@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.0

package/src/services/__tests__/access-control.proof-response-validation.test.ts

@@ -0,0 +1,578 @@
+/**
+ * Proof Submission Response Validation Tests
+ *
+ * These tests verify that the proof submission response format matches
+ * the schema defined in @kya-os/contracts, preventing regressions.
+ *
+ * CRITICAL: These tests ensure API parity between MCP-I and AgentShield/Bouncer.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { AccessControlApiService } from "../access-control.service";
+import { proofSubmissionResponseSchema } from "@kya-os/contracts/agentshield-api";
+import type { ProofSubmissionRequest } from "@kya-os/contracts/agentshield-api";
+
+describe("Proof Submission Response Validation", () => {
+  let service: AccessControlApiService;
+  let mockFetch: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    mockFetch = vi.fn();
+    service = new AccessControlApiService({
+      baseUrl: "https://kya.vouched.id",
+      apiKey: "test-api-key",
+      fetchProvider: {
+        fetch: mockFetch,
+      },
+      logger: vi.fn(),
+    });
+  });
+
+  describe("Wrapped Response Format (AgentShield API)", () => {
+    it("should validate wrapped response with success field in data", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Simulate AgentShield API wrapped response
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 1,
+          rejected: 0,
+          outcomes: {
+            success: 1,
+            failed: 0,
+            blocked: 0,
+            error: 0,
+          },
+        },
+        metadata: {
+          requestId: "test-request-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      expect(result).toMatchObject({
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      });
+    });
+
+    it("should validate wrapped response with errors array", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 0,
+          rejected: 1,
+          outcomes: {
+            success: 0,
+            failed: 1,
+            blocked: 0,
+            error: 0,
+          },
+          errors: [
+            {
+              proof_index: 0,
+              error: {
+                code: "validation_error",
+                message: "Proof validation failed",
+                details: { reason: "invalid_signature" },
+              },
+            },
+          ],
+        },
+        metadata: {
+          requestId: "test-request-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      expect(result).toMatchObject({
+        success: true,
+        accepted: 0,
+        rejected: 1,
+        errors: [
+          {
+            proof_index: 0,
+            error: {
+              code: "validation_error",
+              message: "Proof validation failed",
+              details: { reason: "invalid_signature" },
+            },
+          },
+        ],
+      });
+    });
+
+    it("should validate wrapped response without outcomes (optional field)", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Response without outcomes (should be valid per schema)
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 1,
+          rejected: 0,
+          // outcomes omitted - should still validate
+        },
+        metadata: {
+          requestId: "test-request-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      expect(result).toMatchObject({
+        success: true,
+        accepted: 1,
+        rejected: 0,
+      });
+      // outcomes should be undefined or present, but not required
+      expect(result.outcomes).toBeUndefined();
+    });
+
+    it("should throw validation error if data object missing success field", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Response where data object doesn't have success (should be added by service)
+      const wrappedResponse = {
+        success: true,
+        data: {
+          // Missing success field - service should add it
+          accepted: 1,
+          rejected: 0,
+          outcomes: {
+            success: 1,
+            failed: 0,
+            blocked: 0,
+            error: 0,
+          },
+        },
+        metadata: {
+          requestId: "test-request-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      // Should succeed because service adds success field
+      const result = await service.submitProofs(request);
+      expect(result.success).toBe(true);
+    });
+
+    it("should validate schema directly matches AgentShield response format", () => {
+      // This test ensures the schema matches what AgentShield actually returns
+      const agentShieldResponseData = {
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      };
+
+      const validation = proofSubmissionResponseSchema.safeParse(
+        agentShieldResponseData
+      );
+      expect(validation.success).toBe(true);
+      if (validation.success) {
+        expect(validation.data).toMatchObject(agentShieldResponseData);
+      }
+    });
+
+    it("should validate schema with errors array matches AgentShield format", () => {
+      const agentShieldResponseData = {
+        success: true,
+        accepted: 0,
+        rejected: 1,
+        outcomes: {
+          success: 0,
+          failed: 1,
+          blocked: 0,
+          error: 0,
+        },
+        errors: [
+          {
+            proof_index: 0,
+            error: {
+              code: "validation_error",
+              message: "Proof validation failed",
+              details: { reason: "invalid_signature" },
+            },
+          },
+        ],
+      };
+
+      const validation = proofSubmissionResponseSchema.safeParse(
+        agentShieldResponseData
+      );
+      expect(validation.success).toBe(true);
+      if (validation.success) {
+        expect(validation.data.errors).toHaveLength(1);
+        expect(validation.data.errors![0].proof_index).toBe(0);
+        expect(validation.data.errors![0].error.code).toBe("validation_error");
+      }
+    });
+  });
+
+  describe("Regression Prevention", () => {
+    it("should prevent regression: missing success field in data", () => {
+      // This test ensures we catch if AgentShield changes response format
+      const responseWithoutSuccess = {
+        accepted: 1,
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      };
+
+      const validation = proofSubmissionResponseSchema.safeParse(
+        responseWithoutSuccess
+      );
+      expect(validation.success).toBe(false);
+      if (!validation.success) {
+        expect(
+          validation.error.errors.some((e) => e.path.includes("success"))
+        ).toBe(true);
+      }
+    });
+
+    it("should prevent regression: wrong type for accepted/rejected", () => {
+      const invalidResponse = {
+        success: true,
+        accepted: "1", // Should be number
+        rejected: "0", // Should be number
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      };
+
+      const validation =
+        proofSubmissionResponseSchema.safeParse(invalidResponse);
+      expect(validation.success).toBe(false);
+    });
+
+    it("should prevent regression: missing required fields", () => {
+      const incompleteResponse = {
+        success: true,
+        // Missing accepted
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      };
+
+      const validation =
+        proofSubmissionResponseSchema.safeParse(incompleteResponse);
+      expect(validation.success).toBe(false);
+      if (!validation.success) {
+        expect(
+          validation.error.errors.some((e) => e.path.includes("accepted"))
+        ).toBe(true);
+      }
+    });
+  });
+
+  describe("JSON Deep Clone Fix (Cloudflare Workers Edge Case)", () => {
+    it("should correctly extract data from wrapped response after JSON deep clone", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Simulate the exact response format from AgentShield API
+      // This matches the format seen in production logs
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 1,
+          rejected: 0,
+          outcomes: {
+            success: 1,
+          },
+          errors: [],
+        },
+        metadata: {
+          requestId: "fc1fa88f-9b22-4161-b4fd-17d8215098ee",
+          timestamp: "2025-11-24T21:36:33.029Z",
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      // Verify all fields are correctly extracted
+      expect(result.success).toBe(true);
+      expect(result.accepted).toBe(1);
+      expect(result.rejected).toBe(0);
+      expect(result.outcomes).toEqual({ success: 1 });
+      expect(result.errors).toEqual([]);
+    });
+
+    it("should handle response where data fields are numeric values (not undefined)", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Test with zero values (edge case for falsy check)
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 0,
+          rejected: 0,
+          outcomes: {},
+          errors: [],
+        },
+        metadata: {
+          requestId: "test-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      // Verify zero values are correctly extracted (not treated as undefined)
+      expect(result.success).toBe(true);
+      expect(result.accepted).toBe(0);
+      expect(result.rejected).toBe(0);
+    });
+
+    it("should handle response with nested outcomes object", async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: "test-session",
+        proofs: [
+          {
+            jws: "test.jws.signature",
+            meta: {
+              did: "did:key:test",
+              kid: "did:key:test#key-1",
+              ts: Date.now(),
+              nonce: "test-nonce",
+              audience: "https://kya.vouched.id",
+              sessionId: "test-session",
+              requestHash: "sha256:" + "a".repeat(64),
+              responseHash: "sha256:" + "b".repeat(64),
+              scopeId: "test:execute",
+            },
+          },
+        ],
+      };
+
+      // Test with various outcome types
+      const wrappedResponse = {
+        success: true,
+        data: {
+          accepted: 3,
+          rejected: 2,
+          outcomes: {
+            success: 1,
+            failed: 1,
+            blocked: 1,
+            error: 2,
+          },
+          errors: [
+            {
+              proof_index: 0,
+              error: {
+                code: "validation_error",
+                message: "Invalid signature",
+              },
+            },
+          ],
+        },
+        metadata: {
+          requestId: "test-id",
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      mockFetch.mockResolvedValueOnce({
+        ok: true,
+        status: 200,
+        text: async () => JSON.stringify(wrappedResponse),
+        headers: new Headers(),
+      });
+
+      const result = await service.submitProofs(request);
+
+      expect(result.accepted).toBe(3);
+      expect(result.rejected).toBe(2);
+      expect(result.outcomes).toEqual({
+        success: 1,
+        failed: 1,
+        blocked: 1,
+        error: 2,
+      });
+      expect(result.errors).toHaveLength(1);
+      expect(result.errors![0].proof_index).toBe(0);
+    });
+  });
+});