create-ailk 0.24.0 → 0.26.0

package/templates/apps/mcp/__tests__/abuse/guard.test.ts

@@ -1,198 +0,0 @@
-/**
- * Guard-level tests for abuse/index.ts — the AbuseGuard as a whole, where
- * daily-cap.test.ts and its siblings test one rule each (#8071).
- *
- * Pins:
- * - AC-4: the four daily-capped tools (capture_lead, start_purchase,
- *   create_booking, submit_flow_step) each spend their OWN tracker — spending
- *   one tool's budget from an IP leaves the other three callable from it.
- * - AC-5: a blank or non-numeric MCP_ABUSE_CREATE_BOOKING_DAILY_CAP /
- *   MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP yields the default cap (20 / 50),
- *   never an unlimited one: the call at default + 1 is refused.
- * - D3: create_booking's attendee.email is format-checked, and a non-object
- *   attendee is treated as a missing email rather than throwing.
- */
-
-import type { FastifyRequest } from "fastify";
-
-import {
-  AbuseGuard,
-  AbuseReasonCode,
-  createAbuseGuardFromEnv,
-  DEFAULT_CREATE_BOOKING_DAILY_CAP,
-  DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
-} from "../../src/abuse/index.js";
-
-/** A stub carrying only the two members the guard reads. */
-function requestFrom(ip: string): FastifyRequest {
-  // @ts-expect-error: a full FastifyRequest cannot be built without a server.
-  return {
-    headers: { "user-agent": "Mozilla/5.0 (compatible; TestAgent/1.0)" },
-    ip,
-  };
-}
-
-const CAPPED_TOOLS = [
-  "capture_lead",
-  "start_purchase",
-  "create_booking",
-  "submit_flow_step",
-] as const;
-
-describe("AbuseGuard — each daily-capped tool spends its own tracker (AC-4)", () => {
-  it.each(CAPPED_TOOLS)(
-    "exhausting %s leaves the other three callable from the same IP",
-    (spent) => {
-      const guard = new AbuseGuard({
-        captureLeadDailyCapPerIp: 1,
-        startPurchaseDailyCapPerIp: 1,
-        createBookingDailyCapPerIp: 1,
-        submitFlowStepDailyCapPerIp: 1,
-        blockedUserAgents: "",
-      });
-      const request = requestFrom("198.51.100.4");
-
-      expect(guard.validate(spent, {}, request).allowed).toBe(true);
-      const refused = guard.validate(spent, {}, request);
-      expect(refused).toMatchObject({
-        allowed: false,
-        code: AbuseReasonCode.DAILY_CAP_REACHED,
-      });
-
-      for (const other of CAPPED_TOOLS.filter((t) => t !== spent)) {
-        expect(guard.validate(other, {}, request).allowed).toBe(true);
-      }
-    },
-  );
-});
-
-describe("createAbuseGuardFromEnv — a blank or non-numeric cap falls back to the default (AC-5)", () => {
-  const CASES = [
-    {
-      toolName: "create_booking",
-      envVar: "MCP_ABUSE_CREATE_BOOKING_DAILY_CAP",
-      defaultCap: DEFAULT_CREATE_BOOKING_DAILY_CAP,
-    },
-    {
-      toolName: "submit_flow_step",
-      envVar: "MCP_ABUSE_SUBMIT_FLOW_STEP_DAILY_CAP",
-      defaultCap: DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP,
-    },
-  ] as const;
-
-  afterEach(() => {
-    for (const { envVar } of CASES) delete process.env[envVar];
-  });
-
-  it("the defaults are 20 bookings and 50 flow steps per IP per day", () => {
-    expect(DEFAULT_CREATE_BOOKING_DAILY_CAP).toBe(20);
-    expect(DEFAULT_SUBMIT_FLOW_STEP_DAILY_CAP).toBe(50);
-  });
-
-  describe.each(CASES)("$envVar", ({ toolName, envVar, defaultCap }) => {
-    it.each(["", "abc"])("set to %p refuses the call at default + 1", (raw) => {
-      process.env[envVar] = raw;
-      const guard = createAbuseGuardFromEnv();
-      const request = requestFrom("198.51.100.5");
-
-      for (let i = 0; i < defaultCap; i += 1) {
-        expect(guard.validate(toolName, {}, request).allowed).toBe(true);
-      }
-      expect(guard.validate(toolName, {}, request)).toMatchObject({
-        allowed: false,
-        code: AbuseReasonCode.DAILY_CAP_REACHED,
-      });
-    });
-
-    it("set to a positive integer uses that cap", () => {
-      process.env[envVar] = "3";
-      const guard = createAbuseGuardFromEnv();
-      const request = requestFrom("198.51.100.6");
-
-      for (let i = 0; i < 3; i += 1) {
-        expect(guard.validate(toolName, {}, request).allowed).toBe(true);
-      }
-      expect(guard.validate(toolName, {}, request).allowed).toBe(false);
-    });
-  });
-});
-
-describe("AbuseGuard — create_booking's attendee.email (D3)", () => {
-  const guard = () =>
-    new AbuseGuard({ captureLeadDailyCapPerIp: 50, blockedUserAgents: "" });
-
-  it("refuses a malformed attendee.email with INVALID_EMAIL", () => {
-    const result = guard().validate(
-      "create_booking",
-      { attendee: { name: "Ada", email: "not-an-email" } },
-      requestFrom("198.51.100.7"),
-    );
-
-    expect(result).toMatchObject({
-      allowed: false,
-      code: AbuseReasonCode.INVALID_EMAIL,
-    });
-  });
-
-  it("allows a well-formed attendee.email", () => {
-    const result = guard().validate(
-      "create_booking",
-      { attendee: { name: "Ada", email: "ada@example.com" } },
-      requestFrom("198.51.100.8"),
-    );
-
-    expect(result.allowed).toBe(true);
-  });
-
-  it("does not read a top-level email for create_booking", () => {
-    const result = guard().validate(
-      "create_booking",
-      { email: "not-an-email", attendee: { email: "ada@example.com" } },
-      requestFrom("198.51.100.9"),
-    );
-
-    expect(result.allowed).toBe(true);
-  });
-
-  it.each([undefined, null, "ada@example.com", ["not-an-email"], 7, {}])(
-    "treats attendee %p as a missing email — allowed, never a throw",
-    (attendee) => {
-      expect(() =>
-        guard().validate(
-          "create_booking",
-          { attendee },
-          requestFrom("198.51.100.10"),
-        ),
-      ).not.toThrow();
-      expect(
-        guard().validate(
-          "create_booking",
-          { attendee },
-          requestFrom("198.51.100.10"),
-        ).allowed,
-      ).toBe(true);
-    },
-  );
-
-  it("tolerates a non-object input", () => {
-    for (const input of [null, "x", 3]) {
-      expect(
-        guard().validate("create_booking", input, requestFrom("198.51.100.11"))
-          .allowed,
-      ).toBe(true);
-    }
-  });
-
-  it("still reads capture_lead's top-level email", () => {
-    const result = guard().validate(
-      "capture_lead",
-      { email: "not-an-email" },
-      requestFrom("198.51.100.12"),
-    );
-
-    expect(result).toMatchObject({
-      allowed: false,
-      code: AbuseReasonCode.INVALID_EMAIL,
-    });
-  });
-});

package/templates/apps/mcp/__tests__/abuse/honeypot.test.ts

@@ -1,36 +0,0 @@
-/**
- * Unit tests for abuse/honeypot.ts
- *
- * Verifies that a non-empty `honeypot` field in tool input triggers rejection.
- */
-
-import { isHoneypotTripped } from "../../src/abuse/honeypot.js";
-
-describe("isHoneypotTripped", () => {
-  it("returns false when input has no honeypot field", () => {
-    expect(isHoneypotTripped({ name: "Jane", email: "jane@example.com" })).toBe(
-      false,
-    );
-  });
-
-  it("returns false when honeypot field is empty string", () => {
-    expect(isHoneypotTripped({ honeypot: "" })).toBe(false);
-  });
-
-  it("returns true when honeypot field is non-empty", () => {
-    expect(isHoneypotTripped({ honeypot: "bot-filled" })).toBe(true);
-  });
-
-  it("returns true when honeypot field is a space", () => {
-    expect(isHoneypotTripped({ honeypot: " " })).toBe(true);
-  });
-
-  it("returns false for null honeypot", () => {
-    expect(isHoneypotTripped({ honeypot: null })).toBe(false);
-  });
-
-  it("accepts non-string inputs without throwing", () => {
-    expect(() => isHoneypotTripped(null)).not.toThrow();
-    expect(isHoneypotTripped(null)).toBe(false);
-  });
-});

package/templates/apps/mcp/__tests__/abuse/user-agent-deny.test.ts

@@ -1,54 +0,0 @@
-/**
- * Unit tests for abuse/user-agent-deny.ts
- *
- * Verifies built-in bot UA deny list plus env-configured additions.
- */
-
-import {
-  isUserAgentBlocked,
-  buildDenyList,
-} from "../../src/abuse/user-agent-deny.js";
-
-describe("buildDenyList", () => {
-  it("includes built-in bot user agents", () => {
-    const list = buildDenyList();
-    expect(list.some((r) => r.test("python-requests/2.28"))).toBe(true);
-    expect(list.some((r) => r.test("curl/7.88"))).toBe(true);
-    expect(list.some((r) => r.test("Wget/1.21"))).toBe(true);
-    expect(list.some((r) => r.test("Scrapy/2.8"))).toBe(true);
-  });
-
-  it("merges env-configured additions", () => {
-    const list = buildDenyList("BadBot/1.0,EvilCrawler");
-    expect(list.some((r) => r.test("BadBot/1.0"))).toBe(true);
-    expect(list.some((r) => r.test("EvilCrawler/2"))).toBe(true);
-  });
-});
-
-describe("isUserAgentBlocked", () => {
-  it("blocks a known bot UA", () => {
-    const denyList = buildDenyList();
-    expect(isUserAgentBlocked("python-requests/2.28.1", denyList)).toBe(true);
-  });
-
-  it("allows a real browser UA", () => {
-    const denyList = buildDenyList();
-    expect(
-      isUserAgentBlocked(
-        "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36",
-        denyList,
-      ),
-    ).toBe(false);
-  });
-
-  it("blocks missing UA (empty string)", () => {
-    const denyList = buildDenyList();
-    expect(isUserAgentBlocked("", denyList)).toBe(true);
-  });
-
-  it("blocks undefined/null UA", () => {
-    const denyList = buildDenyList();
-    expect(isUserAgentBlocked(undefined, denyList)).toBe(true);
-    expect(isUserAgentBlocked(null, denyList)).toBe(true);
-  });
-});

package/templates/apps/mcp/__tests__/aeo-cli-parity.test.ts

@@ -1,116 +0,0 @@
-/**
- * AEO CLI ↔ MCP tool parity test.
- *
- * Verifies that `ailkAudit` produces per-page output that matches what
- * you'd get by calling `runAudit` directly with the same single-page input
- * that `buildSinglePageAuditInput` produces.
- *
- * Both code paths use only the public `@working-theory/aeo` API — no imports from
- * CLI-internal files (packages/aeo/src/cli/*). The parity claim is:
- *   buildSinglePageAuditInput → runAudit(input, RULES)
- *   ≡ ailkAudit internally (same adapter, same RULES)
- *
- * Acceptance criteria verified:
- * - Output of audit for a fixture page equals the result of calling
- *   runAudit with the same AuditInput (Layer 2 AC: "identical per-page output")
- * - runAudit invocation uses canonical RULES from packages/aeo/src/rules/index.ts
- */
-
-import { resolve, join } from "node:path";
-
-import {
-  runAudit,
-  alwaysFails,
-  alwaysPasses,
-  entityMarkup,
-  faqHowtoIncentive,
-  jsonldValidity,
-  offerOnPricedPage,
-  policiesPresent,
-  schemaCoverage,
-  taxCodeWhenStripeTax,
-  type Rule,
-} from "@working-theory/aeo";
-
-import { buildSinglePageAuditInput } from "../src/lib/audit-single-page.js";
-import { ailkAudit } from "../src/tools/audit.js";
-
-const REPO_ROOT = resolve(__dirname, "../../..");
-const CONTENT_ROOT = join(REPO_ROOT, "content");
-
-// Canonical rule set — mirrors packages/aeo/src/cli/index.ts RULES array.
-// Must stay in sync with that definition; both are sourced from @working-theory/aeo.
-const RULES: Rule[] = [
-  alwaysPasses,
-  alwaysFails,
-  schemaCoverage,
-  jsonldValidity,
-  faqHowtoIncentive,
-  entityMarkup,
-  policiesPresent,
-  offerOnPricedPage,
-  taxCodeWhenStripeTax,
-];
-
-const FIXTURE_SLUG = "home";
-const FIXTURE_TYPE = "HomePage" as const;
-
-describe("audit ↔ runAudit direct parity", () => {
-  it("per-page score matches runAudit(buildSinglePageAuditInput(slug), RULES)", async () => {
-    // --- Direct path (mirrors what the tool does internally) ---
-    const auditInput = await buildSinglePageAuditInput(
-      { slug: FIXTURE_SLUG, type: FIXTURE_TYPE },
-      CONTENT_ROOT,
-    );
-    const directReport = runAudit(auditInput, RULES);
-    const directPage = directReport.perPage.find(
-      (p) => p.slug === FIXTURE_SLUG && p.type === FIXTURE_TYPE,
-    );
-    expect(directPage).toBeDefined();
-
-    // --- MCP tool path ---
-    const mcpResult = await ailkAudit(
-      { slug: FIXTURE_SLUG, type: FIXTURE_TYPE },
-      CONTENT_ROOT,
-    );
-    const mcpPage = mcpResult.perPage.find(
-      (p) => p.slug === FIXTURE_SLUG && p.type === FIXTURE_TYPE,
-    );
-    expect(mcpPage).toBeDefined();
-
-    // Per-page fields must match
-    expect(mcpPage!.score).toBe(directPage!.score);
-    expect(mcpPage!.slug).toBe(directPage!.slug);
-    expect(mcpPage!.type).toBe(directPage!.type);
-  });
-
-  it("overall score matches runAudit called with the same AuditInput", async () => {
-    const auditInput = await buildSinglePageAuditInput(
-      { slug: FIXTURE_SLUG, type: FIXTURE_TYPE },
-      CONTENT_ROOT,
-    );
-    const directReport = runAudit(auditInput, RULES);
-
-    const mcpResult = await ailkAudit(
-      { slug: FIXTURE_SLUG, type: FIXTURE_TYPE },
-      CONTENT_ROOT,
-    );
-
-    expect(mcpResult.score).toBe(directReport.score);
-  });
-
-  it("perRule count matches — tool uses the same RULES array", async () => {
-    const auditInput = await buildSinglePageAuditInput(
-      { slug: FIXTURE_SLUG, type: FIXTURE_TYPE },
-      CONTENT_ROOT,
-    );
-    const directReport = runAudit(auditInput, RULES);
-
-    const mcpResult = await ailkAudit(
-      { slug: FIXTURE_SLUG, type: FIXTURE_TYPE },
-      CONTENT_ROOT,
-    );
-
-    expect(mcpResult.perRule).toHaveLength(directReport.perRule.length);
-  });
-});