@strixgov/mcp-proxy 0.2.0 → 0.2.2

package/test/config.test.mjs

@@ -0,0 +1,138 @@
+/**
+ * Config loader tests — the CLI's only durable input is the config
+ * file, so the loader's validation rules are the proxy's public
+ * contract for operator-managed deployments.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import path from "node:path";
+import { tmpdir } from "node:os";
+
+import { loadConfig, resolveCapabilities } from "../src/config.mjs";
+
+async function withTempConfig(contents, fn) {
+  const dir = mkdtempSync(path.join(tmpdir(), "strix-proxy-config-"));
+  const file = path.join(dir, "proxy.json");
+  writeFileSync(file, typeof contents === "string" ? contents : JSON.stringify(contents));
+  try { return await fn(file); } finally { rmSync(dir, { recursive: true, force: true }); }
+}
+
+test("loadConfig: rejects missing file", async () => {
+  await assert.rejects(loadConfig("/this/path/does/not/exist.json"), /could not read/);
+});
+
+test("loadConfig: rejects malformed JSON", async () => {
+  await withTempConfig("{ not: json }", async (file) => {
+    await assert.rejects(loadConfig(file), /not valid JSON/);
+  });
+});
+
+test("loadConfig: rejects non-object root", async () => {
+  await withTempConfig("[]", async (file) => {
+    await assert.rejects(loadConfig(file), /must be a JSON object/);
+  });
+});
+
+test("loadConfig: requires upstream.command", async () => {
+  await withTempConfig({ upstream: {} }, async (file) => {
+    await assert.rejects(loadConfig(file), /upstream\.command/);
+  });
+});
+
+test("loadConfig: rejects non-array upstream.args", async () => {
+  await withTempConfig({ upstream: { command: "npx", args: "oops" } }, async (file) => {
+    await assert.rejects(loadConfig(file), /upstream\.args/);
+  });
+});
+
+test("loadConfig: rejects non-object policy", async () => {
+  await withTempConfig({ upstream: { command: "x" }, policy: "deny-all" }, async (file) => {
+    await assert.rejects(loadConfig(file), /'policy' must be an object/);
+  });
+});
+
+test("loadConfig: expands a leading ~ in storagePath", async () => {
+  await withTempConfig(
+    { upstream: { command: "npx" }, storagePath: "~/strix-receipts" },
+    async (file) => {
+      const cfg = await loadConfig(file);
+      assert.ok(!cfg.storagePath.startsWith("~"), `expected ~ to expand; got ${cfg.storagePath}`);
+    },
+  );
+});
+
+test("loadConfig: returns the parsed config when valid", async () => {
+  await withTempConfig(
+    {
+      serverId: "notion",
+      upstream: { command: "npx", args: ["-y", "@notionhq/notion-mcp-server"] },
+      policy: { default: "DENY" },
+    },
+    async (file) => {
+      const cfg = await loadConfig(file);
+      assert.equal(cfg.serverId, "notion");
+      assert.equal(cfg.upstream.command, "npx");
+      assert.deepEqual(cfg.upstream.args, ["-y", "@notionhq/notion-mcp-server"]);
+    },
+  );
+});
+
+test("loadConfig: missing keyPath is fine (undefined passes through)", async () => {
+  await withTempConfig({ upstream: { command: "npx" } }, async (file) => {
+    const cfg = await loadConfig(file);
+    assert.equal(cfg.keyPath, undefined);
+  });
+});
+
+test("loadConfig: rejects non-string keyPath", async () => {
+  await withTempConfig({ upstream: { command: "npx" }, keyPath: 42 }, async (file) => {
+    await assert.rejects(loadConfig(file), /'keyPath' must be a string/);
+  });
+});
+
+test("loadConfig: expands a leading ~ in keyPath", async () => {
+  await withTempConfig(
+    { upstream: { command: "npx" }, keyPath: "~/.strix-mcp-proxy/my-server/keys" },
+    async (file) => {
+      const cfg = await loadConfig(file);
+      assert.ok(!cfg.keyPath.startsWith("~"), `expected ~ to expand; got ${cfg.keyPath}`);
+      assert.ok(cfg.keyPath.includes(".strix-mcp-proxy/my-server/keys"));
+    },
+  );
+});
+
+test("loadConfig: passes a valid string keyPath through unchanged", async () => {
+  await withTempConfig(
+    { upstream: { command: "npx" }, keyPath: "/opt/strix/keys" },
+    async (file) => {
+      const cfg = await loadConfig(file);
+      assert.equal(cfg.keyPath, "/opt/strix/keys");
+    },
+  );
+});
+
+test("resolveCapabilities: passes an inline array through unchanged", async () => {
+  const arr = [{ id: "x", name: "x", risk: "LOW", mode: "READ", description: "x" }];
+  const out = await resolveCapabilities(arr);
+  assert.equal(out, arr);
+});
+
+test("resolveCapabilities: returns undefined for null/undefined input", async () => {
+  assert.equal(await resolveCapabilities(undefined), undefined);
+  assert.equal(await resolveCapabilities(null), undefined);
+});
+
+test("resolveCapabilities: rejects non-string non-array input", async () => {
+  await assert.rejects(resolveCapabilities(42), /must be a string import path or an array/);
+});
+
+test("resolveCapabilities: resolves a companion-pack module by import path", async () => {
+  // Uses the workspace-symlinked package — exercises the real
+  // dynamic-import flow the CLI would use in production.
+  const caps = await resolveCapabilities("@strixgov/capabilities-mcp-common/notion");
+  assert.ok(Array.isArray(caps));
+  assert.ok(caps.length > 0);
+  assert.ok(caps.every((c) => c.id?.startsWith("mcp.notion.")));
+});

package/test/nvidia-nooa-profile.test.mjs

@@ -0,0 +1,69 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = path.dirname(fileURLToPath(import.meta.url));
+const exampleDir = path.resolve(here, "../examples/nvidia-nooa");
+
+test("NOOA .mcp.json launches the Strix proxy over stdio with trusted identity", async () => {
+  const config = JSON.parse(
+    await fs.readFile(path.join(exampleDir, ".mcp.json"), "utf8"),
+  );
+  const server = config.mcpServers.strix_secure_coding;
+  assert.equal(server.transport, "stdio");
+  assert.match(server.args.join(" "), /strix-mcp-proxy\.mjs/);
+  assert.equal(server.env.STRIX_REQUIRE_TRUSTED_IDENTITY, "true");
+  assert.match(server.env.STRIX_TRUSTED_ACTOR_ID, /^spiffe:\/\//);
+  assert.equal(server.env.STRIX_TENANT_ID, "nvidia-nooa-demo");
+  assert.equal(server.env.STRIX_ENVIRONMENT, "openshell");
+});
+
+test("NOOA proxy policy is fail-closed and protects consequential actions", async () => {
+  const config = JSON.parse(
+    await fs.readFile(path.join(exampleDir, "proxy-config.json"), "utf8"),
+  );
+  assert.equal(config.policy.default, "DENY");
+  assert.equal(
+    config.policy.rules["mcp.nooa-secure-coding.inspect_repository"],
+    "ALLOW",
+  );
+  assert.equal(
+    config.policy.rules["mcp.nooa-secure-coding.propose_patch"],
+    "ALLOW",
+  );
+  assert.equal(
+    config.policy.rules["mcp.nooa-secure-coding.merge_production"],
+    "APPROVAL_REQUIRED",
+  );
+  assert.equal(
+    config.policy.rules["mcp.nooa-secure-coding.rotate_credentials"],
+    "DENY",
+  );
+  assert.equal(config.approval.type, "file");
+  assert.ok(config.storagePath);
+  assert.ok(config.keyPath);
+});
+
+test("OpenShell template leaves Python without ordinary downstream egress", async () => {
+  const policy = await fs.readFile(
+    path.join(exampleDir, "openshell-policy.yaml"),
+    "utf8",
+  );
+  assert.match(policy, /^version: 1/m);
+  assert.match(policy, /run_as_user: sandbox/);
+  assert.match(policy, /api\.github\.com/);
+  assert.match(policy, /protocol: rest/);
+  assert.match(policy, /tls: terminate/);
+  assert.match(policy, /enforcement: enforce/);
+  assert.match(policy, /access: read-only/);
+  assert.doesNotMatch(policy, /path: \/usr\/bin\/python/);
+  assert.doesNotMatch(policy, /path: \/usr\/local\/bin\/python/);
+});
+
+test("NOOA agent uses MCPManager.create_from_server", async () => {
+  const source = await fs.readFile(path.join(exampleDir, "nooa_agent.py"), "utf8");
+  assert.match(source, /MCPManager\.create_from_server/);
+  assert.match(source, /strix_secure_coding/);
+});

package/test/package-contract.test.mjs

@@ -0,0 +1,20 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+
+const covered = (rel) =>
+  pkg.files.some((f) => rel === f || (f.endsWith("/") && rel.startsWith(f)));
+
+test("every script file the `test` script runs ships in the tarball", () => {
+  const refs = [...pkg.scripts.test.matchAll(/\b(scripts\/[\w./-]+\.mjs)\b/g)].map((m) => m[1]);
+  assert.ok(refs.length > 0, "test script should reference a script file");
+  for (const rel of refs) {
+    assert.ok(existsSync(path.join(root, rel)), `${rel} is missing from the repo`);
+    assert.ok(covered(rel), `${rel} is used by \`npm test\` but excluded by package.json "files"`);
+  }
+});