@kb-labs/gateway-app 0.2.0 → 0.4.0

package/src/__tests__/auth-routes.test.ts

@@ -1,279 +0,0 @@
-/**
- * Integration tests for auth routes (CC4 — Auth Flow).
- * Spins up a real Fastify instance with mocked AuthService.
- *
- * Covers:
- *   POST /auth/register  — happy path, bad body (400)
- *   POST /auth/token     — happy path, bad creds (401), bad body (400)
- *   POST /auth/refresh   — happy path, expired token (401), bad body (400)
- */
-import { describe, it, expect, vi, beforeAll, afterAll } from 'vitest';
-import Fastify, { type FastifyInstance } from 'fastify';
-import type { ICache } from '@kb-labs/core-platform';
-import type { JwtConfig } from '@kb-labs/gateway-auth';
-import { createAuthMiddleware } from '../auth/middleware.js';
-import { registerAuthRoutes } from '../auth/routes.js';
-
-// ── Minimal stub cache ────────────────────────────────────────────────────────
-
-function makeCache(): ICache {
-  const store = new Map<string, unknown>();
-  return {
-    async get<T>(k: string) { return (store.get(k) as T) ?? null; },
-    async set(k: string, v: unknown) { store.set(k, v); },
-    async delete(k: string) { store.delete(k); },
-    async clear() { store.clear(); },
-  } as unknown as ICache;
-}
-
-// ── Mocked AuthService ────────────────────────────────────────────────────────
-
-function makeAuthService() {
-  return {
-    register: vi.fn(),
-    issueTokens: vi.fn(),
-    refreshTokens: vi.fn(),
-    verify: vi.fn(),
-  };
-}
-
-const testJwtConfig: JwtConfig = { secret: 'test-secret' };
-
-let app: FastifyInstance;
-let authService: ReturnType<typeof makeAuthService>;
-
-beforeAll(async () => {
-  authService = makeAuthService();
-  app = Fastify({ logger: false });
-
-  const cache = makeCache();
-  app.addHook('preHandler', createAuthMiddleware(cache, testJwtConfig));
-
-  // We inject the mocked authService via cast — same interface
-  registerAuthRoutes(app, authService as never);
-
-  await app.ready();
-});
-
-afterAll(async () => {
-  await app.close();
-});
-
-// ── POST /auth/register ───────────────────────────────────────────────────────
-
-describe('POST /auth/register', () => {
-  it('returns 201 with clientId, clientSecret, hostId on success', async () => {
-    authService.register.mockResolvedValue({
-      clientId: 'client-abc',
-      clientSecret: 'secret-xyz',
-      hostId: 'host-001',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/register',
-      payload: { name: 'My Agent', namespaceId: 'ns-test' },
-    });
-
-    expect(res.statusCode).toBe(201);
-    const body = res.json() as { clientId: string; clientSecret: string; hostId: string };
-    expect(body.clientId).toBe('client-abc');
-    expect(body.clientSecret).toBe('secret-xyz');
-    expect(body.hostId).toBe('host-001');
-    expect(authService.register).toHaveBeenCalledWith(
-      expect.objectContaining({ name: 'My Agent', namespaceId: 'ns-test' }),
-    );
-  });
-
-  it('returns 400 when name is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/register',
-      payload: { namespaceId: 'ns-test' },
-    });
-    expect(res.statusCode).toBe(400);
-    const body = res.json() as { error: string };
-    expect(body.error).toBe('Bad Request');
-  });
-
-  it('returns 400 when namespaceId is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/register',
-      payload: { name: 'agent' },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it('returns 400 when body is empty', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/register',
-      payload: {},
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it('forwards capabilities array to authService', async () => {
-    authService.register.mockResolvedValue({
-      clientId: 'c-2',
-      clientSecret: 's-2',
-      hostId: 'h-2',
-    });
-
-    await app.inject({
-      method: 'POST',
-      url: '/auth/register',
-      payload: { name: 'Cap Agent', namespaceId: 'ns', capabilities: ['read', 'write'] },
-    });
-
-    expect(authService.register).toHaveBeenCalledWith(
-      expect.objectContaining({ capabilities: ['read', 'write'] }),
-    );
-  });
-});
-
-// ── POST /auth/token ──────────────────────────────────────────────────────────
-
-describe('POST /auth/token', () => {
-  it('returns 200 with token pair on valid credentials', async () => {
-    authService.issueTokens.mockResolvedValue({
-      accessToken: 'access.jwt.token',
-      refreshToken: 'refresh.jwt.token',
-      expiresIn: 3600,
-      tokenType: 'Bearer',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/token',
-      payload: { clientId: 'client-abc', clientSecret: 'secret-xyz' },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { accessToken: string; tokenType: string };
-    expect(body.accessToken).toBe('access.jwt.token');
-    expect(body.tokenType).toBe('Bearer');
-    expect(authService.issueTokens).toHaveBeenCalledWith('client-abc', 'secret-xyz');
-  });
-
-  it('returns 401 when credentials are invalid (issueTokens returns null)', async () => {
-    authService.issueTokens.mockResolvedValue(null);
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/token',
-      payload: { clientId: 'bad', clientSecret: 'wrong' },
-    });
-
-    expect(res.statusCode).toBe(401);
-    const body = res.json() as { error: string; message: string };
-    expect(body.error).toBe('Unauthorized');
-    expect(body.message).toContain('Invalid credentials');
-  });
-
-  it('returns 400 when clientId is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/token',
-      payload: { clientSecret: 'xyz' },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it('returns 400 when clientSecret is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/token',
-      payload: { clientId: 'abc' },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it('returns 400 when body is empty', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/token',
-      payload: {},
-    });
-    expect(res.statusCode).toBe(400);
-  });
-});
-
-// ── POST /auth/refresh ────────────────────────────────────────────────────────
-
-describe('POST /auth/refresh', () => {
-  it('returns 200 with new token pair on valid refresh token', async () => {
-    authService.refreshTokens.mockResolvedValue({
-      accessToken: 'new.access.token',
-      refreshToken: 'new.refresh.token',
-      expiresIn: 3600,
-      tokenType: 'Bearer',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/refresh',
-      payload: { refreshToken: 'valid.refresh.token' },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { accessToken: string; refreshToken: string };
-    expect(body.accessToken).toBe('new.access.token');
-    expect(body.refreshToken).toBe('new.refresh.token');
-    expect(authService.refreshTokens).toHaveBeenCalledWith('valid.refresh.token');
-  });
-
-  it('returns 401 when refresh token is invalid (refreshTokens returns null)', async () => {
-    authService.refreshTokens.mockResolvedValue(null);
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/refresh',
-      payload: { refreshToken: 'expired.or.invalid' },
-    });
-
-    expect(res.statusCode).toBe(401);
-    const body = res.json() as { error: string; message: string };
-    expect(body.error).toBe('Unauthorized');
-    expect(body.message).toContain('Invalid or expired');
-  });
-
-  it('returns 400 when refreshToken field is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/refresh',
-      payload: {},
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it('returns 400 when body contains wrong field', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/refresh',
-      payload: { token: 'wrong-field-name' },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-});
-
-// ── Auth middleware: public routes skip auth check ────────────────────────────
-
-describe('Auth middleware — public routes', () => {
-  it('/auth/register is accessible without Authorization header', async () => {
-    authService.register.mockResolvedValue({
-      clientId: 'c', clientSecret: 's', hostId: 'h',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/auth/register',
-      payload: { name: 'x', namespaceId: 'y' },
-      // No Authorization header
-    });
-
-    // Should reach the route handler, not be blocked by middleware
-    expect(res.statusCode).not.toBe(401);
-  });
-});

package/src/__tests__/execute-routes.test.ts

@@ -1,408 +0,0 @@
-/**
- * Integration tests for execute routes (CC1/CC2/CC3/CC5).
- *
- * POST /api/v1/execute     — ndjson streaming, 400/401/503, cancellation flow
- * POST /api/v1/execute/:id/cancel — 200/404/403/409
- *
- * Uses real Fastify instance with mocked globalDispatcher.
- * ndjson response is collected line-by-line.
- */
-import { describe, it, expect, vi, beforeAll, afterAll, beforeEach } from 'vitest';
-import Fastify, { type FastifyInstance } from 'fastify';
-import type { ILogger } from '@kb-labs/core-platform';
-
-// ── Mock heavy deps before importing routes ───────────────────────────────────
-// Use vi.hoisted() so variables are available when vi.mock() factory runs
-// (vi.mock calls are hoisted to the top of the file, before variable declarations)
-
-const { mockDispatcher, mockBroadcast } = vi.hoisted(() => {
-  const mockDispatcher = {
-    firstHost: vi.fn(),
-    firstHostWithCapability: vi.fn(),
-    call: vi.fn(),
-  };
-  const mockBroadcast = vi.fn();
-  return { mockDispatcher, mockBroadcast };
-});
-
-vi.mock('../hosts/dispatcher.js', () => ({
-  globalDispatcher: mockDispatcher,
-  HostCallDispatcher: vi.fn(),
-}));
-
-vi.mock('../clients/subscription-registry.js', () => ({
-  subscriptionRegistry: {
-    broadcast: mockBroadcast,
-    subscribe: vi.fn(),
-    unsubscribe: vi.fn(),
-  },
-  SubscriptionRegistry: vi.fn(),
-}));
-
-import { registerExecuteRoutes } from '../execute/routes.js';
-import { executionRegistry } from '../execute/execution-registry.js';
-
-// ── Helpers ───────────────────────────────────────────────────────────────────
-
-const noopLogger: ILogger = {
-  info: vi.fn(),
-  warn: vi.fn(),
-  error: vi.fn(),
-  debug: vi.fn(),
-  child: vi.fn(() => noopLogger),
-} as unknown as ILogger;
-
-function makeAuthContext(namespaceId = 'ns-test') {
-  return {
-    type: 'machine' as const,
-    userId: 'host-001',
-    namespaceId,
-    tier: 'free' as const,
-    permissions: ['host:connect'],
-  };
-}
-
-/** Parse ndjson response body into array of parsed objects */
-function parseNdjson(body: string): unknown[] {
-  return body
-    .split('\n')
-    .filter((line) => line.trim() !== '')
-    .map((line) => JSON.parse(line) as unknown);
-}
-
-let app: FastifyInstance;
-
-beforeAll(async () => {
-  app = Fastify({ logger: false });
-
-  // Inject authContext via preHandler
-  app.addHook('preHandler', async (request) => {
-    (request as { authContext?: unknown }).authContext = makeAuthContext();
-  });
-
-  registerExecuteRoutes(app, noopLogger);
-  await app.ready();
-});
-
-afterAll(async () => {
-  await app.close();
-});
-
-beforeEach(() => {
-  vi.clearAllMocks();
-  // By default, a host exists
-  mockDispatcher.firstHost.mockReturnValue('host-001');
-  mockDispatcher.firstHostWithCapability.mockReturnValue('host-001');
-  // By default, dispatch resolves with a result
-  mockDispatcher.call.mockResolvedValue({ output: 'test-result' });
-});
-
-// ── POST /api/v1/execute — happy path ─────────────────────────────────────────
-
-describe('POST /api/v1/execute — success', () => {
-  it('returns 200 with ndjson content-type', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'my-plugin', handlerRef: 'handlers/main.js', input: { foo: 'bar' } },
-    });
-
-    expect(res.statusCode).toBe(200);
-    expect(res.headers['content-type']).toContain('application/x-ndjson');
-  });
-
-  it('response body contains execution:done as last event', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'my-plugin', handlerRef: 'handlers/main.js', input: {} },
-    });
-
-    const events = parseNdjson(res.body);
-    const doneEvent = events.find((e) => (e as { type: string }).type === 'execution:done');
-    expect(doneEvent).toBeDefined();
-    expect((doneEvent as { exitCode: number }).exitCode).toBe(0);
-  });
-
-  it('X-Execution-Id header is present in response', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', handlerRef: 'h', input: null },
-    });
-
-    expect(res.headers['x-execution-id']).toBeTruthy();
-    expect(typeof res.headers['x-execution-id']).toBe('string');
-  });
-
-  it('dispatches to correct namespace and host', async () => {
-    await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'test-plugin', handlerRef: 'handler.js', input: { x: 1 } },
-    });
-
-    expect(mockDispatcher.firstHostWithCapability).toHaveBeenCalledWith('ns-test', 'execution');
-    expect(mockDispatcher.call).toHaveBeenCalledWith(
-      'ns-test',
-      'host-001',
-      'execution',
-      'execute',
-      expect.arrayContaining([
-        expect.objectContaining({ pluginId: 'test-plugin', handlerRef: 'handler.js' }),
-      ]),
-    );
-  });
-
-  it('broadcasts execution:done event to WS subscribers', async () => {
-    await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', handlerRef: 'h', input: null },
-    });
-
-    // broadcast is called at least once (for execution:done)
-    const calls = mockBroadcast.mock.calls as [string, { type: string }][];
-    const doneCall = calls.find(([, event]) => event.type === 'execution:done');
-    expect(doneCall).toBeDefined();
-  });
-
-  it('execution is removed from registry after completion', async () => {
-    const before = executionRegistry.size;
-    await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', handlerRef: 'h', input: null },
-    });
-    // After response, execution should have been removed
-    expect(executionRegistry.size).toBe(before);
-  });
-});
-
-// ── POST /api/v1/execute — error cases ───────────────────────────────────────
-
-describe('POST /api/v1/execute — error cases', () => {
-  it('returns 400 when pluginId is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { handlerRef: 'h', input: {} },
-    });
-    expect(res.statusCode).toBe(400);
-    const body = res.json() as { error: string };
-    expect(body.error).toBe('Bad Request');
-  });
-
-  it('returns 400 when handlerRef is missing', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', input: {} },
-    });
-    expect(res.statusCode).toBe(400);
-  });
-
-  it('returns 503 when no host is connected for namespace', async () => {
-    mockDispatcher.firstHostWithCapability.mockReturnValue(null);
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', handlerRef: 'h', input: null },
-    });
-
-    expect(res.statusCode).toBe(503);
-    const body = res.json() as { error: string; namespaceId: string };
-    expect(body.error).toBe('No execution host connected');
-    expect(body.namespaceId).toBe('ns-test');
-    expect(noopLogger.warn).toHaveBeenCalledWith(
-      'No execution host connected for namespace',
-      expect.objectContaining({
-        diagnosticEvent: 'gateway.execution.dispatch',
-        reasonCode: 'execution_host_unavailable',
-        serviceId: 'gateway',
-        evidence: expect.objectContaining({
-          namespaceId: 'ns-test',
-        }),
-      }),
-    );
-  });
-
-  it('on dispatch failure: streams execution:error + execution:done(exitCode=1)', async () => {
-    mockDispatcher.call.mockRejectedValue(new Error('ECONNREFUSED connection refused'));
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', handlerRef: 'h', input: null },
-    });
-
-    expect(res.statusCode).toBe(200); // headers already sent
-    const events = parseNdjson(res.body);
-
-    const errorEvent = events.find((e) => (e as { type: string }).type === 'execution:error');
-    expect(errorEvent).toBeDefined();
-    expect((errorEvent as { code: string }).code).toBe('EXECUTION_FAILED');
-    expect(noopLogger.error).toHaveBeenCalledWith(
-      'Gateway execution dispatch failed',
-      expect.any(Error),
-      expect.objectContaining({
-        diagnosticEvent: 'gateway.execution.dispatch',
-        reasonCode: 'execution_dispatch_failed',
-        serviceId: 'gateway',
-      }),
-    );
-
-    const doneEvent = events.find((e) => (e as { type: string }).type === 'execution:done');
-    expect((doneEvent as { exitCode: number }).exitCode).toBe(1);
-  });
-});
-
-// ── POST /api/v1/execute/:id/cancel ──────────────────────────────────────────
-
-describe('POST /api/v1/execute/:id/cancel', () => {
-  it('returns 200 when execution is found and cancelled', async () => {
-    // Register a real execution so cancel can find it
-    const signal = executionRegistry.register({
-      executionId: 'exec-cancel-test',
-      requestId: 'req-1',
-      namespaceId: 'ns-test',
-      hostId: 'host-001',
-      pluginId: 'p',
-      handlerRef: 'h',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute/exec-cancel-test/cancel',
-      payload: { reason: 'user' },
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { executionId: string; status: string };
-    expect(body.status).toBe('cancelled');
-    expect(body.executionId).toBe('exec-cancel-test');
-    expect(signal.aborted).toBe(true);
-
-    executionRegistry.remove('exec-cancel-test');
-  });
-
-  it('returns 404 when execution does not exist', async () => {
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute/nonexistent-id/cancel',
-      payload: {},
-    });
-
-    expect(res.statusCode).toBe(404);
-    const body = res.json() as { error: string };
-    expect(body.error).toContain('not found');
-  });
-
-  it('returns 403 when execution belongs to different namespace', async () => {
-    // Register an execution in a different namespace
-    executionRegistry.register({
-      executionId: 'exec-other-ns',
-      requestId: 'req-x',
-      namespaceId: 'ns-other', // different namespace
-      hostId: 'host-002',
-      pluginId: 'p',
-      handlerRef: 'h',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute/exec-other-ns/cancel',
-      payload: {},
-    });
-
-    expect(res.statusCode).toBe(403);
-    const body = res.json() as { error: string };
-    expect(body.error).toContain('Forbidden');
-
-    executionRegistry.remove('exec-other-ns');
-  });
-
-  it('returns 409 when execution is already cancelled', async () => {
-    executionRegistry.register({
-      executionId: 'exec-already-cancelled',
-      requestId: 'req-2',
-      namespaceId: 'ns-test',
-      hostId: 'host-001',
-      pluginId: 'p',
-      handlerRef: 'h',
-    });
-    // Cancel it first
-    executionRegistry.cancel('exec-already-cancelled', 'user');
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute/exec-already-cancelled/cancel',
-      payload: {},
-    });
-
-    expect(res.statusCode).toBe(409);
-    const body = res.json() as { status: string };
-    expect(body.status).toBe('already_cancelled');
-
-    executionRegistry.remove('exec-already-cancelled');
-  });
-
-  it('defaults reason to "user" when not provided', async () => {
-    executionRegistry.register({
-      executionId: 'exec-default-reason',
-      requestId: 'req-3',
-      namespaceId: 'ns-test',
-      hostId: 'host-001',
-      pluginId: 'p',
-      handlerRef: 'h',
-    });
-
-    const res = await app.inject({
-      method: 'POST',
-      url: '/api/v1/execute/exec-default-reason/cancel',
-      payload: {},
-    });
-
-    expect(res.statusCode).toBe(200);
-    const body = res.json() as { reason: string };
-    expect(body.reason).toBe('user');
-
-    executionRegistry.remove('exec-default-reason');
-  });
-});
-
-// ── 401 without auth context ──────────────────────────────────────────────────
-
-describe('POST /api/v1/execute — auth guard', () => {
-  let appNoAuth: FastifyInstance;
-
-  beforeAll(async () => {
-    appNoAuth = Fastify({ logger: false });
-    // No preHandler — authContext stays undefined
-    registerExecuteRoutes(appNoAuth, noopLogger);
-    await appNoAuth.ready();
-  });
-
-  afterAll(async () => {
-    await appNoAuth.close();
-  });
-
-  it('returns 401 when authContext is absent', async () => {
-    const res = await appNoAuth.inject({
-      method: 'POST',
-      url: '/api/v1/execute',
-      payload: { pluginId: 'p', handlerRef: 'h', input: null },
-    });
-    expect(res.statusCode).toBe(401);
-  });
-
-  it('cancel returns 401 when authContext is absent', async () => {
-    const res = await appNoAuth.inject({
-      method: 'POST',
-      url: '/api/v1/execute/some-id/cancel',
-      payload: {},
-    });
-    expect(res.statusCode).toBe(401);
-  });
-});