@kya-os/mcp-i-core 1.3.12 → 1.3.14

package/src/services/__tests__/access-control.service.test.ts

@@ -1,970 +0,0 @@
-/**
- * Unit Tests for AccessControlApiService
- *
- * Comprehensive test coverage for the access control API service.
- * Tests all methods (fetchConfig, verifyDelegation, submitProofs) with
- * success cases, error cases, retry logic, and validation.
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { AccessControlApiService } from '../access-control.service.js';
-import { AgentShieldAPIError } from '@kya-os/contracts/agentshield-api';
-import type { FetchProvider } from '../../providers/base.js';
-import type {
-  VerifyDelegationRequest,
-  ToolProtectionConfigAPIResponse,
-  ProofSubmissionRequest,
-} from '@kya-os/contracts/agentshield-api';
-
-describe('AccessControlApiService', () => {
-  let service: AccessControlApiService;
-  let mockFetchProvider: FetchProvider;
-  let mockLogger: ReturnType<typeof vi.fn>;
-  let mockSleep: ReturnType<typeof vi.fn>;
-
-  beforeEach(() => {
-    mockLogger = vi.fn();
-    mockSleep = vi.fn().mockResolvedValue(undefined);
-
-    mockFetchProvider = {
-      resolveDID: vi.fn(),
-      fetchStatusList: vi.fn(),
-      fetchDelegationChain: vi.fn(),
-      fetch: vi.fn(),
-    } as unknown as FetchProvider;
-
-    service = new AccessControlApiService({
-      baseUrl: 'https://api.example.com',
-      apiKey: 'test-api-key',
-      fetchProvider: mockFetchProvider,
-      logger: mockLogger,
-      sleepProvider: mockSleep,
-      retryConfig: {
-        maxRetries: 2,
-        initialDelayMs: 10,
-        maxDelayMs: 100,
-      },
-    });
-  });
-
-  describe('fetchConfig', () => {
-    it('should fetch config successfully', async () => {
-      const mockResponse: ToolProtectionConfigAPIResponse = {
-        success: true,
-        data: {
-          agent_did: 'did:key:z123',
-          tools: {
-            'tool1': {
-              scopes: ['scope1'],
-              requires_delegation: true,
-            },
-          },
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result = await service.fetchConfig({ agentDid: 'did:key:z123' });
-
-      expect(result).toEqual(mockResponse);
-      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
-        'https://api.example.com/api/v1/bouncer/config?agent_did=did%3Akey%3Az123',
-        expect.objectContaining({
-          method: 'GET',
-          headers: expect.objectContaining({
-            'Authorization': 'Bearer test-api-key',
-            'Content-Type': 'application/json',
-          }),
-        })
-      );
-    });
-
-    it('should handle 404 error', async () => {
-      const errorResponse = {
-        success: false,
-        error: {
-          code: 'config_not_found',
-          message: 'Config not found',
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(errorResponse), {
-          status: 404,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      await expect(
-        service.fetchConfig({ agentDid: 'did:key:z123' })
-      ).rejects.toThrow(AgentShieldAPIError);
-
-      const metrics = service.getMetrics();
-      expect(metrics.errorCount).toBe(1);
-    });
-
-    it('should retry on 500 error', async () => {
-      const mockResponse: ToolProtectionConfigAPIResponse = {
-        success: true,
-        data: {
-          agent_did: 'did:key:z123',
-          tools: {},
-        },
-      };
-
-      // First call fails with 500, second succeeds
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mockResolvedValueOnce(
-          new Response('Internal Server Error', { status: 500 })
-        )
-        .mockResolvedValueOnce(
-          new Response(JSON.stringify(mockResponse), {
-            status: 200,
-            headers: { 'Content-Type': 'application/json' },
-          })
-        );
-
-      const result = await service.fetchConfig({ agentDid: 'did:key:z123' });
-
-      expect(result).toEqual(mockResponse);
-      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(2);
-      expect(mockSleep).toHaveBeenCalled();
-      expect(service.getMetrics().retryCount).toBe(1);
-    });
-
-    it('should handle invalid JSON response', async () => {
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mockResolvedValueOnce(
-          new Response('invalid json', {
-            status: 200,
-            headers: { 'Content-Type': 'application/json' },
-          })
-        )
-        .mockResolvedValueOnce(
-          new Response('invalid json', {
-            status: 200,
-            headers: { 'Content-Type': 'application/json' },
-          })
-        );
-
-      await expect(
-        service.fetchConfig({ agentDid: 'did:key:z123' })
-      ).rejects.toThrow(AgentShieldAPIError);
-
-      const error = await service
-        .fetchConfig({ agentDid: 'did:key:z123' })
-        .catch((e) => e);
-      expect(error).toBeInstanceOf(AgentShieldAPIError);
-      expect(error.code).toBe('invalid_response');
-    });
-  });
-
-  describe('verifyDelegation', () => {
-    it('should verify delegation successfully', async () => {
-      const request: VerifyDelegationRequest = {
-        agent_did: 'did:key:z123',
-        scopes: ['scope1', 'scope2'],
-      };
-
-      const mockResponse = {
-        success: true,
-        data: {
-          valid: true,
-          delegation_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID format
-          credential: {
-            agent_did: 'did:key:z123',
-            scopes: ['scope1', 'scope2'],
-            issued_at: Math.floor(Date.now() / 1000), // Unix timestamp (positive integer)
-            created_at: Math.floor(Date.now() / 1000), // Unix timestamp (positive integer)
-          },
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result = await service.verifyDelegation(request);
-
-      expect(result.data.valid).toBe(true);
-      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
-        'https://api.example.com/api/v1/bouncer/delegations/verify',
-        expect.objectContaining({
-          method: 'POST',
-          body: JSON.stringify({
-            agent_did: 'did:key:z123',
-            scopes: ['scope1', 'scope2'],
-          }),
-        })
-      );
-    });
-
-    it('should omit scopes field when scopes is undefined (truly optional)', async () => {
-      const request: VerifyDelegationRequest = {
-        agent_did: 'did:key:z123',
-        // scopes is intentionally omitted
-      };
-
-      const mockResponse = {
-        success: true,
-        data: { valid: true },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      try {
-        await service.verifyDelegation(request);
-      } catch (error: any) {
-        // Log validation errors and mock logger calls for debugging
-        if (error.details?.zodErrors) {
-          console.log('Validation errors:', JSON.stringify(error.details.zodErrors, null, 2));
-        }
-        // Check mock logger calls
-        const loggerCalls = mockLogger.mock.calls;
-        const debugCall = loggerCalls.find((call: any[]) => 
-          call[0]?.includes('Request body debug')
-        );
-        if (debugCall) {
-          console.log('Debug log:', JSON.stringify(debugCall[1], null, 2));
-        }
-        throw error;
-      }
-
-      const callArgs = (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mock.calls[0];
-      const requestBody = JSON.parse(callArgs[1].body as string);
-      
-      // Verify scopes field is not included in request body when undefined
-      expect(requestBody).not.toHaveProperty('scopes');
-      expect(requestBody.agent_did).toBe('did:key:z123');
-    });
-
-    it('should include scopes field when scopes is provided', async () => {
-      const request: VerifyDelegationRequest = {
-        agent_did: 'did:key:z123',
-        scopes: ['scope1', 'scope2'],
-      };
-
-      const mockResponse = {
-        success: true,
-        data: { valid: true },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      await service.verifyDelegation(request);
-
-      const callArgs = (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mock.calls[0];
-      const requestBody = JSON.parse(callArgs[1].body as string);
-      
-      // Verify scopes field is included when provided
-      expect(requestBody.scopes).toEqual(['scope1', 'scope2']);
-    });
-
-    it('should include delegation_token from context', async () => {
-      const request: VerifyDelegationRequest = {
-        agent_did: 'did:key:z123',
-        scopes: ['scope1'],
-      };
-
-      const mockResponse = {
-        success: true,
-        data: { valid: true },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      await service.verifyDelegation(request, {
-        delegationToken: 'token-123',
-        credentialJwt: 'jwt-123',
-      });
-
-      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
-        expect.any(String),
-        expect.objectContaining({
-          body: expect.stringContaining('delegation_token'),
-        })
-      );
-    });
-
-    it('should handle validation error', async () => {
-      const invalidRequest = {
-        agent_did: '', // Invalid: empty string
-        scopes: [],
-      } as VerifyDelegationRequest;
-
-      // Mock fetch twice since we call verifyDelegation twice
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({
-              success: false,
-              error: {
-                code: 'validation_error',
-                message: 'Invalid request',
-              },
-            }),
-            {
-              status: 400,
-              headers: { 'Content-Type': 'application/json' },
-            }
-          )
-        )
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({
-              success: false,
-              error: {
-                code: 'validation_error',
-                message: 'Invalid request',
-              },
-            }),
-            {
-              status: 400,
-              headers: { 'Content-Type': 'application/json' },
-            }
-          )
-        );
-
-      await expect(
-        service.verifyDelegation(invalidRequest)
-      ).rejects.toThrow(AgentShieldAPIError);
-
-      const error = await service
-        .verifyDelegation(invalidRequest)
-        .catch((e) => e);
-      expect(error.code).toBe('validation_error');
-    });
-
-    it('should handle 401 authentication error', async () => {
-      const request: VerifyDelegationRequest = {
-        agent_did: 'did:key:z123',
-        scopes: ['scope1'],
-      };
-
-      // Mock fetch twice since we call verifyDelegation twice
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({
-              success: false,
-              error: {
-                code: 'authentication_failed',
-                message: 'Invalid API key',
-              },
-            }),
-            {
-              status: 401,
-              headers: { 'Content-Type': 'application/json' },
-            }
-          )
-        )
-        .mockResolvedValueOnce(
-          new Response(
-            JSON.stringify({
-              success: false,
-              error: {
-                code: 'authentication_failed',
-                message: 'Invalid API key',
-              },
-            }),
-            {
-              status: 401,
-              headers: { 'Content-Type': 'application/json' },
-            }
-          )
-        );
-
-      await expect(service.verifyDelegation(request)).rejects.toThrow(
-        AgentShieldAPIError
-      );
-
-      const error = await service.verifyDelegation(request).catch((e) => e);
-      expect(error.code).toBe('authentication_failed');
-    });
-  });
-
-  describe('submitProofs', () => {
-    it('should submit proofs successfully', async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID
-        delegation_id: null, // Explicitly set to null
-        proofs: [
-          {
-            jws: 'header.payload.signature',
-            meta: {
-              did: 'did:key:z123',
-              kid: 'did:key:z123#key-1',
-              ts: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
-              nonce: 'nonce-123',
-              audience: 'mcp-client',
-              sessionId: 'session-123',
-              requestHash: 'sha256:' + 'a'.repeat(64),
-              responseHash: 'sha256:' + 'b'.repeat(64),
-            },
-          },
-        ],
-      };
-
-      const mockResponse = {
-        // Direct ProofSubmissionResponse (not wrapped)
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result = await service.submitProofs(request);
-
-      expect(result.accepted).toBe(1);
-      expect(result.rejected).toBe(0);
-      expect(mockFetchProvider.fetch).toHaveBeenCalledWith(
-        'https://api.example.com/api/v1/bouncer/proofs',
-        expect.objectContaining({
-          method: 'POST',
-          body: JSON.stringify(request),
-        })
-      );
-    });
-
-    it('should handle all_proofs_rejected error gracefully', async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID
-        delegation_id: null, // Explicitly set to null
-        proofs: [
-          {
-            jws: 'header.payload.signature',
-            meta: {
-              did: 'did:key:z123',
-              kid: 'did:key:z123#key-1',
-              ts: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
-              nonce: 'nonce-123',
-              audience: 'mcp-client',
-              sessionId: 'session-123',
-              requestHash: 'sha256:' + 'a'.repeat(64),
-              responseHash: 'sha256:' + 'b'.repeat(64),
-            },
-          },
-        ],
-      };
-
-      const errorResponse = {
-        success: false,
-        error: {
-          code: 'all_proofs_rejected',
-          message: 'All proofs rejected',
-          details: {
-            rejected: 1,
-            errors: [
-              {
-                proof_index: 0,
-                error: {
-                  code: 'invalid_signature',
-                  message: 'Invalid signature',
-                },
-              },
-            ],
-          },
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(errorResponse), {
-          status: 400,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result = await service.submitProofs(request);
-
-      // ProofSubmissionResponse has a success field
-      expect(result.success).toBe(false);
-      expect(result.accepted).toBe(0);
-      expect(result.rejected).toBe(1);
-      expect(result.errors).toBeDefined();
-    });
-
-    it('should handle wrapped response format', async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: '123e4567-e89b-12d3-a456-426614174000', // Valid UUID
-        delegation_id: null, // Explicitly set to null
-        proofs: [
-          {
-            jws: 'header.payload.signature',
-            meta: {
-              did: 'did:key:z123',
-              kid: 'did:key:z123#key-1',
-              ts: Math.floor(Date.now() / 1000), // Unix timestamp in seconds
-              nonce: 'nonce-123',
-              audience: 'mcp-client',
-              sessionId: 'session-123',
-              requestHash: 'sha256:' + 'a'.repeat(64),
-              responseHash: 'sha256:' + 'b'.repeat(64),
-            },
-          },
-        ],
-      };
-
-      const wrappedResponse = {
-        success: true,
-        data: {
-          // ProofSubmissionResponse has a success field
-          success: true,
-          accepted: 1,
-          rejected: 0,
-          outcomes: {
-            success: 1,
-            failed: 0,
-            blocked: 0,
-            error: 0,
-          },
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(wrappedResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result = await service.submitProofs(request);
-
-      expect(result.accepted).toBe(1);
-    });
-
-    it('should handle invalid response format with detailed error logging', async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: '123e4567-e89b-12d3-a456-426614174000',
-        delegation_id: null,
-        proofs: [
-          {
-            jws: 'header.payload.signature',
-            meta: {
-              did: 'did:key:z123',
-              kid: 'did:key:z123#key-1',
-              ts: Math.floor(Date.now() / 1000),
-              nonce: 'nonce-123',
-              audience: 'mcp-client',
-              sessionId: 'session-123',
-              requestHash: 'sha256:' + 'a'.repeat(64),
-              responseHash: 'sha256:' + 'b'.repeat(64),
-            },
-          },
-        ],
-      };
-
-      // Invalid response: missing required fields (accepted, rejected, outcomes)
-      const invalidResponse = {
-        success: true,
-        message: 'Proof submitted', // Wrong format - missing required fields
-      };
-
-      const consoleErrorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(invalidResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const error = await service.submitProofs(request).catch((e) => e);
-      expect(error).toBeInstanceOf(AgentShieldAPIError);
-      expect((error as AgentShieldAPIError).code).toBe('invalid_response');
-      expect((error as AgentShieldAPIError).message).toBe('Response validation failed');
-      
-      // Verify detailed error logging
-      expect(consoleErrorSpy).toHaveBeenCalled();
-      const errorCall = consoleErrorSpy.mock.calls.find(call => 
-        call[0]?.includes('Response validation failed')
-      );
-      expect(errorCall).toBeDefined();
-      expect(errorCall?.[1]).toHaveProperty('zodErrors');
-      expect(errorCall?.[1]).toHaveProperty('responseData');
-
-      consoleErrorSpy.mockRestore();
-    });
-
-    it('should handle response with missing outcomes field (outcomes is optional)', async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: '123e4567-e89b-12d3-a456-426614174000',
-        delegation_id: null,
-        proofs: [
-          {
-            jws: 'header.payload.signature',
-            meta: {
-              did: 'did:key:z123',
-              kid: 'did:key:z123#key-1',
-              ts: Math.floor(Date.now() / 1000),
-              nonce: 'nonce-123',
-              audience: 'mcp-client',
-              sessionId: 'session-123',
-              requestHash: 'sha256:' + 'a'.repeat(64),
-              responseHash: 'sha256:' + 'b'.repeat(64),
-            },
-          },
-        ],
-      };
-
-      // Test 1: Response WITHOUT outcomes field (valid - outcomes is optional)
-      const responseWithoutOutcomes = {
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        // Missing outcomes field - this is now valid
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce(
-        new Response(JSON.stringify(responseWithoutOutcomes), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result1 = await service.submitProofs(request);
-      expect(result1).toEqual({
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: undefined, // outcomes is optional
-      });
-
-      // Test 2: Response WITH outcomes field (also valid)
-      const responseWithOutcomes = {
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce(
-        new Response(JSON.stringify(responseWithOutcomes), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result2 = await service.submitProofs(request);
-      expect(result2).toEqual({
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      });
-
-      // Test 3: Response with empty outcomes object (also valid)
-      const responseWithEmptyOutcomes = {
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {},
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValueOnce(
-        new Response(JSON.stringify(responseWithEmptyOutcomes), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const result3 = await service.submitProofs(request);
-      expect(result3).toEqual({
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {},
-      });
-    });
-
-    it('should handle wrapped response with invalid data structure', async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: '123e4567-e89b-12d3-a456-426614174000',
-        delegation_id: null,
-        proofs: [
-          {
-            jws: 'header.payload.signature',
-            meta: {
-              did: 'did:key:z123',
-              kid: 'did:key:z123#key-1',
-              ts: Math.floor(Date.now() / 1000),
-              nonce: 'nonce-123',
-              audience: 'mcp-client',
-              sessionId: 'session-123',
-              requestHash: 'sha256:' + 'a'.repeat(64),
-              responseHash: 'sha256:' + 'b'.repeat(64),
-            },
-          },
-        ],
-      };
-
-      // Wrapped response but data is invalid
-      const invalidWrappedResponse = {
-        success: true,
-        data: {
-          // Missing required fields
-          message: 'Invalid format',
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(invalidWrappedResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      const error = await service.submitProofs(request).catch((e) => e);
-      expect(error).toBeInstanceOf(AgentShieldAPIError);
-      expect((error as AgentShieldAPIError).code).toBe('invalid_response');
-    });
-
-    it('should validate request schema', async () => {
-      const invalidRequest = {
-        session_id: '', // Invalid: empty string
-        proofs: [],
-      } as ProofSubmissionRequest;
-
-      await expect(service.submitProofs(invalidRequest)).rejects.toThrow(
-        AgentShieldAPIError
-      );
-
-      const error = await service
-        .submitProofs(invalidRequest)
-        .catch((e) => e);
-      expect(error.code).toBe('validation_error');
-    });
-  });
-
-  describe('retry logic', () => {
-    it('should retry on network errors', async () => {
-      const mockResponse = {
-        success: true,
-        data: {
-          agent_did: 'did:key:z123',
-          tools: {},
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      // First call throws network error, second succeeds
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mockRejectedValueOnce(new TypeError('fetch failed'))
-        .mockResolvedValueOnce(
-          new Response(JSON.stringify(mockResponse), {
-            status: 200,
-            headers: { 'Content-Type': 'application/json' },
-          })
-        );
-
-      const result = await service.fetchConfig({ agentDid: 'did:key:z123' });
-
-      expect(result).toBeDefined();
-      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(2);
-      expect(service.getMetrics().retryCount).toBe(1);
-    });
-
-    it('should not retry on 400 errors', async () => {
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(
-          JSON.stringify({
-            success: false,
-            error: {
-              code: 'validation_error',
-              message: 'Invalid request',
-            },
-          }),
-          {
-            status: 400,
-            headers: { 'Content-Type': 'application/json' },
-          }
-        )
-      );
-
-      await expect(
-        service.fetchConfig({ agentDid: 'did:key:z123' })
-      ).rejects.toThrow(AgentShieldAPIError);
-
-      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(1);
-      expect(mockSleep).not.toHaveBeenCalled();
-    });
-
-    it('should respect maxRetries limit', async () => {
-      // All calls fail with 500 - need to mock multiple times for retries
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mockResolvedValueOnce(new Response('Internal Server Error', { status: 500 }))
-        .mockResolvedValueOnce(new Response('Internal Server Error', { status: 500 }))
-        .mockResolvedValueOnce(new Response('Internal Server Error', { status: 500 }));
-
-      await expect(
-        service.fetchConfig({ agentDid: 'did:key:z123' })
-      ).rejects.toThrow();
-
-      // Should retry maxRetries times (2) + initial attempt = 3 total
-      expect(mockFetchProvider.fetch).toHaveBeenCalledTimes(3);
-      expect(service.getMetrics().retryCount).toBe(2);
-      expect(service.getMetrics().errorCount).toBe(1);
-    });
-  });
-
-  describe('metrics', () => {
-    it('should track successful requests', async () => {
-      const mockResponse = {
-        success: true,
-        data: {
-          agent_did: 'did:key:z123',
-          tools: {},
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      await service.fetchConfig({ agentDid: 'did:key:z123' });
-
-      const metrics = service.getMetrics();
-      expect(metrics.successCount).toBe(1);
-      expect(metrics.errorCount).toBe(0);
-    });
-
-    it('should reset metrics', async () => {
-      const mockResponse = {
-        success: true,
-        data: {
-          agent_did: 'did:key:z123',
-          tools: {},
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      await service.fetchConfig({ agentDid: 'did:key:z123' });
-      service.resetMetrics();
-
-      const metrics = service.getMetrics();
-      expect(metrics.successCount).toBe(0);
-      expect(metrics.errorCount).toBe(0);
-      expect(metrics.retryCount).toBe(0);
-    });
-  });
-
-  describe('correlation ID', () => {
-    it('should include correlation ID in headers', async () => {
-      const mockResponse = {
-        success: true,
-        data: {
-          agent_did: 'did:key:z123',
-          tools: {},
-        },
-        metadata: {
-          requestId: 'test-request-id',
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      (mockFetchProvider.fetch as ReturnType<typeof vi.fn>).mockResolvedValue(
-        new Response(JSON.stringify(mockResponse), {
-          status: 200,
-          headers: { 'Content-Type': 'application/json' },
-        })
-      );
-
-      await service.fetchConfig({ agentDid: 'did:key:z123' });
-
-      const callArgs = (mockFetchProvider.fetch as ReturnType<typeof vi.fn>)
-        .mock.calls[0];
-      const headers = callArgs[1].headers;
-      expect(headers['X-Request-ID']).toBeDefined();
-      expect(typeof headers['X-Request-ID']).toBe('string');
-    });
-  });
-});
-