@neverinfamous/mysql-mcp 2.1.0

package/src/transports/__tests__/http.test.ts

@@ -0,0 +1,596 @@
+/**
+ * mysql-mcp - HTTP Transport Unit Tests
+ * 
+ * Tests for HTTP transport functionality including CORS,
+ * health checks, OAuth metadata, and request routing.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { HttpTransport, createHttpTransport } from '../http.js';
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { createServer } from 'node:http';
+
+
+// Mock node:http
+vi.mock('node:http', () => {
+    const mockServer = {
+        listen: vi.fn((port, host, cb) => cb()),
+        close: vi.fn((cb) => cb && cb()),
+        on: vi.fn()
+    };
+    return {
+        createServer: vi.fn(() => mockServer),
+        IncomingMessage: vi.fn(),
+        ServerResponse: vi.fn()
+    };
+});
+
+// Mock SDK StreamableHTTPServerTransport
+vi.mock('@modelcontextprotocol/sdk/server/streamableHttp.js', () => {
+    return {
+        StreamableHTTPServerTransport: vi.fn(function () {
+            return {
+                start: vi.fn().mockResolvedValue(undefined),
+                handleRequest: vi.fn().mockResolvedValue(undefined)
+            };
+        })
+    };
+});
+
+// Mock logger to avoid console output
+vi.mock('../../utils/logger.js', () => ({
+    logger: {
+        info: vi.fn(),
+        error: vi.fn(),
+        warn: vi.fn(),
+        debug: vi.fn()
+    }
+}));
+
+
+describe('HttpTransport', () => {
+    let transport: HttpTransport;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        transport = new HttpTransport({
+            port: 3000,
+            host: 'localhost'
+        });
+    });
+
+    describe('Lifecycle', () => {
+        it('should start server on start()', async () => {
+            await transport.start();
+            expect(createServer).toHaveBeenCalled();
+            const server = (createServer as any).mock.results[0].value;
+            expect(server.listen).toHaveBeenCalledWith(3000, 'localhost', expect.any(Function));
+            expect(server.on).toHaveBeenCalledWith('error', expect.any(Function));
+        });
+
+        it('should stop server on stop()', async () => {
+            await transport.start();
+            await transport.stop();
+            const server = (createServer as any).mock.results[0].value;
+            expect(server.close).toHaveBeenCalled();
+        });
+
+        it('should do nothing on stop() if not started', async () => {
+            const result = await transport.stop();
+            expect(result).toBeUndefined();
+        });
+    });
+
+    describe('Construction', () => {
+        it('should create transport with config', () => {
+            expect(transport).toBeInstanceOf(HttpTransport);
+        });
+
+        it('should use default host when not provided', () => {
+            const t = new HttpTransport({ port: 8080 });
+            expect(t).toBeInstanceOf(HttpTransport);
+        });
+    });
+
+    describe('setCorsHeaders()', () => {
+        it('should not set CORS headers when origin not in allowed list', () => {
+            const transportWithCors = new HttpTransport({
+                port: 3000,
+                corsOrigins: ['https://allowed.example.com']
+            });
+
+            const mockReq = {
+                headers: { origin: 'https://notallowed.example.com' }
+            } as IncomingMessage;
+
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            // Access private method via prototype
+            (transportWithCors as unknown as { setCorsHeaders: (req: IncomingMessage, res: ServerResponse) => void })
+                .setCorsHeaders(mockReq, mockRes);
+
+            expect(mockRes.setHeader).not.toHaveBeenCalled();
+        });
+
+        it('should set CORS headers when origin is allowed', () => {
+            const transportWithCors = new HttpTransport({
+                port: 3000,
+                corsOrigins: ['https://allowed.example.com']
+            });
+
+            const mockReq = {
+                headers: { origin: 'https://allowed.example.com' }
+            } as IncomingMessage;
+
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transportWithCors as unknown as { setCorsHeaders: (req: IncomingMessage, res: ServerResponse) => void })
+                .setCorsHeaders(mockReq, mockRes);
+
+            expect(mockRes.setHeader).toHaveBeenCalledWith(
+                'Access-Control-Allow-Origin',
+                'https://allowed.example.com'
+            );
+            expect(mockRes.setHeader).toHaveBeenCalledWith(
+                'Access-Control-Allow-Methods',
+                'GET, POST, OPTIONS'
+            );
+            expect(mockRes.setHeader).toHaveBeenCalledWith(
+                'Access-Control-Allow-Headers',
+                'Content-Type, Authorization'
+            );
+        });
+
+        it('should not set CORS when no origin header', () => {
+            const transportWithCors = new HttpTransport({
+                port: 3000,
+                corsOrigins: ['https://allowed.example.com']
+            });
+
+            const mockReq = {
+                headers: {}
+            } as IncomingMessage;
+
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transportWithCors as unknown as { setCorsHeaders: (req: IncomingMessage, res: ServerResponse) => void })
+                .setCorsHeaders(mockReq, mockRes);
+
+            expect(mockRes.setHeader).not.toHaveBeenCalled();
+        });
+    });
+
+    describe('handleHealthCheck()', () => {
+        it('should return healthy status', () => {
+            const mockRes = {
+                writeHead: vi.fn(),
+                end: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { handleHealthCheck: (res: ServerResponse) => void })
+                .handleHealthCheck(mockRes);
+
+            expect(mockRes.writeHead).toHaveBeenCalledWith(200, {
+                'Content-Type': 'application/json'
+            });
+
+            const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+            const response = JSON.parse(endCall as string);
+
+            expect(response).toHaveProperty('status', 'healthy');
+            expect(response).toHaveProperty('timestamp');
+        });
+
+        it('should include ISO timestamp', () => {
+            const mockRes = {
+                writeHead: vi.fn(),
+                end: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { handleHealthCheck: (res: ServerResponse) => void })
+                .handleHealthCheck(mockRes);
+
+            const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+            const response = JSON.parse(endCall as string);
+
+            // Validate ISO timestamp format
+            expect(() => new Date(response.timestamp as string)).not.toThrow();
+        });
+    });
+
+    describe('handleProtectedResourceMetadata()', () => {
+        it('should return 404 when OAuth not configured', () => {
+            const mockRes = {
+                writeHead: vi.fn(),
+                end: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { handleProtectedResourceMetadata: (res: ServerResponse) => void })
+                .handleProtectedResourceMetadata(mockRes);
+
+            expect(mockRes.writeHead).toHaveBeenCalledWith(404);
+
+            const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+            const response = JSON.parse(endCall as string);
+            expect(response).toHaveProperty('error');
+        });
+
+        it('should return metadata when OAuth configured', () => {
+            const mockResourceServer = {
+                getMetadata: () => ({
+                    resource: 'https://mysql-mcp.example.com',
+                    authorization_servers: ['https://auth.example.com'],
+                    scopes_supported: ['read', 'write']
+                })
+            };
+
+            const transportWithOAuth = new HttpTransport({
+                port: 3000,
+                resourceServer: mockResourceServer as never
+            });
+
+            const mockRes = {
+                writeHead: vi.fn(),
+                end: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transportWithOAuth as unknown as { handleProtectedResourceMetadata: (res: ServerResponse) => void })
+                .handleProtectedResourceMetadata(mockRes);
+
+            expect(mockRes.writeHead).toHaveBeenCalledWith(200, {
+                'Content-Type': 'application/json'
+            });
+
+            const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+            const response = JSON.parse(endCall as string);
+            expect(response).toHaveProperty('resource');
+            expect(response).toHaveProperty('authorization_servers');
+        });
+    });
+
+    describe('setSecurityHeaders()', () => {
+        it('should set X-Content-Type-Options header', () => {
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
+                .setSecurityHeaders(mockRes);
+
+            expect(mockRes.setHeader).toHaveBeenCalledWith('X-Content-Type-Options', 'nosniff');
+        });
+
+        it('should set X-Frame-Options header', () => {
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
+                .setSecurityHeaders(mockRes);
+
+            expect(mockRes.setHeader).toHaveBeenCalledWith('X-Frame-Options', 'DENY');
+        });
+
+        it('should set X-XSS-Protection header', () => {
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
+                .setSecurityHeaders(mockRes);
+
+            expect(mockRes.setHeader).toHaveBeenCalledWith('X-XSS-Protection', '1; mode=block');
+        });
+
+        it('should set Cache-Control header', () => {
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
+                .setSecurityHeaders(mockRes);
+
+            expect(mockRes.setHeader).toHaveBeenCalledWith('Cache-Control', 'no-store, no-cache, must-revalidate');
+        });
+
+        it('should set Content-Security-Policy header', () => {
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
+                .setSecurityHeaders(mockRes);
+
+            expect(mockRes.setHeader).toHaveBeenCalledWith(
+                'Content-Security-Policy',
+                "default-src 'none'; frame-ancestors 'none'"
+            );
+        });
+
+        it('should set all 5 security headers', () => {
+            const mockRes = {
+                setHeader: vi.fn()
+            } as unknown as ServerResponse;
+
+            (transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
+                .setSecurityHeaders(mockRes);
+
+            // Verify exactly 5 headers were set
+            expect(mockRes.setHeader).toHaveBeenCalledTimes(5);
+        });
+    });
+});
+
+describe('handleRequest()', () => {
+    let transport: HttpTransport;
+
+    beforeEach(() => {
+        transport = new HttpTransport({
+            port: 3000,
+            corsOrigins: ['https://example.com']
+        });
+    });
+
+    it('should handle OPTIONS preflight request', async () => {
+        const mockReq = {
+            method: 'OPTIONS',
+            url: '/mcp',
+            headers: { host: 'localhost:3000', origin: 'https://example.com' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(mockRes.writeHead).toHaveBeenCalledWith(204);
+        expect(mockRes.end).toHaveBeenCalled();
+    });
+
+    it('should route to health check endpoint', async () => {
+        const mockReq = {
+            method: 'GET',
+            url: '/health',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(mockRes.writeHead).toHaveBeenCalledWith(200, { 'Content-Type': 'application/json' });
+        const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+        expect(JSON.parse(endCall as string)).toHaveProperty('status', 'healthy');
+    });
+
+    it('should route to OAuth metadata endpoint', async () => {
+        const mockReq = {
+            method: 'GET',
+            url: '/.well-known/oauth-protected-resource',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        // Without OAuth configured, should return 404
+        expect(mockRes.writeHead).toHaveBeenCalledWith(404);
+    });
+
+    it('should return 404 for unknown paths', async () => {
+        const mockReq = {
+            method: 'GET',
+            url: '/unknown-path',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(mockRes.writeHead).toHaveBeenCalledWith(404);
+        const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+        expect(JSON.parse(endCall as string)).toHaveProperty('error', 'Not found');
+    });
+
+    it('should reject unauthenticated requests when OAuth is configured', async () => {
+        const mockTokenValidator = {
+            validate: vi.fn().mockResolvedValue({ valid: false, error: 'Token missing' })
+        };
+
+        const mockResourceServer = {
+            getMetadata: vi.fn().mockReturnValue({ resource: 'test' })
+        };
+
+        const transportWithOAuth = new HttpTransport({
+            port: 3000,
+            resourceServer: mockResourceServer as never,
+            tokenValidator: mockTokenValidator as never
+        });
+
+        const mockReq = {
+            method: 'GET',
+            url: '/mcp',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        await (transportWithOAuth as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(mockRes.writeHead).toHaveBeenCalledWith(401, expect.objectContaining({
+            'WWW-Authenticate': 'Bearer'
+        }));
+    });
+
+    it('should allow authenticated requests when OAuth is configured', async () => {
+        const mockTokenValidator = {
+            validate: vi.fn().mockResolvedValue({
+                valid: true,
+                claims: { sub: 'user1', scopes: ['read'], exp: 0, iat: 0 }
+            })
+        };
+
+        const mockResourceServer = {
+            getMetadata: vi.fn().mockReturnValue({ resource: 'test' })
+        };
+
+        const transportWithOAuth = new HttpTransport({
+            port: 3000,
+            resourceServer: mockResourceServer as never,
+            tokenValidator: mockTokenValidator as never
+        });
+
+        const mockReq = {
+            method: 'GET',
+            url: '/mcp',
+            headers: {
+                host: 'localhost:3000',
+                authorization: 'Bearer valid_token'
+            }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        await (transportWithOAuth as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        // After successful auth, should return 404 (no MCP handling yet)
+        expect(mockRes.writeHead).toHaveBeenCalledWith(404);
+    });
+});
+
+describe('SSE Support', () => {
+    it('should route to SSE endpoint', async () => {
+        const mockReq = {
+            method: 'GET',
+            url: '/sse',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        // Spy on onConnect callback
+        const onConnect = vi.fn();
+        const transportWithCallback = createHttpTransport({ port: 3000 }, onConnect);
+        const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
+
+        await (transportWithCallback as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(StreamableHTTPServerTransport).toHaveBeenCalled();
+        // Verify start called (mocked)
+        const mockTransportInstance = (StreamableHTTPServerTransport as unknown as ReturnType<typeof vi.fn>).mock.results[0].value;
+        expect(mockTransportInstance.start).toHaveBeenCalled();
+        expect(onConnect).toHaveBeenCalledWith(mockTransportInstance);
+        expect(mockTransportInstance.handleRequest).toHaveBeenCalledWith(mockReq, mockRes);
+    });
+
+    it('should route to messages endpoint', async () => {
+        const mockReq = {
+            method: 'POST',
+            url: '/messages',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        // Setup transport with active SSE connection
+        const transport = new HttpTransport({ port: 3000 });
+        const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
+        const mockTransportInstance = new StreamableHTTPServerTransport();
+
+        // Manually set transport (private)
+        Object.defineProperty(transport, 'transport', {
+            value: mockTransportInstance,
+            writable: true
+        });
+
+        await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(mockTransportInstance.handleRequest).toHaveBeenCalledWith(mockReq, mockRes);
+    });
+
+    it('should return 400 for messages without active connection', async () => {
+        const mockReq = {
+            method: 'POST',
+            url: '/messages',
+            headers: { host: 'localhost:3000' }
+        } as IncomingMessage;
+
+        const mockRes = {
+            writeHead: vi.fn(),
+            end: vi.fn(),
+            setHeader: vi.fn()
+        } as unknown as ServerResponse;
+
+        const transport = new HttpTransport({ port: 3000 });
+
+        await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
+            .handleRequest(mockReq, mockRes);
+
+        expect(mockRes.writeHead).toHaveBeenCalledWith(400);
+        const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
+        expect(JSON.parse(endCall as string)).toHaveProperty('error', 'No active connection');
+    });
+});
+
+describe('createHttpTransport()', () => {
+    it('should create HttpTransport instance', () => {
+        const transport = createHttpTransport({ port: 8080 });
+        expect(transport).toBeInstanceOf(HttpTransport);
+    });
+
+    it('should pass config to transport', () => {
+        const transport = createHttpTransport({
+            port: 3000,
+            host: '0.0.0.0',
+            corsOrigins: ['https://example.com']
+        });
+        expect(transport).toBeInstanceOf(HttpTransport);
+    });
+});