mcp4openapi 0.1.0

package/dist/testing/http-integration.test.js

@@ -0,0 +1,383 @@
+/**
+ * Integration tests for HTTP transport with mocked message handler
+ *
+ * Tests HTTP protocol compliance without full MCPServer complexity
+ */
+import { describe, it, expect, beforeAll, afterAll, beforeEach } from 'vitest';
+import request from 'supertest';
+import { HttpTransport } from '../http-transport.js';
+import { ConsoleLogger } from '../logger.js';
+describe('HTTP Transport Integration', () => {
+    let transport;
+    let app;
+    let sessionId;
+    const mockTools = [
+        {
+            name: 'test_tool',
+            description: 'Test tool',
+            inputSchema: {
+                type: 'object',
+                properties: {
+                    message: { type: 'string' },
+                },
+            },
+        },
+    ];
+    beforeAll(async () => {
+        const config = {
+            host: '127.0.0.1',
+            port: 0,
+            sessionTimeoutMs: 1800000,
+            heartbeatEnabled: false,
+            heartbeatIntervalMs: 30000,
+            metricsEnabled: false,
+            metricsPath: '/metrics',
+        };
+        const logger = new ConsoleLogger();
+        transport = new HttpTransport(config, logger);
+        app = transport.app;
+        // Set up mock message handler
+        transport.setMessageHandler(async (message) => {
+            const msg = message;
+            if (msg.method === 'initialize') {
+                return {
+                    jsonrpc: '2.0',
+                    id: msg.id,
+                    result: {
+                        protocolVersion: '2025-03-26',
+                        serverInfo: {
+                            name: 'test-server',
+                            version: '1.0.0',
+                        },
+                        capabilities: {
+                            tools: {},
+                        },
+                    },
+                };
+            }
+            if (msg.method === 'tools/list') {
+                return {
+                    jsonrpc: '2.0',
+                    id: msg.id,
+                    result: {
+                        tools: mockTools,
+                    },
+                };
+            }
+            if (msg.method === 'tools/call') {
+                return {
+                    jsonrpc: '2.0',
+                    id: msg.id,
+                    result: {
+                        content: [
+                            {
+                                type: 'text',
+                                text: JSON.stringify({ success: true, message: 'Tool executed' }),
+                            },
+                        ],
+                    },
+                };
+            }
+            // Batch request
+            if (Array.isArray(msg)) {
+                return msg.map((m) => {
+                    if (m.method === 'tools/list') {
+                        return {
+                            jsonrpc: '2.0',
+                            id: m.id,
+                            result: { tools: mockTools },
+                        };
+                    }
+                    return {
+                        jsonrpc: '2.0',
+                        id: m.id,
+                        result: { success: true },
+                    };
+                });
+            }
+            return {
+                jsonrpc: '2.0',
+                id: msg.id,
+                error: {
+                    code: -32601,
+                    message: 'Method not found',
+                },
+            };
+        });
+    });
+    afterAll(async () => {
+        await transport.stop();
+    });
+    beforeEach(() => {
+        // Reset session ID for each test
+        sessionId = '';
+    });
+    describe('Initialization', () => {
+        it('should initialize and create session', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: {
+                        name: 'test-client',
+                        version: '1.0.0',
+                    },
+                },
+            });
+            expect(response.status).toBe(200);
+            expect(response.headers['mcp-session-id']).toBeDefined();
+            expect(response.body).toHaveProperty('jsonrpc', '2.0');
+            expect(response.body).toHaveProperty('result');
+            expect(response.body.result).toHaveProperty('protocolVersion', '2025-03-26');
+            expect(response.body.result).toHaveProperty('serverInfo');
+            // Save session ID for subsequent tests
+            sessionId = response.headers['mcp-session-id'];
+        });
+    });
+    describe('Tools List', () => {
+        it('should list available tools', async () => {
+            // Initialize first
+            const initResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {},
+            });
+            sessionId = initResponse.headers['mcp-session-id'];
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', sessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 2,
+                method: 'tools/list',
+                params: {},
+            });
+            expect(response.status).toBe(200);
+            expect(response.body).toHaveProperty('result');
+            expect(response.body.result).toHaveProperty('tools');
+            expect(Array.isArray(response.body.result.tools)).toBe(true);
+            expect(response.body.result.tools.length).toBeGreaterThan(0);
+            // Check tool structure
+            const tool = response.body.result.tools[0];
+            expect(tool).toHaveProperty('name');
+            expect(tool).toHaveProperty('description');
+            expect(tool).toHaveProperty('inputSchema');
+        });
+    });
+    describe('Tool Execution', () => {
+        beforeEach(async () => {
+            // Initialize for each test
+            const initResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {},
+            });
+            sessionId = initResponse.headers['mcp-session-id'];
+        });
+        it('should execute tool call', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', sessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 3,
+                method: 'tools/call',
+                params: {
+                    name: 'test_tool',
+                    arguments: {
+                        message: 'Hello',
+                    },
+                },
+            });
+            expect(response.status).toBe(200);
+            expect(response.body).toHaveProperty('result');
+            expect(response.body.result).toHaveProperty('content');
+            expect(Array.isArray(response.body.result.content)).toBe(true);
+            const content = response.body.result.content[0];
+            expect(content.type).toBe('text');
+            const result = JSON.parse(content.text);
+            expect(result).toHaveProperty('success', true);
+        });
+        it('should handle unknown method', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', sessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 5,
+                method: 'unknown/method',
+                params: {},
+            });
+            expect(response.status).toBe(200);
+            expect(response.body).toHaveProperty('error');
+            expect(response.body.error).toHaveProperty('code', -32601);
+            expect(response.body.error.message).toContain('Method not found');
+        });
+    });
+    describe('SSE Streaming', () => {
+        it('should support SSE response for requests', async () => {
+            // Initialize first
+            const initResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {},
+            });
+            sessionId = initResponse.headers['mcp-session-id'];
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'text/event-stream')
+                .set('Mcp-Session-Id', sessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 6,
+                method: 'tools/list',
+                params: {},
+            });
+            expect(response.status).toBe(200);
+            expect(response.headers['content-type']).toContain('text/event-stream');
+            expect(response.text).toContain('id:');
+            expect(response.text).toContain('data:');
+            // Parse SSE data
+            const lines = response.text.split('\n');
+            const dataLine = lines.find(l => l.startsWith('data:'));
+            expect(dataLine).toBeDefined();
+            const data = JSON.parse(dataLine.substring(5).trim());
+            expect(data.result).toHaveProperty('tools');
+        });
+    });
+    describe('Session Management', () => {
+        it('should reject requests with invalid session', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', 'invalid-session-id')
+                .send({
+                jsonrpc: '2.0',
+                id: 7,
+                method: 'tools/list',
+                params: {},
+            });
+            expect(response.status).toBe(404);
+            expect(response.body).toHaveProperty('error');
+            expect(response.body.message).toContain('Session not found');
+        });
+        it('should allow explicit session termination', async () => {
+            // Create new session
+            const initResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 8,
+                method: 'initialize',
+                params: {},
+            });
+            const tempSessionId = initResponse.headers['mcp-session-id'];
+            expect(tempSessionId).toBeDefined();
+            // Verify session works
+            const listResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', tempSessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 9,
+                method: 'tools/list',
+                params: {},
+            });
+            expect(listResponse.status).toBe(200);
+            // Terminate session
+            const deleteResponse = await request(app)
+                .delete('/mcp')
+                .set('Mcp-Session-Id', tempSessionId);
+            expect(deleteResponse.status).toBe(204);
+            // Verify session is gone
+            const afterDeleteResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', tempSessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 10,
+                method: 'tools/list',
+                params: {},
+            });
+            expect(afterDeleteResponse.status).toBe(404);
+        });
+    });
+    describe('Batch Requests', () => {
+        it('should handle batch of requests', async () => {
+            // Initialize first
+            const initResponse = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {},
+            });
+            sessionId = initResponse.headers['mcp-session-id'];
+            const response = await request(app)
+                .post('/mcp')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', sessionId)
+                .send([
+                {
+                    jsonrpc: '2.0',
+                    id: 11,
+                    method: 'tools/list',
+                    params: {},
+                },
+                {
+                    jsonrpc: '2.0',
+                    id: 12,
+                    method: 'tools/call',
+                    params: {
+                        name: 'test_tool',
+                        arguments: { message: 'test' },
+                    },
+                },
+            ]);
+            expect(response.status).toBe(200);
+            expect(Array.isArray(response.body)).toBe(true);
+            expect(response.body).toHaveLength(2);
+            // Check each response
+            expect(response.body[0]).toHaveProperty('id', 11);
+            expect(response.body[0]).toHaveProperty('result');
+            expect(response.body[1]).toHaveProperty('id', 12);
+            expect(response.body[1]).toHaveProperty('result');
+        });
+    });
+    describe('Health Check', () => {
+        it('should return health status', async () => {
+            const response = await request(app)
+                .get('/health');
+            expect(response.status).toBe(200);
+            expect(response.body).toHaveProperty('status', 'ok');
+            expect(response.body).toHaveProperty('sessions');
+            expect(typeof response.body.sessions).toBe('number');
+        });
+    });
+});
+//# sourceMappingURL=http-integration.test.js.map

package/dist/testing/http-integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-integration.test.js","sourceRoot":"","sources":["../../src/testing/http-integration.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC/E,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAG7C,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,IAAI,SAAwB,CAAC;IAC7B,IAAI,GAAY,CAAC;IACjB,IAAI,SAAiB,CAAC;IACtB,MAAM,SAAS,GAAG;QAChB;YACE,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,WAAW;YACxB,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAC5B;aACF;SACF;KACF,CAAC;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,CAAC;YACP,gBAAgB,EAAE,OAAO;YACzB,gBAAgB,EAAE,KAAK;YACvB,mBAAmB,EAAE,KAAK;YAC1B,cAAc,EAAE,KAAK;YACrB,WAAW,EAAE,UAAU;SACxB,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QACnC,SAAS,GAAG,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,GAAI,SAAiB,CAAC,GAAG,CAAC;QAE7B,8BAA8B;QAC9B,SAAS,CAAC,iBAAiB,CAAC,KAAK,EAAE,OAAgB,EAAE,EAAE;YACrD,MAAM,GAAG,GAAG,OAAc,CAAC;YAE3B,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE;wBACN,eAAe,EAAE,YAAY;wBAC7B,UAAU,EAAE;4BACV,IAAI,EAAE,aAAa;4BACnB,OAAO,EAAE,OAAO;yBACjB;wBACD,YAAY,EAAE;4BACZ,KAAK,EAAE,EAAE;yBACV;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE;wBACN,KAAK,EAAE,SAAS;qBACjB;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE;wBACN,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;6BAClE;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,gBAAgB;YAChB,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;oBACxB,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;wBAC9B,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,EAAE,EAAE,CAAC,CAAC,EAAE;4BACR,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;yBAC7B,CAAC;oBACJ,CAAC;oBACD,OAAO;wBACL,OAAO,EAAE,KAAK;wBACd,EAAE,EAAE,CAAC,CAAC,EAAE;wBACR,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;qBAC1B,CAAC;gBACJ,CAAC,CAAC,CAAC;YACL,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK,EAAE;oBACL,IAAI,EAAE,CAAC,KAAK;oBACZ,OAAO,EAAE,kBAAkB;iBAC5B;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,GAAG,EAAE;QACd,iCAAiC;QACjC,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,eAAe,EAAE,YAAY;oBAC7B,UAAU,EAAE;wBACV,IAAI,EAAE,aAAa;wBACnB,OAAO,EAAE,OAAO;qBACjB;iBACF;aACF,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACzD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;YAC7E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YAE1D,uCAAuC;YACvC,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,mBAAmB;YACnB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACpC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACL,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;iBAChC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YAE7D,uBAAuB;YACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,UAAU,CAAC,KAAK,IAAI,EAAE;YACpB,2BAA2B;YAC3B,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACpC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACL,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;YACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;iBAChC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE;oBACN,IAAI,EAAE,WAAW;oBACjB,SAAS,EAAE;wBACT,OAAO,EAAE,OAAO;qBACjB;iBACF;aACF,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAE/D,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAChD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAElC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;iBAChC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,gBAAgB;gBACxB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;QAC7B,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;YACxD,mBAAmB;YACnB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACpC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACL,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,mBAAmB,CAAC;iBAClC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;iBAChC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACxE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YAEzC,iBAAiB;YACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;YAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAS,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;QAClC,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YAC3D,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,oBAAoB,CAAC;iBAC3C,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YAC9C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;YACzD,qBAAqB;YACrB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACpC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC7D,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;YAEpC,uBAAuB;YACvB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACpC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC;iBACpC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAEtC,oBAAoB;YACpB,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACtC,MAAM,CAAC,MAAM,CAAC;iBACd,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;YAExC,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAExC,yBAAyB;YACzB,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAC3C,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,aAAa,CAAC;iBACpC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,EAAE;gBACN,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YAEL,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;YAC/C,mBAAmB;YACnB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBACpC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,IAAI,CAAC;gBACJ,OAAO,EAAE,KAAK;gBACd,EAAE,EAAE,CAAC;gBACL,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,EAAE;aACX,CAAC,CAAC;YACL,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,IAAI,CAAC,MAAM,CAAC;iBACZ,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC;iBACjC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC;iBAChC,IAAI,CAAC;gBACJ;oBACE,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,EAAE;oBACN,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,EAAE;iBACX;gBACD;oBACE,OAAO,EAAE,KAAK;oBACd,EAAE,EAAE,EAAE;oBACN,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE;wBACN,IAAI,EAAE,WAAW;wBACjB,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;qBAC/B;iBACF;aACF,CAAC,CAAC;YAEL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;YAEtC,sBAAsB;YACtB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAClD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC5B,EAAE,CAAC,6BAA6B,EAAE,KAAK,IAAI,EAAE;YAC3C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;iBAChC,GAAG,CAAC,SAAS,CAAC,CAAC;YAElB,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACrD,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/testing/http-multiuser.test.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Integration test for HTTP transport in multi-user mode (no API_TOKEN in env)
+ *
+ * Tests that:
+ * 1. Server can start without API_TOKEN env var
+ * 2. Clients can send tokens in Authorization header
+ * 3. Each session uses its own token
+ */
+export {};
+//# sourceMappingURL=http-multiuser.test.d.ts.map

package/dist/testing/http-multiuser.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-multiuser.test.d.ts","sourceRoot":"","sources":["../../src/testing/http-multiuser.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/dist/testing/http-multiuser.test.js

@@ -0,0 +1,255 @@
+/**
+ * Integration test for HTTP transport in multi-user mode (no API_TOKEN in env)
+ *
+ * Tests that:
+ * 1. Server can start without API_TOKEN env var
+ * 2. Clients can send tokens in Authorization header
+ * 3. Each session uses its own token
+ */
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { HttpTransport } from '../http-transport.js';
+import { ConsoleLogger } from '../logger.js';
+import request from 'supertest';
+describe('HTTP Multi-User Mode (No API_TOKEN)', () => {
+    let httpTransport;
+    let app;
+    // Save original env
+    const originalApiToken = process.env.API_TOKEN;
+    beforeAll(() => {
+        // IMPORTANT: Remove API_TOKEN from env to test multi-user mode
+        delete process.env.API_TOKEN;
+        const logger = new ConsoleLogger('error'); // Quiet during tests
+        const config = {
+            host: '127.0.0.1',
+            port: 0, // Port 0 for supertest - doesn't actually listen
+            sessionTimeoutMs: 1800000,
+            heartbeatEnabled: false,
+            heartbeatIntervalMs: 30000,
+            metricsEnabled: false,
+            metricsPath: '/metrics',
+        };
+        httpTransport = new HttpTransport(config, logger);
+        app = httpTransport.app;
+        // Set up simple mock message handler
+        httpTransport.setMessageHandler(async (message, sessionId) => {
+            const msg = message;
+            if (msg.method === 'initialize') {
+                return {
+                    jsonrpc: '2.0',
+                    id: msg.id,
+                    result: {
+                        protocolVersion: '2025-03-26',
+                        serverInfo: {
+                            name: 'test-server',
+                            version: '1.0.0',
+                        },
+                        capabilities: {
+                            tools: {},
+                        },
+                    },
+                };
+            }
+            if (msg.method === 'tools/list') {
+                return {
+                    jsonrpc: '2.0',
+                    id: msg.id,
+                    result: {
+                        tools: [
+                            {
+                                name: 'test_tool',
+                                description: 'Test',
+                                inputSchema: { type: 'object', properties: {} }
+                            }
+                        ],
+                    },
+                };
+            }
+            return {
+                jsonrpc: '2.0',
+                id: msg.id,
+                error: {
+                    code: -32601,
+                    message: 'Method not found',
+                },
+            };
+        });
+    });
+    afterAll(() => {
+        // Restore original env
+        if (originalApiToken) {
+            process.env.API_TOKEN = originalApiToken;
+        }
+        else {
+            delete process.env.API_TOKEN;
+        }
+    });
+    describe('Server Initialization', () => {
+        it('should start successfully without API_TOKEN env var', async () => {
+            expect(process.env.API_TOKEN).toBeUndefined();
+            expect(app).toBeDefined();
+            // Health check should work
+            const response = await request(app).get('/health');
+            expect(response.status).toBe(200);
+            expect(response.body.status).toBe('ok');
+        });
+    });
+    describe('Client Authentication', () => {
+        it('should accept initialization with Authorization header', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('Authorization', 'Bearer glpat-test-token-123')
+                .send({
+                jsonrpc: '2.0',
+                id: 1,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: {
+                        name: 'test-client',
+                        version: '1.0.0'
+                    }
+                }
+            });
+            expect(response.status).toBe(200);
+            expect(response.body.result).toBeDefined();
+            expect(response.body.result.protocolVersion).toBe('2025-03-26');
+            expect(response.headers['mcp-session-id']).toBeDefined();
+        });
+        it('should accept initialization with X-API-Token header', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('X-API-Token', 'glpat-test-token-456')
+                .send({
+                jsonrpc: '2.0',
+                id: 2,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: {
+                        name: 'test-client-2',
+                        version: '1.0.0'
+                    }
+                }
+            });
+            expect(response.status).toBe(200);
+            expect(response.headers['mcp-session-id']).toBeDefined();
+        });
+        it('should create separate sessions for different tokens', async () => {
+            // Client 1
+            const response1 = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('Authorization', 'Bearer token-user-1')
+                .send({
+                jsonrpc: '2.0',
+                id: 3,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: { name: 'client-1', version: '1.0.0' }
+                }
+            });
+            const sessionId1 = response1.headers['mcp-session-id'];
+            expect(sessionId1).toBeDefined();
+            // Client 2
+            const response2 = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('Authorization', 'Bearer token-user-2')
+                .send({
+                jsonrpc: '2.0',
+                id: 4,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: { name: 'client-2', version: '1.0.0' }
+                }
+            });
+            const sessionId2 = response2.headers['mcp-session-id'];
+            expect(sessionId2).toBeDefined();
+            // Sessions should be different
+            expect(sessionId1).not.toBe(sessionId2);
+        });
+    });
+    describe('Security', () => {
+        it('should reject malformed Authorization header', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('Authorization', 'InvalidFormat token')
+                .send({
+                jsonrpc: '2.0',
+                id: 5,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: { name: 'test', version: '1.0.0' }
+                }
+            });
+            // P0#2 fix: Now properly rejects invalid format
+            expect(response.status).toBe(500);
+            expect(response.body.error).toBe('Internal Server Error');
+            expect(response.body.message).toContain('Invalid Authorization header format');
+        });
+        it('should handle initialization without any token gracefully', async () => {
+            const response = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .send({
+                jsonrpc: '2.0',
+                id: 6,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: { name: 'test', version: '1.0.0' }
+                }
+            });
+            // Should create session, token will be checked on first tool call
+            expect(response.status).toBe(200);
+        });
+    });
+    describe('Token Storage', () => {
+        it('should store token in session and use it for subsequent requests', async () => {
+            // Initialize with token
+            const initResponse = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('Authorization', 'Bearer session-token-test')
+                .send({
+                jsonrpc: '2.0',
+                id: 7,
+                method: 'initialize',
+                params: {
+                    protocolVersion: '2025-03-26',
+                    clientInfo: { name: 'test', version: '1.0.0' }
+                }
+            });
+            const sessionId = initResponse.headers['mcp-session-id'];
+            expect(sessionId).toBeDefined();
+            // List tools without token in header (should use session token)
+            const toolsResponse = await request(app)
+                .post('/mcp')
+                .set('Content-Type', 'application/json')
+                .set('Accept', 'application/json')
+                .set('Mcp-Session-Id', sessionId)
+                .send({
+                jsonrpc: '2.0',
+                id: 8,
+                method: 'tools/list',
+                params: {}
+            });
+            expect(toolsResponse.status).toBe(200);
+            expect(toolsResponse.body.result).toBeDefined();
+        });
+    });
+});
+//# sourceMappingURL=http-multiuser.test.js.map