@kya-os/mcp-i-core 1.3.13 → 1.3.15

package/src/__tests__/runtime/delegation-flow.test.ts

@@ -1,164 +0,0 @@
-/**
- * Delegation Verification Flow Integration Tests
- *
- * Tests the complete flow: handshake → session creation → tool call → delegation verification
- * Ensures that session.agentDid is correctly used in delegation verification.
- *
- * @package @kya-os/mcp-i-core/__tests__/runtime
- */
-
-import { describe, it, expect, beforeEach } from "vitest";
-import { MCPIRuntimeBase } from "../../runtime/base";
-import { ProviderRuntimeConfig } from "../../config";
-import {
-  createMockProviders,
-  MockClockProvider,
-  MockIdentityProvider,
-  MockNonceCacheProvider,
-} from "../utils/mock-providers";
-import type { DelegationRecord } from "@kya-os/contracts/delegation";
-
-describe("Delegation Verification Flow", () => {
-  let runtime: MCPIRuntimeBase;
-  let config: ProviderRuntimeConfig;
-  let mockProviders: ReturnType<typeof createMockProviders>;
-
-  beforeEach(async () => {
-    mockProviders = createMockProviders();
-    config = {
-      ...mockProviders,
-      environment: "development",
-      session: {
-        timestampSkewSeconds: 120,
-        ttlMinutes: 30,
-      },
-      audit: {
-        enabled: false, // Disable audit for cleaner test output
-      },
-    };
-    runtime = new MCPIRuntimeBase(config);
-    await runtime.initialize();
-  });
-
-  it("should verify delegation using session.agentDid", async () => {
-    const agentDid = "did:key:zagent123";
-    const userDid = "did:web:user.example.com";
-
-    // 1. Perform handshake with agentDid
-    const handshakeRequest = {
-      nonce: "test-nonce-123",
-      audience: "https://server.example.com",
-      timestamp: Math.floor(Date.now() / 1000),
-      agentDid,
-      clientDid: userDid,
-    };
-
-    const handshakeResponse = await runtime.handleHandshake(handshakeRequest);
-    expect(handshakeResponse.sessionId).toBeDefined();
-
-    // 2. Get session and verify agentDid is correct
-    const session = await runtime.getCurrentSession();
-    expect(session).toBeDefined();
-    expect(session?.agentDid).toBe(agentDid); // ✅ Should be client's agent DID, not server DID
-    expect(session?.serverDid).toBe("did:key:zmock123"); // ✅ Should be server's DID
-
-    // 3. Create a delegation with subjectDid matching agentDid
-    // (In real scenario, this would be verified via delegation verifier)
-    const delegation: DelegationRecord = {
-      id: "del_test_001",
-      issuerDid: userDid,
-      subjectDid: agentDid, // ✅ Matches session.agentDid
-      controller: "user_alice",
-      vcId: "vc_test_001",
-      constraints: {
-        scopes: ["tool:execute"],
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000, // 1 hour
-    };
-
-    // 4. Verify that delegation.subjectDid matches session.agentDid
-    expect(delegation.subjectDid).toBe(session?.agentDid);
-    expect(delegation.subjectDid).not.toBe(session?.serverDid); // ✅ Should NOT match server DID
-  });
-
-  it("should fail when session.agentDid does not match delegation.subjectDid", async () => {
-    const agentDid = "did:key:zagent123";
-    const wrongAgentDid = "did:key:zwrong456";
-    const userDid = "did:web:user.example.com";
-
-    // 1. Perform handshake with agentDid
-    const handshakeRequest = {
-      nonce: "test-nonce-456",
-      audience: "https://server.example.com",
-      timestamp: Math.floor(Date.now() / 1000),
-      agentDid,
-      clientDid: userDid,
-    };
-
-    await runtime.handleHandshake(handshakeRequest);
-
-    // 2. Get session
-    const session = await runtime.getCurrentSession();
-    expect(session?.agentDid).toBe(agentDid);
-
-    // 3. Create delegation with wrong subjectDid
-    const delegation: DelegationRecord = {
-      id: "del_test_002",
-      issuerDid: userDid,
-      subjectDid: wrongAgentDid, // ❌ Does NOT match session.agentDid
-      controller: "user_bob",
-      vcId: "vc_test_002",
-      constraints: {
-        scopes: ["tool:execute"],
-      },
-      createdAt: Date.now(),
-      expiresAt: Date.now() + 3600000,
-    };
-
-    // 4. Verify mismatch
-    expect(delegation.subjectDid).not.toBe(session?.agentDid);
-    expect(delegation.subjectDid).toBe(wrongAgentDid);
-  });
-
-  it("should handle session without agentDid gracefully", async () => {
-    const userDid = "did:web:user.example.com";
-
-    // 1. Perform handshake WITHOUT agentDid
-    const handshakeRequest = {
-      nonce: "test-nonce-789",
-      audience: "https://server.example.com",
-      timestamp: Math.floor(Date.now() / 1000),
-      // agentDid not provided
-      clientDid: userDid,
-    };
-
-    await runtime.handleHandshake(handshakeRequest);
-
-    // 2. Get session
-    const session = await runtime.getCurrentSession();
-    expect(session?.agentDid).toBeUndefined(); // ✅ Should be undefined, not fallback to clientDid
-    expect(session?.serverDid).toBe("did:key:zmock123"); // ✅ Server DID should still be set
-  });
-
-  it("should verify serverDid is set correctly in session", async () => {
-    const agentDid = "did:key:zagent789";
-    const identity = await runtime.getIdentity();
-
-    // 1. Perform handshake
-    const handshakeRequest = {
-      nonce: "test-nonce-server",
-      audience: "https://server.example.com",
-      timestamp: Math.floor(Date.now() / 1000),
-      agentDid,
-    };
-
-    await runtime.handleHandshake(handshakeRequest);
-
-    // 2. Verify serverDid matches identity.did
-    const session = await runtime.getCurrentSession();
-    expect(session?.serverDid).toBe(identity.did);
-    expect(session?.serverDid).not.toBe(agentDid); // ✅ Should NOT match agent DID
-  });
-});
-

package/src/__tests__/runtime/proof-client-did.test.ts

@@ -1,376 +0,0 @@
-/**
- * Proof Client DID Tests
- *
- * Tests for proof generation with clientDid tracking and extraction.
- */
-
-import { describe, it, expect, beforeEach, vi } from 'vitest';
-import { MCPIRuntimeBase } from '../../runtime/base';
-import { ProviderRuntimeConfig } from '../../config';
-import { createMockProviders, MockClockProvider } from '../utils/mock-providers';
-
-describe('MCPIRuntimeBase - Proof Client DID', () => {
-  let runtime: MCPIRuntimeBase;
-  let config: ProviderRuntimeConfig;
-  let mockProviders: ReturnType<typeof createMockProviders>;
-
-  beforeEach(async () => {
-    vi.clearAllMocks();
-    mockProviders = createMockProviders();
-    config = {
-      ...mockProviders,
-      environment: 'development',
-      session: {
-        timestampSkewSeconds: 120,
-        ttlMinutes: 30
-      },
-      audit: {
-        enabled: false
-      }
-    };
-    runtime = new MCPIRuntimeBase(config);
-    await runtime.initialize();
-  });
-
-  describe('createProof with clientDid', () => {
-    it('should include clientDid in proof when provided in session', async () => {
-      const testData = { result: 'success' };
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: 'did:key:zclient123'
-      };
-
-      const proof = await runtime.createProof(testData, session);
-
-      expect(proof).toBeDefined();
-      expect(proof.did).toBe('did:key:zmock123'); // Agent DID
-      expect(proof.sessionId).toBe('session123');
-      expect(proof.audience).toBe('https://client.example.com');
-      // Note: clientDid is stored in proofData but not directly in proof object
-      // The proof structure includes sessionId which can be used to retrieve clientDid
-    });
-
-    it('should include userDid in proof when provided in session', async () => {
-      const testData = { result: 'success' };
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        userDid: 'did:key:zuser456'
-      };
-
-      const proof = await runtime.createProof(testData, session);
-
-      expect(proof).toBeDefined();
-      expect(proof.sessionId).toBe('session123');
-      // userDid is stored in session context
-    });
-
-    it('should work without clientDid or userDid (backward compatibility)', async () => {
-      const testData = { result: 'success' };
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce'
-      };
-
-      const proof = await runtime.createProof(testData, session);
-
-      expect(proof).toBeDefined();
-      expect(proof.did).toBe('did:key:zmock123');
-      expect(proof.sessionId).toBe('session123');
-      expect(proof.audience).toBe('https://client.example.com');
-    });
-
-    it('should prioritize clientDid over userDid when both provided', async () => {
-      const testData = { result: 'success' };
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: 'did:key:zclient123',
-        userDid: 'did:key:zuser456'
-      };
-
-      const proof = await runtime.createProof(testData, session);
-
-      expect(proof).toBeDefined();
-      expect(proof.sessionId).toBe('session123');
-      // clientDid takes precedence in session context
-    });
-  });
-
-  describe('processToolCall with clientDid', () => {
-    const mockHandler = vi.fn().mockResolvedValue({ result: 'success' });
-
-    it('should include clientDid in proof when session has clientDid', async () => {
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: 'did:key:zclient123'
-      };
-
-      await runtime.processToolCall(
-        'testTool',
-        { arg: 'value' },
-        mockHandler,
-        session
-      );
-
-      const proof = runtime.getLastProof();
-      expect(proof).toBeDefined();
-      expect(proof.sessionId).toBe('session123');
-      expect(proof.audience).toBe('https://client.example.com');
-    });
-
-    it('should extract clientDid from handshake session', async () => {
-      // Create session via handshake
-      const handshakeResponse = await runtime.handleHandshake({
-        clientDid: 'did:key:zhandshake123',
-        audience: 'https://client.example.com'
-      });
-
-      const session = await runtime.getCurrentSession();
-      const proof = await runtime.createProof(
-        { test: 'data' },
-        session
-      );
-
-      expect(proof.sessionId).toBe(handshakeResponse.sessionId);
-      expect(session.clientDid).toBe('did:key:zhandshake123');
-    });
-
-    it('should handle anonymous session from handshake (Phase 5)', async () => {
-      // Phase 5: Sessions start anonymous - no userDid at handshake
-      const configWithUserDid = {
-        ...config,
-        identity: {
-          enabled: true,
-          generateUserDids: true,
-          environment: 'development'
-        }
-      };
-      const runtimeWithUserDid = new MCPIRuntimeBase(configWithUserDid);
-      await runtimeWithUserDid.initialize();
-
-      const handshakeResponse = await runtimeWithUserDid.handleHandshake({
-        audience: 'https://client.example.com'
-      });
-
-      const session = await runtimeWithUserDid.getCurrentSession();
-      expect(session).toBeDefined();
-
-      // Phase 5: Sessions start anonymous without userDid
-      // userDid is only set after OAuth identity resolution
-      expect(session.userDid).toBeUndefined();
-      expect(session.identityState).toBe('anonymous');
-
-      const proof = await runtimeWithUserDid.createProof(
-        { test: 'data' },
-        session
-      );
-      expect(proof.sessionId).toBe(handshakeResponse.sessionId);
-    });
-  });
-
-  describe('verifyProof with clientDid context', () => {
-    let validProof: any;
-    const testData = { foo: 'bar' };
-
-    beforeEach(async () => {
-      // Set up DID document for verification
-      const fetchProvider = mockProviders.fetchProvider as any;
-      fetchProvider.setDIDDocument('did:key:zmock123', {
-        verificationMethod: [{
-          publicKeyBase64: 'mock-public-key'
-        }]
-      });
-
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: 'did:key:zclient123'
-      };
-
-      validProof = await runtime.createProof(testData, session);
-    });
-
-    it('should verify proof with clientDid in session context', async () => {
-      const nonceCache = mockProviders.nonceCacheProvider as any;
-      nonceCache.clear();
-
-      const isValid = await runtime.verifyProof(testData, validProof);
-      expect(isValid).toBe(true);
-    });
-
-    it('should verify proof independently of clientDid presence', async () => {
-      // Create proof without clientDid
-      const proofWithoutClientDid = await runtime.createProof(testData, {
-        id: 'session456',
-        audience: 'https://client.example.com',
-        nonce: 'other-nonce'
-      });
-
-      const nonceCache = mockProviders.nonceCacheProvider as any;
-      nonceCache.clear();
-
-      const isValid = await runtime.verifyProof(testData, proofWithoutClientDid);
-      expect(isValid).toBe(true);
-    });
-  });
-
-  describe('clientDid extraction from session', () => {
-    it('should retrieve clientDid from active session', async () => {
-      const handshakeResponse = await runtime.handleHandshake({
-        clientDid: 'did:key:zclient789',
-        audience: 'https://client.example.com'
-      });
-
-      const session = await runtime.getCurrentSession();
-      expect(session.clientDid).toBe('did:key:zclient789');
-    });
-
-    it('should handle anonymous session when no clientDid provided (Phase 5)', async () => {
-      // Phase 5: Sessions start anonymous - userDid and clientDid may both be undefined
-      const configWithUserDid = {
-        ...config,
-        identity: {
-          enabled: true,
-          generateUserDids: true,
-          environment: 'development'
-        }
-      };
-      const runtimeWithUserDid = new MCPIRuntimeBase(configWithUserDid);
-      await runtimeWithUserDid.initialize();
-
-      const handshakeResponse = await runtimeWithUserDid.handleHandshake({
-        audience: 'https://client.example.com'
-      });
-
-      const session = await runtimeWithUserDid.getCurrentSession();
-      expect(session).toBeDefined();
-
-      // Phase 5: Sessions start anonymous without userDid
-      // userDid is only set after OAuth identity resolution
-      expect(session.userDid).toBeUndefined();
-      expect(session.identityState).toBe('anonymous');
-
-      // clientDid can also be undefined in anonymous sessions
-      // Both will be set after OAuth completes
-
-      // Verify proof includes the session
-      const proof = await runtimeWithUserDid.createProof(
-        { test: 'data' },
-        session
-      );
-      expect(proof.sessionId).toBe(handshakeResponse.sessionId);
-    });
-  });
-
-  describe('edge cases', () => {
-    it('should handle empty clientDid string gracefully', async () => {
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: ''
-      };
-
-      const proof = await runtime.createProof({ test: 'data' }, session);
-      expect(proof).toBeDefined();
-      expect(proof.sessionId).toBe('session123');
-    });
-
-    it('should handle null clientDid gracefully', async () => {
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: null as any
-      };
-
-      const proof = await runtime.createProof({ test: 'data' }, session);
-      expect(proof).toBeDefined();
-      expect(proof.sessionId).toBe('session123');
-    });
-
-    it('should handle undefined clientDid gracefully', async () => {
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce'
-        // clientDid is undefined
-      };
-
-      const proof = await runtime.createProof({ test: 'data' }, session);
-      expect(proof).toBeDefined();
-      expect(proof.sessionId).toBe('session123');
-    });
-
-    it('should handle invalid DID format in clientDid', async () => {
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: 'invalid-did-format'
-      };
-
-      const proof = await runtime.createProof({ test: 'data' }, session);
-      expect(proof).toBeDefined();
-      // Proof should still be created even with invalid DID format
-      expect(proof.sessionId).toBe('session123');
-    });
-  });
-
-  describe('proof metadata consistency', () => {
-    it('should maintain consistent proof structure with clientDid', async () => {
-      const session = {
-        id: 'session123',
-        audience: 'https://client.example.com',
-        nonce: 'test-nonce',
-        clientDid: 'did:key:zclient123'
-      };
-
-      const proof1 = await runtime.createProof({ test: 'data1' }, session);
-      const proof2 = await runtime.createProof({ test: 'data2' }, session);
-
-      // Both proofs should have same sessionId and audience
-      expect(proof1.sessionId).toBe(proof2.sessionId);
-      expect(proof1.audience).toBe(proof2.audience);
-      
-      // But different nonces (if not pre-provided)
-      // Since we're using same nonce, they should be same
-      expect(proof1.nonce).toBe(proof2.nonce);
-      
-      // Different timestamps
-      expect(proof1.timestamp).toBeLessThanOrEqual(proof2.timestamp);
-    });
-
-    it('should use different proofs for different sessions', async () => {
-      const session1 = {
-        id: 'session1',
-        audience: 'https://client.example.com',
-        nonce: 'nonce1',
-        clientDid: 'did:key:zclient1'
-      };
-
-      const session2 = {
-        id: 'session2',
-        audience: 'https://client.example.com',
-        nonce: 'nonce2',
-        clientDid: 'did:key:zclient2'
-      };
-
-      const proof1 = await runtime.createProof({ test: 'data' }, session1);
-      const proof2 = await runtime.createProof({ test: 'data' }, session2);
-
-      expect(proof1.sessionId).not.toBe(proof2.sessionId);
-      expect(proof1.nonce).not.toBe(proof2.nonce);
-    });
-  });
-});
-