeto ou
+   * um lote. Mensagem malformada é ignorada aqui de propósito — quem a rejeita é
+   * o parser do SDK, e inventar um nome a partir dela só produziria um 403 com
+   * mensagem enganosa.
+   */
+  private extractToolNames(body: unknown): string[] {
+    const messages = Array.isArray(body) ? body : [body];
+
+    return messages
+      .filter((m: any) => m?.method === 'tools/call')
+      .map((m: any) => m?.params?.name)
+      .filter((name: unknown): name is string => typeof name === 'string' && name.length > 0);
+  }
+}

package/src/mcp/mcp-audit.service.spec.ts

@@ -0,0 +1,107 @@
+import { describe, expect, it, jest } from '@jest/globals';
+
+jest.mock('@hed-hog/api-prisma', () => ({
+  __esModule: true,
+  PrismaService: class {},
+  Prisma: {},
+}));
+
+import { McpAuditService } from './mcp-audit.service';
+
+const makeService = () => {
+  const rows: any[] = [];
+
+  const prisma: any = {
+    mcp_tool_call_log: {
+      create: jest.fn(async ({ data }: any) => {
+        rows.push(data);
+        return data;
+      }),
+    },
+  };
+
+  const accessLogService: any = { recordMcp: jest.fn() };
+  const service = new McpAuditService(prisma, accessLogService);
+
+  return { service, rows, accessLogService };
+};
+
+const base = {
+  userId: 7,
+  toolName: 'finance.titles.attachments.add',
+  success: true,
+  durationMs: 12,
+};
+
+describe('McpAuditService.record', () => {
+  it('redige o conteúdo do arquivo e preserva o resto dos argumentos', async () => {
+    const { service, rows } = makeService();
+    const base64 = 'A'.repeat(50_000);
+
+    await service.record({
+      ...base,
+      input: { titleId: 42, fileName: 'nota.pdf', fileBase64: base64 },
+    });
+
+    const logged = JSON.parse(rows[0].input);
+
+    // O que a auditoria quer é o id do título e a modalidade, não mil caracteres de
+    // base64 — que é tudo o que sobrava do slice(0, 1000).
+    expect(logged.titleId).toBe(42);
+    expect(logged.fileName).toBe('nota.pdf');
+    expect(logged.fileBase64).toBe('<redacted: 50000 chars>');
+    expect(rows[0].input).not.toContain('AAAA');
+  });
+
+  it('redige também a parte do upload em partes', async () => {
+    const { service, rows } = makeService();
+
+    await service.record({
+      ...base,
+      toolName: 'core.files.upload.append',
+      input: { uploadId: 3, index: 0, chunkBase64: 'B'.repeat(1000) },
+    });
+
+    const logged = JSON.parse(rows[0].input);
+    expect(logged.uploadId).toBe(3);
+    expect(logged.chunkBase64).toBe('<redacted: 1000 chars>');
+  });
+
+  it('mantém a entrada intacta quando não há conteúdo de arquivo', async () => {
+    const { service, rows } = makeService();
+
+    await service.record({ ...base, input: { titleId: 42, fileId: 10 } });
+
+    expect(JSON.parse(rows[0].input)).toEqual({ titleId: 42, fileId: 10 });
+  });
+
+  it('não modifica o objeto de entrada do chamador', async () => {
+    // O mesmo objeto segue para o handler da tool; redigir no lugar apagaria o arquivo.
+    const { service } = makeService();
+    const input = { fileBase64: 'AAAA' };
+
+    await service.record({ ...base, input });
+
+    expect(input.fileBase64).toBe('AAAA');
+  });
+
+  it('continua cortando em 1000 caracteres o que sobra', async () => {
+    const { service, rows } = makeService();
+
+    await service.record({ ...base, input: { note: 'x'.repeat(5000) } });
+
+    expect(rows[0].input.length).toBe(1000);
+  });
+
+  it('não deixa a falha da auditoria derrubar a chamada', async () => {
+    const { service, rows } = makeService();
+    (service as any).prisma.mcp_tool_call_log.create.mockRejectedValue(
+      new Error('banco fora'),
+    );
+
+    await expect(
+      service.record({ ...base, input: { titleId: 1 } }),
+    ).resolves.toBeUndefined();
+    expect(rows).toHaveLength(0);
+  });
+});