@kya-os/mcp-i-core 1.2.3-canary.6 → 1.3.0

package/src/__tests__/runtime/delegation-flow.test.ts

@@ -0,0 +1,164 @@
+/**
+ * Delegation Verification Flow Integration Tests
+ *
+ * Tests the complete flow: handshake → session creation → tool call → delegation verification
+ * Ensures that session.agentDid is correctly used in delegation verification.
+ *
+ * @package @kya-os/mcp-i-core/__tests__/runtime
+ */
+
+import { describe, it, expect, beforeEach } from "vitest";
+import { MCPIRuntimeBase } from "../../runtime/base";
+import { ProviderRuntimeConfig } from "../../config";
+import {
+  createMockProviders,
+  MockClockProvider,
+  MockIdentityProvider,
+  MockNonceCacheProvider,
+} from "../utils/mock-providers";
+import type { DelegationRecord } from "@kya-os/contracts/delegation";
+
+describe("Delegation Verification Flow", () => {
+  let runtime: MCPIRuntimeBase;
+  let config: ProviderRuntimeConfig;
+  let mockProviders: ReturnType<typeof createMockProviders>;
+
+  beforeEach(async () => {
+    mockProviders = createMockProviders();
+    config = {
+      ...mockProviders,
+      environment: "development",
+      session: {
+        timestampSkewSeconds: 120,
+        ttlMinutes: 30,
+      },
+      audit: {
+        enabled: false, // Disable audit for cleaner test output
+      },
+    };
+    runtime = new MCPIRuntimeBase(config);
+    await runtime.initialize();
+  });
+
+  it("should verify delegation using session.agentDid", async () => {
+    const agentDid = "did:key:zagent123";
+    const userDid = "did:web:user.example.com";
+
+    // 1. Perform handshake with agentDid
+    const handshakeRequest = {
+      nonce: "test-nonce-123",
+      audience: "https://server.example.com",
+      timestamp: Math.floor(Date.now() / 1000),
+      agentDid,
+      clientDid: userDid,
+    };
+
+    const handshakeResponse = await runtime.handleHandshake(handshakeRequest);
+    expect(handshakeResponse.sessionId).toBeDefined();
+
+    // 2. Get session and verify agentDid is correct
+    const session = await runtime.getCurrentSession();
+    expect(session).toBeDefined();
+    expect(session?.agentDid).toBe(agentDid); // ✅ Should be client's agent DID, not server DID
+    expect(session?.serverDid).toBe("did:key:zmock123"); // ✅ Should be server's DID
+
+    // 3. Create a delegation with subjectDid matching agentDid
+    // (In real scenario, this would be verified via delegation verifier)
+    const delegation: DelegationRecord = {
+      id: "del_test_001",
+      issuerDid: userDid,
+      subjectDid: agentDid, // ✅ Matches session.agentDid
+      controller: "user_alice",
+      vcId: "vc_test_001",
+      constraints: {
+        scopes: ["tool:execute"],
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000, // 1 hour
+    };
+
+    // 4. Verify that delegation.subjectDid matches session.agentDid
+    expect(delegation.subjectDid).toBe(session?.agentDid);
+    expect(delegation.subjectDid).not.toBe(session?.serverDid); // ✅ Should NOT match server DID
+  });
+
+  it("should fail when session.agentDid does not match delegation.subjectDid", async () => {
+    const agentDid = "did:key:zagent123";
+    const wrongAgentDid = "did:key:zwrong456";
+    const userDid = "did:web:user.example.com";
+
+    // 1. Perform handshake with agentDid
+    const handshakeRequest = {
+      nonce: "test-nonce-456",
+      audience: "https://server.example.com",
+      timestamp: Math.floor(Date.now() / 1000),
+      agentDid,
+      clientDid: userDid,
+    };
+
+    await runtime.handleHandshake(handshakeRequest);
+
+    // 2. Get session
+    const session = await runtime.getCurrentSession();
+    expect(session?.agentDid).toBe(agentDid);
+
+    // 3. Create delegation with wrong subjectDid
+    const delegation: DelegationRecord = {
+      id: "del_test_002",
+      issuerDid: userDid,
+      subjectDid: wrongAgentDid, // ❌ Does NOT match session.agentDid
+      controller: "user_bob",
+      vcId: "vc_test_002",
+      constraints: {
+        scopes: ["tool:execute"],
+      },
+      createdAt: Date.now(),
+      expiresAt: Date.now() + 3600000,
+    };
+
+    // 4. Verify mismatch
+    expect(delegation.subjectDid).not.toBe(session?.agentDid);
+    expect(delegation.subjectDid).toBe(wrongAgentDid);
+  });
+
+  it("should handle session without agentDid gracefully", async () => {
+    const userDid = "did:web:user.example.com";
+
+    // 1. Perform handshake WITHOUT agentDid
+    const handshakeRequest = {
+      nonce: "test-nonce-789",
+      audience: "https://server.example.com",
+      timestamp: Math.floor(Date.now() / 1000),
+      // agentDid not provided
+      clientDid: userDid,
+    };
+
+    await runtime.handleHandshake(handshakeRequest);
+
+    // 2. Get session
+    const session = await runtime.getCurrentSession();
+    expect(session?.agentDid).toBeUndefined(); // ✅ Should be undefined, not fallback to clientDid
+    expect(session?.serverDid).toBe("did:key:zmock123"); // ✅ Server DID should still be set
+  });
+
+  it("should verify serverDid is set correctly in session", async () => {
+    const agentDid = "did:key:zagent789";
+    const identity = await runtime.getIdentity();
+
+    // 1. Perform handshake
+    const handshakeRequest = {
+      nonce: "test-nonce-server",
+      audience: "https://server.example.com",
+      timestamp: Math.floor(Date.now() / 1000),
+      agentDid,
+    };
+
+    await runtime.handleHandshake(handshakeRequest);
+
+    // 2. Verify serverDid matches identity.did
+    const session = await runtime.getCurrentSession();
+    expect(session?.serverDid).toBe(identity.did);
+    expect(session?.serverDid).not.toBe(agentDid); // ✅ Should NOT match agent DID
+  });
+});
+

package/src/__tests__/runtime/proof-client-did.test.ts

@@ -0,0 +1,375 @@
+/**
+ * Proof Client DID Tests
+ *
+ * Tests for proof generation with clientDid tracking and extraction.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { MCPIRuntimeBase } from '../../runtime/base';
+import { ProviderRuntimeConfig } from '../../config';
+import { createMockProviders, MockClockProvider } from '../utils/mock-providers';
+
+describe('MCPIRuntimeBase - Proof Client DID', () => {
+  let runtime: MCPIRuntimeBase;
+  let config: ProviderRuntimeConfig;
+  let mockProviders: ReturnType<typeof createMockProviders>;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    mockProviders = createMockProviders();
+    config = {
+      ...mockProviders,
+      environment: 'development',
+      session: {
+        timestampSkewSeconds: 120,
+        ttlMinutes: 30
+      },
+      audit: {
+        enabled: false
+      }
+    };
+    runtime = new MCPIRuntimeBase(config);
+    await runtime.initialize();
+  });
+
+  describe('createProof with clientDid', () => {
+    it('should include clientDid in proof when provided in session', async () => {
+      const testData = { result: 'success' };
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: 'did:key:zclient123'
+      };
+
+      const proof = await runtime.createProof(testData, session);
+
+      expect(proof).toBeDefined();
+      expect(proof.did).toBe('did:key:zmock123'); // Agent DID
+      expect(proof.sessionId).toBe('session123');
+      expect(proof.audience).toBe('https://client.example.com');
+      // Note: clientDid is stored in proofData but not directly in proof object
+      // The proof structure includes sessionId which can be used to retrieve clientDid
+    });
+
+    it('should include userDid in proof when provided in session', async () => {
+      const testData = { result: 'success' };
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        userDid: 'did:key:zuser456'
+      };
+
+      const proof = await runtime.createProof(testData, session);
+
+      expect(proof).toBeDefined();
+      expect(proof.sessionId).toBe('session123');
+      // userDid is stored in session context
+    });
+
+    it('should work without clientDid or userDid (backward compatibility)', async () => {
+      const testData = { result: 'success' };
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce'
+      };
+
+      const proof = await runtime.createProof(testData, session);
+
+      expect(proof).toBeDefined();
+      expect(proof.did).toBe('did:key:zmock123');
+      expect(proof.sessionId).toBe('session123');
+      expect(proof.audience).toBe('https://client.example.com');
+    });
+
+    it('should prioritize clientDid over userDid when both provided', async () => {
+      const testData = { result: 'success' };
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: 'did:key:zclient123',
+        userDid: 'did:key:zuser456'
+      };
+
+      const proof = await runtime.createProof(testData, session);
+
+      expect(proof).toBeDefined();
+      expect(proof.sessionId).toBe('session123');
+      // clientDid takes precedence in session context
+    });
+  });
+
+  describe('processToolCall with clientDid', () => {
+    const mockHandler = vi.fn().mockResolvedValue({ result: 'success' });
+
+    it('should include clientDid in proof when session has clientDid', async () => {
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: 'did:key:zclient123'
+      };
+
+      await runtime.processToolCall(
+        'testTool',
+        { arg: 'value' },
+        mockHandler,
+        session
+      );
+
+      const proof = runtime.getLastProof();
+      expect(proof).toBeDefined();
+      expect(proof.sessionId).toBe('session123');
+      expect(proof.audience).toBe('https://client.example.com');
+    });
+
+    it('should extract clientDid from handshake session', async () => {
+      // Create session via handshake
+      const handshakeResponse = await runtime.handleHandshake({
+        clientDid: 'did:key:zhandshake123',
+        audience: 'https://client.example.com'
+      });
+
+      const session = await runtime.getCurrentSession();
+      const proof = await runtime.createProof(
+        { test: 'data' },
+        session
+      );
+
+      expect(proof.sessionId).toBe(handshakeResponse.sessionId);
+      expect(session.clientDid).toBe('did:key:zhandshake123');
+    });
+
+    it('should handle userDid from handshake session', async () => {
+      // Initialize runtime with user DID generation enabled
+      const configWithUserDid = {
+        ...config,
+        identity: {
+          enabled: true,
+          generateUserDids: true,
+          environment: 'development'
+        }
+      };
+      const runtimeWithUserDid = new MCPIRuntimeBase(configWithUserDid);
+      await runtimeWithUserDid.initialize();
+
+      const handshakeResponse = await runtimeWithUserDid.handleHandshake({
+        audience: 'https://client.example.com'
+      });
+
+      const session = await runtimeWithUserDid.getCurrentSession();
+      expect(session).toBeDefined();
+      
+      // When userDid generation is enabled, it should be generated and available
+      // This is a critical assertion - if userDid is missing, the test should fail
+      expect(session.userDid).toBeDefined();
+      expect(session.userDid).toMatch(/^did:key:z/);
+      
+      const proof = await runtimeWithUserDid.createProof(
+        { test: 'data' },
+        session
+      );
+      expect(proof.sessionId).toBe(handshakeResponse.sessionId);
+    });
+  });
+
+  describe('verifyProof with clientDid context', () => {
+    let validProof: any;
+    const testData = { foo: 'bar' };
+
+    beforeEach(async () => {
+      // Set up DID document for verification
+      const fetchProvider = mockProviders.fetchProvider as any;
+      fetchProvider.setDIDDocument('did:key:zmock123', {
+        verificationMethod: [{
+          publicKeyBase64: 'mock-public-key'
+        }]
+      });
+
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: 'did:key:zclient123'
+      };
+
+      validProof = await runtime.createProof(testData, session);
+    });
+
+    it('should verify proof with clientDid in session context', async () => {
+      const nonceCache = mockProviders.nonceCacheProvider as any;
+      nonceCache.clear();
+
+      const isValid = await runtime.verifyProof(testData, validProof);
+      expect(isValid).toBe(true);
+    });
+
+    it('should verify proof independently of clientDid presence', async () => {
+      // Create proof without clientDid
+      const proofWithoutClientDid = await runtime.createProof(testData, {
+        id: 'session456',
+        audience: 'https://client.example.com',
+        nonce: 'other-nonce'
+      });
+
+      const nonceCache = mockProviders.nonceCacheProvider as any;
+      nonceCache.clear();
+
+      const isValid = await runtime.verifyProof(testData, proofWithoutClientDid);
+      expect(isValid).toBe(true);
+    });
+  });
+
+  describe('clientDid extraction from session', () => {
+    it('should retrieve clientDid from active session', async () => {
+      const handshakeResponse = await runtime.handleHandshake({
+        clientDid: 'did:key:zclient789',
+        audience: 'https://client.example.com'
+      });
+
+      const session = await runtime.getCurrentSession();
+      expect(session.clientDid).toBe('did:key:zclient789');
+    });
+
+    it('should use generated userDid as clientDid when no clientDid provided', async () => {
+      const configWithUserDid = {
+        ...config,
+        identity: {
+          enabled: true,
+          generateUserDids: true,
+          environment: 'development'
+        }
+      };
+      const runtimeWithUserDid = new MCPIRuntimeBase(configWithUserDid);
+      await runtimeWithUserDid.initialize();
+
+      const handshakeResponse = await runtimeWithUserDid.handleHandshake({
+        audience: 'https://client.example.com'
+      });
+
+      const session = await runtimeWithUserDid.getCurrentSession();
+      expect(session).toBeDefined();
+      
+      // When userDid generation is enabled, it should be generated and available
+      // This is a critical assertion - if userDid is missing, the test should fail
+      expect(session.userDid).toBeDefined();
+      expect(session.userDid).toMatch(/^did:key:z/);
+      
+      // clientDid should be set to userDid if no explicit clientDid provided
+      expect(session.clientDid || session.userDid).toBeDefined();
+      
+      // Verify proof includes the session
+      const proof = await runtimeWithUserDid.createProof(
+        { test: 'data' },
+        session
+      );
+      expect(proof.sessionId).toBe(handshakeResponse.sessionId);
+    });
+  });
+
+  describe('edge cases', () => {
+    it('should handle empty clientDid string gracefully', async () => {
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: ''
+      };
+
+      const proof = await runtime.createProof({ test: 'data' }, session);
+      expect(proof).toBeDefined();
+      expect(proof.sessionId).toBe('session123');
+    });
+
+    it('should handle null clientDid gracefully', async () => {
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: null as any
+      };
+
+      const proof = await runtime.createProof({ test: 'data' }, session);
+      expect(proof).toBeDefined();
+      expect(proof.sessionId).toBe('session123');
+    });
+
+    it('should handle undefined clientDid gracefully', async () => {
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce'
+        // clientDid is undefined
+      };
+
+      const proof = await runtime.createProof({ test: 'data' }, session);
+      expect(proof).toBeDefined();
+      expect(proof.sessionId).toBe('session123');
+    });
+
+    it('should handle invalid DID format in clientDid', async () => {
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: 'invalid-did-format'
+      };
+
+      const proof = await runtime.createProof({ test: 'data' }, session);
+      expect(proof).toBeDefined();
+      // Proof should still be created even with invalid DID format
+      expect(proof.sessionId).toBe('session123');
+    });
+  });
+
+  describe('proof metadata consistency', () => {
+    it('should maintain consistent proof structure with clientDid', async () => {
+      const session = {
+        id: 'session123',
+        audience: 'https://client.example.com',
+        nonce: 'test-nonce',
+        clientDid: 'did:key:zclient123'
+      };
+
+      const proof1 = await runtime.createProof({ test: 'data1' }, session);
+      const proof2 = await runtime.createProof({ test: 'data2' }, session);
+
+      // Both proofs should have same sessionId and audience
+      expect(proof1.sessionId).toBe(proof2.sessionId);
+      expect(proof1.audience).toBe(proof2.audience);
+      
+      // But different nonces (if not pre-provided)
+      // Since we're using same nonce, they should be same
+      expect(proof1.nonce).toBe(proof2.nonce);
+      
+      // Different timestamps
+      expect(proof1.timestamp).toBeLessThanOrEqual(proof2.timestamp);
+    });
+
+    it('should use different proofs for different sessions', async () => {
+      const session1 = {
+        id: 'session1',
+        audience: 'https://client.example.com',
+        nonce: 'nonce1',
+        clientDid: 'did:key:zclient1'
+      };
+
+      const session2 = {
+        id: 'session2',
+        audience: 'https://client.example.com',
+        nonce: 'nonce2',
+        clientDid: 'did:key:zclient2'
+      };
+
+      const proof1 = await runtime.createProof({ test: 'data' }, session1);
+      const proof2 = await runtime.createProof({ test: 'data' }, session2);
+
+      expect(proof1.sessionId).not.toBe(proof2.sessionId);
+      expect(proof1.nonce).not.toBe(proof2.nonce);
+    });
+  });
+});
+