@lightsage/mcp 0.4.16 → 0.4.17

package/test/tracker.test.js

@@ -0,0 +1,323 @@
+import assert from "node:assert/strict";
+import http from "node:http";
+import test from "node:test";
+
+process.env.MCP_OAUTH_ENABLED = "false";
+process.env.LIGHTSAGE_MCP_TRACKER_API_KEY = "lsmcp_test_key";
+
+// Capture analytics batches instead of sending them.
+const batches = [];
+const authChecks = [];
+let analyticsHangs = false;
+const realFetch = globalThis.fetch;
+globalThis.fetch = async (url, init) => {
+  if (String(url).includes("/v2/auth/status")) {
+    authChecks.push(init.headers["X-Lightsage-Api-Key"]);
+    const valid = !String(init.headers["X-Lightsage-Api-Key"]).startsWith("ls_bad");
+    return new Response("{}", { status: valid ? 200 : 401 });
+  }
+  if (String(url).includes("mcp-analytics")) {
+    // Never settles and ignores the abort signal.
+    if (analyticsHangs) return new Promise(() => {});
+    batches.push({ headers: init.headers, body: JSON.parse(init.body) });
+    return new Response("{}", { status: 200 });
+  }
+  return realFetch(url, init);
+};
+
+const { default: handler } = await import("../api/mcp.js");
+const { Client } = await import(
+  "@modelcontextprotocol/sdk/client/index.js"
+);
+const { StreamableHTTPClientTransport } = await import(
+  "@modelcontextprotocol/sdk/client/streamableHttp.js"
+);
+
+function createServer() {
+  return http.createServer(async (req, res) => {
+    res.status = (code) => {
+      res.statusCode = code;
+      return res;
+    };
+    res.json = (value) => {
+      res.setHeader("content-type", "application/json");
+      res.end(JSON.stringify(value));
+    };
+
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    const body = Buffer.concat(chunks).toString("utf8");
+    req.body = body ? JSON.parse(body) : undefined;
+    await handler(req, res);
+  });
+}
+
+function initializeRequest(url) {
+  return realFetch(url, {
+    method: "POST",
+    headers: {
+      accept: "application/json, text/event-stream",
+      "content-type": "application/json",
+      "lightsage-api-key-auth": "ls_test_key",
+    },
+    body: JSON.stringify({
+      jsonrpc: "2.0",
+      id: 1,
+      method: "initialize",
+      params: {
+        protocolVersion: "2025-11-25",
+        capabilities: {},
+        clientInfo: { name: "tracker-test", version: "1.0.0" },
+      },
+    }),
+  });
+}
+
+function sentEvents() {
+  return batches.flatMap((batch) =>
+    batch.body.events ?? [batch.body]
+  );
+}
+
+test("tracks the handshake and tool calls and flushes before the handler returns", async () => {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+  const url = new URL(`http://127.0.0.1:${address.port}/mcp`);
+  const client = new Client({ name: "tracker-test", version: "1.0.0" });
+
+  try {
+    await client.connect(
+      new StreamableHTTPClientTransport(url, {
+        fetch: realFetch,
+        requestInit: { headers: { "lightsage-api-key-auth": "ls_test_key" } },
+      }),
+    );
+    await client.listTools();
+    await client.callTool({ name: "list_tools", arguments: {} });
+
+    const events = sentEvents();
+    const initialize = events.find((e) => e.event === "$mcp_initialize");
+    assert.equal(initialize?.client_name, "tracker-test");
+    assert.equal(initialize?.server_name, "LightsageMcp");
+    assert.ok(events.some((e) => e.event === "$mcp_tools_list"));
+    assert.ok(
+      events.some((e) =>
+        e.event === "$mcp_tool_call" && e.tool_name === "list_tools"
+      ),
+    );
+    assert.ok(
+      JSON.stringify(batches[0].headers).includes("lsmcp_test_key"),
+    );
+
+    // Each request is a new stateless server, so these only line up because
+    // the session comes from the caller's credential.
+    const toolCall = events.find((e) => e.event === "$mcp_tool_call");
+    assert.match(toolCall.session_id, /^mcp_caller_[0-9a-f]{32}$/);
+    assert.ok(events.every((e) => e.session_id === toolCall.session_id));
+    assert.equal(toolCall.client_name, "tracker-test");
+    assert.ok(!JSON.stringify(events).includes("ls_test_key"));
+  } finally {
+    await client.close();
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+test("caller sessions are stable per credential and client, and never contain the credential", async () => {
+  const { callerSessionId } = await import("../lib/tracker.js");
+  const alice = callerSessionId({
+    headers: { "x-lightsage-api-key": "ls_alice", "user-agent": "claude-code/2.1.3" },
+  });
+  assert.equal(
+    alice,
+    callerSessionId({
+      headers: { "x-lightsage-api-key": "ls_alice", "user-agent": "claude-code/2.1.3" },
+    }),
+  );
+  assert.notEqual(
+    alice,
+    callerSessionId({ headers: { "x-lightsage-api-key": "ls_bob", "user-agent": "claude-code/2.1.3" } }),
+  );
+  assert.notEqual(
+    alice,
+    callerSessionId({ headers: { "x-lightsage-api-key": "ls_alice", "user-agent": "cursor/1.0" } }),
+  );
+  assert.ok(!alice.includes("ls_alice"));
+  assert.match(
+    callerSessionId({ headers: { authorization: "Bearer oauth_token" } }),
+    /^mcp_caller_/,
+  );
+  assert.equal(callerSessionId({ headers: {} }), undefined);
+});
+
+test("a stalled analytics request does not hold the handler open", async () => {
+  analyticsHangs = true;
+  let handlerMs;
+  const server = http.createServer(async (req, res) => {
+    const chunks = [];
+    for await (const chunk of req) chunks.push(chunk);
+    req.body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const started = Date.now();
+    await handler(req, res);
+    handlerMs = Date.now() - started;
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+
+  try {
+    const response = await initializeRequest(
+      `http://127.0.0.1:${address.port}/mcp`,
+    );
+    assert.equal(response.status, 200);
+    await response.text();
+    await new Promise((resolve) => setTimeout(resolve, 3500));
+    assert.ok(handlerMs !== undefined && handlerMs < 3500, `handler took ${handlerMs}ms`);
+  } finally {
+    analyticsHangs = false;
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+test("on Vercel the analytics flush is registered with waitUntil", async () => {
+  // Vercel exposes the request context on this symbol; @vercel/functions reads it.
+  const contextSymbol = Symbol.for("@vercel/request-context");
+  const registered = [];
+  globalThis[contextSymbol] = {
+    get: () => ({ waitUntil: (promise) => registered.push(promise) }),
+  };
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const address = server.address();
+
+  try {
+    const response = await initializeRequest(
+      `http://127.0.0.1:${address.port}/mcp`,
+    );
+    assert.equal(response.status, 200);
+    await response.text();
+    await Promise.all(registered);
+    assert.equal(registered.length, 1);
+  } finally {
+    delete globalThis[contextSymbol];
+    await new Promise((resolve) => server.close(resolve));
+  }
+});
+
+
+async function postJsonRpc(url, headers, method, params, id = 1) {
+  const response = await realFetch(url, {
+    method: "POST",
+    headers: {
+      accept: "application/json, text/event-stream",
+      "content-type": "application/json",
+      ...headers,
+    },
+    body: JSON.stringify({ jsonrpc: "2.0", id, method, params }),
+  });
+  await response.text();
+  return response.status;
+}
+
+async function withServer(fn) {
+  const server = createServer();
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  try {
+    await fn(`http://127.0.0.1:${server.address().port}/mcp`);
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+}
+
+test("calls with a made-up API key are served but not recorded, even with a forged caller header", async () => {
+  await withServer(async (url) => {
+    const before = sentEvents().length;
+    const status = await postJsonRpc(
+      url,
+      {
+        "x-lightsage-api-key": "ls_bad_made_up",
+        "x-lightsage-verified-caller": "oauth:someone_else",
+      },
+      "tools/call",
+      { name: "list_tools", arguments: {} },
+    );
+    assert.equal(status, 200);
+    assert.equal(sentEvents().length, before);
+    assert.ok(authChecks.includes("ls_bad_made_up"));
+  });
+});
+
+test("the in-app agent's headers attribute the user, run and request, and search results are kept", async () => {
+  await withServer(async (url) => {
+    const before = sentEvents().length;
+    await postJsonRpc(
+      url,
+      {
+        "x-lightsage-api-key": "ls_agent_key",
+        "user-agent": "Lightsage-Agent/1.0",
+        "x-lightsage-agent-user": "user_123",
+        "x-lightsage-agent-run": "run_9",
+        "x-lightsage-agent-intent": encodeURIComponent("What's my visibility — today?"),
+      },
+      "tools/call",
+      { name: "list_tools", arguments: { search_terms: ["visibility"] } },
+    );
+    const call = sentEvents().slice(before).find((e) => e.event === "$mcp_tool_call");
+    assert.equal(call.client_name, "Lightsage-Agent");
+    assert.equal(call.distinct_id, "user_123");
+    assert.equal(call.conversation_id, "run_9");
+    assert.equal(call.intent, "What's my visibility — today?");
+    assert.deepEqual(call.properties, { auth: "api_key" });
+    // A catalog search result is kept: it is how empty searches are detected
+    assert.ok(call.response?.content?.length);
+    assert.match(call.session_id, /^mcp_caller_/);
+  });
+});
+
+test("an API key is checked once and then cached", async () => {
+  const { isTrackedApiKey } = await import("../lib/tracker.js");
+  let checks = 0;
+  const fakeFetch = async () => {
+    checks += 1;
+    return new Response("{}", { status: 200 });
+  };
+  assert.equal(await isTrackedApiKey("ls_cached", "https://api.example.test", fakeFetch), true);
+  assert.equal(await isTrackedApiKey("ls_cached", "https://api.example.test", fakeFetch), true);
+  assert.equal(checks, 1);
+
+  const failing = async () => {
+    throw new Error("network down");
+  };
+  // An unreachable API does not lose analytics, and is not cached
+  assert.equal(await isTrackedApiKey("ls_unknown", "https://api.example.test", failing), true);
+  const rejecting = async () => new Response("{}", { status: 401 });
+  assert.equal(await isTrackedApiKey("ls_unknown", "https://api.example.test", rejecting), false);
+});
+
+test("OAuth sessions follow the user, not the token", async () => {
+  const { callerSessionId } = await import("../lib/tracker.js");
+  const first = callerSessionId({
+    headers: {
+      authorization: "Bearer token_a",
+      "x-lightsage-verified-caller": "oauth:user_1",
+      "user-agent": "claude-code/2.1.3",
+    },
+  });
+  const refreshed = callerSessionId({
+    headers: {
+      authorization: "Bearer token_b",
+      "x-lightsage-verified-caller": "oauth:user_1",
+      "user-agent": "claude-code/2.1.3",
+    },
+  });
+  assert.equal(first, refreshed);
+});
+
+
+test("only failed calls and catalog tool results are stored", async () => {
+  const { shouldStoreResponse } = await import("../lib/tracker.js");
+  assert.equal(shouldStoreResponse({ toolName: "list_tools", isError: false }), true);
+  assert.equal(shouldStoreResponse({ toolName: "describe_tool_input", isError: false }), true);
+  assert.equal(shouldStoreResponse({ toolName: "execute_tool", isError: false }), false);
+  assert.equal(shouldStoreResponse({ toolName: "get_profile", isError: false }), false);
+  assert.equal(shouldStoreResponse({ toolName: "execute_tool", isError: true }), true);
+});