palaryn 0.1.0 → 0.3.2

package/dist/tests/unit/app-routes.test.js

@@ -0,0 +1,715 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const supertest_1 = __importDefault(require("supertest"));
+const app_1 = require("../../src/server/app");
+// ---------------------------------------------------------------------------
+// Test config helper
+// ---------------------------------------------------------------------------
+function testConfig(overrides) {
+    return {
+        port: 0,
+        host: '127.0.0.1',
+        auth: { enabled: false, api_keys: {} },
+        policy: { pack_path: './policy-packs/dev_fast.yaml', default_effect: 'ALLOW', hot_reload: false },
+        dlp: { enabled: false, scan_args: false, scan_output: false, secrets_detection: false, pii_detection: false, default_redaction_method: 'mask' },
+        budget: { task_budget_usd: 100, max_steps_per_task: 1000, max_retries_per_call: 3, max_wall_clock_ms: 300000 },
+        audit: { enabled: false, log_dir: '', console_output: false, retention_days: 30 },
+        executor: { http: { timeout_ms: 5000, max_retries: 1, backoff_base_ms: 100 }, cache: { enabled: false, ttl_ms: 0 } },
+        approval: { enabled: false, token_secret: 'test-secret', default_ttl_seconds: 3600 },
+        ...overrides,
+    };
+}
+// ---------------------------------------------------------------------------
+// Minimal valid tool call body (passes validateToolCall middleware)
+// ---------------------------------------------------------------------------
+function validToolCall(extra) {
+    return {
+        tool_call_id: 'tc-000001',
+        task_id: 'task-001',
+        actor: { type: 'agent', id: 'agent-1' },
+        source: { platform: 'test' },
+        tool: { name: 'http', capability: 'read' },
+        args: { method: 'GET', url: 'https://example.com' },
+        ...extra,
+    };
+}
+// ---------------------------------------------------------------------------
+// Suite
+// ---------------------------------------------------------------------------
+describe('app.ts routes', () => {
+    let app;
+    let gateway;
+    let metrics;
+    let healthChecks;
+    beforeEach(() => {
+        const result = (0, app_1.createApp)(testConfig());
+        app = result.app;
+        gateway = result.gateway;
+        metrics = result.metrics;
+        healthChecks = result.healthChecks;
+    });
+    afterEach(async () => {
+        await gateway.shutdown();
+    });
+    // =========================================================================
+    // 1. GET /health
+    // =========================================================================
+    describe('GET /health', () => {
+        it('returns { status: "ok" } when no health checks registered', async () => {
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(200);
+            expect(res.body).toEqual({ status: 'ok' });
+        });
+        it('returns check results when a healthy health check is registered', async () => {
+            healthChecks.push({
+                name: 'test-db',
+                check: async () => ({ status: 'ok' }),
+            });
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(200);
+            expect(res.body.status).toBe('ok');
+        });
+        it('returns 503 when an unhealthy health check is registered', async () => {
+            healthChecks.push({
+                name: 'test-db',
+                check: async () => ({ status: 'unhealthy', message: 'connection refused' }),
+            });
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(503);
+            expect(res.body.status).toBe('unhealthy');
+        });
+        it('returns 200 with degraded status when health check is degraded', async () => {
+            healthChecks.push({
+                name: 'test-cache',
+                check: async () => ({ status: 'degraded', message: 'high latency' }),
+            });
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(200);
+            expect(res.body.status).toBe('degraded');
+        });
+        it('marks overall as unhealthy when health check throws', async () => {
+            healthChecks.push({
+                name: 'test-crash',
+                check: async () => { throw new Error('boom'); },
+            });
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(503);
+            expect(res.body.status).toBe('unhealthy');
+        });
+        it('unhealthy overrides degraded when multiple checks present', async () => {
+            healthChecks.push({ name: 'degraded-svc', check: async () => ({ status: 'degraded' }) }, { name: 'unhealthy-svc', check: async () => ({ status: 'unhealthy' }) });
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(503);
+            expect(res.body.status).toBe('unhealthy');
+        });
+        it('returns minimal response for unauthenticated requests (no version/uptime)', async () => {
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.body).not.toHaveProperty('version');
+            expect(res.body).not.toHaveProperty('uptime_seconds');
+            expect(res.body).not.toHaveProperty('checks');
+        });
+        it('always returns minimal response since session middleware is registered after /health', async () => {
+            // The session middleware is registered after the /health route in app.ts,
+            // so (req as any).auth is always undefined for /health requests.
+            // This test verifies the unauthenticated path is always taken.
+            healthChecks.push({
+                name: 'test-svc',
+                check: async () => ({ status: 'ok' }),
+            });
+            const res = await (0, supertest_1.default)(app).get('/health');
+            expect(res.status).toBe(200);
+            // No version, uptime, checks, or timestamp in unauthenticated response
+            expect(res.body).toEqual({ status: 'ok' });
+        });
+    });
+    // =========================================================================
+    // 2. GET /ready
+    // =========================================================================
+    describe('GET /ready', () => {
+        it('returns { ready: true } in normal state', async () => {
+            const res = await (0, supertest_1.default)(app).get('/ready');
+            expect(res.status).toBe(200);
+            expect(res.body.ready).toBe(true);
+            // Should always include policy_engine check
+            expect(res.body.checks.find((c) => c.name === 'policy_engine')).toBeDefined();
+        });
+        it('returns 503 { ready: false } when gateway is shutting down', async () => {
+            // Trigger shutdown to set isShuttingDown = true
+            await gateway.shutdown();
+            const res = await (0, supertest_1.default)(app).get('/ready');
+            expect(res.status).toBe(503);
+            expect(res.body.ready).toBe(false);
+            const gwCheck = res.body.checks.find((c) => c.name === 'gateway');
+            expect(gwCheck.status).toBe('unhealthy');
+            expect(gwCheck.message).toBe('shutting down');
+        });
+        it('returns 503 when a health check throws', async () => {
+            healthChecks.push({
+                name: 'test-db',
+                check: async () => { throw new Error('db connection failed'); },
+            });
+            const res = await (0, supertest_1.default)(app).get('/ready');
+            expect(res.status).toBe(503);
+            expect(res.body.ready).toBe(false);
+            const dbCheck = res.body.checks.find((c) => c.name === 'test-db');
+            expect(dbCheck.status).toBe('unhealthy');
+            expect(dbCheck.message).toBe('db connection failed');
+        });
+        it('includes error message from non-Error throw', async () => {
+            healthChecks.push({
+                name: 'test-db',
+                check: async () => { throw 'string error'; },
+            });
+            const res = await (0, supertest_1.default)(app).get('/ready');
+            expect(res.status).toBe(503);
+            const dbCheck = res.body.checks.find((c) => c.name === 'test-db');
+            expect(dbCheck.status).toBe('unhealthy');
+            expect(dbCheck.message).toBe('check failed');
+        });
+        it('returns 503 when health check returns unhealthy', async () => {
+            healthChecks.push({
+                name: 'test-redis',
+                check: async () => ({ status: 'unhealthy', message: 'timeout' }),
+            });
+            const res = await (0, supertest_1.default)(app).get('/ready');
+            expect(res.status).toBe(503);
+            expect(res.body.ready).toBe(false);
+        });
+        it('returns 200 when health check is degraded (ready but degraded)', async () => {
+            healthChecks.push({
+                name: 'test-cache',
+                check: async () => ({ status: 'degraded', message: 'slow' }),
+            });
+            const res = await (0, supertest_1.default)(app).get('/ready');
+            // degraded does not make ready=false, only unhealthy does
+            expect(res.status).toBe(200);
+            expect(res.body.ready).toBe(true);
+        });
+    });
+    // =========================================================================
+    // 3. GET /metrics
+    // =========================================================================
+    describe('GET /metrics', () => {
+        it('returns metrics without auth in non-production', async () => {
+            const res = await (0, supertest_1.default)(app).get('/metrics');
+            expect(res.status).toBe(200);
+            expect(res.text).toContain('palaryn_');
+        });
+        it('returns 401 in production mode with auth enabled and no key', async () => {
+            const origEnv = process.env.NODE_ENV;
+            process.env.NODE_ENV = 'production';
+            try {
+                const prodResult = (0, app_1.createApp)(testConfig({
+                    auth: { enabled: true, api_keys: { 'prod-key-12345': { workspace_id: 'ws-1' } } },
+                }));
+                const res = await (0, supertest_1.default)(prodResult.app).get('/metrics');
+                expect(res.status).toBe(401);
+                expect(res.body.error_code).toBe('AUTH_REQUIRED');
+                await prodResult.gateway.shutdown();
+            }
+            finally {
+                process.env.NODE_ENV = origEnv;
+            }
+        });
+        it('returns metrics in production mode with x-api-key header', async () => {
+            const origEnv = process.env.NODE_ENV;
+            process.env.NODE_ENV = 'production';
+            try {
+                const prodResult = (0, app_1.createApp)(testConfig({
+                    auth: { enabled: true, api_keys: { 'prod-key-12345': { workspace_id: 'ws-1' } } },
+                }));
+                const res = await (0, supertest_1.default)(prodResult.app)
+                    .get('/metrics')
+                    .set('x-api-key', 'prod-key-12345');
+                expect(res.status).toBe(200);
+                expect(res.text).toContain('palaryn_');
+                await prodResult.gateway.shutdown();
+            }
+            finally {
+                process.env.NODE_ENV = origEnv;
+            }
+        });
+        it('returns metrics in production mode with bearer token', async () => {
+            const origEnv = process.env.NODE_ENV;
+            process.env.NODE_ENV = 'production';
+            try {
+                const prodResult = (0, app_1.createApp)(testConfig({
+                    auth: { enabled: true, api_keys: { 'bearer-key-123': { workspace_id: 'ws-1' } } },
+                }));
+                const res = await (0, supertest_1.default)(prodResult.app)
+                    .get('/metrics')
+                    .set('Authorization', 'Bearer some-bearer-token');
+                expect(res.status).toBe(200);
+                await prodResult.gateway.shutdown();
+            }
+            finally {
+                process.env.NODE_ENV = origEnv;
+            }
+        });
+        it('returns 500 when metrics.getMetrics() throws', async () => {
+            jest.spyOn(metrics, 'getMetrics').mockRejectedValueOnce(new Error('metrics boom'));
+            const res = await (0, supertest_1.default)(app).get('/metrics');
+            expect(res.status).toBe(500);
+        });
+    });
+    // =========================================================================
+    // 4. GET /install.sh
+    // =========================================================================
+    describe('GET /install.sh', () => {
+        it('returns install script with text/plain content type when file exists', async () => {
+            // Mock fs to simulate install.sh existing (path resolution differs in Jest vs dist)
+            const fs = require('fs');
+            const origExistsSync = fs.existsSync;
+            const origReadFileSync = fs.readFileSync;
+            fs.existsSync = (p) => {
+                if (p.endsWith('install.sh'))
+                    return true;
+                return origExistsSync(p);
+            };
+            fs.readFileSync = (p, enc) => {
+                if (typeof p === 'string' && p.endsWith('install.sh'))
+                    return '#!/bin/sh\necho "install"';
+                return origReadFileSync(p, enc);
+            };
+            try {
+                const result2 = (0, app_1.createApp)(testConfig());
+                const res = await (0, supertest_1.default)(result2.app).get('/install.sh');
+                expect(res.status).toBe(200);
+                expect(res.headers['content-type']).toContain('text/plain');
+                expect(res.text).toContain('#!/bin/sh');
+                await result2.gateway.shutdown();
+            }
+            finally {
+                fs.existsSync = origExistsSync;
+                fs.readFileSync = origReadFileSync;
+            }
+        });
+        it('returns 404 when file does not exist', async () => {
+            const fs = require('fs');
+            const origExistsSync = fs.existsSync;
+            fs.existsSync = (p) => {
+                if (p.endsWith('install.sh'))
+                    return false;
+                return origExistsSync(p);
+            };
+            try {
+                const result2 = (0, app_1.createApp)(testConfig());
+                const res = await (0, supertest_1.default)(result2.app).get('/install.sh');
+                expect(res.status).toBe(404);
+                expect(res.text).toContain('install.sh not found');
+                await result2.gateway.shutdown();
+            }
+            finally {
+                fs.existsSync = origExistsSync;
+            }
+        });
+    });
+    // =========================================================================
+    // 5. POST /v1/tool/execute
+    // =========================================================================
+    describe('POST /v1/tool/execute', () => {
+        it('returns 200 when gateway.execute returns status "ok"', async () => {
+            const mockResult = {
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'ok',
+                policy: { decision: 'allow', reasons: [] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                output: { http_status: 200, body: { data: 'ok' } },
+                timing: { started_at: new Date().toISOString(), duration_ms: 10 },
+            };
+            jest.spyOn(gateway, 'execute').mockResolvedValueOnce(mockResult);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(200);
+            expect(res.body.status).toBe('ok');
+        });
+        it('returns 403 when gateway.execute returns status "blocked"', async () => {
+            const mockResult = {
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'blocked',
+                policy: { decision: 'deny', rule_id: 'block-all', reasons: ['blocked by policy'] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                timing: { started_at: new Date().toISOString(), duration_ms: 5 },
+            };
+            jest.spyOn(gateway, 'execute').mockResolvedValueOnce(mockResult);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(403);
+            expect(res.body.status).toBe('blocked');
+        });
+        it('returns 429 when blocked with rate_limit rule_id', async () => {
+            const mockResult = {
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'blocked',
+                policy: { decision: 'deny', rule_id: 'rate_limit', reasons: ['rate limited'] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                timing: { started_at: new Date().toISOString(), duration_ms: 5 },
+            };
+            jest.spyOn(gateway, 'execute').mockResolvedValueOnce(mockResult);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(429);
+        });
+        it('returns 202 when status is "needs_approval"', async () => {
+            const mockResult = {
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'needs_approval',
+                policy: { decision: 'require_approval', reasons: ['requires admin approval'] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                timing: { started_at: new Date().toISOString(), duration_ms: 5 },
+            };
+            jest.spyOn(gateway, 'execute').mockResolvedValueOnce(mockResult);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(202);
+            expect(res.body.status).toBe('needs_approval');
+        });
+        it('sanitizes error in result (never leaks internal details)', async () => {
+            const mockResult = {
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'ok',
+                policy: { decision: 'allow', reasons: [] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                error: 'Internal path /var/secrets/key.pem leaked',
+                timing: { started_at: new Date().toISOString(), duration_ms: 10 },
+            };
+            jest.spyOn(gateway, 'execute').mockResolvedValueOnce(mockResult);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(200);
+            expect(res.body.error).toBe('Tool execution failed');
+        });
+        it('returns 500 when gateway.execute throws', async () => {
+            jest.spyOn(gateway, 'execute').mockRejectedValueOnce(new Error('unexpected crash'));
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(500);
+            expect(res.body.error_code).toBe('TOOL_EXECUTION_ERROR');
+        });
+        it('returns 500 when gateway.execute throws non-Error', async () => {
+            jest.spyOn(gateway, 'execute').mockRejectedValueOnce('string error');
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(500);
+            expect(res.body.error_code).toBe('TOOL_EXECUTION_ERROR');
+        });
+        it('merges api_key_tags into context.labels', async () => {
+            // Create an app with auth enabled and an API key that has tags
+            const authConfig = testConfig({
+                auth: {
+                    enabled: true,
+                    api_keys: {
+                        'tagged-key-12345': {
+                            workspace_id: 'ws-tags',
+                            roles: ['operator'],
+                        },
+                    },
+                },
+            });
+            const authResult = (0, app_1.createApp)(authConfig);
+            // The api_key_tags won't be set by config-based keys (they come from SaaS keys),
+            // but we can test the merge logic by setting auth context via a mock.
+            // Instead, we spy on execute to verify the toolCall passed to it has merged labels.
+            const executeSpy = jest.spyOn(authResult.gateway, 'execute').mockResolvedValueOnce({
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'ok',
+                policy: { decision: 'allow', reasons: [] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                timing: { started_at: new Date().toISOString(), duration_ms: 10 },
+            });
+            const res = await (0, supertest_1.default)(authResult.app)
+                .post('/v1/tool/execute')
+                .set('x-api-key', 'tagged-key-12345')
+                .send(validToolCall({
+                context: { labels: ['existing-label'] },
+            }));
+            expect(res.status).toBe(200);
+            // Gateway should have been called with the tool call
+            expect(executeSpy).toHaveBeenCalled();
+            await authResult.gateway.shutdown();
+        });
+        it('returns 403 for capability-specific RBAC check when rbac is enabled', async () => {
+            const rbacConfig = testConfig({
+                auth: {
+                    enabled: true,
+                    api_keys: {
+                        'rbac-key-12345': {
+                            workspace_id: 'ws-rbac',
+                            roles: ['reader'],
+                        },
+                    },
+                    rbac: {
+                        enabled: true,
+                        roles: {
+                            reader: {
+                                permissions: ['tool:execute:read'],
+                            },
+                        },
+                    },
+                },
+            });
+            const rbacResult = (0, app_1.createApp)(rbacConfig);
+            // Request with a write capability but only reader role
+            const res = await (0, supertest_1.default)(rbacResult.app)
+                .post('/v1/tool/execute')
+                .set('x-api-key', 'rbac-key-12345')
+                .send(validToolCall({
+                tool: { name: 'http', capability: 'write' },
+            }));
+            // The reader role has tool:execute:read but not tool:execute:write
+            // However, the broad rbacToolExecute middleware checks tool:execute
+            // which the reader doesn't have either, so it may be blocked at the middleware level
+            expect([403]).toContain(res.status);
+            await rbacResult.gateway.shutdown();
+        });
+    });
+    // =========================================================================
+    // 6. POST /v1/tool/approve
+    // =========================================================================
+    describe('POST /v1/tool/approve', () => {
+        it('returns 400 when approval_token is missing', async () => {
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approved: true });
+            expect(res.status).toBe(400);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+            expect(res.body.error).toContain('approval_token');
+        });
+        it('returns { status: "ok" } on successful approval', async () => {
+            jest.spyOn(gateway, 'processApproval').mockResolvedValueOnce({
+                success: true,
+            });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approval_token: 'valid-token-123', approved: true });
+            expect(res.status).toBe(200);
+            expect(res.body.status).toBe('ok');
+            expect(res.body.success).toBe(true);
+        });
+        it('returns 400 when processApproval returns success=false', async () => {
+            jest.spyOn(gateway, 'processApproval').mockResolvedValueOnce({
+                success: false,
+                error: 'Token expired',
+            });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approval_token: 'expired-token', approved: true });
+            expect(res.status).toBe(400);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+            expect(res.body.error).toContain('Token expired');
+        });
+        it('returns 400 with default message when processApproval fails without error', async () => {
+            jest.spyOn(gateway, 'processApproval').mockResolvedValueOnce({
+                success: false,
+            });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approval_token: 'bad-token' });
+            expect(res.status).toBe(400);
+            expect(res.body.error).toContain('Approval processing failed');
+        });
+        it('returns 500 when processApproval throws', async () => {
+            jest.spyOn(gateway, 'processApproval').mockRejectedValueOnce(new Error('internal failure'));
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approval_token: 'crash-token' });
+            expect(res.status).toBe(500);
+            expect(res.body.error_code).toBe('INTERNAL_ERROR');
+        });
+        it('returns 500 when processApproval throws non-Error', async () => {
+            jest.spyOn(gateway, 'processApproval').mockRejectedValueOnce('string crash');
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approval_token: 'crash-token' });
+            expect(res.status).toBe(500);
+            expect(res.body.error_code).toBe('INTERNAL_ERROR');
+        });
+        it('uses approved=true when approved field is omitted (defaults to approved !== false)', async () => {
+            const spy = jest.spyOn(gateway, 'processApproval').mockResolvedValueOnce({ success: true });
+            await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({ approval_token: 'token-no-approved-field' });
+            // approved !== false should be true when approved is undefined
+            expect(spy).toHaveBeenCalledWith('token-no-approved-field', expect.any(String), true, undefined, undefined);
+        });
+    });
+    // =========================================================================
+    // 7. POST /v1/usage/report
+    // =========================================================================
+    describe('POST /v1/usage/report', () => {
+        it('returns 400 when tool_call_id is missing', async () => {
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/usage/report')
+                .send({ task_id: 'task-001' });
+            expect(res.status).toBe(400);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+            expect(res.body.error).toContain('tool_call_id');
+        });
+        it('returns 400 when task_id is missing', async () => {
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/usage/report')
+                .send({ tool_call_id: 'tc-001' });
+            expect(res.status).toBe(400);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+        });
+        it('returns 400 when both tool_call_id and task_id are missing', async () => {
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/usage/report')
+                .send({});
+            expect(res.status).toBe(400);
+        });
+        it('returns { status: "ok" } on successful usage report', async () => {
+            jest.spyOn(gateway, 'reportUsage').mockImplementation(() => { });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/usage/report')
+                .send({
+                tool_call_id: 'tc-001',
+                task_id: 'task-001',
+                actual_cost_usd: 0.05,
+                usage: { input_tokens: 100, output_tokens: 50 },
+            });
+            expect(res.status).toBe(200);
+            expect(res.body.status).toBe('ok');
+        });
+        it('returns 500 when reportUsage throws an Error', async () => {
+            jest.spyOn(gateway, 'reportUsage').mockImplementation(() => {
+                throw new Error('storage failure');
+            });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/usage/report')
+                .send({ tool_call_id: 'tc-001', task_id: 'task-001' });
+            expect(res.status).toBe(500);
+            expect(res.body.error_code).toBe('INTERNAL_ERROR');
+        });
+        it('returns 500 when reportUsage throws a non-Error', async () => {
+            jest.spyOn(gateway, 'reportUsage').mockImplementation(() => {
+                throw 'string error';
+            });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/usage/report')
+                .send({ tool_call_id: 'tc-001', task_id: 'task-001' });
+            expect(res.status).toBe(500);
+            expect(res.body.error_code).toBe('INTERNAL_ERROR');
+        });
+    });
+    // =========================================================================
+    // 8. Error handler
+    // =========================================================================
+    describe('Global error handler', () => {
+        it('returns 400 with VALIDATION_FAILED for invalid JSON body', async () => {
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .set('Content-Type', 'application/json')
+                .send('{ invalid json }');
+            expect(res.status).toBe(400);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+            expect(res.body.error).toContain('Invalid JSON');
+        });
+        it('returns 413 for body too large', async () => {
+            // The express.json() limit is 10MB; send > 10MB
+            const largeBody = 'x'.repeat(11 * 1024 * 1024);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .set('Content-Type', 'application/json')
+                .send(largeBody);
+            expect(res.status).toBe(413);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+            expect(res.body.error).toContain('too large');
+        });
+    });
+    // =========================================================================
+    // 9. IP rate limiter
+    // =========================================================================
+    describe('IP rate limiter', () => {
+        it('allows requests within limit', async () => {
+            // Use a very tight rate limit
+            const limitedResult = (0, app_1.createApp)(testConfig({
+                public_rate_limit: { max_per_window: 5, window_ms: 60000 },
+            }));
+            const res = await (0, supertest_1.default)(limitedResult.app).get('/health');
+            expect(res.status).toBe(200);
+            await limitedResult.gateway.shutdown();
+        });
+        it('returns 429 when exceeding the rate limit', async () => {
+            const limitedResult = (0, app_1.createApp)(testConfig({
+                public_rate_limit: { max_per_window: 2, window_ms: 60000 },
+            }));
+            // Make requests up to the limit
+            await (0, supertest_1.default)(limitedResult.app).get('/health');
+            await (0, supertest_1.default)(limitedResult.app).get('/health');
+            // Third request should be blocked
+            const res = await (0, supertest_1.default)(limitedResult.app).get('/health');
+            expect(res.status).toBe(429);
+            expect(res.body.error_code).toBe('RATE_LIMIT_EXCEEDED');
+            expect(res.body.details).toHaveProperty('retry_after_ms');
+            await limitedResult.gateway.shutdown();
+        });
+    });
+    // =========================================================================
+    // Additional route coverage
+    // =========================================================================
+    describe('POST /v1/tool/execute - validation', () => {
+        it('returns 400 for missing required fields', async () => {
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send({ tool_call_id: 'tc-bad' });
+            expect(res.status).toBe(400);
+            expect(res.body.error_code).toBe('VALIDATION_FAILED');
+        });
+    });
+    describe('POST /v1/tool/execute - status fallback to 500', () => {
+        it('returns 500 for an unknown result status', async () => {
+            const mockResult = {
+                tool_call_id: 'tc-000001',
+                task_id: 'task-001',
+                status: 'error',
+                policy: { decision: 'allow', reasons: [] },
+                dlp: { detected: [], redactions: [], severity: 'low' },
+                budget: { estimated_cost_usd: 0, spent_cost_usd_task: 0, remaining_cost_usd_task: 100 },
+                timing: { started_at: new Date().toISOString(), duration_ms: 10 },
+            };
+            jest.spyOn(gateway, 'execute').mockResolvedValueOnce(mockResult);
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/execute')
+                .send(validToolCall());
+            expect(res.status).toBe(500);
+        });
+    });
+    describe('POST /v1/tool/approve - denial flow', () => {
+        it('handles explicit denied approval (approved=false)', async () => {
+            const spy = jest.spyOn(gateway, 'processApproval').mockResolvedValueOnce({ success: true });
+            const res = await (0, supertest_1.default)(app)
+                .post('/v1/tool/approve')
+                .send({
+                approval_token: 'deny-token',
+                approved: false,
+                reason: 'Not needed',
+            });
+            expect(res.status).toBe(200);
+            expect(spy).toHaveBeenCalledWith('deny-token', expect.any(String), false, 'Not needed', undefined);
+        });
+    });
+});
+//# sourceMappingURL=app-routes.test.js.map