create-ailk 0.24.0 → 0.26.0

package/templates/apps/mcp/__tests__/http-transport.test.ts

@@ -1,1232 +0,0 @@
-/**
- * Integration tests for the MCP HTTP transport.
- *
- * Starts a real Fastify server on an ephemeral port (port 0) per test suite
- * and uses Node's global fetch to send requests. Real TCP sockets avoid the
- * `socket.destroySoon is not a function` crash that occurs when the MCP SDK's
- * StreamableHTTPServerTransport receives the mock socket from app.inject().
- *
- * Uses stateless transport mode: each request is independent, responses are
- * plain JSON (no SSE). This is the simplest deployment model and the easiest
- * to test. Stateful session behaviour is exercised by the SDK's own test suite.
- *
- * Acceptance criteria verified here (Layer 2):
- * - tools/list returns all OSS tools (count matches listRegisteredTools())
- * - Read-tool call succeeds over HTTP
- * - Write-tool call from a disallowed origin returns 403
- * - Rate-limit triggers at configured threshold
- * - Abuse rules reject invalid email on capture_lead
- * - Honeypot field rejection on capture_lead
- * - Blocked UA returns 403
- * - #5971: a start_purchase burst past the per-IP daily cap is refused with
- *   the rate-limit error, and no Checkout Session is created
- * - #8071: create_booking and submit_flow_step take the same write branch —
- *   the origin allow-list, each tool's own daily cap (no hub call for a
- *   refused one), one cap unit per batched call, and for create_booking an
- *   attendee.email format check
- * - #8073: a capture_lead call forwards the socket address the transport
- *   trusted (never a caller-forged X-Forwarded-For) plus
- *   AILK_VISITOR_FORWARD_KEY as the two visitor-forwarding headers, and sends
- *   neither when the key is unset
- */
-
-import type { AddressInfo } from "node:net";
-
-import type { FastifyInstance, FastifyRequest } from "fastify";
-import { apiClient, checkout } from "@working-theory/api-client";
-
-import {
-  __setMcpCommerceClaimForTest,
-  resetMcpCommerceClaim,
-} from "../src/lib/commerce-claim.js";
-import { AbuseGuard, AbuseReasonCode } from "../src/abuse/index.js";
-import {
-  ABUSE_REFUSAL_STATUS,
-  buildHttpTransportApp,
-  WRITE_TOOLS,
-} from "../src/http-transport.js";
-import { listRegisteredTools } from "../src/server.js";
-
-jest.mock("@working-theory/api-client", () => {
-  const actual = jest.requireActual("@working-theory/api-client");
-  // The hub stubs for the two #8071 write tools: every other surface stays
-  // real, so a tool these tests do not name behaves exactly as before.
-  return {
-    ...actual,
-    checkout: { createSession: jest.fn() },
-    apiClient: {
-      ...actual.apiClient,
-      schedule: { ...actual.apiClient.schedule, book: jest.fn() },
-      flows: { ...actual.apiClient.flows, submitStep: jest.fn() },
-    },
-  };
-});
-
-/** Permissive JSON-RPC 2.0 envelope type for response body assertions. */
-type JsonRpcResponse = {
-  jsonrpc?: string;
-  id?: number | string | null;
-  result?: { tools?: unknown[]; [k: string]: unknown };
-  error?: { code: number; message: string };
-};
-
-const TOOLS_LIST_PAYLOAD = {
-  jsonrpc: "2.0",
-  id: 1,
-  method: "tools/list",
-  params: {},
-};
-
-/** Default config used by most test suites. */
-const DEFAULT_CONFIG = {
-  path: "/mcp",
-  stateless: true,
-  rateLimits: { readPerMin: 60, writePerMin: 10 },
-  cors: { writeAllowedOrigins: [] as string[] },
-  abuse: {
-    captureLeadDailyCapPerIp: 50,
-    blockedUserAgents: "",
-  },
-} as const;
-
-/**
- * Post a JSON-RPC payload to the server at the given port and return the
- * fetch Response. Includes the Accept header required by the MCP Streamable
- * HTTP spec.
- */
-async function mcpPost(
-  port: number,
-  payload: object,
-  headers: Record<string, string> = {},
-): Promise<Response> {
-  return fetch(`http://127.0.0.1:${port}/mcp`, {
-    method: "POST",
-    body: JSON.stringify(payload),
-    headers: {
-      "content-type": "application/json",
-      accept: "application/json, text/event-stream",
-      ...headers,
-    },
-  });
-}
-
-describe("buildHttpTransportApp", () => {
-  let app: FastifyInstance;
-  let port: number;
-
-  beforeEach(async () => {
-    app = await buildHttpTransportApp(DEFAULT_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("starts listening on an ephemeral port without throwing", () => {
-    expect(app.server.listening).toBe(true);
-    expect(port).toBeGreaterThan(0);
-  });
-});
-
-describe("tools/list over HTTP (stateless)", () => {
-  let app: FastifyInstance;
-  let port: number;
-
-  beforeEach(async () => {
-    app = await buildHttpTransportApp(DEFAULT_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("returns 200 for a tools/list request", async () => {
-    const res = await mcpPost(port, TOOLS_LIST_PAYLOAD);
-    expect(res.status).toBe(200);
-  });
-
-  it("tools/list response includes all OSS tools", async () => {
-    const res = await mcpPost(port, TOOLS_LIST_PAYLOAD);
-    expect(res.status).toBe(200);
-
-    const body = (await res.json()) as JsonRpcResponse;
-    expect(body.result).toBeDefined();
-    // body.result is confirmed defined above; non-null assertion is safe
-    expect(Array.isArray(body.result!.tools)).toBe(true);
-
-    const expectedCount = listRegisteredTools().length;
-    expect(body.result!.tools).toHaveLength(expectedCount);
-  });
-});
-
-describe("CORS enforcement on write tools", () => {
-  let app: FastifyInstance;
-  let port: number;
-
-  beforeEach(async () => {
-    app = await buildHttpTransportApp(DEFAULT_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("blocks a tools/call write from a non-allowlisted origin", async () => {
-    const payload = {
-      jsonrpc: "2.0",
-      id: 3,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: {
-          source: "mcp",
-          email: "bot@evil.com",
-          payload: { name: "Bot" },
-        },
-      },
-    };
-
-    const res = await mcpPost(port, payload, {
-      origin: "https://evil.example.com",
-    });
-
-    expect(res.status).toBe(403);
-  });
-
-  it("allows a tools/call write from an allowlisted origin", async () => {
-    const allowedApp = await buildHttpTransportApp({
-      ...DEFAULT_CONFIG,
-      cors: { writeAllowedOrigins: ["https://allowed.example.com"] },
-    });
-    await allowedApp.listen({ host: "127.0.0.1", port: 0 });
-    const allowedPort = (allowedApp.server.address() as AddressInfo).port;
-
-    try {
-      const payload = {
-        jsonrpc: "2.0",
-        id: 3,
-        method: "tools/call",
-        params: {
-          name: "capture_lead",
-          arguments: {
-            source: "mcp",
-            email: "jane@example.com",
-            payload: { name: "Jane" },
-          },
-        },
-      };
-
-      const res = await mcpPost(allowedPort, payload, {
-        origin: "https://allowed.example.com",
-      });
-
-      // Should NOT be 403 (may be 200 or a tool-level error, but not CORS blocked)
-      expect(res.status).not.toBe(403);
-    } finally {
-      await allowedApp.close();
-    }
-  });
-});
-
-describe("Rate limiting", () => {
-  // Use a very low limit to test without hammering
-  const LOW_RATE_CONFIG = {
-    ...DEFAULT_CONFIG,
-    rateLimits: { readPerMin: 3, writePerMin: 2 },
-  } as const;
-
-  let app: FastifyInstance;
-  let port: number;
-
-  beforeEach(async () => {
-    app = await buildHttpTransportApp(LOW_RATE_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("returns 429 after exceeding the read rate limit", async () => {
-    const payload = {
-      jsonrpc: "2.0",
-      id: 10,
-      method: "tools/list",
-      params: {},
-    };
-
-    let lastStatus = 200;
-    for (let i = 0; i < 5; i++) {
-      const res = await mcpPost(port, payload);
-      lastStatus = res.status;
-    }
-
-    expect(lastStatus).toBe(429);
-  });
-});
-
-describe("Abuse rules", () => {
-  const OPEN_CORS_CONFIG = {
-    ...DEFAULT_CONFIG,
-    cors: { writeAllowedOrigins: ["*"] as string[] },
-  };
-
-  let app: FastifyInstance;
-  let port: number;
-
-  beforeEach(async () => {
-    app = await buildHttpTransportApp(OPEN_CORS_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-  });
-
-  it("rejects capture_lead with malformed email", async () => {
-    const payload = {
-      jsonrpc: "2.0",
-      id: 20,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: {
-          source: "mcp",
-          email: "not-an-email",
-          payload: { name: "Spammer" },
-        },
-      },
-    };
-
-    const res = await mcpPost(port, payload);
-    expect(res.status).toBe(422);
-  });
-
-  // #7171 — `email` is optional at the top level of the route body (the
-  // site's own envelope carries it inside `payload`, and the route lifts it
-  // from there), so the guard reads `payload.email` when the top level has
-  // none: a malformed address cannot be nested past the check.
-  it("rejects capture_lead with a malformed payload.email and no top-level email", async () => {
-    const payload = {
-      jsonrpc: "2.0",
-      id: 23,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: {
-          source: "mcp",
-          payload: { name: "Spammer", email: "not-an-email" },
-        },
-      },
-    };
-
-    const res = await mcpPost(port, payload);
-    expect(res.status).toBe(422);
-  });
-
-  it("rejects capture_lead with honeypot field filled", async () => {
-    const payload = {
-      jsonrpc: "2.0",
-      id: 21,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: {
-          source: "mcp",
-          email: "bot@example.com",
-          honeypot: "i-am-a-bot",
-          payload: { name: "Bot" },
-        },
-      },
-    };
-
-    const res = await mcpPost(port, payload);
-    expect(res.status).toBe(422);
-  });
-
-  it("blocks requests from blocked user agents", async () => {
-    const blockedApp = await buildHttpTransportApp({
-      ...OPEN_CORS_CONFIG,
-      abuse: {
-        captureLeadDailyCapPerIp: 50,
-        blockedUserAgents: "EvilBot",
-      },
-    });
-    await blockedApp.listen({ host: "127.0.0.1", port: 0 });
-    const blockedPort = (blockedApp.server.address() as AddressInfo).port;
-
-    try {
-      const res = await mcpPost(
-        blockedPort,
-        {
-          jsonrpc: "2.0",
-          id: 22,
-          method: "tools/call",
-          params: {
-            name: "capture_lead",
-            arguments: {
-              source: "mcp",
-              email: "bot@example.com",
-              payload: { name: "Bot" },
-            },
-          },
-        },
-        { "user-agent": "EvilBot/1.0" },
-      );
-      expect(res.status).toBe(403);
-    } finally {
-      await blockedApp.close();
-    }
-  });
-});
-
-/**
- * #8073 — the lead-write tools forward the address the transport TRUSTED
- * (`request.ip`), not a caller-supplied `X-Forwarded-For` value. The
- * long-running entry (`buildHttpTransportApp`, used throughout this file)
- * sets no `trustProxy`, so `request.ip` is always the real socket address —
- * 127.0.0.1 here — exactly the D5 guarantee a forged header cannot move.
- */
-describe("capture_lead forwards the trusted caller address (#8073)", () => {
-  let app: FastifyInstance;
-  let port: number;
-  let submitSpy: jest.SpiedFunction<typeof apiClient.leads.submit>;
-
-  beforeEach(async () => {
-    submitSpy = jest
-      .spyOn(apiClient.leads, "submit")
-      .mockResolvedValue({
-        ok: true,
-        body: {
-          id: "lead_1",
-          persisted: "db",
-          email: { ok: true, messageId: "msg_1" },
-        },
-      });
-    app = await buildHttpTransportApp(DEFAULT_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    submitSpy.mockRestore();
-    delete process.env.AILK_VISITOR_FORWARD_KEY;
-  });
-
-  function capturePayload(id: number, email: string) {
-    return {
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: { source: "mcp", email, payload: { name: "Jane" } },
-      },
-    };
-  }
-
-  it("sends the socket address and the forward key as the two visitor headers", async () => {
-    process.env.AILK_VISITOR_FORWARD_KEY = "spoke-key";
-
-    const res = await mcpPost(port, capturePayload(40, "jane@example.com"), {
-      // A caller-forged hop: D5 says this must not move the key.
-      "x-forwarded-for": "203.0.113.7",
-    });
-
-    expect(res.status).toBe(200);
-    expect(submitSpy).toHaveBeenCalledTimes(1);
-    const init = submitSpy.mock.calls[0]?.[1];
-    expect(init?.headers).toEqual({
-      "x-ailk-visitor-ip": "127.0.0.1",
-      "x-ailk-visitor-forward-key": "spoke-key",
-    });
-  });
-
-  // #7171 AC-11, AC-14 — the body reaches the hub as the agent sent it; an
-  // agent's `siteId` is STRIPPED by the SDK's parse against the registered
-  // shape (never refused, as the route strips it), so none is ever posted.
-  it("posts the route body as sent, and strips an agent's siteId rather than refusing it", async () => {
-    delete process.env.AILK_LEAD_SITE;
-
-    const res = await mcpPost(port, {
-      jsonrpc: "2.0",
-      id: 42,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: {
-          source: "mcp",
-          email: "jane3@example.com",
-          payload: { name: "Jane" },
-          siteId: "evil",
-        },
-      },
-    });
-
-    expect(res.status).toBe(200);
-    expect(submitSpy).toHaveBeenCalledTimes(1);
-    expect(submitSpy.mock.calls[0]?.[0]).toEqual({
-      source: "mcp",
-      email: "jane3@example.com",
-      payload: { name: "Jane" },
-    });
-  });
-
-  it("sends no visitor headers (and no second argument) when the key is unset", async () => {
-    delete process.env.AILK_VISITOR_FORWARD_KEY;
-
-    const res = await mcpPost(port, capturePayload(41, "jane2@example.com"));
-
-    expect(res.status).toBe(200);
-    expect(submitSpy).toHaveBeenCalledTimes(1);
-    expect(submitSpy.mock.calls[0]).toHaveLength(1);
-  });
-});
-
-/**
- * AC-3 — a `start_purchase` burst beyond the AbuseGuard per-IP cap is refused
- * with the rate-limit error and creates no Checkout Session (#5971 D6).
- *
- * The refusal happens in the POST preHandler, BEFORE the MCP handler runs, so
- * `checkout.createSession` is the thing to count: it is called once per call
- * that got through and never for the one that was refused.
- *
- * `start_purchase` takes the write branch only because #5971 added it to
- * `WRITE_TOOLS`; on the read branch the AbuseGuard checks the UA deny list
- * alone and the cap would never be consulted.
- */
-describe("start_purchase — per-IP daily cap (#5971)", () => {
-  const CAP = 2;
-  const CAPPED_CONFIG = {
-    ...DEFAULT_CONFIG,
-    cors: { writeAllowedOrigins: ["*"] as string[] },
-    abuse: {
-      captureLeadDailyCapPerIp: 50,
-      startPurchaseDailyCapPerIp: CAP,
-      blockedUserAgents: "",
-    },
-  };
-
-  const createSession = checkout.createSession as jest.MockedFunction<
-    typeof checkout.createSession
-  >;
-
-  let app: FastifyInstance;
-  let port: number;
-
-  function purchasePayload(id: number) {
-    return {
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: {
-        name: "start_purchase",
-        arguments: { productCode: "growth_monthly" },
-      },
-    };
-  }
-
-  beforeEach(async () => {
-    __setMcpCommerceClaimForTest("claimed");
-    createSession.mockResolvedValue({
-      ok: true,
-      body: {
-        sessionId: "cs_test_burst",
-        url: "https://checkout.stripe.com/c/pay/cs_test_burst",
-      },
-    });
-    app = await buildHttpTransportApp(CAPPED_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    jest.clearAllMocks();
-    resetMcpCommerceClaim();
-  });
-
-  it("refuses the call past the cap with 403 and a 'daily cap' reason", async () => {
-    const first = await mcpPost(port, purchasePayload(30));
-    const second = await mcpPost(port, purchasePayload(31));
-    const third = await mcpPost(port, purchasePayload(32));
-
-    expect(first.status).toBe(200);
-    expect(second.status).toBe(200);
-    expect(third.status).toBe(403);
-
-    const body = (await third.json()) as { error?: string };
-    expect(body.error).toContain("daily");
-    expect(body.error).toContain("cap");
-  });
-
-  it("creates no Checkout Session for the refused call", async () => {
-    await mcpPost(port, purchasePayload(33));
-    await mcpPost(port, purchasePayload(34));
-    await mcpPost(port, purchasePayload(35));
-
-    expect(createSession).toHaveBeenCalledTimes(CAP);
-  });
-
-  it("start_purchase takes the write branch, so the guard sees it at all", async () => {
-    const res = await mcpPost(port, purchasePayload(36), {
-      "user-agent": "curl/8.0",
-    });
-
-    // A built-in blocked UA is refused on the write branch; a read-branch
-    // tool would be too, but only the write branch consults the cap above.
-    expect(res.status).toBe(403);
-  });
-});
-
-/**
- * JSON-RPC BATCH envelope — the write branch must survive it (#5971 security
- * review, High).
- *
- * JSON-RPC 2.0 allows an ARRAY of messages in one POST, and the pinned MCP SDK
- * dispatches every one of them. The write-tool guard used to read
- * `body.method` on a body that may be an array: an array has no `.method`, so
- * the whole batch was classified as a READ, skipping the write-origin
- * allow-list and every AbuseGuard rule — including the per-IP daily cap. N
- * batched `start_purchase` calls then executed on zero cap units, each one
- * creating a real Stripe Checkout Session on the seller's account.
- *
- * These tests pin the envelope, not the tool: any future WRITE_TOOLS addition
- * inherits them. The gap predated `start_purchase` and covered the three other
- * write tools too, which is why the last case here is `capture_lead`.
- */
-describe("JSON-RPC batch bodies take the write branch (#5971)", () => {
-  const CAP = 2;
-  const BATCH_CONFIG = {
-    ...DEFAULT_CONFIG,
-    cors: { writeAllowedOrigins: ["*"] as string[] },
-    abuse: {
-      captureLeadDailyCapPerIp: CAP,
-      startPurchaseDailyCapPerIp: CAP,
-      blockedUserAgents: "",
-    },
-  };
-
-  const createSession = checkout.createSession as jest.MockedFunction<
-    typeof checkout.createSession
-  >;
-
-  let app: FastifyInstance;
-  let port: number;
-
-  function purchaseMessage(id: number) {
-    return {
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: {
-        name: "start_purchase",
-        arguments: { productCode: "growth_monthly" },
-      },
-    };
-  }
-
-  beforeEach(async () => {
-    __setMcpCommerceClaimForTest("claimed");
-    createSession.mockResolvedValue({
-      ok: true,
-      body: {
-        sessionId: "cs_test_batch",
-        url: "https://checkout.stripe.com/c/pay/cs_test_batch",
-      },
-    });
-    app = await buildHttpTransportApp(BATCH_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    jest.clearAllMocks();
-    resetMcpCommerceClaim();
-  });
-
-  it("a batch of N write calls consumes N cap units, not one", async () => {
-    // One POST carrying CAP + 1 messages. Under the old per-request check this
-    // returned 200 and executed every one; the cap must refuse it outright.
-    const res = await mcpPost(port, [
-      purchaseMessage(40),
-      purchaseMessage(41),
-      purchaseMessage(42),
-    ]);
-
-    expect(res.status).toBe(403);
-    const body = (await res.json()) as { error?: string };
-    expect(body.error).toContain("daily cap");
-  });
-
-  it("refuses the batch before the SDK dispatches any of its messages", async () => {
-    await mcpPost(port, [
-      purchaseMessage(43),
-      purchaseMessage(44),
-      purchaseMessage(45),
-    ]);
-
-    // Refused in the preHandler ⇒ no Checkout Session for ANY message.
-    expect(createSession).not.toHaveBeenCalled();
-  });
-
-  it("a batch within the cap still works, and charges one unit per message", async () => {
-    const res = await mcpPost(port, [purchaseMessage(46), purchaseMessage(47)]);
-    expect(res.status).toBe(200);
-
-    // Both units are now spent, so a single further call is refused.
-    const third = await mcpPost(port, purchaseMessage(48));
-    expect(third.status).toBe(403);
-  });
-
-  it("a batch is subject to the write-origin allow-list", async () => {
-    const strictApp = await buildHttpTransportApp({
-      ...BATCH_CONFIG,
-      cors: { writeAllowedOrigins: [] as string[] },
-    });
-    await strictApp.listen({ host: "127.0.0.1", port: 0 });
-    const strictPort = (strictApp.server.address() as AddressInfo).port;
-
-    try {
-      const res = await mcpPost(strictPort, [purchaseMessage(49)], {
-        origin: "https://evil.example",
-      });
-      expect(res.status).toBe(403);
-      const body = (await res.json()) as { error?: string };
-      expect(body.error).toContain("CORS");
-    } finally {
-      await strictApp.close();
-    }
-  });
-
-  it("the same protection covers the pre-existing write tools (capture_lead)", async () => {
-    const leadMessage = (id: number) => ({
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: {
-        name: "capture_lead",
-        arguments: { source: "mcp", email: "a@example.com", payload: { name: "A" } },
-      },
-    });
-
-    const res = await mcpPost(port, [
-      leadMessage(50),
-      leadMessage(51),
-      leadMessage(52),
-    ]);
-
-    expect(res.status).toBe(403);
-  });
-
-  it("a batch of READ messages is unaffected", async () => {
-    const res = await mcpPost(port, [TOOLS_LIST_PAYLOAD]);
-    expect(res.status).toBe(200);
-  });
-});
-
-/**
- * Guardrail — batch coverage is driven from WRITE_TOOLS itself (#5971 security
- * review round 2), not from hand-picked names.
- *
- * The round-1 defect was invisible because every existing test used the
- * single-message envelope. A comment on WRITE_TOOLS saying "enforce this
- * batch-aware" is the weakest available remedy for a defect whose whole
- * character was that nobody thought to send an array — so the inheritance is
- * mechanical here: a tool added to WRITE_TOOLS without batch enforcement fails
- * this suite on its first run.
- *
- * The assertion is the write-branch ORIGIN check rather than the cap, because
- * it needs no per-tool arguments and no per-tool budget — only two of the four
- * write tools carry a daily cap (see DAILY_CAPPED_TOOLS).
- */
-describe.each([...WRITE_TOOLS])(
-  "a batch naming %s takes the write branch (#5971)",
-  (toolName) => {
-    let app: FastifyInstance;
-    let port: number;
-
-    beforeEach(async () => {
-      // Empty allow-list ⇒ a cross-origin write must be refused. On the read
-      // branch the origin is never consulted, so a 200 here means the batch
-      // was misclassified.
-      app = await buildHttpTransportApp({
-        ...DEFAULT_CONFIG,
-        cors: { writeAllowedOrigins: [] as string[] },
-      });
-      await app.listen({ host: "127.0.0.1", port: 0 });
-      port = (app.server.address() as AddressInfo).port;
-    });
-
-    afterEach(async () => {
-      await app.close();
-    });
-
-    it("is refused by the write-origin allow-list inside an array body", async () => {
-      const res = await mcpPost(
-        port,
-        [
-          {
-            jsonrpc: "2.0",
-            id: 60,
-            method: "tools/call",
-            params: { name: toolName, arguments: {} },
-          },
-        ],
-        { origin: "https://evil.example" },
-      );
-
-      expect(res.status).toBe(403);
-    });
-  },
-);
-
-/**
- * Guardrail — a blank or malformed cap must not silently disable enforcement
- * (#5971 security review round 2, Medium).
- *
- * `parseInt("")` is NaN, NaN survives every `??` guard, and `count >= NaN` is
- * always false — so the cap stops refusing anything, with no log and no
- * startup warning. A misconfigured deployment looks identical to a correct one
- * at rest, which is why this is pinned rather than left to convention.
- */
-describe("a non-finite daily cap falls back to the default, never to unlimited (#5971)", () => {
-  let app: FastifyInstance;
-  let port: number;
-
-  afterEach(async () => {
-    if (app) await app.close();
-    jest.clearAllMocks();
-    resetMcpCommerceClaim();
-  });
-
-  async function startWithCap(cap: number): Promise<void> {
-    __setMcpCommerceClaimForTest("claimed");
-    (
-      checkout.createSession as jest.MockedFunction<
-        typeof checkout.createSession
-      >
-    ).mockResolvedValue({
-      ok: true,
-      body: { sessionId: "cs_nan", url: "https://checkout.stripe.com/c/nan" },
-    });
-    app = await buildHttpTransportApp({
-      ...DEFAULT_CONFIG,
-      // 21 writes in one minute: lift the per-minute write bucket (#9251) so
-      // the DAILY cap is the limit this test exercises.
-      rateLimits: { readPerMin: 60, writePerMin: 1000 },
-      cors: { writeAllowedOrigins: ["*"] as string[] },
-      abuse: {
-        captureLeadDailyCapPerIp: 50,
-        startPurchaseDailyCapPerIp: cap,
-        blockedUserAgents: "",
-      },
-    });
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  }
-
-  it("NaN does not disable the start_purchase cap", async () => {
-    // What `parseInt("")` on a blank MCP_ABUSE_START_PURCHASE_DAILY_CAP yields.
-    await startWithCap(Number.NaN);
-
-    // The default (20) must still bite. 21 calls ⇒ the last one is refused.
-    let lastStatus = 0;
-    for (let i = 0; i < 21; i += 1) {
-      const res = await mcpPost(port, {
-        jsonrpc: "2.0",
-        id: 70 + i,
-        method: "tools/call",
-        params: {
-          name: "start_purchase",
-          arguments: { productCode: "growth_monthly" },
-        },
-      });
-      lastStatus = res.status;
-    }
-
-    expect(lastStatus).toBe(403);
-  });
-});
-
-/**
- * #5994 — the 403-vs-422 split is keyed on a TYPED reason code, never on the
- * wording of the refusal reason.
- *
- * The guard refuses for two different kinds of reason and the transport owes
- * them different statuses: a refusal of the CALLER (blocked UA, per-IP daily
- * cap) is 403, a refusal of the INPUT (honeypot, malformed email) is 422.
- * Before this change the transport told them apart with
- * `reason.includes("daily cap")`, so a reworded reason silently turned a
- * rate-limit refusal into a 422 — and `capture_lead`'s wording carried the
- * substring only by accident ("daily capture_lead cap" contains "daily cap"
- * because the tool name starts with "cap").
- *
- * These tests pin the mapping from the code, and assert the two daily-capped
- * tools — whose reason wordings differ — both reach 403 through it.
- */
-describe("abuse refusal status is keyed on the typed reason code (#5994)", () => {
-  const CODE_KEYED_CONFIG = {
-    ...DEFAULT_CONFIG,
-    cors: { writeAllowedOrigins: ["*"] as string[] },
-    abuse: {
-      captureLeadDailyCapPerIp: 1,
-      startPurchaseDailyCapPerIp: 1,
-      blockedUserAgents: "",
-    },
-  };
-
-  const createSession = checkout.createSession as jest.MockedFunction<
-    typeof checkout.createSession
-  >;
-
-  let app: FastifyInstance;
-  let port: number;
-
-  beforeEach(async () => {
-    __setMcpCommerceClaimForTest("claimed");
-    createSession.mockResolvedValue({
-      ok: true,
-      body: {
-        sessionId: "cs_test_5994",
-        url: "https://checkout.stripe.com/c/pay/cs_test_5994",
-      },
-    });
-    app = await buildHttpTransportApp(CODE_KEYED_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    jest.clearAllMocks();
-    resetMcpCommerceClaim();
-  });
-
-  function captureLeadPayload(id: number, args: Record<string, unknown>) {
-    return {
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: { name: "capture_lead", arguments: args },
-    };
-  }
-
-  it("maps a capture_lead daily-cap refusal to 403", async () => {
-    // The first call spends the IP's single cap unit. Whatever the handler
-    // then makes of it is irrelevant here — only the SECOND call, refused in
-    // the preHandler, is under test.
-    await mcpPost(
-      port,
-      captureLeadPayload(40, {
-        source: "mcp",
-        email: "first@example.com",
-        payload: { name: "First" },
-      }),
-    );
-
-    const capped = await mcpPost(
-      port,
-      captureLeadPayload(41, {
-        source: "mcp",
-        email: "second@example.com",
-        payload: { name: "Second" },
-      }),
-    );
-
-    expect(capped.status).toBe(403);
-  });
-
-  it("maps a start_purchase daily-cap refusal to 403", async () => {
-    const purchase = (id: number) => ({
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: { name: "start_purchase", arguments: { productCode: "growth_monthly" } },
-    });
-
-    const first = await mcpPost(port, purchase(42));
-    const capped = await mcpPost(port, purchase(43));
-
-    expect(first.status).toBe(200);
-    expect(capped.status).toBe(403);
-  });
-
-  it("maps a validation refusal to 422", async () => {
-    const res = await mcpPost(
-      port,
-      captureLeadPayload(44, { name: "Spammer", email: "not-an-email" }),
-    );
-
-    expect(res.status).toBe(422);
-  });
-
-  /**
-   * The AbuseGuard reads exactly two things off the request — the
-   * `user-agent` header and `ip`. The UA here is one the built-in deny list
-   * lets through, so Rule 4 (the cap) is what refuses these calls rather than
-   * Rule 1.
-   */
-  function makeGuardRequest(): FastifyRequest {
-    // @ts-expect-error: a stub carrying only the two members the guard reads;
-    // a full FastifyRequest cannot be constructed without a live server.
-    return {
-      headers: { "user-agent": "Mozilla/5.0 (compatible; TestAgent/1.0)" },
-      ip: "203.0.113.7",
-    };
-  }
-
-  it("derives the status from the code alone — the two daily-capped tools word their reasons differently yet both map to 403", () => {
-    const guard = new AbuseGuard({
-      captureLeadDailyCapPerIp: 1,
-      startPurchaseDailyCapPerIp: 1,
-      blockedUserAgents: "",
-    });
-    const request = makeGuardRequest();
-
-    // Spend each tool's single cap unit, then collect the refusal.
-    guard.validate("capture_lead", {}, request);
-    guard.validate("start_purchase", {}, request);
-    const lead = guard.validate("capture_lead", {}, request);
-    const purchase = guard.validate("start_purchase", {}, request);
-
-    expect(lead.allowed).toBe(false);
-    expect(purchase.allowed).toBe(false);
-    if (lead.allowed || purchase.allowed) return;
-
-    // Same code, different wording — the wording is prose for the caller, the
-    // code is what the transport reads.
-    expect(lead.code).toBe(AbuseReasonCode.DAILY_CAP_REACHED);
-    expect(purchase.code).toBe(AbuseReasonCode.DAILY_CAP_REACHED);
-    expect(lead.reason).not.toBe(purchase.reason);
-
-    expect(ABUSE_REFUSAL_STATUS[lead.code]).toBe(403);
-    expect(ABUSE_REFUSAL_STATUS[purchase.code]).toBe(403);
-  });
-
-  it("declares a status for every reason code the guard can return", () => {
-    expect(Object.keys(ABUSE_REFUSAL_STATUS).sort()).toEqual(
-      Object.values(AbuseReasonCode).sort(),
-    );
-    expect(ABUSE_REFUSAL_STATUS[AbuseReasonCode.BLOCKED_USER_AGENT]).toBe(403);
-    expect(ABUSE_REFUSAL_STATUS[AbuseReasonCode.HONEYPOT_FILLED]).toBe(422);
-    expect(ABUSE_REFUSAL_STATUS[AbuseReasonCode.INVALID_EMAIL]).toBe(422);
-  });
-});
-
-/**
- * #8071 — `create_booking` and `submit_flow_step` send caller-chosen data to
- * the hub, so they take the same write branch as `capture_lead`: the
- * write-origin allow-list, then the AbuseGuard once per call — each on its OWN
- * daily-cap tracker.
- *
- * Every assertion here is a refusal the preHandler makes, so the suite holds
- * in a scaffold that does not register the tool (no `scheduling` or
- * `signal-collectors` module): the hub stub is checked for "no request for the
- * refused call", never for a count the handler would have to produce.
- */
-const HUB_WRITE_TOOLS = [
-  {
-    toolName: "create_booking",
-    capField: "createBookingDailyCapPerIp",
-    hubStub: () => apiClient.schedule.book as jest.Mock,
-    args: () => ({
-      calLink: "acme/intro",
-      start: "2030-01-07T15:00:00.000Z",
-      attendee: { name: "Ada", email: "ada@example.com" },
-    }),
-  },
-  {
-    toolName: "submit_flow_step",
-    capField: "submitFlowStepDailyCapPerIp",
-    hubStub: () => apiClient.flows.submitStep as jest.Mock,
-    args: () => ({
-      slug: "intake",
-      stepKey: "contact",
-      values: { company: "Acme" },
-    }),
-  },
-] as const;
-
-describe.each(HUB_WRITE_TOOLS)(
-  "$toolName takes the write branch of the HTTP guard (#8071)",
-  ({ toolName, capField, hubStub, args }) => {
-    const CAP = 2;
-    const config = {
-      ...DEFAULT_CONFIG,
-      cors: { writeAllowedOrigins: ["https://allowed.example"] as string[] },
-      abuse: {
-        captureLeadDailyCapPerIp: 50,
-        startPurchaseDailyCapPerIp: 20,
-        [capField]: CAP,
-        blockedUserAgents: "",
-      },
-    };
-
-    let app: FastifyInstance;
-    let port: number;
-
-    function call(id: number, callArgs: object = args()) {
-      return {
-        jsonrpc: "2.0",
-        id,
-        method: "tools/call",
-        params: { name: toolName, arguments: callArgs },
-      };
-    }
-
-    beforeEach(async () => {
-      hubStub().mockResolvedValue({ ok: false, status: 503, body: {} });
-      app = await buildHttpTransportApp(config);
-      await app.listen({ host: "127.0.0.1", port: 0 });
-      port = (app.server.address() as AddressInfo).port;
-    });
-
-    afterEach(async () => {
-      await app.close();
-      jest.clearAllMocks();
-    });
-
-    it("is a member of WRITE_TOOLS", () => {
-      expect(WRITE_TOOLS.has(toolName)).toBe(true);
-    });
-
-    it("refuses a call from an origin not on writeAllowedOrigins with 403", async () => {
-      const res = await mcpPost(port, call(80), {
-        origin: "https://evil.example",
-      });
-
-      expect(res.status).toBe(403);
-      const body = (await res.json()) as { error?: string };
-      expect(body.error).toContain("CORS");
-      expect(hubStub()).not.toHaveBeenCalled();
-    });
-
-    it("refuses the call past its daily cap with 403, and the hub gets no request for it", async () => {
-      for (let i = 0; i < CAP; i += 1) {
-        const res = await mcpPost(port, call(81 + i));
-        expect(res.status).toBe(200);
-      }
-      const hubCallsBefore = hubStub().mock.calls.length;
-
-      const capped = await mcpPost(port, call(90));
-
-      expect(capped.status).toBe(403);
-      const body = (await capped.json()) as { error?: string };
-      expect(body.error).toContain(toolName);
-      expect(hubStub().mock.calls.length).toBe(hubCallsBefore);
-    });
-
-    it("a batch of N calls charges N cap units", async () => {
-      const res = await mcpPost(port, [call(91), call(92), call(93)]);
-
-      expect(res.status).toBe(403);
-      expect(hubStub()).not.toHaveBeenCalled();
-    });
-
-    it("its cap is its own — spending it leaves capture_lead callable", async () => {
-      for (let i = 0; i < CAP; i += 1) await mcpPost(port, call(94 + i));
-      expect((await mcpPost(port, call(97))).status).toBe(403);
-
-      const lead = await mcpPost(port, {
-        jsonrpc: "2.0",
-        id: 98,
-        method: "tools/call",
-        params: {
-          name: "capture_lead",
-          arguments: { name: "Ada", email: "ada@example.com" },
-        },
-      });
-      expect(lead.status).not.toBe(403);
-    });
-
-    it("a refusal maps through the typed code: past the cap is DAILY_CAP_REACHED", () => {
-      const guard = new AbuseGuard({
-        captureLeadDailyCapPerIp: 50,
-        [capField]: 1,
-        blockedUserAgents: "",
-      });
-      // @ts-expect-error: a stub carrying only the two members the guard reads.
-      const request: FastifyRequest = {
-        headers: { "user-agent": "Mozilla/5.0 (compatible; TestAgent/1.0)" },
-        ip: "203.0.113.9",
-      };
-
-      expect(guard.validate(toolName, args(), request).allowed).toBe(true);
-      const refused = guard.validate(toolName, args(), request);
-
-      expect(refused.allowed).toBe(false);
-      if (refused.allowed) return;
-      expect(refused.code).toBe(AbuseReasonCode.DAILY_CAP_REACHED);
-      expect(ABUSE_REFUSAL_STATUS[refused.code]).toBe(403);
-    });
-  },
-);
-
-describe("create_booking — attendee.email is format-checked before the hub (#8071)", () => {
-  let app: FastifyInstance;
-  let port: number;
-
-  const book = () => apiClient.schedule.book as jest.Mock;
-
-  function booking(id: number, attendee: unknown) {
-    return {
-      jsonrpc: "2.0",
-      id,
-      method: "tools/call",
-      params: {
-        name: "create_booking",
-        arguments: {
-          calLink: "acme/intro",
-          start: "2030-01-07T15:00:00.000Z",
-          attendee,
-        },
-      },
-    };
-  }
-
-  beforeEach(async () => {
-    book().mockResolvedValue({ ok: false, status: 503, body: {} });
-    app = await buildHttpTransportApp(DEFAULT_CONFIG);
-    await app.listen({ host: "127.0.0.1", port: 0 });
-    port = (app.server.address() as AddressInfo).port;
-  });
-
-  afterEach(async () => {
-    await app.close();
-    jest.clearAllMocks();
-  });
-
-  it("refuses a malformed attendee.email with 422 and leaves the hub stub untouched", async () => {
-    const res = await mcpPost(
-      port,
-      booking(100, { name: "Spammer", email: "not-an-email" }),
-    );
-
-    expect(res.status).toBe(422);
-    const body = (await res.json()) as { error?: string };
-    expect(body.error).toContain("email");
-    expect(book()).not.toHaveBeenCalled();
-  });
-
-  it.each([null, "ada@example.com", ["ada@example.com"], 42])(
-    "a non-object attendee (%p) is not a guard refusal and never a 500",
-    async (attendee) => {
-      const res = await mcpPost(port, booking(101, attendee));
-
-      // The handler's own Zod schema is the authority on the shape.
-      expect(res.status).toBe(200);
-      expect(book()).not.toHaveBeenCalled();
-    },
-  );
-});