@neverinfamous/mysql-mcp 2.3.0 → 3.0.0

package/src/adapters/mysql/tools/__tests__/replication.test.ts

@@ -204,6 +204,21 @@ describe("Replication Handler Execution", () => {
       expect(mockAdapter.executeQuery).toHaveBeenCalled();
       expect(result).toBeDefined();
     });
+
+    it("should return structured error on query failure", async () => {
+      mockAdapter.executeQuery.mockRejectedValue(
+        new Error("GTID not supported"),
+      );
+
+      const tool = tools.find((t) => t.name === "mysql_gtid_status")!;
+      const result = (await tool.handler({}, mockContext)) as {
+        success: boolean;
+        error: string;
+      };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Failed to retrieve GTID status");
+    });
   });
 
   describe("mysql_replication_lag", () => {
@@ -710,14 +725,18 @@ describe("Replication Fallback Handling", () => {
       expect(result).toHaveProperty("status");
     });
 
-    it("should return error when binary logging is disabled", async () => {
+    it("should return structured error when binary logging is disabled", async () => {
       mockAdapter.executeQuery
         .mockRejectedValueOnce(new Error("Unknown command"))
         .mockRejectedValueOnce(new Error("Binary logging not enabled"));
 
       const tool = tools.find((t) => t.name === "mysql_master_status")!;
-      const result = (await tool.handler({}, mockContext)) as { error: string };
+      const result = (await tool.handler({}, mockContext)) as {
+        success: boolean;
+        error: string;
+      };
 
+      expect(result.success).toBe(false);
       expect(result.error).toContain("Binary logging");
     });
   });
@@ -812,6 +831,33 @@ describe("Replication Fallback Handling", () => {
     });
   });
 
+  describe("mysql_binlog_events limit:0 guard", () => {
+    it("should return empty events for limit: 0 without querying MySQL", async () => {
+      const tool = tools.find((t) => t.name === "mysql_binlog_events")!;
+      const result = (await tool.handler(
+        { logFile: "mysql-bin.000001", limit: 0 },
+        mockContext,
+      )) as { events: unknown[] };
+
+      expect(result.events).toEqual([]);
+      // Should NOT have called executeQuery — guard returns before any SQL
+      expect(mockAdapter.executeQuery).not.toHaveBeenCalled();
+    });
+
+    it("should return structured error for negative limit", async () => {
+      const tool = tools.find((t) => t.name === "mysql_binlog_events")!;
+      const result = (await tool.handler(
+        { logFile: "mysql-bin.000001", limit: -1 },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBeDefined();
+      // Should NOT have called executeQuery — Zod rejects before any SQL
+      expect(mockAdapter.executeQuery).not.toHaveBeenCalled();
+    });
+  });
+
   describe("mysql_replication_lag fallback", () => {
     it("should return lag from replica status", async () => {
       mockAdapter.executeQuery.mockResolvedValue(

package/src/adapters/mysql/tools/__tests__/roles.test.ts

@@ -108,11 +108,10 @@ describe("Handler Execution", () => {
       expect(call).toContain("CREATE ROLE 'test_role'");
     });
 
-    it("should reject invalid role names", async () => {
+    it("should return structured error for invalid role names", async () => {
       const tool = tools.find((t) => t.name === "mysql_role_create")!;
-      await expect(
-        tool.handler({ name: "invalid-role" }, mockContext),
-      ).rejects.toThrow("Invalid role name");
+      const result = await tool.handler({ name: "invalid-role" }, mockContext);
+      expect(result).toEqual({ success: false, error: "Invalid role name" });
     });
 
     it("should return skipped when ifNotExists and role already exists", async () => {
@@ -170,14 +169,13 @@ describe("Handler Execution", () => {
       );
     });
 
-    it("should reject invalid role names", async () => {
+    it("should return structured error for invalid role names", async () => {
       const tool = tools.find((t) => t.name === "mysql_role_grant")!;
-      await expect(
-        tool.handler(
-          { role: "invalid-role", privileges: ["SELECT"] },
-          mockContext,
-        ),
-      ).rejects.toThrow("Invalid role name");
+      const result = await tool.handler(
+        { role: "invalid-role", privileges: ["SELECT"] },
+        mockContext,
+      );
+      expect(result).toEqual({ success: false, error: "Invalid role name" });
     });
   });
 
@@ -218,7 +216,7 @@ describe("Handler Execution", () => {
         role: "test_role",
         user: "testuser",
         host: "localhost",
-        reason:
+        error:
           "Role 'test_role' is not assigned to user 'testuser'@'localhost'",
       });
       expect(mockAdapter.rawQuery).not.toHaveBeenCalled();
@@ -249,11 +247,10 @@ describe("Handler Execution", () => {
       expect(call).toContain("DROP ROLE 'test_role'");
     });
 
-    it("should reject invalid role names", async () => {
+    it("should return structured error for invalid role names", async () => {
       const tool = tools.find((t) => t.name === "mysql_role_drop")!;
-      await expect(
-        tool.handler({ name: "invalid-role" }, mockContext),
-      ).rejects.toThrow("Invalid role name");
+      const result = await tool.handler({ name: "invalid-role" }, mockContext);
+      expect(result).toEqual({ success: false, error: "Invalid role name" });
     });
 
     it("should return skipped when ifExists and role does not exist", async () => {
@@ -367,7 +364,7 @@ describe("Handler Execution", () => {
 
       expect(result).toEqual({
         success: false,
-        reason: "Role 'test_role' already exists",
+        error: "Role 'test_role' already exists",
       });
     });
   });
@@ -386,7 +383,7 @@ describe("Handler Execution", () => {
 
       expect(result).toEqual({
         success: false,
-        reason: "Role 'test_role' does not exist",
+        error: "Role 'test_role' does not exist",
       });
     });
   });

package/src/adapters/mysql/tools/__tests__/router.test.ts

@@ -475,7 +475,7 @@ describe("Error Handling", () => {
 
     expect(result).toEqual({
       available: false,
-      reason: "Router API error: 401 Unauthorized",
+      error: "Router API error: 401 Unauthorized",
     });
   });
 
@@ -510,8 +510,8 @@ describe("Error Handling", () => {
     );
 
     expect(result).toEqual({
-      available: false,
-      reason: "Router API error: 404 Not Found",
+      success: false,
+      error: "Router API error: 404 Not Found",
     });
   });
 
@@ -535,7 +535,7 @@ describe("Error Handling", () => {
 
     expect(result).toEqual({
       available: false,
-      reason: "Router API request failed: Network error",
+      error: "Router API request failed: Network error",
     });
   });
 
@@ -561,11 +561,38 @@ describe("Error Handling", () => {
 
     expect(result).toEqual({
       available: false,
-      reason: expect.stringContaining("Connection refused"),
+      error: expect.stringContaining("Connection refused"),
     });
   });
 });
 
+describe("Zod Validation Error Handling", () => {
+  let tools: ReturnType<typeof getRouterTools>;
+  let mockContext: ReturnType<typeof createMockRequestContext>;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    tools = getRouterTools(createMockMySQLAdapter() as unknown as MySQLAdapter);
+    mockContext = createMockRequestContext();
+  });
+
+  it("should return structured error for invalid routeName type", async () => {
+    const tool = tools.find((t) => t.name === "mysql_router_route_status")!;
+    const result = await tool.handler({ routeName: 123 }, mockContext);
+
+    expect(result).toHaveProperty("success", false);
+    expect(result).toHaveProperty("error");
+  });
+
+  it("should return structured error for invalid metadataName type", async () => {
+    const tool = tools.find((t) => t.name === "mysql_router_metadata_status")!;
+    const result = await tool.handler({ metadataName: true }, mockContext);
+
+    expect(result).toHaveProperty("success", false);
+    expect(result).toHaveProperty("error");
+  });
+});
+
 describe("Authentication and TLS Handling", () => {
   let originalEnv: NodeJS.ProcessEnv;
 

package/src/adapters/mysql/tools/__tests__/security.test.ts

@@ -101,8 +101,19 @@ describe("Security Tools", () => {
       const tool = tools.find((t) => t.name === "mysql_security_audit");
       const result = (await tool?.handler({}, mockContext)) as any;
 
+      expect(result.success).toBe(false);
+      expect(result.error).toBe("Connect error");
+    });
+
+    it("should include error field in access-denied response", async () => {
+      mockAdapter.executeQuery.mockRejectedValue(new Error("Access denied"));
+
+      const tool = tools.find((t) => t.name === "mysql_security_audit");
+      const result = (await tool?.handler({}, mockContext)) as any;
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Audit logging is not enabled");
       expect(result.available).toBe(false);
-      expect(result.message).toContain("Audit logging is not enabled");
     });
   });
 
@@ -153,7 +164,9 @@ describe("Security Tools", () => {
       );
       const result = (await tool?.handler({}, mockContext)) as any;
 
+      expect(result.success).toBe(false);
       expect(result.available).toBe(false);
+      expect(result.error).toContain("Firewall tables not accessible");
     });
   });
 
@@ -200,8 +213,9 @@ describe("Security Tools", () => {
       );
       const result = (await tool?.handler({}, mockContext)) as any;
 
+      expect(result.success).toBe(false);
       expect(result.installed).toBe(false);
-      expect(result.message).toBe("Firewall plugin check failed");
+      expect(result.error).toContain("Firewall plugin check failed");
     });
   });
 
@@ -501,6 +515,27 @@ describe("Security Tools", () => {
       expect(result.sslEnabled).toBe(false);
       expect(result.currentCipher).toBe("None");
     });
+
+    it("should return 'None' for empty cipher string", async () => {
+      // Status with empty Ssl_cipher (SSL disabled but variable present)
+      mockAdapter.executeQuery.mockResolvedValueOnce(
+        createMockQueryResult([
+          { Variable_name: "Ssl_cipher", Value: "" },
+          { Variable_name: "Ssl_version", Value: "" },
+        ]),
+      );
+      // Variables
+      mockAdapter.executeQuery.mockResolvedValueOnce(createMockQueryResult([]));
+      // Connection
+      mockAdapter.executeQuery.mockResolvedValueOnce(createMockQueryResult([]));
+
+      const tool = tools.find((t) => t.name === "mysql_security_ssl_status");
+      const result = (await tool?.handler({}, mockContext)) as any;
+
+      expect(result.sslEnabled).toBe(false);
+      expect(result.currentCipher).toBe("None");
+      expect(result.sslVersion).toBe("N/A");
+    });
   });
 
   describe("mysql_security_user_privileges", () => {
@@ -788,4 +823,93 @@ describe("Security Tools", () => {
       expect(result.encryptionSettings).toEqual({ "": "invalid" });
     });
   });
+
+  describe("Error handling (try/catch wrapping)", () => {
+    it("mysql_security_ssl_status should return structured error on query failure", async () => {
+      mockAdapter.executeQuery.mockRejectedValue(new Error("Access denied"));
+
+      const tool = tools.find((t) => t.name === "mysql_security_ssl_status");
+      const result = (await tool?.handler({}, mockContext)) as any;
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe("Access denied");
+    });
+
+    it("mysql_security_encryption_status should return structured error on query failure", async () => {
+      mockAdapter.executeQuery.mockRejectedValue(
+        new Error("Query failed: Execute failed: Access denied"),
+      );
+
+      const tool = tools.find(
+        (t) => t.name === "mysql_security_encryption_status",
+      );
+      const result = (await tool?.handler({}, mockContext)) as any;
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe("Access denied");
+    });
+
+    it("mysql_security_user_privileges should return structured error on query failure", async () => {
+      mockAdapter.executeQuery.mockRejectedValue(
+        new Error("Query failed: Access denied to mysql.user"),
+      );
+
+      const tool = tools.find(
+        (t) => t.name === "mysql_security_user_privileges",
+      );
+      const result = (await tool?.handler({}, mockContext)) as any;
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe("Access denied to mysql.user");
+    });
+
+    it("mysql_security_sensitive_tables should return structured error on query failure", async () => {
+      mockAdapter.executeQuery.mockRejectedValue(
+        new Error("Execute failed: Connection lost"),
+      );
+
+      const tool = tools.find(
+        (t) => t.name === "mysql_security_sensitive_tables",
+      );
+      const result = (await tool?.handler({}, mockContext)) as any;
+
+      expect(result.success).toBe(false);
+      expect(result.error).toBe("Connection lost");
+    });
+
+    it("mysql_security_user_privileges should use backtick-quoted identifiers in SHOW GRANTS", async () => {
+      // Setup: one user returned
+      mockAdapter.executeQuery.mockResolvedValueOnce(
+        createMockQueryResult([
+          {
+            User: "test_user",
+            Host: "localhost",
+            plugin: "caching_sha2_password",
+            account_locked: "N",
+          },
+        ]),
+      );
+      // SHOW GRANTS
+      mockAdapter.executeQuery.mockResolvedValueOnce(
+        createMockQueryResult([
+          {
+            "Grants for test_user@localhost":
+              "GRANT USAGE ON *.* TO `test_user`@`localhost`",
+          },
+        ]),
+      );
+      // Role edges
+      mockAdapter.executeQuery.mockResolvedValueOnce(createMockQueryResult([]));
+
+      const tool = tools.find(
+        (t) => t.name === "mysql_security_user_privileges",
+      );
+      await tool?.handler({}, mockContext);
+
+      // The SHOW GRANTS call is the second call (index 1)
+      const grantsCall = mockAdapter.executeQuery.mock.calls[1][0] as string;
+      expect(grantsCall).toContain("`test_user`@`localhost`");
+      expect(grantsCall).not.toContain("'test_user'@'localhost'");
+    });
+  });
 });

package/src/adapters/mysql/tools/__tests__/security_injection.test.ts

@@ -28,94 +28,100 @@ describe("Security: SQL Injection Prevention", () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const exportTool = tools.find((t) => t.name === "mysql_export_table")!;
 
-      await expect(
-        exportTool.handler(
-          {
-            table: "users; DROP TABLE users",
-            format: "SQL",
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("Invalid table name");
+      const result = (await exportTool.handler(
+        {
+          table: "users; DROP TABLE users",
+          format: "SQL",
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Invalid table name");
     });
 
     it("should reject table name starting with number", async () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const exportTool = tools.find((t) => t.name === "mysql_export_table")!;
 
-      await expect(
-        exportTool.handler(
-          {
-            table: "123users",
-            format: "SQL",
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("Invalid table name");
+      const result = (await exportTool.handler(
+        {
+          table: "123users",
+          format: "SQL",
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Invalid table name");
     });
 
     it("should reject WHERE clause with stacked queries", async () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const exportTool = tools.find((t) => t.name === "mysql_export_table")!;
 
-      await expect(
-        exportTool.handler(
-          {
-            table: "users",
-            format: "SQL",
-            where: "1=1; DROP TABLE users",
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("dangerous SQL patterns");
+      const result = (await exportTool.handler(
+        {
+          table: "users",
+          format: "SQL",
+          where: "1=1; DROP TABLE users",
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("dangerous SQL patterns");
     });
 
     it("should reject WHERE clause with UNION attack", async () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const exportTool = tools.find((t) => t.name === "mysql_export_table")!;
 
-      await expect(
-        exportTool.handler(
-          {
-            table: "users",
-            format: "SQL",
-            where: "1=1 UNION SELECT password FROM admin",
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("dangerous SQL patterns");
+      const result = (await exportTool.handler(
+        {
+          table: "users",
+          format: "SQL",
+          where: "1=1 UNION SELECT password FROM admin",
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("dangerous SQL patterns");
     });
 
     it("should reject WHERE clause with timing attack (SLEEP)", async () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const exportTool = tools.find((t) => t.name === "mysql_export_table")!;
 
-      await expect(
-        exportTool.handler(
-          {
-            table: "users",
-            format: "SQL",
-            where: "1=1 AND SLEEP(5)",
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("dangerous SQL patterns");
+      const result = (await exportTool.handler(
+        {
+          table: "users",
+          format: "SQL",
+          where: "1=1 AND SLEEP(5)",
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("dangerous SQL patterns");
     });
 
     it("should reject WHERE clause with unbalanced quotes", async () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const exportTool = tools.find((t) => t.name === "mysql_export_table")!;
 
-      await expect(
-        exportTool.handler(
-          {
-            table: "users",
-            format: "SQL",
-            where: "id = 1 OR '1'='1",
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("unbalanced");
+      const result = (await exportTool.handler(
+        {
+          table: "users",
+          format: "SQL",
+          where: "id = 1 OR '1'='1",
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("unbalanced");
     });
 
     it("should accept valid table and WHERE", async () => {
@@ -142,30 +148,32 @@ describe("Security: SQL Injection Prevention", () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const importTool = tools.find((t) => t.name === "mysql_import_data")!;
 
-      await expect(
-        importTool.handler(
-          {
-            table: "users`; DROP TABLE users; --",
-            data: [{ id: 1, name: "test" }],
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("Invalid table name");
+      const result = (await importTool.handler(
+        {
+          table: "users`; DROP TABLE users; --",
+          data: [{ id: 1, name: "test" }],
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Invalid table name");
     });
 
     it("should reject column name with injection", async () => {
       const tools = getBackupTools(mockAdapter as unknown as MySQLAdapter);
       const importTool = tools.find((t) => t.name === "mysql_import_data")!;
 
-      await expect(
-        importTool.handler(
-          {
-            table: "users",
-            data: [{ "id; DROP TABLE": 1 }],
-          },
-          mockContext,
-        ),
-      ).rejects.toThrow("Invalid column name");
+      const result = (await importTool.handler(
+        {
+          table: "users",
+          data: [{ "id; DROP TABLE": 1 }],
+        },
+        mockContext,
+      )) as { success: boolean; error: string };
+
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("Invalid column name");
     });
   });