@neverinfamous/mysql-mcp 2.3.0 → 3.0.0

package/src/codemode/__tests__/sandbox.test.ts

@@ -0,0 +1,301 @@
+/**
+ * mysql-mcp - Code Mode Sandbox Unit Tests
+ *
+ * Tests for CodeModeSandbox (vm-based) and SandboxPool.
+ * Uses real Node.js vm module for sandbox execution.
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { CodeModeSandbox, SandboxPool } from "../sandbox.js";
+
+// Suppress logger
+vi.mock("../../utils/logger.js", () => ({
+  logger: { info: vi.fn(), warning: vi.fn(), error: vi.fn() },
+}));
+
+describe("CodeModeSandbox", () => {
+  let sandbox: CodeModeSandbox;
+
+  beforeEach(() => {
+    sandbox = CodeModeSandbox.create({
+      memoryLimitMb: 64,
+      timeoutMs: 5000,
+      cpuLimitMs: 5000,
+    });
+  });
+
+  afterEach(() => {
+    sandbox.dispose();
+  });
+
+  // ===========================================================================
+  // Creation
+  // ===========================================================================
+  describe("create", () => {
+    it("should create a sandbox with default options", () => {
+      const s = CodeModeSandbox.create();
+      expect(s).toBeDefined();
+      expect(s.isHealthy()).toBe(true);
+      s.dispose();
+    });
+
+    it("should create a sandbox with custom options", () => {
+      expect(sandbox).toBeDefined();
+      expect(sandbox.isHealthy()).toBe(true);
+    });
+  });
+
+  // ===========================================================================
+  // Execution
+  // ===========================================================================
+  describe("execute", () => {
+    it("should execute simple code and return result", async () => {
+      const result = await sandbox.execute("return 42", {});
+      expect(result.success).toBe(true);
+      expect(result.result).toBe(42);
+      expect(result.metrics.wallTimeMs).toBeGreaterThanOrEqual(0);
+    });
+
+    it("should provide access to api bindings", async () => {
+      const mockApi = {
+        core: {
+          readQuery: vi
+            .fn()
+            .mockResolvedValue({ rows: [{ id: 1 }], rowsAffected: 0 }),
+        },
+      };
+      const result = await sandbox.execute(
+        "return await mysql.core.readQuery('SELECT 1')",
+        mockApi,
+      );
+      expect(result.success).toBe(true);
+      expect(mockApi.core.readQuery).toHaveBeenCalledWith("SELECT 1");
+    });
+
+    it("should capture console output", async () => {
+      await sandbox.execute(
+        'console.log("hello"); console.warn("warning")',
+        {},
+      );
+      const output = sandbox.getConsoleOutput();
+      expect(output.some((line: string) => line.includes("hello"))).toBe(true);
+      expect(output.some((line: string) => line.includes("warning"))).toBe(
+        true,
+      );
+    });
+
+    it("should handle code errors gracefully", async () => {
+      const result = await sandbox.execute("throw new Error('test error')", {});
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("test error");
+    });
+
+    it("should handle syntax errors", async () => {
+      const result = await sandbox.execute("const x = {{{", {});
+      expect(result.success).toBe(false);
+      expect(result.error).toBeTruthy();
+    });
+
+    it("should handle async code", async () => {
+      const result = await sandbox.execute(
+        "const val = await Promise.resolve(99); return val",
+        {},
+      );
+      expect(result.success).toBe(true);
+      expect(result.result).toBe(99);
+    });
+
+    it("should fail on disposed sandbox", async () => {
+      sandbox.dispose();
+      const result = await sandbox.execute("return 1", {});
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("disposed");
+    });
+
+    it("should include execution metrics", async () => {
+      const result = await sandbox.execute("return 1", {});
+      expect(result.metrics).toBeDefined();
+      expect(result.metrics.wallTimeMs).toBeGreaterThanOrEqual(0);
+      expect(result.metrics.memoryUsedMb).toBeGreaterThanOrEqual(0);
+    });
+
+    it("should handle console.error and console.info", async () => {
+      await sandbox.execute('console.error("err"); console.info("inf")', {});
+      const output = sandbox.getConsoleOutput();
+      expect(output.some((line: string) => line.includes("err"))).toBe(true);
+      expect(output.some((line: string) => line.includes("inf"))).toBe(true);
+    });
+  });
+
+  // ===========================================================================
+  // calculateMetrics
+  // ===========================================================================
+  describe("calculateMetrics", () => {
+    it("should calculate correct metrics", () => {
+      const metrics = sandbox.calculateMetrics(0, 100, 1000, 2000);
+      expect(metrics.wallTimeMs).toBe(100);
+      expect(metrics.memoryUsedMb).toBeGreaterThanOrEqual(0);
+    });
+  });
+
+  // ===========================================================================
+  // Console output management
+  // ===========================================================================
+  describe("getConsoleOutput / clearConsoleOutput", () => {
+    it("should return empty array initially", () => {
+      expect(sandbox.getConsoleOutput()).toHaveLength(0);
+    });
+
+    it("should clear console output", async () => {
+      await sandbox.execute('console.log("test")', {});
+      expect(sandbox.getConsoleOutput().length).toBeGreaterThan(0);
+      sandbox.clearConsoleOutput();
+      expect(sandbox.getConsoleOutput()).toHaveLength(0);
+    });
+  });
+
+  // ===========================================================================
+  // Health and disposal
+  // ===========================================================================
+  describe("isHealthy / dispose", () => {
+    it("should be healthy after creation", () => {
+      expect(sandbox.isHealthy()).toBe(true);
+    });
+
+    it("should be unhealthy after dispose", () => {
+      sandbox.dispose();
+      expect(sandbox.isHealthy()).toBe(false);
+    });
+
+    it("should handle multiple dispose calls", () => {
+      sandbox.dispose();
+      sandbox.dispose(); // Should not throw
+      expect(sandbox.isHealthy()).toBe(false);
+    });
+  });
+});
+
+// =============================================================================
+// SandboxPool
+// =============================================================================
+describe("SandboxPool", () => {
+  let pool: SandboxPool;
+
+  beforeEach(() => {
+    pool = new SandboxPool(
+      { minInstances: 0, maxInstances: 3, idleTimeoutMs: 1000 },
+      { memoryLimitMb: 64, timeoutMs: 5000, cpuLimitMs: 5000 },
+    );
+  });
+
+  afterEach(() => {
+    pool.dispose();
+  });
+
+  describe("initialize", () => {
+    it("should initialize without error", () => {
+      pool.initialize();
+      const stats = pool.getStats();
+      expect(stats.max).toBe(3);
+    });
+
+    it("should pre-warm minimum instances", () => {
+      const warmPool = new SandboxPool(
+        { minInstances: 2, maxInstances: 5, idleTimeoutMs: 1000 },
+        { memoryLimitMb: 64, timeoutMs: 5000, cpuLimitMs: 5000 },
+      );
+      warmPool.initialize();
+      expect(warmPool.getStats().available).toBe(2);
+      warmPool.dispose();
+    });
+  });
+
+  describe("acquire / release", () => {
+    it("should acquire and release sandboxes", () => {
+      pool.initialize();
+      const s = pool.acquire();
+      expect(s).toBeDefined();
+      expect(s.isHealthy()).toBe(true);
+      pool.release(s);
+    });
+
+    it("should track in-use count", () => {
+      pool.initialize();
+      const s = pool.acquire();
+      expect(pool.getStats().inUse).toBe(1);
+      pool.release(s);
+      expect(pool.getStats().inUse).toBe(0);
+    });
+
+    it("should throw when pool is exhausted", () => {
+      pool.initialize();
+      const acquired: CodeModeSandbox[] = [];
+      for (let i = 0; i < 3; i++) {
+        acquired.push(pool.acquire());
+      }
+      expect(() => pool.acquire()).toThrow();
+      for (const s of acquired) pool.release(s);
+    });
+
+    it("should dispose unhealthy sandbox on release", () => {
+      pool.initialize();
+      const s = pool.acquire();
+      s.dispose(); // Make it unhealthy
+      pool.release(s);
+      expect(pool.getStats().available).toBe(0);
+    });
+  });
+
+  describe("execute", () => {
+    it("should execute code using pooled sandbox", async () => {
+      pool.initialize();
+      const result = await pool.execute("return 42", {});
+      expect(result.success).toBe(true);
+      expect(result.result).toBe(42);
+    });
+
+    it("should handle execution errors", async () => {
+      pool.initialize();
+      const result = await pool.execute("throw new Error('pool error')", {});
+      expect(result.success).toBe(false);
+      expect(result.error).toContain("pool error");
+    });
+  });
+
+  describe("cleanup", () => {
+    it("should clean up idle sandboxes", () => {
+      pool.initialize();
+      // Acquire and release to create idle sandbox
+      const s = pool.acquire();
+      pool.release(s);
+      expect(pool.getStats().available).toBeGreaterThan(0);
+
+      // Advance time past idle timeout
+      vi.useFakeTimers();
+      vi.advanceTimersByTime(2000);
+      pool.cleanup();
+      vi.useRealTimers();
+    });
+  });
+
+  describe("getStats", () => {
+    it("should return correct stats", () => {
+      pool.initialize();
+      const stats = pool.getStats();
+      expect(stats).toHaveProperty("available");
+      expect(stats).toHaveProperty("inUse");
+      expect(stats).toHaveProperty("max");
+      expect(stats.max).toBe(3);
+    });
+  });
+
+  describe("dispose", () => {
+    it("should dispose all sandboxes", () => {
+      pool.initialize();
+      const s = pool.acquire();
+      pool.release(s);
+      pool.dispose();
+      expect(pool.getStats().available).toBe(0);
+    });
+  });
+});

package/src/codemode/__tests__/security.test.ts

@@ -0,0 +1,368 @@
+/**
+ * mysql-mcp - Code Mode Security Unit Tests
+ *
+ * Tests for CodeModeSecurityManager: validation, rate limiting,
+ * result sanitization, audit logging, and cleanup.
+ */
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { CodeModeSecurityManager } from "../security.js";
+import type { SandboxResult } from "../types.js";
+
+// Suppress logger output
+vi.mock("../../utils/logger.js", () => ({
+  logger: {
+    info: vi.fn(),
+    warning: vi.fn(),
+    error: vi.fn(),
+  },
+}));
+
+describe("CodeModeSecurityManager", () => {
+  let manager: CodeModeSecurityManager;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    manager = new CodeModeSecurityManager();
+  });
+
+  // ===========================================================================
+  // validateCode
+  // ===========================================================================
+  describe("validateCode", () => {
+    it("should accept valid code", () => {
+      const result = manager.validateCode(
+        'const x = await mysql.core.readQuery("SELECT 1")',
+      );
+      expect(result.valid).toBe(true);
+      expect(result.errors).toHaveLength(0);
+    });
+
+    it("should reject empty string", () => {
+      const result = manager.validateCode("");
+      expect(result.valid).toBe(false);
+      expect(result.errors[0]).toContain("non-empty string");
+    });
+
+    it("should reject non-string input", () => {
+      const result = manager.validateCode(null as unknown as string);
+      expect(result.valid).toBe(false);
+      expect(result.errors[0]).toContain("non-empty string");
+    });
+
+    it("should reject code exceeding max length", () => {
+      const longCode = "x".repeat(100_000);
+      const result = manager.validateCode(longCode);
+      expect(result.valid).toBe(false);
+      expect(result.errors[0]).toContain("maximum length");
+    });
+
+    it("should detect require() pattern", () => {
+      const result = manager.validateCode('const fs = require("fs")');
+      expect(result.valid).toBe(false);
+      expect(result.errors.length).toBeGreaterThan(0);
+    });
+
+    it("should detect dynamic import()", () => {
+      const result = manager.validateCode('const m = import("child_process")');
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect process access", () => {
+      const result = manager.validateCode("process.exit(1)");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect eval()", () => {
+      const result = manager.validateCode('eval("malicious")');
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect Function constructor", () => {
+      const result = manager.validateCode('new Function("return 1")');
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect __proto__ access", () => {
+      const result = manager.validateCode("obj.__proto__.polluted = true");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect constructor.constructor chaining", () => {
+      const result = manager.validateCode(
+        '"".constructor.constructor("return this")()',
+      );
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect globalThis access", () => {
+      const result = manager.validateCode("globalThis.foo = 1");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect child_process", () => {
+      const result = manager.validateCode("child_process.exec('ls')");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect fs access", () => {
+      const result = manager.validateCode("fs.readFileSync('/etc/passwd')");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect net access", () => {
+      const result = manager.validateCode("net.connect(80)");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect http access", () => {
+      const result = manager.validateCode("http.get('http://evil.test')");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect https access", () => {
+      const result = manager.validateCode("https.get('https://evil.test')");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect bracket-notation constructor access", () => {
+      const result = manager.validateCode('x["constructor"]');
+      expect(result.valid).toBe(false);
+    });
+
+    it("should detect Reflect.construct", () => {
+      const result = manager.validateCode("Reflect.construct(Array, [])");
+      expect(result.valid).toBe(false);
+    });
+
+    it("should accumulate multiple blocked pattern errors", () => {
+      const result = manager.validateCode(
+        'require("fs"); process.exit(1); eval("x")',
+      );
+      expect(result.valid).toBe(false);
+      expect(result.errors.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it("should respect custom maxCodeLength", () => {
+      const small = new CodeModeSecurityManager({ maxCodeLength: 10 });
+      const result = small.validateCode("a".repeat(11));
+      expect(result.valid).toBe(false);
+    });
+  });
+
+  // ===========================================================================
+  // checkRateLimit
+  // ===========================================================================
+  describe("checkRateLimit", () => {
+    it("should allow first request", () => {
+      expect(manager.checkRateLimit("client-1")).toBe(true);
+    });
+
+    it("should allow requests within limit", () => {
+      for (let i = 0; i < 59; i++) {
+        expect(manager.checkRateLimit("client-2")).toBe(true);
+      }
+    });
+
+    it("should block when limit exceeded", () => {
+      const smallLimit = new CodeModeSecurityManager({
+        maxExecutionsPerMinute: 3,
+      });
+      expect(smallLimit.checkRateLimit("c")).toBe(true);
+      expect(smallLimit.checkRateLimit("c")).toBe(true);
+      expect(smallLimit.checkRateLimit("c")).toBe(true);
+      expect(smallLimit.checkRateLimit("c")).toBe(false);
+    });
+
+    it("should reset after window expires", () => {
+      const smallLimit = new CodeModeSecurityManager({
+        maxExecutionsPerMinute: 1,
+      });
+      expect(smallLimit.checkRateLimit("c")).toBe(true);
+      expect(smallLimit.checkRateLimit("c")).toBe(false);
+
+      // Simulate time passage by manipulating the internal map
+      vi.useFakeTimers();
+      vi.advanceTimersByTime(61_000);
+      expect(smallLimit.checkRateLimit("c")).toBe(true);
+      vi.useRealTimers();
+    });
+
+    it("should track clients independently", () => {
+      const smallLimit = new CodeModeSecurityManager({
+        maxExecutionsPerMinute: 1,
+      });
+      expect(smallLimit.checkRateLimit("a")).toBe(true);
+      expect(smallLimit.checkRateLimit("a")).toBe(false);
+      expect(smallLimit.checkRateLimit("b")).toBe(true);
+    });
+  });
+
+  // ===========================================================================
+  // getRateLimitRemaining
+  // ===========================================================================
+  describe("getRateLimitRemaining", () => {
+    it("should return full limit for unknown client", () => {
+      expect(manager.getRateLimitRemaining("unknown")).toBe(60);
+    });
+
+    it("should decrease after requests", () => {
+      manager.checkRateLimit("client");
+      expect(manager.getRateLimitRemaining("client")).toBe(59);
+    });
+
+    it("should return 0 when exhausted", () => {
+      const small = new CodeModeSecurityManager({
+        maxExecutionsPerMinute: 2,
+      });
+      small.checkRateLimit("c");
+      small.checkRateLimit("c");
+      expect(small.getRateLimitRemaining("c")).toBe(0);
+    });
+
+    it("should return full limit after window expires", () => {
+      manager.checkRateLimit("client");
+      vi.useFakeTimers();
+      vi.advanceTimersByTime(61_000);
+      expect(manager.getRateLimitRemaining("client")).toBe(60);
+      vi.useRealTimers();
+    });
+  });
+
+  // ===========================================================================
+  // sanitizeResult
+  // ===========================================================================
+  describe("sanitizeResult", () => {
+    it("should pass through small results", () => {
+      const input = { foo: "bar" };
+      expect(manager.sanitizeResult(input)).toEqual(input);
+    });
+
+    it("should truncate oversized results", () => {
+      const small = new CodeModeSecurityManager({ maxResultSize: 10 });
+      const result = small.sanitizeResult({ data: "a".repeat(100) }) as {
+        _truncated: boolean;
+      };
+      expect(result._truncated).toBe(true);
+    });
+
+    it("should handle non-serializable results", () => {
+      const circular: Record<string, unknown> = {};
+      circular.self = circular;
+      const result = manager.sanitizeResult(circular) as {
+        _error: string;
+      };
+      expect(result._error).toContain("could not be serialized");
+    });
+  });
+
+  // ===========================================================================
+  // auditLog
+  // ===========================================================================
+  describe("auditLog", () => {
+    const makeResult = (success: boolean): SandboxResult => ({
+      success,
+      result: success ? "ok" : undefined,
+      error: success ? undefined : "test error",
+      stack: success ? undefined : "Error: test error\n  at line 1",
+      metrics: { wallTimeMs: 10, cpuTimeMs: 5, memoryUsedMb: 1 },
+    });
+
+    it("should log successful executions", async () => {
+      const { logger } = await import("../../utils/logger.js");
+      const record = manager.createExecutionRecord(
+        "const x = 1",
+        makeResult(true),
+        false,
+        "client-1",
+      );
+      manager.auditLog(record);
+      expect(logger.info).toHaveBeenCalled();
+    });
+
+    it("should log failed executions with warning", async () => {
+      const { logger } = await import("../../utils/logger.js");
+      const record = manager.createExecutionRecord(
+        "bad code",
+        makeResult(false),
+        true,
+      );
+      manager.auditLog(record);
+      expect(logger.warning).toHaveBeenCalled();
+    });
+  });
+
+  // ===========================================================================
+  // createExecutionRecord
+  // ===========================================================================
+  describe("createExecutionRecord", () => {
+    it("should create record with correct fields", () => {
+      const result: SandboxResult = {
+        success: true,
+        result: 42,
+        metrics: { wallTimeMs: 10, cpuTimeMs: 5, memoryUsedMb: 1 },
+      };
+      const record = manager.createExecutionRecord(
+        "const x = 1",
+        result,
+        false,
+        "client-1",
+      );
+
+      expect(record.id).toBeTruthy();
+      expect(record.clientId).toBe("client-1");
+      expect(record.timestamp).toBeInstanceOf(Date);
+      expect(record.codePreview).toBe("const x = 1");
+      expect(record.result).toEqual(result);
+      expect(record.readonly).toBe(false);
+    });
+
+    it("should truncate long code in preview", () => {
+      const longCode = "x".repeat(300);
+      const result: SandboxResult = {
+        success: true,
+        metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 },
+      };
+      const record = manager.createExecutionRecord(longCode, result, true);
+
+      expect(record.codePreview.length).toBeLessThan(longCode.length);
+      expect(record.codePreview).toContain("...");
+    });
+
+    it("should handle undefined clientId", () => {
+      const result: SandboxResult = {
+        success: true,
+        metrics: { wallTimeMs: 0, cpuTimeMs: 0, memoryUsedMb: 0 },
+      };
+      const record = manager.createExecutionRecord("x", result, false);
+      expect(record.clientId).toBeUndefined();
+    });
+  });
+
+  // ===========================================================================
+  // cleanupRateLimits
+  // ===========================================================================
+  describe("cleanupRateLimits", () => {
+    it("should remove expired entries", () => {
+      const small = new CodeModeSecurityManager({
+        maxExecutionsPerMinute: 1,
+      });
+      small.checkRateLimit("client-old");
+      small.checkRateLimit("client-old"); // blocked
+
+      vi.useFakeTimers();
+      vi.advanceTimersByTime(61_000);
+      small.cleanupRateLimits();
+
+      // After cleanup, should have full limit again
+      expect(small.getRateLimitRemaining("client-old")).toBe(1);
+      vi.useRealTimers();
+    });
+
+    it("should keep active entries", () => {
+      manager.checkRateLimit("active");
+      manager.cleanupRateLimits();
+      expect(manager.getRateLimitRemaining("active")).toBe(59);
+    });
+  });
+});