@kya-os/mcp-i-core 1.2.3-canary.7 → 1.3.1

package/src/services/__tests__/batch-delegation.service.test.ts

@@ -0,0 +1,351 @@
+/**
+ * Batch Delegation Service Tests
+ *
+ * @package @kya-os/mcp-i-core
+ */
+
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { BatchDelegationService } from "../batch-delegation.service.js";
+import { ProviderResolver } from "../provider-resolver.js";
+import { ToolProtectionService } from "../tool-protection.service.js";
+import type { ToolProtection } from "@kya-os/contracts/tool-protection";
+
+describe("BatchDelegationService", () => {
+  let mockProviderResolver: ProviderResolver;
+  let mockToolProtectionService: ToolProtectionService;
+  let service: BatchDelegationService;
+
+  beforeEach(() => {
+    mockProviderResolver = {
+      resolveProvider: vi.fn(),
+    } as any;
+
+    mockToolProtectionService = {
+      checkToolProtection: vi.fn(),
+    } as any;
+
+    service = new BatchDelegationService(
+      mockProviderResolver,
+      mockToolProtectionService
+    );
+  });
+
+  describe("groupToolsByProvider", () => {
+    it("should group tools by provider", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read"],
+        oauthProvider: "github",
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:write"],
+        oauthProvider: "github",
+      };
+
+      const toolProtection3: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["google:calendar:read"],
+        oauthProvider: "google",
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2)
+        .mockResolvedValueOnce(toolProtection3);
+
+      (mockProviderResolver.resolveProvider as any)
+        .mockResolvedValueOnce("github")
+        .mockResolvedValueOnce("github")
+        .mockResolvedValueOnce("google");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2", "tool3"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(2);
+      expect(groups.get("github")?.tools).toEqual(["tool1", "tool2"]);
+      expect(groups.get("google")?.tools).toEqual(["tool3"]);
+    });
+
+    it("should merge scopes for tools in same group", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read", "github:user:read"],
+        oauthProvider: "github",
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:write"],
+        oauthProvider: "github",
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      (mockProviderResolver.resolveProvider as any)
+        .mockResolvedValue("github");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      const githubGroup = groups.get("github");
+      expect(githubGroup?.scopes).toContain("github:repo:read");
+      expect(githubGroup?.scopes).toContain("github:user:read");
+      expect(githubGroup?.scopes).toContain("github:repo:write");
+      expect(githubGroup?.scopes.length).toBe(3); // No duplicates
+    });
+
+    it("should use highest risk level in group", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read"],
+        oauthProvider: "github",
+        riskLevel: "low",
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:write"],
+        oauthProvider: "github",
+        riskLevel: "high",
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      (mockProviderResolver.resolveProvider as any)
+        .mockResolvedValue("github");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.get("github")?.riskLevel).toBe("high");
+    });
+
+    it("should skip tools that don't require delegation", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read"],
+        oauthProvider: "github",
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: false,
+        requiredScopes: [],
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      (mockProviderResolver.resolveProvider as any).mockResolvedValue("github");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.get("github")?.tools).toEqual(["tool1"]);
+      expect(groups.get("github")?.tools).not.toContain("tool2");
+    });
+
+    it("should handle tools with provider resolution errors gracefully", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read"],
+        oauthProvider: "github",
+      };
+
+      (mockToolProtectionService.checkToolProtection as any).mockResolvedValue(
+        toolProtection
+      );
+
+      (mockProviderResolver.resolveProvider as any).mockRejectedValue(
+        new Error("Provider not found")
+      );
+
+      const consoleSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(0);
+      expect(consoleSpy).toHaveBeenCalled();
+
+      consoleSpy.mockRestore();
+    });
+
+    it("should return empty map when no tools require delegation", async () => {
+      const toolProtection: ToolProtection = {
+        requiresDelegation: false,
+        requiredScopes: [],
+      };
+
+      (mockToolProtectionService.checkToolProtection as any).mockResolvedValue(
+        toolProtection
+      );
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(0);
+    });
+
+    it("should group tools with oauthProvider field specified", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["repo:read"],
+        oauthProvider: "github", // Explicit provider
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["repo:write"],
+        oauthProvider: "github", // Same explicit provider
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      (mockProviderResolver.resolveProvider as any)
+        .mockResolvedValueOnce("github")
+        .mockResolvedValueOnce("github");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(1);
+      expect(groups.get("github")?.tools).toEqual(["tool1", "tool2"]);
+      expect(mockProviderResolver.resolveProvider).toHaveBeenCalledTimes(2);
+    });
+
+    it("should group tools with oauthProvider field missing (fallback behavior)", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:read"],
+        // No oauthProvider - should use scope inference
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["github:repo:write"],
+        // No oauthProvider - should use scope inference
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      // ProviderResolver should infer from scopes
+      (mockProviderResolver.resolveProvider as any)
+        .mockResolvedValueOnce("github")
+        .mockResolvedValueOnce("github");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(1);
+      expect(groups.get("github")?.tools).toEqual(["tool1", "tool2"]);
+      // Should still call resolveProvider (which handles fallback)
+      expect(mockProviderResolver.resolveProvider).toHaveBeenCalledTimes(2);
+    });
+
+    it("should handle empty groups when all tools skip delegation", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: false,
+        requiredScopes: [],
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: false,
+        requiredScopes: [],
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(0);
+      // Should not call resolveProvider if no tools require delegation
+      expect(mockProviderResolver.resolveProvider).not.toHaveBeenCalled();
+    });
+
+    it("should handle mixed tools with and without oauthProvider", async () => {
+      const toolProtection1: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["repo:read"],
+        oauthProvider: "github", // Explicit
+      };
+
+      const toolProtection2: ToolProtection = {
+        requiresDelegation: true,
+        requiredScopes: ["gmail:read"],
+        // No oauthProvider - should infer google from scope
+      };
+
+      (mockToolProtectionService.checkToolProtection as any)
+        .mockResolvedValueOnce(toolProtection1)
+        .mockResolvedValueOnce(toolProtection2);
+
+      (mockProviderResolver.resolveProvider as any)
+        .mockResolvedValueOnce("github")
+        .mockResolvedValueOnce("google");
+
+      const groups = await service.groupToolsByProvider(
+        ["tool1", "tool2"],
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(groups.size).toBe(2);
+      expect(groups.get("github")?.tools).toEqual(["tool1"]);
+      expect(groups.get("google")?.tools).toEqual(["tool2"]);
+    });
+  });
+
+  describe("getToolsForProvider", () => {
+    it("should return empty array (not yet implemented)", async () => {
+      const tools = await service.getToolsForProvider(
+        "github",
+        "test-project",
+        "did:key:test"
+      );
+
+      expect(tools).toEqual([]);
+    });
+  });
+});
+