@malloy-publisher/server 0.0.235 → 0.0.236

package/tests/integration/mcp/mcp_transport.integration.spec.ts

@@ -1,98 +0,0 @@
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import {
-   ErrorCode,
-   Notification,
-   Request,
-   Result,
-} from "@modelcontextprotocol/sdk/types.js";
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import { URL } from "url";
-
-// --- Import E2E Test Setup ---
-import {
-   cleanupE2ETestEnvironment,
-   McpE2ETestEnvironment,
-   setupE2ETestEnvironment,
-} from "../../harness/mcp_test_setup";
-
-// --- Test Suite ---
-// Note: These tests assume interaction via a standard MCP client.
-// Tests for raw HTTP edge cases (non-JSON, non-RPC) are omitted based on this assumption.
-describe.serial("MCP Transport Tests (E2E Integration)", () => {
-   let env: McpE2ETestEnvironment | null = null;
-   let mcpClient: Client<Request, Notification, Result>; // Convenience variable
-
-   beforeAll(async () => {
-      env = await setupE2ETestEnvironment();
-      mcpClient = env.mcpClient;
-   });
-
-   afterAll(async () => {
-      await cleanupE2ETestEnvironment(env);
-      env = null;
-   });
-
-   describe("Basic Protocol", () => {
-      it(
-         "should handle a simple listTools request",
-         async () => {
-            if (!env) throw new Error("Test environment not initialized");
-            const result = await mcpClient.listTools();
-            // Assert based on actual successful response structure
-            expect(result).toHaveProperty("tools");
-            expect(Array.isArray(result.tools)).toBe(true);
-            expect(
-               result.tools.some((t) => t.name === "malloy_executeQuery"),
-            ).toBe(true);
-         },
-         { timeout: 30000 },
-      );
-
-      it("should receive MethodNotFound error for unknown methods", async () => {
-         if (!env) throw new Error("Test environment not initialized");
-         expect.assertions(2); // Expecting error instance and specific code
-         try {
-            // Attempt to call a method that doesn't exist
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            await (mcpClient as any).request({
-               method: "nonexistent/method",
-               params: {},
-            });
-            // Should not reach here
-            throw new Error("Request should have failed");
-         } catch (error) {
-            expect(error).toBeInstanceOf(Error);
-            // Check for the specific MethodNotFound error code
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            expect((error as { code?: number }).code).toBe(
-               ErrorCode.MethodNotFound,
-            );
-         }
-      });
-   });
-
-   describe("Connection Management & Bridge Logic", () => {
-      it("should return 405 Method Not Allowed for GET requests", async () => {
-         if (!env) throw new Error("Test environment not initialized");
-         const getUrl = new URL(`${env.serverUrl}/mcp`); // No session ID needed
-         const response = await fetch(getUrl.toString(), {
-            method: "GET",
-            headers: { Accept: "text/event-stream" },
-         });
-         expect(response.status).toBe(405); // Expect Method Not Allowed
-         const errorBody = await response.json();
-         expect(errorBody.error.message).toContain("Method Not Allowed");
-      });
-
-      it("should return 405 Method Not Allowed for DELETE requests", async () => {
-         if (!env) throw new Error("Test environment not initialized");
-         const deleteUrl = new URL(`${env.serverUrl}/mcp`); // No session ID needed
-         const response = await fetch(deleteUrl.toString(), {
-            method: "DELETE",
-         });
-         expect(response.status).toBe(405); // Expect Method Not Allowed
-         const errorBody = await response.json();
-         expect(errorBody.error.message).toContain("Method Not Allowed");
-      });
-   });
-});

package/tests/integration/query_givens/query_givens.integration.spec.ts

@@ -1,146 +0,0 @@
-/// <reference types="bun-types" />
-
-/**
- * HTTP E2E coverage for `given:` runtime parameters on POST .../query:
- * givens retarget query results, unknown/mistyped givens surface as 400 (not
- * 500), givens compose with filterParams, a `null` given value is an
- * explicit SQL-NULL override, and a numeric-string value is accepted for a
- * `number`-typed given (Malloy's own coercion). Malloy is the single validator:
- * an unknown name or bad value throws a `runtime-given-*` error that
- * model.ts maps to a 400 (see getQueryResults).
- */
-
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import path from "path";
-import { fileURLToPath } from "url";
-import { type RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ENV_NAME = "query-givens-env";
-const PKG = "query-givens";
-const MODEL = "model.malloy";
-
-type Row = Record<string, unknown>;
-
-describe("givens forwarding on /query (HTTP E2E)", () => {
-   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
-   let baseUrl: string;
-
-   beforeAll(async () => {
-      env = await startRestE2E();
-      baseUrl = env.baseUrl;
-      const fixtureDir = path.resolve(__dirname, "../../fixtures/query-givens");
-      const createRes = await fetch(`${baseUrl}/api/v0/environments`, {
-         method: "POST",
-         headers: { "Content-Type": "application/json" },
-         body: JSON.stringify({
-            name: ENV_NAME,
-            packages: [{ name: PKG, location: fixtureDir }],
-            connections: [],
-         }),
-      });
-      if (!createRes.ok) {
-         throw new Error(
-            `Failed to create test environment (${createRes.status}): ${await createRes.text()}`,
-         );
-      }
-      const deadline = Date.now() + 30_000;
-      while (Date.now() < deadline) {
-         const res = await fetch(
-            `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}`,
-         );
-         if (res.ok) break;
-         await new Promise((r) => setTimeout(r, 250));
-      }
-   });
-
-   afterAll(async () => {
-      await fetch(`${baseUrl}/api/v0/environments/${ENV_NAME}`, {
-         method: "DELETE",
-      }).catch(() => {});
-      await env?.stop();
-   });
-
-   const query = (body: Record<string, unknown>) =>
-      fetch(
-         `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}/models/${MODEL}/query`,
-         {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-               sourceName: "orders",
-               queryName: "by_given_region",
-               compactJson: true,
-               ...body,
-            }),
-         },
-      );
-
-   async function rows(res: Response): Promise<Row[]> {
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { result: string };
-      return JSON.parse(body.result) as Row[];
-   }
-
-   it("retargets rows via a given override (EU vs default US)", async () => {
-      const res = await query({ givens: { target_region: "EU" } });
-      const r = await rows(res);
-      expect(r.length).toBe(1);
-      expect(Number(r[0].order_count)).toBe(3);
-   });
-
-   it("returns 400 for an unknown given name, naming it in the message", async () => {
-      // Malloy rejects the unknown name (`runtime-given-unknown`, with a
-      // did-you-mean hint) at prepare time; model.ts maps that to a 400 and
-      // forwards Malloy's message, which names the given.
-      const res = await query({ givens: { NOtaGiven: 1 } });
-      expect(res.status).toBe(400);
-      const body = (await res.json()) as { message: string };
-      expect(body.message).toContain("NOtaGiven");
-   });
-
-   it("returns 400 for a value-type mismatch on a number-typed given", async () => {
-      // "min_amount" is declared `:: number`; a non-numeric string can't be
-      // coerced, so Malloy rejects it at prepare time (`runtime-given-*`),
-      // surfaced as a 400 via the run try/catch in model.ts, not a 500.
-      const res = await query({ givens: { min_amount: "not-a-number" } });
-      expect(res.status).toBe(400);
-   });
-
-   it("composes givens with filterParams", async () => {
-      // target_region=EU narrows to ids 4,5,6; filterParams status=active
-      // narrows further to ids 4,6 -> order_count=2.
-      const res = await query({
-         givens: { target_region: "EU" },
-         filterParams: { status: "active" },
-      });
-      const r = await rows(res);
-      expect(r.length).toBe(1);
-      expect(Number(r[0].order_count)).toBe(2);
-   });
-
-   it("omitting givens entirely uses the declared defaults (US baseline)", async () => {
-      const res = await query({});
-      const r = await rows(res);
-      expect(r.length).toBe(1);
-      expect(Number(r[0].order_count)).toBe(3);
-   });
-
-   it("a null given value is an explicit SQL-NULL override", async () => {
-      // `region = NULL` is never true in SQL, so this should return zero
-      // matching rows rather than falling back to the 'US' default.
-      const res = await query({ givens: { target_region: null } });
-      const r = await rows(res);
-      expect(r.length).toBe(1);
-      expect(Number(r[0].order_count)).toBe(0);
-   });
-
-   it("accepts a numeric string for a number-typed given", async () => {
-      // Guards against Malloy's numeric-string coercion for `number` givens
-      // regressing; "5" should be accepted just like the literal 5.
-      const res = await query({ givens: { min_amount: "5" } });
-      const r = await rows(res);
-      expect(r.length).toBe(1);
-      expect(Number(r[0].order_count)).toBe(3);
-   });
-});

package/tests/integration/query_givens/query_givens_authorize.integration.spec.ts

@@ -1,121 +0,0 @@
-/// <reference types="bun-types" />
-
-/**
- * HTTP E2E for the givens × `#(authorize)` interaction. Malloy is the single
- * given validator, so on a GATED source a bad given (unknown NAME or wrong-typed
- * VALUE) is caught inside the authorize probe, which fails closed — surfacing as
- * a 403, not the 400 the ungated path returns. This suite pins that documented
- * asymmetry so it stays intentional:
- *
- *   - unknown given name        -> 403 (probe can't bind it -> fails closed)
- *   - authorized + valid givens -> 200 (retargets rows)
- *   - authorize denies          -> 403
- *   - valid name, BAD value     -> 403 (probe can't evaluate it -> fails closed)
- *
- * On an UNGATED source the same unknown name / bad value are a clean 400 (Malloy
- * `runtime-given-*` mapped by model.ts) — see query_givens.integration.spec.ts.
- *
- * See packages/server/src/service/authorize.ts (evaluateAuthorize, fail-closed).
- */
-
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import path from "path";
-import { fileURLToPath } from "url";
-import { type RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ENV_NAME = "query-givens-authz-env";
-const PKG = "query-givens";
-const MODEL = "model.malloy";
-
-type Row = Record<string, unknown>;
-
-describe("givens × authorize on /query (HTTP E2E)", () => {
-   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
-   let baseUrl: string;
-
-   beforeAll(async () => {
-      env = await startRestE2E();
-      baseUrl = env.baseUrl;
-      const fixtureDir = path.resolve(__dirname, "../../fixtures/query-givens");
-      const createRes = await fetch(`${baseUrl}/api/v0/environments`, {
-         method: "POST",
-         headers: { "Content-Type": "application/json" },
-         body: JSON.stringify({
-            name: ENV_NAME,
-            packages: [{ name: PKG, location: fixtureDir }],
-            connections: [],
-         }),
-      });
-      if (!createRes.ok) {
-         throw new Error(
-            `Failed to create test environment (${createRes.status}): ${await createRes.text()}`,
-         );
-      }
-      const deadline = Date.now() + 30_000;
-      while (Date.now() < deadline) {
-         const res = await fetch(
-            `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}`,
-         );
-         if (res.ok) break;
-         await new Promise((r) => setTimeout(r, 250));
-      }
-   });
-
-   afterAll(async () => {
-      await fetch(`${baseUrl}/api/v0/environments/${ENV_NAME}`, {
-         method: "DELETE",
-      }).catch(() => {});
-      await env?.stop();
-   });
-
-   const queryGated = (body: Record<string, unknown>) =>
-      fetch(
-         `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}/models/${MODEL}/query`,
-         {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-               sourceName: "gated_orders",
-               queryName: "by_given_region",
-               compactJson: true,
-               ...body,
-            }),
-         },
-      );
-
-   it("unknown given name -> 403 on a gated source (authorize probe fails closed)", async () => {
-      // Even with role=admin, the unknown given makes the authorize probe throw
-      // (`runtime-given-unknown`), which the gate treats as not-granting. On an
-      // ungated source the same name is a clean 400 (see query_givens suite).
-      const res = await queryGated({
-         givens: { role: "admin", NOtaGiven: 1 },
-      });
-      expect(res.status).toBe(403);
-   });
-
-   it("authorized caller with valid givens -> 200 and retargets rows", async () => {
-      const res = await queryGated({
-         givens: { role: "admin", target_region: "EU" },
-      });
-      expect(res.status).toBe(200);
-      const body = (await res.json()) as { result: string };
-      const r = JSON.parse(body.result) as Row[];
-      expect(Number(r[0].order_count)).toBe(3);
-   });
-
-   it("authorize deny (non-admin role) -> 403", async () => {
-      const res = await queryGated({ givens: { role: "guest" } });
-      expect(res.status).toBe(403);
-   });
-
-   it("valid given name with a bad value -> 403 on a gated source (fail-closed authorize)", async () => {
-      // The authorize probe binds the supplied givens; a value it can't evaluate
-      // makes the probe throw and the gate denies. On the UNGATED path the same
-      // bad value is a 400 (Malloy at prepare time) — this asymmetry is by design.
-      const res = await queryGated({
-         givens: { role: "admin", min_amount: "not-a-number" },
-      });
-      expect(res.status).toBe(403);
-   });
-});

package/tests/integration/sdk_givens/sdk_givens.integration.spec.ts

@@ -1,110 +0,0 @@
-/// <reference types="bun-types" />
-
-/**
- * Proves the browser SDK (`packages/server/src/runtime/publisher.js`, served
- * at GET /sdk/publisher.js) actually puts `givens` on the wire: fetch the
- * served source, evaluate it in a sandboxed vm context standing in for
- * `window` (self === top, so the in-iframe/live-reload branches are
- * inert no-ops), and call `window.Publisher.query(...)` with a `givens`
- * override against the real HTTP server. Approach used: sandbox-eval via
- * Node's `vm` module — evaluating the actual runtime rather than just
- * grepping its source proves the SDK's fetch body really carries `givens`
- * end-to-end.
- */
-
-import { afterAll, beforeAll, describe, expect, it } from "bun:test";
-import path from "path";
-import { fileURLToPath } from "url";
-import vm from "vm";
-import { type RestE2EEnv, startRestE2E } from "../../harness/rest_e2e";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const ENV_NAME = "sdk-givens-env";
-const PKG = "query-givens";
-const MODEL = "model.malloy";
-
-type Row = Record<string, unknown>;
-
-describe("Publisher SDK forwards givens (sandbox-eval HTTP E2E)", () => {
-   let env: (RestE2EEnv & { stop(): Promise<void> }) | null = null;
-   let baseUrl: string;
-
-   beforeAll(async () => {
-      env = await startRestE2E();
-      baseUrl = env.baseUrl;
-      const fixtureDir = path.resolve(__dirname, "../../fixtures/query-givens");
-      const createRes = await fetch(`${baseUrl}/api/v0/environments`, {
-         method: "POST",
-         headers: { "Content-Type": "application/json" },
-         body: JSON.stringify({
-            name: ENV_NAME,
-            packages: [{ name: PKG, location: fixtureDir }],
-            connections: [],
-         }),
-      });
-      if (!createRes.ok) {
-         throw new Error(
-            `Failed to create test environment (${createRes.status}): ${await createRes.text()}`,
-         );
-      }
-      const deadline = Date.now() + 30_000;
-      while (Date.now() < deadline) {
-         const res = await fetch(
-            `${baseUrl}/api/v0/environments/${ENV_NAME}/packages/${PKG}`,
-         );
-         if (res.ok) break;
-         await new Promise((r) => setTimeout(r, 250));
-      }
-   });
-
-   afterAll(async () => {
-      await fetch(`${baseUrl}/api/v0/environments/${ENV_NAME}`, {
-         method: "DELETE",
-      }).catch(() => {});
-      await env?.stop();
-   });
-
-   it("Publisher.query() with a givens override reaches the server and retargets rows", async () => {
-      const sdkRes = await fetch(`${baseUrl}/sdk/publisher.js`);
-      expect(sdkRes.status).toBe(200);
-      const sdkSource = await sdkRes.text();
-
-      // Sandbox stands in for `window`. self === top so the runtime's
-      // in-iframe (postMessage resize) and live-reload (EventSource) branches
-      // are no-ops; document/EventSource are omitted since that code path
-      // never runs for a non-embedded page.
-      const sandbox: Record<string, unknown> = {
-         fetch,
-         location: {
-            pathname: `/environments/${ENV_NAME}/packages/${PKG}/`,
-            origin: baseUrl,
-         },
-         console,
-      };
-      sandbox.self = sandbox;
-      sandbox.top = sandbox;
-      sandbox.window = sandbox;
-
-      const context = vm.createContext(sandbox);
-      vm.runInContext(sdkSource, context, { filename: "publisher.js" });
-
-      const publisher = (sandbox.window as { Publisher: unknown })
-         .Publisher as {
-         query: (
-            modelPath: string,
-            malloyQuery: string | undefined,
-            opts: Record<string, unknown>,
-         ) => Promise<Row[]>;
-      };
-      expect(publisher).toBeDefined();
-
-      const rows = await publisher.query(MODEL, undefined, {
-         sourceName: "orders",
-         queryName: "by_given_region",
-         givens: { target_region: "EU" },
-      });
-
-      expect(rows.length).toBe(1);
-      expect(Number(rows[0].order_count)).toBe(3);
-   });
-});