@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.0

package/src/services/__tests__/access-control.service.test.ts

@@ -0,0 +1,970 @@
+/**
+ * Unit Tests for AccessControlApiService
+ *
+ * Comprehensive test coverage for the access control API service.
+ * Tests all methods (fetchConfig, verifyDelegation, submitProofs) with
+ * success cases, error cases, retry logic, and validation.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { AccessControlApiService } from '../access-control.service.js';
+import { AgentShieldAPIError } from '@kya-os/contracts/agentshield-api';
+import type { FetchProvider } from '../../providers/base.js';
+import type {
+  VerifyDelegationRequest,
+  ToolProtectionConfigAPIResponse,
+  ProofSubmissionRequest,
+} from '@kya-os/contracts/agentshield-api';
+
+describe('AccessControlApiService', () => {
+  let service: AccessControlApiService;
+  let mockFetchProvider: FetchProvider;
+  let mockLogger: ReturnType<typeof vi.fn>;
+  let mockSleep: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    mockLogger = vi.fn();
+    mockSleep = vi.fn().mockResolvedValue(undefined);
+
+    mockFetchProvider = {
+      resolveDID: vi.fn(),
+      fetchStatusList: vi.fn(),
+      fetchDelegationChain: vi.fn(),
+      fetch: vi.fn(),
+    } as unknown as FetchProvider;
+
+    service = new AccessControlApiService({
+      baseUrl: 'https://api.example.com',
+      apiKey: 'test-api-key',
+      fetchProvider: mockFetchProvider,
+      logger: mockLogger,
+      sleepProvider: mockSleep,
+      retryConfig: {
+        maxRetries: 2,
+        initialDelayMs: 10,
+        maxDelayMs: 100,
+      },
+    });
+  });
+
+  describe('fetchConfig', () => {
+    it('should fetch config successfully', async () => {
+      const mockResponse: ToolProtectionConfigAPIResponse = {
+        success: true,
+        data: {
+          agent_did: 'did:key:z123',
+          tools: {
+            'tool1': {
+              scopes: ['scope1'],
+              requires_delegation: true,
+            },
+          },
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result = await service.fetchConfig({ agentDid: 'did:key:z123' });
+
+      expect(result).toEqual(mockResponse);
+      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
+        'https://api.example.com/api/v1/bouncer/config?agent_did=did%3Akey%3Az123',
+        expect.objectContaining({
+          method: 'GET',
+          headers: expect.objectContaining({
+            'Authorization': 'Bearer test-api-key',
+            'Content-Type': 'application/json',
+          }),
+        })
+      );
+    });
+
+    it('should handle 404 error', async () => {
+      const errorResponse = {
+        success: false,
+        error: {
+          code: 'config_not_found',
+          message: 'Config not found',
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(errorResponse), {
+          status: 404,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      await expect(
+        service.fetchConfig({ agentDid: 'did:key:z123' })
+      ).rejects.toThrow(AgentShieldAPIError);
+
+      const metrics = service.getMetrics();
+      expect(metrics.errorCount).toBe(1);
+    });
+
+    it('should retry on 500 error', async () => {
+      const mockResponse: ToolProtectionConfigAPIResponse = {
+        success: true,
+        data: {
+          agent_did: 'did:key:z123',
+          tools: {},
+        },
+      };
+
+      // First call fails with 500, second succeeds
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mockResolvedValueOnce(
+          new Response('Internal Server Error', { status: 500 })
+        )
+        .mockResolvedValueOnce(
+          new Response(JSON.stringify(mockResponse), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+          })
+        );
+
+      const result = await service.fetchConfig({ agentDid: 'did:key:z123' });
+
+      expect(result).toEqual(mockResponse);
+      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(2);
+      expect(mockSleep).toHaveBeenCalled();
+      expect(service.getMetrics().retryCount).toBe(1);
+    });
+
+    it('should handle invalid JSON response', async () => {
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mockResolvedValueOnce(
+          new Response('invalid json', {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+          })
+        )
+        .mockResolvedValueOnce(
+          new Response('invalid json', {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+          })
+        );
+
+      await expect(
+        service.fetchConfig({ agentDid: 'did:key:z123' })
+      ).rejects.toThrow(AgentShieldAPIError);
+
+      const error = await service
+        .fetchConfig({ agentDid: 'did:key:z123' })
+        .catch((e) => e);
+      expect(error).toBeInstanceOf(AgentShieldAPIError);
+      expect(error.code).toBe('invalid_response');
+    });
+  });
+
+  describe('verifyDelegation', () => {
+    it('should verify delegation successfully', async () => {
+      const request: VerifyDelegationRequest = {
+        agent_did: 'did:key:z123',
+        scopes: ['scope1', 'scope2'],
+      };
+
+      const mockResponse = {
+        success: true,
+        data: {
+          valid: true,
+          delegation_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID format
+          credential: {
+            agent_did: 'did:key:z123',
+            scopes: ['scope1', 'scope2'],
+            issued_at: Math.floor(Date.now() / 1000), // Unix timestamp (positive integer)
+            created_at: Math.floor(Date.now() / 1000), // Unix timestamp (positive integer)
+          },
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result = await service.verifyDelegation(request);
+
+      expect(result.data.valid).toBe(true);
+      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
+        'https://api.example.com/api/v1/bouncer/delegations/verify',
+        expect.objectContaining({
+          method: 'POST',
+          body: JSON.stringify({
+            agent_did: 'did:key:z123',
+            scopes: ['scope1', 'scope2'],
+          }),
+        })
+      );
+    });
+
+    it('should omit scopes field when scopes is undefined (truly optional)', async () => {
+      const request: VerifyDelegationRequest = {
+        agent_did: 'did:key:z123',
+        // scopes is intentionally omitted
+      };
+
+      const mockResponse = {
+        success: true,
+        data: { valid: true },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      try {
+        await service.verifyDelegation(request);
+      } catch (error: any) {
+        // Log validation errors and mock logger calls for debugging
+        if (error.details?.zodErrors) {
+          console.log('Validation errors:', JSON.stringify(error.details.zodErrors, null, 2));
+        }
+        // Check mock logger calls
+        const loggerCalls = mockLogger.mock.calls;
+        const debugCall = loggerCalls.find((call: any[]) => 
+          call[0]?.includes('Request body debug')
+        );
+        if (debugCall) {
+          console.log('Debug log:', JSON.stringify(debugCall[1], null, 2));
+        }
+        throw error;
+      }
+
+      const callArgs = (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mock.calls[0];
+      const requestBody = JSON.parse(callArgs[1].body as string);
+      
+      // Verify scopes field is not included in request body when undefined
+      expect(requestBody).not.toHaveProperty('scopes');
+      expect(requestBody.agent_did).toBe('did:key:z123');
+    });
+
+    it('should include scopes field when scopes is provided', async () => {
+      const request: VerifyDelegationRequest = {
+        agent_did: 'did:key:z123',
+        scopes: ['scope1', 'scope2'],
+      };
+
+      const mockResponse = {
+        success: true,
+        data: { valid: true },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      await service.verifyDelegation(request);
+
+      const callArgs = (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mock.calls[0];
+      const requestBody = JSON.parse(callArgs[1].body as string);
+      
+      // Verify scopes field is included when provided
+      expect(requestBody.scopes).toEqual(['scope1', 'scope2']);
+    });
+
+    it('should include delegation_token from context', async () => {
+      const request: VerifyDelegationRequest = {
+        agent_did: 'did:key:z123',
+        scopes: ['scope1'],
+      };
+
+      const mockResponse = {
+        success: true,
+        data: { valid: true },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      await service.verifyDelegation(request, {
+        delegationToken: 'token-123',
+        credentialJwt: 'jwt-123',
+      });
+
+      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
+        expect.any(String),
+        expect.objectContaining({
+          body: expect.stringContaining('delegation_token'),
+        })
+      );
+    });
+
+    it('should handle validation error', async () => {
+      const invalidRequest = {
+        agent_did: '', // Invalid: empty string
+        scopes: [],
+      } as VerifyDelegationRequest;
+
+      // Mock fetch twice since we call verifyDelegation twice
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: 'validation_error',
+                message: 'Invalid request',
+              },
+            }),
+            {
+              status: 400,
+              headers: { 'Content-Type': 'application/json' },
+            }
+          )
+        )
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: 'validation_error',
+                message: 'Invalid request',
+              },
+            }),
+            {
+              status: 400,
+              headers: { 'Content-Type': 'application/json' },
+            }
+          )
+        );
+
+      await expect(
+        service.verifyDelegation(invalidRequest)
+      ).rejects.toThrow(AgentShieldAPIError);
+
+      const error = await service
+        .verifyDelegation(invalidRequest)
+        .catch((e) => e);
+      expect(error.code).toBe('validation_error');
+    });
+
+    it('should handle 401 authentication error', async () => {
+      const request: VerifyDelegationRequest = {
+        agent_did: 'did:key:z123',
+        scopes: ['scope1'],
+      };
+
+      // Mock fetch twice since we call verifyDelegation twice
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: 'authentication_failed',
+                message: 'Invalid API key',
+              },
+            }),
+            {
+              status: 401,
+              headers: { 'Content-Type': 'application/json' },
+            }
+          )
+        )
+        .mockResolvedValueOnce(
+          new Response(
+            JSON.stringify({
+              success: false,
+              error: {
+                code: 'authentication_failed',
+                message: 'Invalid API key',
+              },
+            }),
+            {
+              status: 401,
+              headers: { 'Content-Type': 'application/json' },
+            }
+          )
+        );
+
+      await expect(service.verifyDelegation(request)).rejects.toThrow(
+        AgentShieldAPIError
+      );
+
+      const error = await service.verifyDelegation(request).catch((e) => e);
+      expect(error.code).toBe('authentication_failed');
+    });
+  });
+
+  describe('submitProofs', () => {
+    it('should submit proofs successfully', async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID
+        delegation_id: null, // Explicitly set to null
+        proofs: [
+          {
+            jws: 'header.payload.signature',
+            meta: {
+              did: 'did:key:z123',
+              kid: 'did:key:z123#key-1',
+              ts: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
+              nonce: 'nonce-123',
+              audience: 'mcp-client',
+              sessionId: 'session-123',
+              requestHash: 'sha256:' + 'a'.repeat(64),
+              responseHash: 'sha256:' + 'b'.repeat(64),
+            },
+          },
+        ],
+      };
+
+      const mockResponse = {
+        // Direct ProofSubmissionResponse (not wrapped)
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result = await service.submitProofs(request);
+
+      expect(result.accepted).toBe(1);
+      expect(result.rejected).toBe(0);
+      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
+        'https://api.example.com/api/v1/bouncer/proofs',
+        expect.objectContaining({
+          method: 'POST',
+          body: JSON.stringify(request),
+        })
+      );
+    });
+
+    it('should handle all_proofs_rejected error gracefully', async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID
+        delegation_id: null, // Explicitly set to null
+        proofs: [
+          {
+            jws: 'header.payload.signature',
+            meta: {
+              did: 'did:key:z123',
+              kid: 'did:key:z123#key-1',
+              ts: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
+              nonce: 'nonce-123',
+              audience: 'mcp-client',
+              sessionId: 'session-123',
+              requestHash: 'sha256:' + 'a'.repeat(64),
+              responseHash: 'sha256:' + 'b'.repeat(64),
+            },
+          },
+        ],
+      };
+
+      const errorResponse = {
+        success: false,
+        error: {
+          code: 'all_proofs_rejected',
+          message: 'All proofs rejected',
+          details: {
+            rejected: 1,
+            errors: [
+              {
+                proof_index: 0,
+                error: {
+                  code: 'invalid_signature',
+                  message: 'Invalid signature',
+                },
+              },
+            ],
+          },
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(errorResponse), {
+          status: 400,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result = await service.submitProofs(request);
+
+      // ProofSubmissionResponse has a success field
+      expect(result.success).toBe(false);
+      expect(result.accepted).toBe(0);
+      expect(result.rejected).toBe(1);
+      expect(result.errors).toBeDefined();
+    });
+
+    it('should handle wrapped response format', async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID
+        delegation_id: null, // Explicitly set to null
+        proofs: [
+          {
+            jws: 'header.payload.signature',
+            meta: {
+              did: 'did:key:z123',
+              kid: 'did:key:z123#key-1',
+              ts: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
+              nonce: 'nonce-123',
+              audience: 'mcp-client',
+              sessionId: 'session-123',
+              requestHash: 'sha256:' + 'a'.repeat(64),
+              responseHash: 'sha256:' + 'b'.repeat(64),
+            },
+          },
+        ],
+      };
+
+      const wrappedResponse = {
+        success: true,
+        data: {
+          // ProofSubmissionResponse has a success field
+          success: true,
+          accepted: 1,
+          rejected: 0,
+          outcomes: {
+            success: 1,
+            failed: 0,
+            blocked: 0,
+            error: 0,
+          },
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(wrappedResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result = await service.submitProofs(request);
+
+      expect(result.accepted).toBe(1);
+    });
+
+    it('should handle invalid response format with detailed error logging', async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: '123e4567-e89b-12d3-a456-426614174000',
+        delegation_id: null,
+        proofs: [
+          {
+            jws: 'header.payload.signature',
+            meta: {
+              did: 'did:key:z123',
+              kid: 'did:key:z123#key-1',
+              ts: Math.floor(Date.now() / 1000),
+              nonce: 'nonce-123',
+              audience: 'mcp-client',
+              sessionId: 'session-123',
+              requestHash: 'sha256:' + 'a'.repeat(64),
+              responseHash: 'sha256:' + 'b'.repeat(64),
+            },
+          },
+        ],
+      };
+
+      // Invalid response: missing required fields (accepted, rejected, outcomes)
+      const invalidResponse = {
+        success: true,
+        message: 'Proof submitted', // Wrong format - missing required fields
+      };
+
+      const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(invalidResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const error = await service.submitProofs(request).catch((e) => e);
+      expect(error).toBeInstanceOf(AgentShieldAPIError);
+      expect((error as AgentShieldAPIError).code).toBe('invalid_response');
+      expect((error as AgentShieldAPIError).message).toBe('Response validation failed');
+      
+      // Verify detailed error logging
+      expect(consoleErrorSpy).toHaveBeenCalled();
+      const errorCall = consoleErrorSpy.mock.calls.find(call => 
+        call[0]?.includes('Response validation failed')
+      );
+      expect(errorCall).toBeDefined();
+      expect(errorCall?.[1]).toHaveProperty('zodErrors');
+      expect(errorCall?.[1]).toHaveProperty('responseData');
+
+      consoleErrorSpy.mockRestore();
+    });
+
+    it('should handle response with missing outcomes field (outcomes is optional)', async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: '123e4567-e89b-12d3-a456-426614174000',
+        delegation_id: null,
+        proofs: [
+          {
+            jws: 'header.payload.signature',
+            meta: {
+              did: 'did:key:z123',
+              kid: 'did:key:z123#key-1',
+              ts: Math.floor(Date.now() / 1000),
+              nonce: 'nonce-123',
+              audience: 'mcp-client',
+              sessionId: 'session-123',
+              requestHash: 'sha256:' + 'a'.repeat(64),
+              responseHash: 'sha256:' + 'b'.repeat(64),
+            },
+          },
+        ],
+      };
+
+      // Test 1: Response WITHOUT outcomes field (valid - outcomes is optional)
+      const responseWithoutOutcomes = {
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        // Missing outcomes field - this is now valid
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce(
+        new Response(JSON.stringify(responseWithoutOutcomes), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result1 = await service.submitProofs(request);
+      expect(result1).toEqual({
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: undefined, // outcomes is optional
+      });
+
+      // Test 2: Response WITH outcomes field (also valid)
+      const responseWithOutcomes = {
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce(
+        new Response(JSON.stringify(responseWithOutcomes), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result2 = await service.submitProofs(request);
+      expect(result2).toEqual({
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {
+          success: 1,
+          failed: 0,
+          blocked: 0,
+          error: 0,
+        },
+      });
+
+      // Test 3: Response with empty outcomes object (also valid)
+      const responseWithEmptyOutcomes = {
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {},
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce(
+        new Response(JSON.stringify(responseWithEmptyOutcomes), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const result3 = await service.submitProofs(request);
+      expect(result3).toEqual({
+        success: true,
+        accepted: 1,
+        rejected: 0,
+        outcomes: {},
+      });
+    });
+
+    it('should handle wrapped response with invalid data structure', async () => {
+      const request: ProofSubmissionRequest = {
+        session_id: '123e4567-e89b-12d3-a456-426614174000',
+        delegation_id: null,
+        proofs: [
+          {
+            jws: 'header.payload.signature',
+            meta: {
+              did: 'did:key:z123',
+              kid: 'did:key:z123#key-1',
+              ts: Math.floor(Date.now() / 1000),
+              nonce: 'nonce-123',
+              audience: 'mcp-client',
+              sessionId: 'session-123',
+              requestHash: 'sha256:' + 'a'.repeat(64),
+              responseHash: 'sha256:' + 'b'.repeat(64),
+            },
+          },
+        ],
+      };
+
+      // Wrapped response but data is invalid
+      const invalidWrappedResponse = {
+        success: true,
+        data: {
+          // Missing required fields
+          message: 'Invalid format',
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(invalidWrappedResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      const error = await service.submitProofs(request).catch((e) => e);
+      expect(error).toBeInstanceOf(AgentShieldAPIError);
+      expect((error as AgentShieldAPIError).code).toBe('invalid_response');
+    });
+
+    it('should validate request schema', async () => {
+      const invalidRequest = {
+        session_id: '', // Invalid: empty string
+        proofs: [],
+      } as ProofSubmissionRequest;
+
+      await expect(service.submitProofs(invalidRequest)).rejects.toThrow(
+        AgentShieldAPIError
+      );
+
+      const error = await service
+        .submitProofs(invalidRequest)
+        .catch((e) => e);
+      expect(error.code).toBe('validation_error');
+    });
+  });
+
+  describe('retry logic', () => {
+    it('should retry on network errors', async () => {
+      const mockResponse = {
+        success: true,
+        data: {
+          agent_did: 'did:key:z123',
+          tools: {},
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      // First call throws network error, second succeeds
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mockRejectedValueOnce(new TypeError('fetch failed'))
+        .mockResolvedValueOnce(
+          new Response(JSON.stringify(mockResponse), {
+            status: 200,
+            headers: { 'Content-Type': 'application/json' },
+          })
+        );
+
+      const result = await service.fetchConfig({ agentDid: 'did:key:z123' });
+
+      expect(result).toBeDefined();
+      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(2);
+      expect(service.getMetrics().retryCount).toBe(1);
+    });
+
+    it('should not retry on 400 errors', async () => {
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(
+          JSON.stringify({
+            success: false,
+            error: {
+              code: 'validation_error',
+              message: 'Invalid request',
+            },
+          }),
+          {
+            status: 400,
+            headers: { 'Content-Type': 'application/json' },
+          }
+        )
+      );
+
+      await expect(
+        service.fetchConfig({ agentDid: 'did:key:z123' })
+      ).rejects.toThrow(AgentShieldAPIError);
+
+      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(1);
+      expect(mockSleep).not.toHaveBeenCalled();
+    });
+
+    it('should respect maxRetries limit', async () => {
+      // All calls fail with 500 - need to mock multiple times for retries
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mockResolvedValueOnce(new Response('Internal Server Error', { status: 500 }))
+        .mockResolvedValueOnce(new Response('Internal Server Error', { status: 500 }))
+        .mockResolvedValueOnce(new Response('Internal Server Error', { status: 500 }));
+
+      await expect(
+        service.fetchConfig({ agentDid: 'did:key:z123' })
+      ).rejects.toThrow();
+
+      // Should retry maxRetries times (2) + initial attempt = 3 total
+      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(3);
+      expect(service.getMetrics().retryCount).toBe(2);
+      expect(service.getMetrics().errorCount).toBe(1);
+    });
+  });
+
+  describe('metrics', () => {
+    it('should track successful requests', async () => {
+      const mockResponse = {
+        success: true,
+        data: {
+          agent_did: 'did:key:z123',
+          tools: {},
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      await service.fetchConfig({ agentDid: 'did:key:z123' });
+
+      const metrics = service.getMetrics();
+      expect(metrics.successCount).toBe(1);
+      expect(metrics.errorCount).toBe(0);
+    });
+
+    it('should reset metrics', async () => {
+      const mockResponse = {
+        success: true,
+        data: {
+          agent_did: 'did:key:z123',
+          tools: {},
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      await service.fetchConfig({ agentDid: 'did:key:z123' });
+      service.resetMetrics();
+
+      const metrics = service.getMetrics();
+      expect(metrics.successCount).toBe(0);
+      expect(metrics.errorCount).toBe(0);
+      expect(metrics.retryCount).toBe(0);
+    });
+  });
+
+  describe('correlation ID', () => {
+    it('should include correlation ID in headers', async () => {
+      const mockResponse = {
+        success: true,
+        data: {
+          agent_did: 'did:key:z123',
+          tools: {},
+        },
+        metadata: {
+          requestId: 'test-request-id',
+          timestamp: new Date().toISOString(),
+        },
+      };
+
+      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
+        new Response(JSON.stringify(mockResponse), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })
+      );
+
+      await service.fetchConfig({ agentDid: 'did:key:z123' });
+
+      const callArgs = (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
+        .mock.calls[0];
+      const headers = callArgs[1].headers;
+      expect(headers['X-Request-ID']).toBeDefined();
+      expect(typeof headers['X-Request-ID']).toBe('string');
+    });
+  });
+});
+