@neverinfamous/mysql-mcp 2.1.0

package/src/adapters/mysql/tools/__tests__/security_integration.test.ts

@@ -0,0 +1,223 @@
+/**
+ * Security Integration Tests
+ * 
+ * End-to-end validation flow tests and error message leakage prevention.
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { createMockMySQLAdapter, createMockRequestContext } from '../../../../__tests__/mocks/index.js';
+import { getBackupTools } from '../admin/index.js';
+import { getJsonTools } from '../json/index.js';
+import type { MySQLAdapter } from '../../MySQLAdapter.js';
+import { ValidationError } from '../../../../utils/validators.js';
+
+describe('Security: Validation Flow Integration', () => {
+    let mockAdapter: ReturnType<typeof createMockMySQLAdapter>;
+    let mockContext: ReturnType<typeof createMockRequestContext>;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockAdapter = createMockMySQLAdapter();
+        mockContext = createMockRequestContext();
+    });
+
+    describe('End-to-End Injection Rejection', () => {
+        it('should reject malicious input at validation layer, not database layer', async () => {
+            const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+            const exportTool = tools.find(t => t.name === 'mysql_export_table')!;
+
+            // Malicious input should be rejected BEFORE any database call
+            await expect(exportTool.handler({
+                table: "users'; DROP TABLE users; --",
+                format: 'SQL'
+            }, mockContext)).rejects.toThrow();
+
+            // Verify NO database query was executed
+            expect(mockAdapter.executeReadQuery).not.toHaveBeenCalled();
+            expect(mockAdapter.executeWriteQuery).not.toHaveBeenCalled();
+        });
+
+        it('should reject complex injection attempt with multiple vectors', async () => {
+            const tools = getJsonTools(mockAdapter as unknown as MySQLAdapter);
+            const setTool = tools.find(t => t.name === 'mysql_json_set')!;
+
+            // Multiple attack vectors in one request
+            await expect(setTool.handler({
+                table: 'users',  // Valid
+                column: 'data',  // Valid
+                path: '$.name',
+                value: 'test',
+                where: "1=1; DELETE FROM users; -- UNION SELECT * FROM passwords"
+            }, mockContext)).rejects.toThrow('dangerous SQL patterns');
+
+            expect(mockAdapter.executeWriteQuery).not.toHaveBeenCalled();
+        });
+
+        it('should process valid input successfully after validation', async () => {
+            mockAdapter.executeReadQuery.mockResolvedValue({
+                rows: [{ id: 1, name: 'Test User' }]
+            });
+
+            const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+            const exportTool = tools.find(t => t.name === 'mysql_export_table')!;
+
+            const result = await exportTool.handler({
+                table: 'users',
+                format: 'SQL',
+                where: "status = 'active'"
+            }, mockContext);
+
+            // Verify database was called with safe query
+            expect(mockAdapter.executeReadQuery).toHaveBeenCalled();
+            expect(result).toBeDefined();
+        });
+    });
+
+    describe('Error Message Security', () => {
+        it('should not leak table name validation patterns in errors', async () => {
+            const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+            const exportTool = tools.find(t => t.name === 'mysql_export_table')!;
+
+            try {
+                await exportTool.handler({
+                    table: "admin'; SELECT * FROM secrets; --",
+                    format: 'SQL'
+                }, mockContext);
+                expect.fail('Should have thrown');
+            } catch (error) {
+                // Error should indicate invalid input but not reveal regex pattern
+                expect(error).toBeInstanceOf(ValidationError);
+                const message = (error as Error).message;
+                expect(message).not.toContain('regex');
+                expect(message).not.toContain('/^[a-zA-Z');
+                expect(message).not.toContain('secrets'); // Shouldn't echo user input
+            }
+        });
+
+        it('should not expose database schema information in errors', async () => {
+            const tools = getJsonTools(mockAdapter as unknown as MySQLAdapter);
+            const setTool = tools.find(t => t.name === 'mysql_json_set')!;
+
+            try {
+                await setTool.handler({
+                    table: 'users',
+                    column: 'data',
+                    path: '$.x',
+                    value: 'test',
+                    where: "1=1 AND information_schema.tables"
+                }, mockContext);
+                expect.fail('Should have thrown');
+            } catch (error) {
+                const message = (error as Error).message;
+                // Should not reveal what patterns are being blocked
+                expect(message).not.toContain('INFORMATION_SCHEMA');
+                expect(message).not.toContain('information_schema.tables');
+            }
+        });
+
+        it('should provide user-friendly error messages', async () => {
+            const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+            const exportTool = tools.find(t => t.name === 'mysql_export_table')!;
+
+            try {
+                await exportTool.handler({
+                    table: '123invalid',
+                    format: 'SQL'
+                }, mockContext);
+                expect.fail('Should have thrown');
+            } catch (error) {
+                const message = (error as Error).message;
+                // Error should be helpful but not technical
+                expect(message).toContain('table');
+                expect(message).not.toContain('IDENTIFIER_PATTERN');
+            }
+        });
+    });
+
+    describe('Validation Consistency', () => {
+        it('should validate identifiers consistently across tools', async () => {
+            const backupTools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+            const jsonTools = getJsonTools(mockAdapter as unknown as MySQLAdapter);
+
+            const maliciousTable = "users'; DROP TABLE users; --";
+
+            // Both tool families should reject the same malicious input
+            const exportTool = backupTools.find(t => t.name === 'mysql_export_table')!;
+            const jsonTool = jsonTools.find(t => t.name === 'mysql_json_extract')!;
+
+            await expect(exportTool.handler({
+                table: maliciousTable,
+                format: 'SQL'
+            }, mockContext)).rejects.toThrow('Invalid table name');
+
+            await expect(jsonTool.handler({
+                table: maliciousTable,
+                column: 'data',
+                path: '$.x'
+            }, mockContext)).rejects.toThrow('Invalid table name');
+        });
+    });
+});
+
+describe('Rate Limiting Preparation', () => {
+    /**
+     * These tests establish the patterns for rate limiting when implemented.
+     * They verify the infrastructure is ready for rate limiting middleware.
+     */
+
+    it('should support request context for rate limiting metadata', () => {
+        const context = createMockRequestContext();
+
+        // Verify context has properties useful for rate limiting
+        expect(context).toHaveProperty('requestId');
+        // Rate limiting will need client identification
+        expect(typeof context.requestId).toBe('string');
+    });
+
+    it('should have tool definitions with metadata for rate limiting rules', () => {
+        const mockAdapter = createMockMySQLAdapter();
+        const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+
+        const exportTool = tools.find(t => t.name === 'mysql_export_table')!;
+
+        // Tools have annotations that can inform rate limiting
+        expect(exportTool.annotations).toBeDefined();
+        expect(exportTool.annotations?.readOnlyHint).toBe(true);
+        // Read-only tools could have different rate limits than write tools
+    });
+
+    it('should have scope information for tier-based rate limiting', () => {
+        const mockAdapter = createMockMySQLAdapter();
+        const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+
+        const exportTool = tools.find(t => t.name === 'mysql_export_table')!;
+        const importTool = tools.find(t => t.name === 'mysql_import_data')!;
+
+        // Scopes can determine rate limit tiers
+        expect(exportTool.requiredScopes).toContain('read');
+        expect(importTool.requiredScopes).toContain('write');
+        // Write operations could have stricter rate limits
+    });
+
+    it('should distinguish between tool groups for rate limiting categories', () => {
+        const mockAdapter = createMockMySQLAdapter();
+        const backupTools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
+        const jsonTools = getJsonTools(mockAdapter as unknown as MySQLAdapter);
+
+        // All tools have group assignments for category-based limiting
+        expect(backupTools.every(t => t.group === 'backup')).toBe(true);
+        expect(jsonTools.every(t => t.group === 'json')).toBe(true);
+    });
+
+    /**
+     * Future rate limiting implementation guide:
+     * 
+     * 1. Add rate limiting middleware to HTTP transport
+     * 2. Use request context clientId/IP for tracking
+     * 3. Apply different limits based on:
+     *    - Tool group (backup tools: stricter limits)
+     *    - Required scopes (write ops: lower limits)
+     *    - Request annotations (readOnlyHint: higher limits)
+     * 4. Return 429 Too Many Requests with Retry-After header
+     */
+});

package/src/adapters/mysql/tools/__tests__/spatial.test.ts

@@ -0,0 +1,333 @@
+/**
+ * mysql-mcp - Spatial Tools Unit Tests
+ * 
+ * Tests for spatial tool definitions and handler execution.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { getSpatialTools } from '../spatial/index.js';
+import type { MySQLAdapter } from '../../MySQLAdapter.js';
+import { createMockMySQLAdapter, createMockRequestContext, createMockQueryResult } from '../../../../__tests__/mocks/index.js';
+
+describe('getSpatialTools', () => {
+    let tools: ReturnType<typeof getSpatialTools>;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        tools = getSpatialTools(createMockMySQLAdapter() as unknown as MySQLAdapter);
+    });
+
+    it('should return 12 spatial tools', () => {
+        expect(tools).toHaveLength(12);
+    });
+
+    it('should have spatial group for all tools', () => {
+        for (const tool of tools) {
+            expect(tool.group).toBe('spatial');
+        }
+    });
+
+    it('should have handler functions for all tools', () => {
+        for (const tool of tools) {
+            expect(typeof tool.handler).toBe('function');
+        }
+    });
+
+    it('should have inputSchema for all tools', () => {
+        for (const tool of tools) {
+            expect(tool.inputSchema).toBeDefined();
+        }
+    });
+
+    it('should include expected tool names', () => {
+        const names = tools.map(t => t.name);
+        expect(names).toContain('mysql_spatial_create_column');
+        expect(names).toContain('mysql_spatial_create_index');
+        expect(names).toContain('mysql_spatial_point');
+        expect(names).toContain('mysql_spatial_polygon');
+        expect(names).toContain('mysql_spatial_distance');
+        expect(names).toContain('mysql_spatial_distance_sphere');
+        expect(names).toContain('mysql_spatial_contains');
+        expect(names).toContain('mysql_spatial_within');
+        expect(names).toContain('mysql_spatial_intersection');
+        expect(names).toContain('mysql_spatial_buffer');
+        expect(names).toContain('mysql_spatial_transform');
+        expect(names).toContain('mysql_spatial_geojson');
+    });
+});
+
+describe('Handler Execution', () => {
+    let mockAdapter: ReturnType<typeof createMockMySQLAdapter>;
+    let tools: ReturnType<typeof getSpatialTools>;
+    let mockContext: ReturnType<typeof createMockRequestContext>;
+
+    beforeEach(() => {
+        vi.clearAllMocks();
+        mockAdapter = createMockMySQLAdapter();
+        tools = getSpatialTools(mockAdapter as unknown as MySQLAdapter);
+        mockContext = createMockRequestContext();
+    });
+
+    describe('mysql_spatial_create_column', () => {
+        it('should create a spatial column', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_create_column')!;
+            const result = await tool.handler({
+                table: 'locations',
+                column: 'geom',
+                type: 'POINT',
+                srid: 4326
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ADD COLUMN');
+            expect(result).toHaveProperty('success', true);
+        });
+
+        it('should create NOT NULL column', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_create_column')!;
+            await tool.handler({
+                table: 'locations',
+                column: 'geom',
+                nullable: false
+            }, mockContext);
+
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('NOT NULL');
+        });
+    });
+
+    describe('mysql_spatial_create_index', () => {
+        it('should create a spatial index', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([]));
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_create_index')!;
+            const result = await tool.handler({
+                table: 'locations',
+                column: 'geom',
+                indexName: 'idx_locations_geom'
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('SPATIAL INDEX');
+            expect(result).toHaveProperty('success', true);
+        });
+
+        it('should handle index creation errors', async () => {
+            mockAdapter.executeQuery.mockRejectedValue(new Error('Index already exists'));
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_create_index')!;
+            await expect(tool.handler({
+                table: 'locations',
+                column: 'geom',
+                indexName: 'idx_locations_geom'
+            }, mockContext)).rejects.toThrow('Index already exists');
+        });
+    });
+
+    describe('mysql_spatial_point', () => {
+        it('should create a POINT geometry', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ wkt: 'POINT(-73.9857 40.7484)', srid: 4326 }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_point')!;
+            const result = await tool.handler({ longitude: -73.9857, latitude: 40.7484 }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('POINT');
+            expect(result).toBeDefined();
+        });
+
+        it('should reject invalid coordinates', async () => {
+            mockAdapter.executeQuery.mockRejectedValue(new Error('Invalid coordinate'));
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_point')!;
+            await expect(tool.handler({ longitude: -200, latitude: 40.7484 }, mockContext))
+                .rejects.toThrow('Invalid coordinate');
+        });
+    });
+
+    describe('mysql_spatial_polygon', () => {
+        it('should create a POLYGON geometry', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ wkt: 'POLYGON((...))' }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_polygon')!;
+            const result = await tool.handler({
+                coordinates: [[[0, 0], [10, 0], [10, 10], [0, 10], [0, 0]]],
+                srid: 4326
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            expect(result).toBeDefined();
+        });
+    });
+
+    describe('mysql_spatial_distance', () => {
+        it('should find points within distance', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ distance: 1000.5 }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_distance')!;
+            await tool.handler({
+                table: 'locations',
+                spatialColumn: 'geom',
+                point: { longitude: 0, latitude: 0 }
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Distance');
+        });
+    });
+
+    describe('mysql_spatial_distance_sphere', () => {
+        it('should calculate spherical distance', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ id: 1, distance_meters: 5000 }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_distance_sphere')!;
+            await tool.handler({
+                table: 'locations',
+                spatialColumn: 'geom',
+                point: { longitude: -73.9857, latitude: 40.7484 },
+                maxDistance: 10000
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Distance_Sphere');
+        });
+    });
+
+    describe('mysql_spatial_contains', () => {
+        it('should find geometries within a polygon', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(createMockQueryResult([
+                { id: 1 }, { id: 2 }
+            ]));
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_contains')!;
+            await tool.handler({
+                table: 'locations',
+                spatialColumn: 'geom',
+                polygon: 'POLYGON((0 0, 10 0, 10 10, 0 10, 0 0))'
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Contains');
+        });
+    });
+
+    describe('mysql_spatial_within', () => {
+        it('should find geometries within another', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ id: 1 }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_within')!;
+            await tool.handler({
+                table: 'locations',
+                spatialColumn: 'geom',
+                geometry: 'POLYGON((0 0, 10 0, 10 10, 0 10, 0 0))'
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Within');
+        });
+    });
+
+    describe('mysql_spatial_intersection', () => {
+        it('should calculate intersection of geometries', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ intersects: 1, intersection_wkt: 'POINT(5 5)' }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_intersection')!;
+            await tool.handler({
+                geometry1: 'POLYGON((0 0, 10 0, 10 10, 0 10, 0 0))',
+                geometry2: 'POLYGON((5 5, 15 5, 15 15, 5 15, 5 5))'
+            }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Intersection');
+        });
+    });
+
+    describe('mysql_spatial_buffer', () => {
+        it('should create buffer around geometry', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ buffered: 'POLYGON(...)' }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_buffer')!;
+            await tool.handler({ geometry: 'POINT(0 0)', distance: 100 }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Buffer');
+        });
+    });
+
+    describe('mysql_spatial_transform', () => {
+        it('should transform geometry between SRIDs', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ transformed_wkt: 'POINT(...)' }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_transform')!;
+            await tool.handler({ geometry: 'POINT(0 0)', fromSrid: 4326, toSrid: 3857 }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            const call = mockAdapter.executeQuery.mock.calls[0][0] as string;
+            expect(call).toContain('ST_Transform');
+        });
+    });
+
+    describe('mysql_spatial_geojson', () => {
+        it('should convert WKT to GeoJSON', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ geoJson: '{"type":"Point","coordinates":[0,0]}' }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_geojson')!;
+            const result = await tool.handler({ geometry: 'POINT(0 0)' }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            expect(result).toBeDefined();
+        });
+
+        it('should convert GeoJSON to WKT', async () => {
+            mockAdapter.executeQuery.mockResolvedValue(
+                createMockQueryResult([{ wkt: 'POINT(0 0)' }])
+            );
+
+            const tool = tools.find(t => t.name === 'mysql_spatial_geojson')!;
+            const result = await tool.handler({ geoJson: '{"type":"Point","coordinates":[0,0]}' }, mockContext);
+
+            expect(mockAdapter.executeQuery).toHaveBeenCalled();
+            expect(result).toBeDefined();
+        });
+
+        it('should handle logic fallback (coverage)', async () => {
+            const tool = tools.find(t => t.name === 'mysql_spatial_geojson')!;
+            try {
+                await tool.handler({ geometry: "" }, mockContext);
+            } catch (error) {
+                expect(error).toBeDefined();
+            }
+        });
+    });
+});