@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.0-canary.clientinfo.20251126003544

package/src/__tests__/services/provider-resolver-edge-cases.test.ts

@@ -0,0 +1,487 @@
+/**
+ * Provider Resolver - Edge Cases Tests
+ *
+ * Tests for edge cases and error scenarios in provider resolution
+ * (Phase 2: Dynamic Providers)
+ *
+ * @package @kya-os/mcp-i-core
+ */
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { ProviderResolver } from "../../services/provider-resolver.js";
+import { OAuthProviderRegistry } from "../../services/oauth-provider-registry.js";
+import { OAuthConfigService } from "../../services/oauth-config.service.js";
+import type { ToolProtection } from "@kya-os/contracts/tool-protection";
+import type { OAuthConfig } from "@kya-os/contracts/config";
+
+describe("ProviderResolver - Edge Cases", () => {
+  let mockConfigService: OAuthConfigService;
+  let mockRegistry: OAuthProviderRegistry;
+  let resolver: ProviderResolver;
+
+  const mockOAuthConfig: OAuthConfig = {
+    providers: {
+      github: {
+        clientId: "github_client_id",
+        authorizationUrl: "https://github.com/login/oauth/authorize",
+        tokenUrl: "https://github.com/login/oauth/access_token",
+        supportsPKCE: true,
+        requiresClientSecret: false,
+      },
+      google: {
+        clientId: "google_client_id",
+        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
+        tokenUrl: "https://oauth2.googleapis.com/token",
+        supportsPKCE: true,
+        requiresClientSecret: false,
+      },
+      microsoft: {
+        clientId: "microsoft_client_id",
+        authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        supportsPKCE: true,
+        requiresClientSecret: false,
+      },
+    },
+  };
+
+  beforeEach(() => {
+    // Don't clear mocks here - it might interfere with mock return values
+    // Instead, create fresh mocks for each test
+
+    mockConfigService = {
+      getOAuthConfig: vi.fn().mockResolvedValue(mockOAuthConfig),
+    } as any;
+
+    // Create fresh mocks for each test
+    const getProviderNamesMock = vi.fn().mockReturnValue([]);
+    const loadFromAgentShieldMock = vi.fn().mockResolvedValue(undefined);
+    const hasProviderMock = vi.fn().mockReturnValue(false);
+
+    mockRegistry = {
+      hasProvider: hasProviderMock,
+      getAllProviders: vi.fn().mockReturnValue([]),
+      getProviderNames: getProviderNamesMock,
+      loadFromAgentShield: loadFromAgentShieldMock,
+    } as any;
+
+    resolver = new ProviderResolver(mockRegistry, mockConfigService);
+  });
+
+  describe("Provider validation (Priority 1)", () => {
+    it("should validate provider exists before returning", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["repo:read"],
+        oauthProvider: "github",
+      };
+
+      // Mock registry that simulates loaded state
+      const testRegistry = {
+        getProviderNames: vi.fn().mockReturnValue(["github", "google"]),
+        hasProvider: vi.fn((provider: string) => provider === "github" || provider === "google"),
+        loadFromAgentShield: vi.fn().mockResolvedValue(undefined),
+        getAllProviders: vi.fn().mockReturnValue([]),
+      };
+      
+      const testResolver = new ProviderResolver(testRegistry as any, mockConfigService);
+
+      const provider = await testResolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("github");
+      expect(testRegistry.hasProvider).toHaveBeenCalledWith("github");
+      // Should not need to load since registry already has providers
+      expect(testRegistry.loadFromAgentShield).not.toHaveBeenCalled();
+    });
+
+    // TODO: Fix this test - it's trying to verify that the registry automatically loads
+    // when empty, but the mock state transitions are complex due to async timing.
+    // The test needs to properly simulate the registry state changing from empty to
+    // populated after loadFromAgentShield completes, but before hasProvider is called.
+    // Consider using a more integration-style test or rethinking the test approach.
+    it.skip("should load registry if empty before checking provider existence", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["repo:read"],
+        oauthProvider: "github",
+      };
+
+      // Create a mock registry that starts empty
+      const mockEmptyRegistry = {
+        getProviderNames: vi.fn().mockReturnValue([]), // Empty initially
+        hasProvider: vi.fn().mockReturnValue(false), // No providers initially
+        loadFromAgentShield: vi.fn().mockResolvedValue(undefined),
+        getAllProviders: vi.fn().mockReturnValue([]),
+      };
+      
+      const testResolver = new ProviderResolver(mockEmptyRegistry as any, mockConfigService);
+      
+      // Since the registry starts empty and hasProvider returns false,
+      // the resolver will throw an error about the provider not being configured
+      await expect(
+        testResolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow(/not configured for project/);
+      
+      // Verify that loadFromAgentShield was called
+      expect(mockEmptyRegistry.loadFromAgentShield).toHaveBeenCalledWith("test-project");
+      expect(mockEmptyRegistry.getProviderNames).toHaveBeenCalled();
+      expect(mockEmptyRegistry.hasProvider).toHaveBeenCalledWith("github");
+    });
+
+    it("should throw error if tool-specific provider not configured", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["repo:read"],
+        oauthProvider: "nonexistent",
+      };
+
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+
+      await expect(
+        resolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow(/not configured for project/);
+    });
+  });
+
+  describe("Scope inference edge cases (Priority 2)", () => {
+    it("should handle empty scopes array", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [],
+      };
+
+      // Should fall through to Priority 3
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use first configured provider (Priority 3)
+      expect(provider).toBe("github");
+    });
+
+    it("should handle ambiguous scopes (multiple providers inferred)", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read", "google:calendar:read"],
+      };
+
+      // Ambiguous scopes should fall through to Priority 3
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use first configured provider (Priority 3)
+      expect(provider).toBe("github");
+    });
+
+    it("should handle unknown scope prefixes", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["custom:unknown:scope"],
+      };
+
+      // Unknown prefix should fall through to Priority 3
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use first configured provider (Priority 3)
+      expect(provider).toBe("github");
+    });
+
+    it("should verify gmail → google mapping works", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["gmail:read"],
+      };
+
+      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
+        return name === "google";
+      });
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("google");
+    });
+
+    it("should verify calendar → google mapping works", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["calendar:read"],
+      };
+
+      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
+        return name === "google";
+      });
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("google");
+    });
+
+    it("should verify outlook → microsoft mapping works", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["outlook:read"],
+      };
+
+      (mockRegistry.getProviderNames as any).mockReturnValue(["microsoft"]);
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
+        return name === "microsoft";
+      });
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("microsoft");
+    });
+
+    it("should handle scopes without colons", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["read", "write"], // No colons
+      };
+
+      // Should fall through to Priority 3
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use first configured provider (Priority 3)
+      expect(provider).toBe("github");
+    });
+
+    it("should handle inferred provider not in registry", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read"],
+      };
+
+      // Inferred provider exists but not in registry
+      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]); // Only google configured
+      (mockRegistry.hasProvider as any).mockReturnValue(false); // github not in registry
+
+      // Should fall through to Priority 3
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "google_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use first configured provider (Priority 3)
+      expect(provider).toBe("google");
+    });
+  });
+
+  describe("Fallback behavior (Priority 3)", () => {
+    it("should log deprecation warning for Phase 1 fallback", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["custom:scope"],
+      };
+
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+
+      const consoleSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+      await resolver.resolveProvider(toolProtection, "test-project");
+
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining("deprecated")
+      );
+      expect(consoleSpy).toHaveBeenCalledWith(
+        expect.stringContaining("first configured provider")
+      );
+
+      consoleSpy.mockRestore();
+    });
+
+    it("should use first configured provider when oauthProvider not specified", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["custom:scope"],
+      };
+
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([
+        { clientId: "github_client_id" },
+        { clientId: "google_client_id" },
+      ]);
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      // Should use first provider
+      expect(provider).toBe("github");
+    });
+  });
+
+  describe("Error scenarios (Priority 4)", () => {
+    it("should throw error if no providers configured", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [],
+      };
+
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([]);
+      (mockRegistry.getProviderNames as any).mockReturnValue([]);
+
+      await expect(
+        resolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow(/no provider could be resolved/);
+    });
+
+    it("should include project ID in error message", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [],
+      };
+
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([]);
+      (mockRegistry.getProviderNames as any).mockReturnValue([]);
+
+      try {
+        await resolver.resolveProvider(toolProtection, "test-project-123");
+      } catch (error) {
+        expect((error as Error).message).toContain("test-project-123");
+      }
+    });
+
+    it("should provide helpful error message with resolution steps", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [],
+      };
+
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.getAllProviders as any).mockReturnValue([]);
+      (mockRegistry.getProviderNames as any).mockReturnValue([]);
+
+      try {
+        await resolver.resolveProvider(toolProtection, "test-project");
+      } catch (error) {
+        const message = (error as Error).message;
+        expect(message).toContain("oauthProvider");
+        expect(message).toContain("configure");
+      }
+    });
+  });
+
+  describe("Registry load failures", () => {
+    it("should propagate registry load errors", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [],
+      };
+
+      (mockRegistry.hasProvider as any).mockReturnValue(false);
+      (mockRegistry.loadFromAgentShield as any).mockRejectedValueOnce(
+        new Error("Network error")
+      );
+
+      await expect(
+        resolver.resolveProvider(toolProtection, "test-project")
+      ).rejects.toThrow("Network error");
+    });
+  });
+
+  describe("Provider name case sensitivity", () => {
+    it("should handle provider names case-insensitively in inference", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["GITHUB:repo:read"], // Uppercase prefix
+      };
+
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
+        return name.toLowerCase() === "github";
+      });
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("github");
+    });
+  });
+
+  describe("Multiple scopes with same provider", () => {
+    it("should handle multiple scopes from same provider", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: [
+          "github:repo:read",
+          "github:repo:write",
+          "github:user:read",
+        ],
+      };
+
+      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
+      (mockRegistry.hasProvider as any).mockReturnValue(true);
+
+      const provider = await resolver.resolveProvider(
+        toolProtection,
+        "test-project"
+      );
+
+      expect(provider).toBe("github");
+    });
+  });
+});
+