@kya-os/mcp-i-core 1.3.13 → 1.3.15

package/src/services/__tests__/access-control.proof-response-validation.test.ts

@@ -1,578 +0,0 @@
-/**
- * Proof Submission Response Validation Tests
- *
- * These tests verify that the proof submission response format matches
- * the schema defined in @kya-os/contracts, preventing regressions.
- *
- * CRITICAL: These tests ensure API parity between MCP-I and AgentShield/Bouncer.
- */
-
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { AccessControlApiService } from "../access-control.service";
-import { proofSubmissionResponseSchema } from "@kya-os/contracts/agentshield-api";
-import type { ProofSubmissionRequest } from "@kya-os/contracts/agentshield-api";
-
-describe("Proof Submission Response Validation", () => {
-  let service: AccessControlApiService;
-  let mockFetch: ReturnType<typeof vi.fn>;
-
-  beforeEach(() => {
-    mockFetch = vi.fn();
-    service = new AccessControlApiService({
-      baseUrl: "https://kya.vouched.id",
-      apiKey: "test-api-key",
-      fetchProvider: {
-        fetch: mockFetch,
-      },
-      logger: vi.fn(),
-    });
-  });
-
-  describe("Wrapped Response Format (AgentShield API)", () => {
-    it("should validate wrapped response with success field in data", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      // Simulate AgentShield API wrapped response
-      const wrappedResponse = {
-        success: true,
-        data: {
-          accepted: 1,
-          rejected: 0,
-          outcomes: {
-            success: 1,
-            failed: 0,
-            blocked: 0,
-            error: 0,
-          },
-        },
-        metadata: {
-          requestId: "test-request-id",
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      const result = await service.submitProofs(request);
-
-      expect(result).toMatchObject({
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      });
-    });
-
-    it("should validate wrapped response with errors array", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      const wrappedResponse = {
-        success: true,
-        data: {
-          accepted: 0,
-          rejected: 1,
-          outcomes: {
-            success: 0,
-            failed: 1,
-            blocked: 0,
-            error: 0,
-          },
-          errors: [
-            {
-              proof_index: 0,
-              error: {
-                code: "validation_error",
-                message: "Proof validation failed",
-                details: { reason: "invalid_signature" },
-              },
-            },
-          ],
-        },
-        metadata: {
-          requestId: "test-request-id",
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      const result = await service.submitProofs(request);
-
-      expect(result).toMatchObject({
-        success: true,
-        accepted: 0,
-        rejected: 1,
-        errors: [
-          {
-            proof_index: 0,
-            error: {
-              code: "validation_error",
-              message: "Proof validation failed",
-              details: { reason: "invalid_signature" },
-            },
-          },
-        ],
-      });
-    });
-
-    it("should validate wrapped response without outcomes (optional field)", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      // Response without outcomes (should be valid per schema)
-      const wrappedResponse = {
-        success: true,
-        data: {
-          accepted: 1,
-          rejected: 0,
-          // outcomes omitted - should still validate
-        },
-        metadata: {
-          requestId: "test-request-id",
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      const result = await service.submitProofs(request);
-
-      expect(result).toMatchObject({
-        success: true,
-        accepted: 1,
-        rejected: 0,
-      });
-      // outcomes should be undefined or present, but not required
-      expect(result.outcomes).toBeUndefined();
-    });
-
-    it("should throw validation error if data object missing success field", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      // Response where data object doesn't have success (should be added by service)
-      const wrappedResponse = {
-        success: true,
-        data: {
-          // Missing success field - service should add it
-          accepted: 1,
-          rejected: 0,
-          outcomes: {
-            success: 1,
-            failed: 0,
-            blocked: 0,
-            error: 0,
-          },
-        },
-        metadata: {
-          requestId: "test-request-id",
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      // Should succeed because service adds success field
-      const result = await service.submitProofs(request);
-      expect(result.success).toBe(true);
-    });
-
-    it("should validate schema directly matches AgentShield response format", () => {
-      // This test ensures the schema matches what AgentShield actually returns
-      const agentShieldResponseData = {
-        success: true,
-        accepted: 1,
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      };
-
-      const validation = proofSubmissionResponseSchema.safeParse(
-        agentShieldResponseData
-      );
-      expect(validation.success).toBe(true);
-      if (validation.success) {
-        expect(validation.data).toMatchObject(agentShieldResponseData);
-      }
-    });
-
-    it("should validate schema with errors array matches AgentShield format", () => {
-      const agentShieldResponseData = {
-        success: true,
-        accepted: 0,
-        rejected: 1,
-        outcomes: {
-          success: 0,
-          failed: 1,
-          blocked: 0,
-          error: 0,
-        },
-        errors: [
-          {
-            proof_index: 0,
-            error: {
-              code: "validation_error",
-              message: "Proof validation failed",
-              details: { reason: "invalid_signature" },
-            },
-          },
-        ],
-      };
-
-      const validation = proofSubmissionResponseSchema.safeParse(
-        agentShieldResponseData
-      );
-      expect(validation.success).toBe(true);
-      if (validation.success) {
-        expect(validation.data.errors).toHaveLength(1);
-        expect(validation.data.errors![0].proof_index).toBe(0);
-        expect(validation.data.errors![0].error.code).toBe("validation_error");
-      }
-    });
-  });
-
-  describe("Regression Prevention", () => {
-    it("should prevent regression: missing success field in data", () => {
-      // This test ensures we catch if AgentShield changes response format
-      const responseWithoutSuccess = {
-        accepted: 1,
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      };
-
-      const validation = proofSubmissionResponseSchema.safeParse(
-        responseWithoutSuccess
-      );
-      expect(validation.success).toBe(false);
-      if (!validation.success) {
-        expect(
-          validation.error.errors.some((e) => e.path.includes("success"))
-        ).toBe(true);
-      }
-    });
-
-    it("should prevent regression: wrong type for accepted/rejected", () => {
-      const invalidResponse = {
-        success: true,
-        accepted: "1", // Should be number
-        rejected: "0", // Should be number
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      };
-
-      const validation =
-        proofSubmissionResponseSchema.safeParse(invalidResponse);
-      expect(validation.success).toBe(false);
-    });
-
-    it("should prevent regression: missing required fields", () => {
-      const incompleteResponse = {
-        success: true,
-        // Missing accepted
-        rejected: 0,
-        outcomes: {
-          success: 1,
-          failed: 0,
-          blocked: 0,
-          error: 0,
-        },
-      };
-
-      const validation =
-        proofSubmissionResponseSchema.safeParse(incompleteResponse);
-      expect(validation.success).toBe(false);
-      if (!validation.success) {
-        expect(
-          validation.error.errors.some((e) => e.path.includes("accepted"))
-        ).toBe(true);
-      }
-    });
-  });
-
-  describe("JSON Deep Clone Fix (Cloudflare Workers Edge Case)", () => {
-    it("should correctly extract data from wrapped response after JSON deep clone", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      // Simulate the exact response format from AgentShield API
-      // This matches the format seen in production logs
-      const wrappedResponse = {
-        success: true,
-        data: {
-          accepted: 1,
-          rejected: 0,
-          outcomes: {
-            success: 1,
-          },
-          errors: [],
-        },
-        metadata: {
-          requestId: "fc1fa88f-9b22-4161-b4fd-17d8215098ee",
-          timestamp: "2025-11-24T21:36:33.029Z",
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      const result = await service.submitProofs(request);
-
-      // Verify all fields are correctly extracted
-      expect(result.success).toBe(true);
-      expect(result.accepted).toBe(1);
-      expect(result.rejected).toBe(0);
-      expect(result.outcomes).toEqual({ success: 1 });
-      expect(result.errors).toEqual([]);
-    });
-
-    it("should handle response where data fields are numeric values (not undefined)", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      // Test with zero values (edge case for falsy check)
-      const wrappedResponse = {
-        success: true,
-        data: {
-          accepted: 0,
-          rejected: 0,
-          outcomes: {},
-          errors: [],
-        },
-        metadata: {
-          requestId: "test-id",
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      const result = await service.submitProofs(request);
-
-      // Verify zero values are correctly extracted (not treated as undefined)
-      expect(result.success).toBe(true);
-      expect(result.accepted).toBe(0);
-      expect(result.rejected).toBe(0);
-    });
-
-    it("should handle response with nested outcomes object", async () => {
-      const request: ProofSubmissionRequest = {
-        session_id: "test-session",
-        proofs: [
-          {
-            jws: "test.jws.signature",
-            meta: {
-              did: "did:key:test",
-              kid: "did:key:test#key-1",
-              ts: Date.now(),
-              nonce: "test-nonce",
-              audience: "https://kya.vouched.id",
-              sessionId: "test-session",
-              requestHash: "sha256:" + "a".repeat(64),
-              responseHash: "sha256:" + "b".repeat(64),
-              scopeId: "test:execute",
-            },
-          },
-        ],
-      };
-
-      // Test with various outcome types
-      const wrappedResponse = {
-        success: true,
-        data: {
-          accepted: 3,
-          rejected: 2,
-          outcomes: {
-            success: 1,
-            failed: 1,
-            blocked: 1,
-            error: 2,
-          },
-          errors: [
-            {
-              proof_index: 0,
-              error: {
-                code: "validation_error",
-                message: "Invalid signature",
-              },
-            },
-          ],
-        },
-        metadata: {
-          requestId: "test-id",
-          timestamp: new Date().toISOString(),
-        },
-      };
-
-      mockFetch.mockResolvedValueOnce({
-        ok: true,
-        status: 200,
-        text: async () => JSON.stringify(wrappedResponse),
-        headers: new Headers(),
-      });
-
-      const result = await service.submitProofs(request);
-
-      expect(result.accepted).toBe(3);
-      expect(result.rejected).toBe(2);
-      expect(result.outcomes).toEqual({
-        success: 1,
-        failed: 1,
-        blocked: 1,
-        error: 2,
-      });
-      expect(result.errors).toHaveLength(1);
-      expect(result.errors![0].proof_index).toBe(0);
-    });
-  });
-});