@kya-os/mcp-i-core 1.2.2-canary.35 → 1.2.2-canary.37

package/src/services/__tests__/access-control.proof-response-validation.test.ts

@@ -396,4 +396,183 @@ describe("Proof Submission Response Validation", () => {
       }
     });
   });
+
+  describe("JSON Deep Clone Fix (Cloudflare Workers Edge Case)", () => {
+    it("should correctly extract data from wrapped response after JSON deep clone", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Simulate the exact response format from AgentShield API
+      // This matches the format seen in production logs
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 1,
+          rejected: 0,
+          outcomes: {
+            success: 1,
+          },
+          errors: [],
+        },
+        metadata: {
+          requestId: "fc1fa88f-9b22-4161-b4fd-17d8215098ee",
+          timestamp: "2025-11-24T21:36:33.029Z",
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      // Verify all fields are correctly extracted
+      expect(result.success).toBe(true);
+      expect(result.accepted).toBe(1);
+      expect(result.rejected).toBe(0);
+      expect(result.outcomes).toEqual({ success: 1 });
+      expect(result.errors).toEqual([]);
+    });
+
+    it("should handle response where data fields are numeric values (not undefined)", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Test with zero values (edge case for falsy check)
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 0,
+          rejected: 0,
+          outcomes: {},
+          errors: [],
+        },
+        metadata: {
+          requestId: "test-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      // Verify zero values are correctly extracted (not treated as undefined)
+      expect(result.success).toBe(true);
+      expect(result.accepted).toBe(0);
+      expect(result.rejected).toBe(0);
+    });
+
+    it("should handle response with nested outcomes object", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Test with various outcome types
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 3,
+          rejected: 2,
+          outcomes: {
+            success: 1,
+            failed: 1,
+            blocked: 1,
+            error: 2,
+          },
+          errors: [
+            {
+              proof_index: 0,
+              error: {
+                code: "validation_error",
+                message: "Invalid signature",
+              },
+            },
+          ],
+        },
+        metadata: {
+          requestId: "test-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      expect(result.accepted).toBe(3);
+      expect(result.rejected).toBe(2);
+      expect(result.outcomes).toEqual({
+        success: 1,
+        failed: 1,
+        blocked: 1,
+        error: 2,
+      });
+      expect(result.errors).toHaveLength(1);
+      expect(result.errors![0].proof_index).toBe(0);
+    });
+  });
 });

package/src/services/access-control.service.ts

@@ -511,45 +511,49 @@ export class AccessControlApiService {
       if (wrappedResponse.success !== undefined && wrappedResponse.data) {
         // Response is wrapped in { success, data }
         // Extract data and add success field if missing (for schema validation)
-        // CRITICAL: Ensure data is actually an object, not a string or other type
+        // CRITICAL: Use JSON.parse(JSON.stringify()) to create a clean object
+        // This handles edge cases in Cloudflare Workers where response.json()
+        // might return objects with proxy/getter issues that prevent property access
         let dataToValidate: Record<string, unknown>;
-        if (typeof wrappedResponse.data === "string") {
-          // If data is a string, parse it (shouldn't happen but defensive)
-          try {
-            dataToValidate = JSON.parse(wrappedResponse.data) as Record<
-              string,
-              unknown
-            >;
-          } catch (parseError) {
+
+        try {
+          // Deep clone via JSON to ensure we have a plain JavaScript object
+          // This is the most reliable way to handle potential proxy/getter issues
+          const rawData = wrappedResponse.data;
+          const clonedData = JSON.parse(JSON.stringify(rawData));
+
+          if (typeof clonedData !== "object" || clonedData === null) {
             throw new AgentShieldAPIError(
               "invalid_response",
-              "Failed to parse response data",
+              "Response data is not an object after cloning",
               {
-                parseError:
-                  parseError instanceof Error
-                    ? parseError.message
-                    : String(parseError),
+                originalType: typeof rawData,
+                clonedType: typeof clonedData,
+                clonedValue: clonedData,
               }
             );
           }
-        } else if (
-          typeof wrappedResponse.data === "object" &&
-          wrappedResponse.data !== null
-        ) {
-          dataToValidate = wrappedResponse.data as Record<string, unknown>;
-        } else {
+
+          dataToValidate = clonedData as Record<string, unknown>;
+        } catch (cloneError) {
+          if (cloneError instanceof AgentShieldAPIError) {
+            throw cloneError;
+          }
           throw new AgentShieldAPIError(
             "invalid_response",
-            "Response data is not an object",
+            "Failed to clone response data",
             {
+              error:
+                cloneError instanceof Error
+                  ? cloneError.message
+                  : String(cloneError),
               dataType: typeof wrappedResponse.data,
-              data: wrappedResponse.data,
             }
           );
         }
 
         // CRITICAL: Log the actual data structure for debugging
-        console.error(`[AccessControl] 🔍 DATA OBJECT STRUCTURE:`, {
+        console.error(`[AccessControl] 🔍 DATA OBJECT STRUCTURE (after deep clone):`, {
           correlationId,
           dataKeys: Object.keys(dataToValidate),
           hasAccepted: "accepted" in dataToValidate,
@@ -569,8 +573,7 @@ export class AccessControlApiService {
 
         // Ensure success field is present (required by schema)
         // wrappedResponse.success should be true since we checked it exists
-        // CRITICAL: Explicitly construct the object to ensure all fields are present
-        // Don't rely on spread operator which might fail with Proxies or non-enumerable properties
+        // CRITICAL: Construct from the cloned data to ensure all fields are present
         const dataWithSuccess: Record<string, unknown> = {
           success: wrappedResponse.success === true,
           accepted: dataToValidate.accepted,