@opsee/mcp-server 0.9.33 → 0.9.35

package/src/__tests__/work-logs.test.ts

@@ -1,140 +0,0 @@
-import { describe, test, expect, beforeAll, afterAll } from "vitest";
-import { Client } from "@modelcontextprotocol/sdk/client/index.js";
-import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
-import { createServer } from "../server.js";
-import type { ApiClients } from "../client/api.js";
-
-const mockTaskWithLogs = {
-  id: 10,
-  identifier: "TP-1",
-  title: "Fix the bug",
-  estimatedHours: 5,
-  workLogs: [
-    { id: 1, userId: 5, user: { fullName: "Alice" }, hours: 2, description: "implemented foo" },
-    { id: 2, userId: 6, hours: 1.5 },
-  ],
-};
-
-function createMockClients(overrides: Partial<ApiClients["tasks"]> = {}): ApiClients {
-  return {
-    tasks: {
-      getTask: async () => ({ task: mockTaskWithLogs }),
-      addWorkLog: async (req: { taskId: number; hours: number }) => ({
-        workLog: { id: 42, taskId: req.taskId, userId: 5, hours: req.hours },
-      }),
-      deleteWorkLog: async () => ({}),
-      ...overrides,
-    },
-  } as unknown as ApiClients;
-}
-
-async function connect(clients: ApiClients) {
-  const [ct, st] = InMemoryTransport.createLinkedPair();
-  const server = createServer(() => clients);
-  await server.connect(st);
-  const client = new Client({ name: "work-logs-test", version: "1.0.0" });
-  await client.connect(ct);
-  return { client, cleanup: async () => { await client.close(); await server.close(); } };
-}
-
-describe("Work log tools", () => {
-  let client: Client;
-  let cleanup: () => Promise<void>;
-
-  beforeAll(async () => {
-    const conn = await connect(createMockClients());
-    client = conn.client;
-    cleanup = conn.cleanup;
-  });
-
-  afterAll(async () => {
-    await cleanup();
-  });
-
-  test("opsee_list_work_logs formats entries, users, and the running total", async () => {
-    const result = await client.callTool({
-      name: "opsee_list_work_logs",
-      arguments: { taskId: 10 },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("Work logs for TP-1 (total 3.5h)");
-    expect(text).toContain("Alice @");
-    expect(text).toContain("2h — implemented foo (ID: 1)");
-    expect(text).toContain("User #6 @");
-    expect(text).toContain("1.5h (ID: 2)");
-  });
-
-  test("opsee_list_work_logs reports task not found", async () => {
-    const { client: c, cleanup: cl } = await connect(createMockClients({ getTask: async () => ({}) } as any));
-    const result = await c.callTool({
-      name: "opsee_list_work_logs",
-      arguments: { taskId: 999 },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("Task not found.");
-    await cl();
-  });
-
-  test("opsee_log_work logs hours against a task", async () => {
-    const result = await client.callTool({
-      name: "opsee_log_work",
-      arguments: { taskId: 10, hours: 2.5, description: "implemented foo" },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("Logged 2.5h on task 10 (work_log ID 42).");
-  });
-
-  test("opsee_log_work reports failure when the backend returns no work log", async () => {
-    const { client: c, cleanup: cl } = await connect(createMockClients({ addWorkLog: async () => ({}) } as any));
-    const result = await c.callTool({
-      name: "opsee_log_work",
-      arguments: { taskId: 10, hours: 1 },
-    });
-    expect(result.isError).toBe(true);
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("Failed to log work");
-    await cl();
-  });
-
-  test("opsee_delete_work_log succeeds", async () => {
-    const result = await client.callTool({
-      name: "opsee_delete_work_log",
-      arguments: { taskId: 10, workLogId: 1 },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("Work log deleted.");
-  });
-
-  test("opsee_get_task_actual_hours reports over-budget delta", async () => {
-    const result = await client.callTool({
-      name: "opsee_get_task_actual_hours",
-      arguments: { taskId: 10 },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    // total logged is 3.5h against an estimate of 5h, so this is under budget.
-    expect(text).toContain("TP-1: 3.5h logged (estimated 5h, under by 1.5 h).");
-  });
-
-  test("opsee_get_task_actual_hours reports over-budget when logged hours exceed the estimate", async () => {
-    const overBudgetTask = { ...mockTaskWithLogs, estimatedHours: 2 };
-    const { client: c, cleanup: cl } = await connect(createMockClients({ getTask: async () => ({ task: overBudgetTask }) } as any));
-    const result = await c.callTool({
-      name: "opsee_get_task_actual_hours",
-      arguments: { taskId: 10 },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("TP-1: 3.5h logged (estimated 2h, over by 1.5 h).");
-    await cl();
-  });
-
-  test("opsee_get_task_actual_hours reports task not found", async () => {
-    const { client: c, cleanup: cl } = await connect(createMockClients({ getTask: async () => ({}) } as any));
-    const result = await c.callTool({
-      name: "opsee_get_task_actual_hours",
-      arguments: { taskId: 999 },
-    });
-    const text = (result.content as Array<{ type: string; text: string }>)[0].text;
-    expect(text).toContain("Task not found.");
-    await cl();
-  });
-});

package/src/auth/__tests__/manager.test.ts

@@ -1,67 +0,0 @@
-import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
-import type { Credentials } from "../credentials.js";
-
-// Control what the manager reads from disk.
-const { mockRead } = vi.hoisted(() => ({ mockRead: vi.fn() }));
-vi.mock("../credentials.js", () => ({
-  readCredentials: mockRead,
-  clearCredentials: vi.fn(),
-}));
-
-import { AuthManager } from "../manager.js";
-
-const CANONICAL = "https://grpc.api.opsee.ai";
-const LEGACY_STALE = "https://api.opsee.dev";
-
-function creds(serverUrl: string): Credentials {
-  return {
-    token: "jwt.token.here",
-    serverUrl,
-    userId: "u",
-    companyId: "c",
-    expiresAt: new Date(Date.now() + 3_600_000).toISOString(),
-  };
-}
-
-// Build a manager whose credentials are populated from `stored` (null = none).
-function managerWith(stored: Credentials | null): AuthManager {
-  mockRead.mockReturnValue(stored);
-  const m = new AuthManager();
-  m.getToken(); // populates the private credentials field, as in real startup
-  return m;
-}
-
-describe("AuthManager.getServerUrl", () => {
-  const OLD_ENV = process.env.OPSEE_API_URL;
-  beforeEach(() => {
-    mockRead.mockReset();
-    delete process.env.OPSEE_API_URL;
-  });
-  afterEach(() => {
-    if (OLD_ENV === undefined) delete process.env.OPSEE_API_URL;
-    else process.env.OPSEE_API_URL = OLD_ENV;
-  });
-
-  test("returns the canonical default when nothing is stored", () => {
-    expect(managerWith(null).getServerUrl()).toBe(CANONICAL);
-  });
-
-  test("returns a stored, non-stale serverUrl unchanged", () => {
-    expect(managerWith(creds("https://custom.example.com")).getServerUrl()).toBe(
-      "https://custom.example.com",
-    );
-  });
-
-  test("treats the legacy stale host as unset and falls back to the canonical default", () => {
-    // The whole point of the migration: existing users with the dead host in
-    // ~/.opsee/credentials.json must NOT be pinned to it, without re-login.
-    expect(managerWith(creds(LEGACY_STALE)).getServerUrl()).toBe(CANONICAL);
-  });
-
-  test("OPSEE_API_URL env var overrides both stored and default", () => {
-    process.env.OPSEE_API_URL = "https://env.example.com";
-    expect(managerWith(creds("https://custom.example.com")).getServerUrl()).toBe(
-      "https://env.example.com",
-    );
-  });
-});

package/src/auth/__tests__/oauth-provider.test.ts

@@ -1,272 +0,0 @@
-import { describe, test, expect, vi, beforeEach, afterEach } from "vitest";
-import type { Response } from "express";
-import { InMemoryKVStore } from "../kv-store.js";
-import { OpseeClientStore, OpseeOAuthProvider } from "../oauth-provider.js";
-import type { OAuthClientInformationFull } from "@modelcontextprotocol/sdk/shared/auth.js";
-
-const SERVER_URL = "https://mcp.example.com";
-const REDIRECT_URI = "https://claude.ai/api/mcp/auth_callback";
-
-function makeClient(): Omit<
-  OAuthClientInformationFull,
-  "client_id" | "client_id_issued_at"
-> {
-  return {
-    redirect_uris: [REDIRECT_URI],
-    token_endpoint_auth_method: "none",
-    grant_types: ["authorization_code"],
-    response_types: ["code"],
-  } as unknown as Omit<
-    OAuthClientInformationFull,
-    "client_id" | "client_id_issued_at"
-  >;
-}
-
-describe("InMemoryKVStore", () => {
-  test("stores and retrieves values", async () => {
-    const store = new InMemoryKVStore();
-    await store.set("k", "v");
-    expect(await store.get("k")).toBe("v");
-  });
-
-  test("returns null for missing keys", async () => {
-    const store = new InMemoryKVStore();
-    expect(await store.get("nope")).toBeNull();
-  });
-
-  test("deletes values", async () => {
-    const store = new InMemoryKVStore();
-    await store.set("k", "v");
-    await store.del("k");
-    expect(await store.get("k")).toBeNull();
-  });
-
-  test("expires values after the TTL elapses", async () => {
-    vi.useFakeTimers();
-    const store = new InMemoryKVStore();
-    await store.set("k", "v", 10); // 10 second TTL
-    expect(await store.get("k")).toBe("v");
-    vi.advanceTimersByTime(11_000);
-    expect(await store.get("k")).toBeNull();
-    vi.useRealTimers();
-  });
-});
-
-describe("OpseeClientStore", () => {
-  test("registerClient persists redirect_uris and getClient round-trips them", async () => {
-    const store = new InMemoryKVStore();
-    const clientStore = new OpseeClientStore(store);
-
-    const registered = await clientStore.registerClient(makeClient());
-    expect(registered.client_id).toBeTruthy();
-
-    const fetched = await clientStore.getClient(registered.client_id);
-    expect(fetched).toBeDefined();
-    // The actual fix: the registered redirect_uri survives the round-trip, so
-    // the SDK's `redirect_uris.includes(redirect_uri)` check passes.
-    expect(fetched?.redirect_uris).toContain(REDIRECT_URI);
-  });
-
-  test("public clients (auth method 'none') are not issued a client_secret", async () => {
-    const store = new InMemoryKVStore();
-    const clientStore = new OpseeClientStore(store);
-
-    // makeClient() registers with token_endpoint_auth_method "none". Issuing a
-    // secret would make the SDK's token endpoint require it and reject the
-    // PKCE-only token request with invalid_client.
-    const registered = await clientStore.registerClient(makeClient());
-    expect(registered.client_secret).toBeUndefined();
-
-    const fetched = await clientStore.getClient(registered.client_id);
-    expect(fetched?.client_secret).toBeUndefined();
-  });
-
-  test("confidential clients still receive a client_secret", async () => {
-    const store = new InMemoryKVStore();
-    const clientStore = new OpseeClientStore(store);
-
-    const confidential = {
-      ...makeClient(),
-      token_endpoint_auth_method: "client_secret_post",
-    } as unknown as Omit<
-      OAuthClientInformationFull,
-      "client_id" | "client_id_issued_at"
-    >;
-
-    const registered = await clientStore.registerClient(confidential);
-    expect(registered.client_secret).toBeTruthy();
-  });
-
-  test("registrations persist without a TTL", async () => {
-    vi.useFakeTimers();
-    try {
-      const store = new InMemoryKVStore();
-      const clientStore = new OpseeClientStore(store);
-
-      const registered = await clientStore.registerClient(makeClient());
-      // Well past any old 30-day expiry — the registration must still resolve,
-      // otherwise long-idle clients hit invalid_client at /authorize.
-      vi.advanceTimersByTime(60 * 24 * 60 * 60 * 1000);
-      expect(await clientStore.getClient(registered.client_id)).toBeDefined();
-    } finally {
-      vi.useRealTimers();
-    }
-  });
-
-  test("getClient returns undefined for an unknown client (no empty-uri fallback)", async () => {
-    const store = new InMemoryKVStore();
-    const clientStore = new OpseeClientStore(store);
-    expect(await clientStore.getClient("never-registered")).toBeUndefined();
-  });
-});
-
-describe("OpseeOAuthProvider flow", () => {
-  let store: InMemoryKVStore;
-  let provider: OpseeOAuthProvider;
-  let client: OAuthClientInformationFull;
-
-  beforeEach(async () => {
-    store = new InMemoryKVStore();
-    provider = new OpseeOAuthProvider(SERVER_URL, store, "https://app.example.com");
-    client = await (provider.clientsStore as OpseeClientStore).registerClient(
-      makeClient(),
-    );
-  });
-
-  // Captures the pendingId the provider embedded in the login redirect URL.
-  async function authorizeAndGetPendingId(): Promise<string> {
-    let location = "";
-    const res = {
-      redirect: (url: string) => {
-        location = url;
-      },
-    } as unknown as Response;
-
-    await provider.authorize(
-      client,
-      {
-        redirectUri: REDIRECT_URI,
-        codeChallenge: "challenge-123",
-        state: "state-xyz",
-      },
-      res,
-    );
-
-    expect(location).toContain("https://app.example.com/auth/mcp");
-    const callback = new URL(
-      decodeURIComponent(location.split("callback=")[1]),
-    );
-    const pendingId = callback.searchParams.get("pending");
-    expect(pendingId).toBeTruthy();
-    return pendingId as string;
-  }
-
-  test("authorize → callback → exchange issues the backend token", async () => {
-    const pendingId = await authorizeAndGetPendingId();
-
-    const result = await provider.handleCallback(
-      pendingId,
-      "backend.jwt.token",
-      "user-1",
-      "company-1",
-      "",
-    );
-    expect("redirectUri" in result).toBe(true);
-    const redirectUri = (result as { redirectUri: string }).redirectUri;
-
-    const url = new URL(redirectUri);
-    expect(url.searchParams.get("state")).toBe("state-xyz");
-    const code = url.searchParams.get("code");
-    expect(code).toBeTruthy();
-
-    // PKCE challenge is recoverable for the issued code.
-    expect(await provider.challengeForAuthorizationCode(client, code as string)).toBe(
-      "challenge-123",
-    );
-
-    const tokens = await provider.exchangeAuthorizationCode(client, code as string);
-    expect(tokens.access_token).toBe("backend.jwt.token");
-    expect(tokens.token_type).toBe("bearer");
-  });
-
-  test("authorization codes are single-use", async () => {
-    const pendingId = await authorizeAndGetPendingId();
-    const result = await provider.handleCallback(pendingId, "t", "u", "c", "");
-    const code = new URL((result as { redirectUri: string }).redirectUri).searchParams.get(
-      "code",
-    ) as string;
-
-    await provider.exchangeAuthorizationCode(client, code);
-    await expect(provider.exchangeAuthorizationCode(client, code)).rejects.toThrow(
-      /Invalid or expired authorization code/,
-    );
-  });
-
-  test("a pendingId cannot be replayed", async () => {
-    const pendingId = await authorizeAndGetPendingId();
-    await provider.handleCallback(pendingId, "t", "u", "c", "");
-    const second = await provider.handleCallback(pendingId, "t", "u", "c", "");
-    expect("error" in second).toBe(true);
-  });
-
-  test("revoked tokens fail verification", async () => {
-    // Build a JWT-shaped token with a future exp so only revocation can reject it.
-    const future = Math.floor(Date.now() / 1000) + 3600;
-    const payload = Buffer.from(
-      JSON.stringify({ exp: future, userId: "u", companyId: "c" }),
-    ).toString("base64url");
-    const token = `header.${payload}.sig`;
-
-    await expect(provider.verifyAccessToken(token)).resolves.toMatchObject({
-      clientId: "opsee",
-    });
-
-    await provider.revokeToken(client, { token });
-    await expect(provider.verifyAccessToken(token)).rejects.toThrow(/revoked/);
-  });
-
-  // --- verifyAccessToken validation edge cases (require exp) ---
-
-  // Build a JWT-shaped token (header.payload.sig) from a payload object.
-  const tokenWith = (payload: Record<string, unknown>) =>
-    `header.${Buffer.from(JSON.stringify(payload)).toString("base64url")}.sig`;
-
-  test("accepts a token with a future exp and exposes its claims", async () => {
-    const future = Math.floor(Date.now() / 1000) + 3600;
-    const token = tokenWith({ exp: future, userId: "u1", companyId: "c1", role: "admin" });
-    await expect(provider.verifyAccessToken(token)).resolves.toMatchObject({
-      clientId: "opsee",
-      expiresAt: future,
-      extra: { userId: "u1", companyId: "c1", role: "admin" },
-    });
-  });
-
-  test("rejects a token with no exp claim (not valid indefinitely)", async () => {
-    const token = tokenWith({ userId: "u", companyId: "c" });
-    await expect(provider.verifyAccessToken(token)).rejects.toThrow(/missing expiry/i);
-  });
-
-  test("rejects a token whose exp is not a number", async () => {
-    const token = tokenWith({ exp: "later", userId: "u" });
-    await expect(provider.verifyAccessToken(token)).rejects.toThrow(/missing expiry/i);
-  });
-
-  test("rejects an expired token", async () => {
-    const past = Math.floor(Date.now() / 1000) - 10;
-    const token = tokenWith({ exp: past, userId: "u" });
-    await expect(provider.verifyAccessToken(token)).rejects.toThrow(/expired/i);
-  });
-
-  test("rejects a token with a non-JSON payload as Invalid token", async () => {
-    const badBody = Buffer.from("this is not json").toString("base64url");
-    await expect(provider.verifyAccessToken(`header.${badBody}.sig`)).rejects.toThrow(
-      /Invalid token/,
-    );
-  });
-
-  test("rejects a token that is not three parts", async () => {
-    await expect(provider.verifyAccessToken("only.two")).rejects.toThrow(
-      /Invalid token format/,
-    );
-  });
-});

package/src/utils/__tests__/format.test.ts

@@ -1,53 +0,0 @@
-import { describe, test, expect } from "vitest";
-import { Code, ConnectError } from "@connectrpc/connect";
-import { formatError } from "../format.js";
-
-describe("formatError classification", () => {
-  test("ConnectError Unauthenticated → login instruction (correct command)", () => {
-    const msg = formatError(new ConnectError("nope", Code.Unauthenticated));
-    expect(msg).toContain("npx opsee-mcp login");
-    expect(msg).toMatch(/Not authenticated/i);
-  });
-
-  test("ConnectError Unavailable → reach-API message with raw detail", () => {
-    const msg = formatError(new ConnectError("backend down", Code.Unavailable));
-    expect(msg).toMatch(/Could not reach Opsee API/i);
-    expect(msg).toContain("backend down");
-  });
-
-  test("other ConnectError codes pass through as [Code] rawMessage", () => {
-    const msg = formatError(new ConnectError("task missing", Code.NotFound));
-    expect(msg).toBe("[NotFound] task missing");
-  });
-
-  test("does NOT misclassify a ConnectError whose text embeds 401/ECONNREFUSED", () => {
-    // The point of keying on the structured code: a NotFound whose message
-    // contains "401" must stay NotFound, not become an auth error.
-    const msg = formatError(new ConnectError('task "401 ECONNREFUSED" missing', Code.NotFound));
-    expect(msg).toBe('[NotFound] task "401 ECONNREFUSED" missing');
-    expect(msg).not.toMatch(/Not authenticated/i);
-  });
-
-  test("raw ECONNREFUSED error (err.code) → reach-API message", () => {
-    const err = Object.assign(new Error("connect ECONNREFUSED 127.0.0.1:443"), {
-      code: "ECONNREFUSED",
-    });
-    expect(formatError(err)).toMatch(/Could not reach Opsee API/i);
-  });
-
-  test("raw ENOTFOUND error (err.code) → reach-API message", () => {
-    const err = Object.assign(new Error("getaddrinfo ENOTFOUND api"), {
-      code: "ENOTFOUND",
-    });
-    expect(formatError(err)).toMatch(/Could not reach Opsee API/i);
-  });
-
-  test("plain Error without a code → its message verbatim", () => {
-    expect(formatError(new Error("something odd"))).toBe("something odd");
-  });
-
-  test("non-Error value → String(value)", () => {
-    expect(formatError("boom")).toBe("boom");
-    expect(formatError(42)).toBe("42");
-  });
-});