@kya-os/mcp-i-core 1.3.13 → 1.3.15

package/src/__tests__/services/provider-resolver-edge-cases.test.ts

@@ -1,591 +0,0 @@
-/**
- * Provider Resolver - Edge Cases Tests
- *
- * Tests for edge cases and error scenarios in provider resolution
- * (Phase 2: Dynamic Providers)
- *
- * @package @kya-os/mcp-i-core
- */
-
-import { describe, it, expect, beforeEach, vi } from "vitest";
-import { ProviderResolver } from "../../services/provider-resolver.js";
-import { OAuthProviderRegistry } from "../../services/oauth-provider-registry.js";
-import { OAuthConfigService } from "../../services/oauth-config.service.js";
-import type { ToolProtection } from "@kya-os/contracts/tool-protection";
-import type { OAuthConfig } from "@kya-os/contracts/config";
-
-describe("ProviderResolver - Edge Cases", () => {
-  let mockConfigService: OAuthConfigService;
-  let mockRegistry: OAuthProviderRegistry;
-  let resolver: ProviderResolver;
-
-  const mockOAuthConfig: OAuthConfig = {
-    providers: {
-      github: {
-        clientId: "github_client_id",
-        authorizationUrl: "https://github.com/login/oauth/authorize",
-        tokenUrl: "https://github.com/login/oauth/access_token",
-        supportsPKCE: true,
-        requiresClientSecret: false,
-      },
-      google: {
-        clientId: "google_client_id",
-        authorizationUrl: "https://accounts.google.com/o/oauth2/v2/auth",
-        tokenUrl: "https://oauth2.googleapis.com/token",
-        supportsPKCE: true,
-        requiresClientSecret: false,
-      },
-      microsoft: {
-        clientId: "microsoft_client_id",
-        authorizationUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
-        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
-        supportsPKCE: true,
-        requiresClientSecret: false,
-      },
-    },
-  };
-
-  beforeEach(() => {
-    // Don't clear mocks here - it might interfere with mock return values
-    // Instead, create fresh mocks for each test
-
-    mockConfigService = {
-      getOAuthConfig: vi.fn().mockResolvedValue(mockOAuthConfig),
-    } as any;
-
-    // Create fresh mocks for each test
-    const getProviderNamesMock = vi.fn().mockReturnValue([]);
-    const loadFromAgentShieldMock = vi.fn().mockResolvedValue(undefined);
-    const hasProviderMock = vi.fn().mockReturnValue(false);
-    const getConfiguredProviderMock = vi.fn().mockReturnValue(null);
-
-    mockRegistry = {
-      hasProvider: hasProviderMock,
-      getAllProviders: vi.fn().mockReturnValue([]),
-      getProviderNames: getProviderNamesMock,
-      loadFromAgentShield: loadFromAgentShieldMock,
-      getConfiguredProvider: getConfiguredProviderMock,
-    } as any;
-
-    resolver = new ProviderResolver(mockRegistry, mockConfigService);
-  });
-
-  describe("Provider validation (Priority 1)", () => {
-    it("should validate provider exists before returning", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["repo:read"],
-        oauthProvider: "github",
-      };
-
-      // Mock registry that simulates loaded state
-      const testRegistry = {
-        getProviderNames: vi.fn().mockReturnValue(["github", "google"]),
-        hasProvider: vi.fn((provider: string) => provider === "github" || provider === "google"),
-        loadFromAgentShield: vi.fn().mockResolvedValue(undefined),
-        getAllProviders: vi.fn().mockReturnValue([]),
-      };
-      
-      const testResolver = new ProviderResolver(testRegistry as any, mockConfigService);
-
-      const provider = await testResolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("github");
-      expect(testRegistry.hasProvider).toHaveBeenCalledWith("github");
-      // Should not need to load since registry already has providers
-      expect(testRegistry.loadFromAgentShield).not.toHaveBeenCalled();
-    });
-
-    // TODO: Fix this test - it's trying to verify that the registry automatically loads
-    // when empty, but the mock state transitions are complex due to async timing.
-    // The test needs to properly simulate the registry state changing from empty to
-    // populated after loadFromAgentShield completes, but before hasProvider is called.
-    // Consider using a more integration-style test or rethinking the test approach.
-    it.skip("should load registry if empty before checking provider existence", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["repo:read"],
-        oauthProvider: "github",
-      };
-
-      // Create a mock registry that starts empty
-      const mockEmptyRegistry = {
-        getProviderNames: vi.fn().mockReturnValue([]), // Empty initially
-        hasProvider: vi.fn().mockReturnValue(false), // No providers initially
-        loadFromAgentShield: vi.fn().mockResolvedValue(undefined),
-        getAllProviders: vi.fn().mockReturnValue([]),
-      };
-      
-      const testResolver = new ProviderResolver(mockEmptyRegistry as any, mockConfigService);
-      
-      // Since the registry starts empty and hasProvider returns false,
-      // the resolver will throw an error about the provider not being configured
-      await expect(
-        testResolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/not configured for project/);
-      
-      // Verify that loadFromAgentShield was called
-      expect(mockEmptyRegistry.loadFromAgentShield).toHaveBeenCalledWith("test-project");
-      expect(mockEmptyRegistry.getProviderNames).toHaveBeenCalled();
-      expect(mockEmptyRegistry.hasProvider).toHaveBeenCalledWith("github");
-    });
-
-    it("should throw error if tool-specific provider not configured", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["repo:read"],
-        oauthProvider: "nonexistent",
-      };
-
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-
-      await expect(
-        resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/not configured for project/);
-    });
-  });
-
-  describe("Scope inference edge cases (Priority 2)", () => {
-    it("should handle empty scopes array", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [],
-      };
-
-      // Should fall through to Priority 3 (configuredProvider)
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use configured provider (Priority 3)
-      expect(provider).toBe("github");
-    });
-
-    it("should handle ambiguous scopes (multiple providers inferred)", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["github:repo:read", "google:calendar:read"],
-      };
-
-      // Ambiguous scopes should fall through to Priority 3 (configuredProvider)
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use configured provider (Priority 3)
-      expect(provider).toBe("github");
-    });
-
-    it("should handle unknown scope prefixes", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["custom:unknown:scope"],
-      };
-
-      // Unknown prefix should fall through to Priority 3 (configuredProvider)
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use configured provider (Priority 3)
-      expect(provider).toBe("github");
-    });
-
-    it("should verify gmail → google mapping works", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["gmail:read"],
-      };
-
-      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
-        return name === "google";
-      });
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("google");
-    });
-
-    it("should verify calendar → google mapping works", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["calendar:read"],
-      };
-
-      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
-        return name === "google";
-      });
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("google");
-    });
-
-    it("should verify outlook → microsoft mapping works", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["outlook:read"],
-      };
-
-      (mockRegistry.getProviderNames as any).mockReturnValue(["microsoft"]);
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
-        return name === "microsoft";
-      });
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("microsoft");
-    });
-
-    it("should handle scopes without colons", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["read", "write"], // No colons
-      };
-
-      // Should fall through to Priority 3 (configuredProvider)
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use configured provider (Priority 3)
-      expect(provider).toBe("github");
-    });
-
-    it("should handle inferred provider not in registry", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["github:repo:read"],
-      };
-
-      // Inferred provider (github) exists but not in registry
-      // configuredProvider is google
-      (mockRegistry.getProviderNames as any).mockReturnValue(["google"]);
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "google");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("google");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use configured provider (Priority 3)
-      expect(provider).toBe("google");
-    });
-  });
-
-  describe("Fallback behavior (Priority 3 - configuredProvider)", () => {
-    it("should log warning when using configuredProvider fallback", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["custom:scope"],
-      };
-
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-
-      const consoleSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
-
-      await resolver.resolveProvider(toolProtection, "test-project");
-
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("project-configured provider")
-      );
-      expect(consoleSpy).toHaveBeenCalledWith(
-        expect.stringContaining("github")
-      );
-
-      consoleSpy.mockRestore();
-    });
-
-    it("should use configuredProvider when oauthProvider not specified", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["custom:scope"],
-      };
-
-      // Multiple providers available, but configuredProvider is google
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => 
-        name === "github" || name === "google"
-      );
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("google");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Should use configuredProvider, not first alphabetically
-      expect(provider).toBe("google");
-    });
-
-    it("should NOT fall back to first provider alphabetically", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["custom:scope"],
-      };
-
-      // Multiple providers in registry, but NO configuredProvider
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-        { clientId: "google_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
-
-      // Should throw error, NOT pick first provider
-      await expect(
-        resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/no provider is configured/);
-    });
-  });
-
-  describe("Error scenarios (Priority 4)", () => {
-    it("should throw error if no provider is configured", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [],
-      };
-
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
-
-      await expect(
-        resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/no provider is configured/);
-    });
-
-    it("should include project ID in error message", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [],
-      };
-
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
-
-      try {
-        await resolver.resolveProvider(toolProtection, "test-project-123");
-      } catch (error) {
-        expect((error as Error).message).toContain("test-project-123");
-      }
-    });
-
-    it("should provide helpful error message with resolution steps", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [],
-      };
-
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
-
-      try {
-        await resolver.resolveProvider(toolProtection, "test-project");
-      } catch (error) {
-        const message = (error as Error).message;
-        expect(message).toContain("AgentShield dashboard");
-        expect(message).toContain("Configure");
-      }
-    });
-  });
-
-  describe("Registry load failures", () => {
-    it("should propagate registry load errors", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [],
-      };
-
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.loadFromAgentShield as any).mockRejectedValueOnce(
-        new Error("Network error")
-      );
-
-      await expect(
-        resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow("Network error");
-    });
-  });
-
-  describe("Provider name case sensitivity", () => {
-    it("should handle provider names case-insensitively in inference", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["GITHUB:repo:read"], // Uppercase prefix
-      };
-
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => {
-        return name.toLowerCase() === "github";
-      });
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("github");
-    });
-  });
-
-  describe("Multiple scopes with same provider", () => {
-    it("should handle multiple scopes from same provider", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [
-          "github:repo:read",
-          "github:repo:write",
-          "github:user:read",
-        ],
-      };
-
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github"]);
-      (mockRegistry.hasProvider as any).mockReturnValue(true);
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("github");
-    });
-  });
-
-  describe("configuredProvider behavior (Priority 3)", () => {
-    it("should use configuredProvider when tool has no oauthProvider", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["greet:execute"], // No scope inference match
-      };
-
-      // configuredProvider is github
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => name === "github");
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      expect(provider).toBe("github");
-      expect(mockRegistry.getConfiguredProvider).toHaveBeenCalled();
-    });
-
-    it("should throw when configuredProvider is null and tool needs OAuth", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["greet:execute"],
-      };
-
-      // No configuredProvider set
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
-
-      await expect(
-        resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/no provider is configured/);
-    });
-
-    it("should NOT use unconfigured providers as fallback", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["greet:execute"],
-      };
-
-      // Registry has providers but configuredProvider is null
-      // This simulates AgentShield returning all providers but none configured
-      (mockRegistry.hasProvider as any).mockReturnValue(false);
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue(null);
-      (mockRegistry.getAllProviders as any).mockReturnValue([
-        { clientId: "github_client_id" },
-        { clientId: "google_client_id" },
-        { clientId: "microsoft_client_id" },
-      ]);
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google", "microsoft"]);
-
-      // Should NOT pick "github" alphabetically - should throw
-      await expect(
-        resolver.resolveProvider(toolProtection, "test-project")
-      ).rejects.toThrow(/no provider is configured/);
-    });
-
-    it("should prefer tool-specific oauthProvider over configuredProvider", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: [],
-        oauthProvider: "google", // Tool specifies google
-      };
-
-      // configuredProvider is github, but tool wants google
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => 
-        name === "github" || name === "google"
-      );
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Priority 1 (tool-specific) should win over Priority 3 (configuredProvider)
-      expect(provider).toBe("google");
-    });
-
-    it("should prefer scope-inferred provider over configuredProvider", async () => {
-      const toolProtection: ToolProtection = {
-        requiresDelegation: true,
-        requiredScopes: ["google:calendar:read"], // Infers google
-      };
-
-      // configuredProvider is github, but scopes infer google
-      (mockRegistry.hasProvider as any).mockImplementation((name: string) => 
-        name === "github" || name === "google"
-      );
-      (mockRegistry.getConfiguredProvider as any).mockReturnValue("github");
-      (mockRegistry.getProviderNames as any).mockReturnValue(["github", "google"]);
-
-      const provider = await resolver.resolveProvider(
-        toolProtection,
-        "test-project"
-      );
-
-      // Priority 2 (scope inference) should win over Priority 3 (configuredProvider)
-      expect(provider).toBe("google");
-    });
-  });
-});
-