@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.0

package/src/__tests__/services/tool-protection-oauth-provider.test.ts

@@ -0,0 +1,480 @@
+/**
+ * Tool Protection Service - oauthProvider Parsing Tests
+ *
+ * Tests for parsing oauthProvider field from all API response formats
+ * (Phase 2: Dynamic Providers)
+ *
+ * @package @kya-os/mcp-i-core
+ */
+
+import { describe, test, expect, beforeEach, vi, afterEach } from 'vitest';
+import { ToolProtectionService } from '../../services/tool-protection.service';
+import {
+  InMemoryToolProtectionCache,
+  type ToolProtectionCache,
+} from '../../cache/tool-protection-cache';
+import type {
+  ToolProtectionServiceConfig,
+  ToolProtectionConfig,
+} from '../../types/tool-protection';
+
+// Mock global fetch
+global.fetch = vi.fn();
+
+describe('ToolProtectionService - oauthProvider Parsing', () => {
+  let service: ToolProtectionService;
+  let cache: ToolProtectionCache;
+  let config: ToolProtectionServiceConfig;
+  const mockAgentDid = 'did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK';
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    cache = new InMemoryToolProtectionCache();
+    config = {
+      apiUrl: 'https://kya.vouched.id',
+      apiKey: 'test-api-key-12345',
+      cacheTtl: 300000, // 5 minutes
+      debug: false,
+    };
+    service = new ToolProtectionService(config, cache);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe('New endpoint format (toolProtections object)', () => {
+    test('should parse oauthProvider from camelCase field', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+            },
+            send_email: {
+              requiresDelegation: true,
+              requiredScopes: ['gmail:send'],
+              oauthProvider: 'google',
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(result.toolProtections.send_email.oauthProvider).toBe('google');
+    });
+
+    test('should parse oauthProvider from snake_case field', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauth_provider: 'github',
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+    });
+
+    test('should prefer camelCase over snake_case when both present', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github', // camelCase (preferred)
+              oauth_provider: 'google', // snake_case (should be ignored)
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      // Should prefer camelCase
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(result.toolProtections.read_repos.oauthProvider).not.toBe('google');
+    });
+
+    test('should handle missing oauthProvider field (backward compatible)', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              // No oauthProvider field (Phase 1 compatibility)
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.requiresDelegation).toBe(true);
+      expect(result.toolProtections.read_repos.requiredScopes).toEqual(['repo:read']);
+      // oauthProvider should be undefined (not included in object)
+      expect(result.toolProtections.read_repos).not.toHaveProperty('oauthProvider');
+    });
+  });
+
+  describe('Old endpoint format (tools array)', () => {
+    test('should parse oauthProvider from array format with camelCase', async () => {
+      const apiResponse = {
+        success: true,
+        data: {
+          tools: [
+            {
+              name: 'read_repos',
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+            },
+            {
+              name: 'send_email',
+              requiresDelegation: true,
+              requiredScopes: ['gmail:send'],
+              oauthProvider: 'google',
+            },
+          ],
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(result.toolProtections.send_email.oauthProvider).toBe('google');
+    });
+
+    test('should parse oauthProvider from array format with snake_case', async () => {
+      const apiResponse = {
+        success: true,
+        data: {
+          tools: [
+            {
+              name: 'read_repos',
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauth_provider: 'github',
+            },
+          ],
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+    });
+
+    test('should prefer camelCase over snake_case in array format', async () => {
+      const apiResponse = {
+        success: true,
+        data: {
+          tools: [
+            {
+              name: 'read_repos',
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+              oauth_provider: 'google',
+            },
+          ],
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+    });
+  });
+
+  describe('Old endpoint format (tools object)', () => {
+    test('should parse oauthProvider from object format with camelCase', async () => {
+      const apiResponse = {
+        success: true,
+        data: {
+          tools: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+            },
+            send_email: {
+              requiresDelegation: true,
+              requiredScopes: ['gmail:send'],
+              oauthProvider: 'google',
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(result.toolProtections.send_email.oauthProvider).toBe('google');
+    });
+
+    test('should parse oauthProvider from object format with snake_case', async () => {
+      const apiResponse = {
+        success: true,
+        data: {
+          tools: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauth_provider: 'github',
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+    });
+
+    test('should prefer camelCase over snake_case in object format', async () => {
+      const apiResponse = {
+        success: true,
+        data: {
+          tools: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+              oauth_provider: 'google',
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+    });
+  });
+
+  describe('Caching', () => {
+    test('should cache oauthProvider field correctly', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            read_repos: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      // First call - should fetch from API
+      const result1 = await service.getToolProtectionConfig(mockAgentDid);
+      expect(result1.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(global.fetch).toHaveBeenCalledTimes(1);
+
+      // Second call - should use cache
+      const result2 = await service.getToolProtectionConfig(mockAgentDid);
+      expect(result2.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(global.fetch).toHaveBeenCalledTimes(1); // Still 1, not 2
+    });
+
+    test('should preserve oauthProvider through cache operations', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const cachedConfig: ToolProtectionConfig = {
+        toolProtections: {
+          read_repos: {
+            requiresDelegation: true,
+            requiredScopes: ['repo:read'],
+            oauthProvider: 'github',
+          },
+        },
+      };
+
+      const cacheKey = `config:tool-protections:${projectId}`;
+      await cache.set(cacheKey, cachedConfig, 300000);
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      expect(result.toolProtections.read_repos.oauthProvider).toBe('github');
+      expect(global.fetch).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('oauthProvider field inclusion', () => {
+    test('should include oauthProvider in returned ToolProtection objects when present', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            tool_with_provider: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: 'github',
+            },
+            tool_without_provider: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              // No oauthProvider
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      // Tool with provider should have oauthProvider field
+      expect(result.toolProtections.tool_with_provider.oauthProvider).toBe('github');
+      expect(result.toolProtections.tool_with_provider).toHaveProperty('oauthProvider');
+
+      // Tool without provider should not have oauthProvider field
+      expect(result.toolProtections.tool_without_provider).not.toHaveProperty('oauthProvider');
+    });
+
+    test('should handle empty string oauthProvider gracefully', async () => {
+      const projectId = 'test-project-123';
+      config.projectId = projectId;
+      service = new ToolProtectionService(config, cache);
+
+      const apiResponse = {
+        success: true,
+        data: {
+          toolProtections: {
+            tool_with_empty_provider: {
+              requiresDelegation: true,
+              requiredScopes: ['repo:read'],
+              oauthProvider: '', // Empty string
+            },
+          },
+        },
+        metadata: {},
+      };
+
+      (global.fetch as any).mockResolvedValueOnce({
+        ok: true,
+        json: async () => apiResponse,
+      });
+
+      const result = await service.getToolProtectionConfig(mockAgentDid);
+
+      // Empty string should be treated as falsy and not included
+      expect(result.toolProtections.tool_with_empty_provider).not.toHaveProperty('oauthProvider');
+    });
+  });
+});
+