* test(web): audit branch-coverage outliers, raise per-file gate to 70 (#1271) The web per-file coverage gate had drifted red: the recently-landed EMA auth feature (core/auth/ema/*) and ClientSettings components shipped undertested, and the prior 50% branch floor let business-logic branches go untested. CI does not run the coverage gate, so this accumulated. Add tests to bring every failing file above the gate and push branch coverage well past 70 across the board, then raise the per-file branches threshold 50 -> 70 in clients/web/vite.config.ts. - EMA core (emaFlow, resourceContext, jwt, wire): 50-88% -> 86-100% branch - EMA OIDC/transport (idpOidc, tokenEndpoint, transportProvider): -> 97-100% - oauthManager / discovery: 73-83% -> 88-92% - ClientSettingsModal/Form, ConnectionInfoContent: 0-88% -> 96-100% - useClientSettingsDraft / useEmaIdpLoginState hooks: 20% -> 100% - TaskStatusBadge / SortableServerCard outliers: 50% -> 100% Coverable branches reached by mocking useComputedColorScheme (dark theme), dnd-kit useSortable (isDragging), and fetch/OIDC paths. Remaining sub-100 branches are genuinely-unreachable defensive guards or happy-dom-inherent (portal / useMediaQuery / typeof window) and documented in test comments. No source files changed. Global web branch coverage 88.73% -> 90.63%. AGENTS.md updated; cli/tui/launcher stay at 50 (out of scope). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test: raise per-file coverage gate to 90/90/90/90 across all clients Follows the #1271 web branch-coverage audit (50 -> 70) by raising the whole per-file gate to >=90 on all four dimensions — lines, statements, functions, branches — for web, cli, tui, and launcher (core/ is measured under the web suite). A codebase-wide audit added real tests for every outlier and brought global coverage up across the board. Config: all four vitest/vite coverage configs set to 90/90/90/90. Two pure-type modules (core/mcp/import/types.ts, clients/web/server/ types.ts) added to the web coverage exclude list, matching the existing type-only exclusions. Tests: ~50 test files extended/created across core (auth, ema, mcp, remote, state, storage, react), web components/screens/server, and the cli/tui clients. Highlights: full EMA OAuth flow + transport coverage, inspectorClient/remote server backfill, every Mantine control's handler branches, and the cli unsupported-method / argv-fallback paths. Genuinely-unreachable branches are annotated at the source with justified `/* v8 ignore -- <reason> */` comments rather than lowering the gate: happy-dom-inherent paths (Mantine portal, useMediaQuery, typeof window SSR guards), React StrictMode effect replay, and provably-dead defensive guards (?? fallbacks the types make impossible, Select.onChange values outside the allowed list). No runtime logic changed; the only structural edits are two behavior-preserving refactors (ResourceTemplatePanel hoists the field value to a local so the ignore applies in JSX; ToolsScreen swaps a ternary for an if) and prettier line-wrapping. Also fixed a flaky real-timer debounce assertion in PromptArgumentsForm (asserted an exact sibling-typing interleaving that raced the 300ms debounce; now asserts the load-bearing fact — a non-empty fire-time sibling capture). AGENTS.md updated to describe the uniform 90 gate and the v8-ignore policy. All four client coverage gates, root validate, storybook (370), and smoke pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(web): make connect-crash SSE reader stop on the terminal event `readSseEvents` looped until the server closed the stream (`done`). The server closes the events stream immediately after writing the terminal `transport_error`, but under the heavy parallel scheduler pressure of a full `coverage` run (v8 instrumentation across all workers) that close can lag far enough behind the event to trip the 30s test timeout — a hang, not a wrong result. This made the test intermittently fail under `npm run coverage` (it passed in isolation and under CI's lighter `test:integration`). Stop reading as soon as the terminal `transport_error` event arrives (cancelling the reader) instead of waiting only for `done`. That event is always the last one the session queue emits, so nothing is lost, and the test no longer depends on stream-close timing. The `done` break is kept for any stream that closes first. Verified green across two consecutive full `npm run test:coverage` runs (3094 tests) where it previously hung, plus isolation (~0.5s). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Cliff Hall
GitHub
parent
d04a7fb9c8
commit
c96db0402e
4 changed files with 8793 additions and 63 deletions
|
|
@ -46,43 +46,62 @@ interface ParsedSseEvent {
|
|||
}
|
||||
|
||||
/**
|
||||
* Read a streaming Response body and parse Server-Sent Events. Stops when
|
||||
* the server closes the stream (read returns done).
|
||||
* Read a streaming Response body and parse Server-Sent Events. Stops as soon
|
||||
* as the terminal `stopAtType` event arrives (default `transport_error`),
|
||||
* cancelling the reader — or when the server closes the stream (`done`).
|
||||
*
|
||||
* We stop on the terminal event rather than waiting only for `done` because
|
||||
* the server closes the stream immediately *after* writing `transport_error`,
|
||||
* and under heavy parallel scheduler pressure (a full `coverage` run with v8
|
||||
* instrumentation across all workers) that close can lag far enough behind the
|
||||
* event to trip the 30s test timeout — a hang, not a wrong result. Bailing on
|
||||
* the terminal event keeps the test fast and deterministic regardless of load;
|
||||
* `transport_error` is always the last event the queue emits, so nothing is
|
||||
* lost. The `done` break still covers any stream that closes first.
|
||||
*
|
||||
* The SSE `data:` field carries the full SessionEvent JSON (both `type` and
|
||||
* `data`), per the writer in /api/mcp/events — we unwrap and surface just
|
||||
* the inner `.data` as the event payload, so callers can read e.g.
|
||||
* `event.data.message` for stdio_log without an extra hop.
|
||||
*/
|
||||
async function readSseEvents(res: Response): Promise<ParsedSseEvent[]> {
|
||||
async function readSseEvents(
|
||||
res: Response,
|
||||
stopAtType = "transport_error",
|
||||
): Promise<ParsedSseEvent[]> {
|
||||
if (!res.body) return [];
|
||||
const reader = res.body.getReader();
|
||||
const decoder = new TextDecoder();
|
||||
let buffer = "";
|
||||
const events: ParsedSseEvent[] = [];
|
||||
|
||||
while (true) {
|
||||
const { value, done } = await reader.read();
|
||||
if (value) buffer += decoder.decode(value, { stream: true });
|
||||
// SSE events terminate with a blank line — split on it.
|
||||
let split: number;
|
||||
while ((split = buffer.indexOf("\n\n")) !== -1) {
|
||||
const block = buffer.slice(0, split);
|
||||
buffer = buffer.slice(split + 2);
|
||||
let type: string | undefined;
|
||||
let dataLine: string | undefined;
|
||||
for (const line of block.split("\n")) {
|
||||
if (line.startsWith("event:"))
|
||||
type = line.slice("event:".length).trim();
|
||||
else if (line.startsWith("data:"))
|
||||
dataLine = line.slice("data:".length).trim();
|
||||
}
|
||||
if (type && dataLine) {
|
||||
const parsed = JSON.parse(dataLine) as { data?: unknown };
|
||||
events.push({ type, data: parsed.data });
|
||||
try {
|
||||
while (true) {
|
||||
const { value, done } = await reader.read();
|
||||
if (value) buffer += decoder.decode(value, { stream: true });
|
||||
// SSE events terminate with a blank line — split on it.
|
||||
let split: number;
|
||||
let sawTerminal = false;
|
||||
while ((split = buffer.indexOf("\n\n")) !== -1) {
|
||||
const block = buffer.slice(0, split);
|
||||
buffer = buffer.slice(split + 2);
|
||||
let type: string | undefined;
|
||||
let dataLine: string | undefined;
|
||||
for (const line of block.split("\n")) {
|
||||
if (line.startsWith("event:"))
|
||||
type = line.slice("event:".length).trim();
|
||||
else if (line.startsWith("data:"))
|
||||
dataLine = line.slice("data:".length).trim();
|
||||
}
|
||||
if (type && dataLine) {
|
||||
const parsed = JSON.parse(dataLine) as { data?: unknown };
|
||||
events.push({ type, data: parsed.data });
|
||||
if (type === stopAtType) sawTerminal = true;
|
||||
}
|
||||
}
|
||||
if (sawTerminal || done) break;
|
||||
}
|
||||
if (done) break;
|
||||
} finally {
|
||||
await reader.cancel().catch(() => {});
|
||||
}
|
||||
return events;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6,8 +6,23 @@
|
|||
* no network) so the integration runner is comfortable for it.
|
||||
*/
|
||||
|
||||
import { describe, it, expect } from "vitest";
|
||||
import { describe, it, expect, vi } from "vitest";
|
||||
import type { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
|
||||
import { RemoteSession } from "@inspector/core/mcp/remote/node/remote-session.js";
|
||||
import type { FetchRequestEntryBase } from "@inspector/core/mcp/types.js";
|
||||
|
||||
function makeFetchEntry(
|
||||
overrides: Partial<FetchRequestEntryBase> = {},
|
||||
): FetchRequestEntryBase {
|
||||
return {
|
||||
id: "req-1",
|
||||
timestamp: new Date("2026-01-01T00:00:00Z"),
|
||||
method: "GET",
|
||||
url: "http://example.com/",
|
||||
requestHeaders: {},
|
||||
...overrides,
|
||||
};
|
||||
}
|
||||
|
||||
describe("RemoteSession", () => {
|
||||
it("queues events before a consumer attaches and drains them on attach", () => {
|
||||
|
|
@ -75,4 +90,87 @@ describe("RemoteSession", () => {
|
|||
session.markTransportDead("boom");
|
||||
expect(session.clearEventConsumer()).toBe(true);
|
||||
});
|
||||
|
||||
it("flushes a non-empty queue in order on consumer attach", () => {
|
||||
const session = new RemoteSession("s6");
|
||||
session.onStderr({ timestamp: new Date(), message: "first" });
|
||||
session.onMessage({ jsonrpc: "2.0", id: 1, method: "ping" });
|
||||
session.onFetchResponseBody("req-1", "body");
|
||||
const received: string[] = [];
|
||||
session.setEventConsumer((event) => received.push(event.type));
|
||||
expect(received).toEqual([
|
||||
"stdio_log",
|
||||
"message",
|
||||
"fetch_request_body_update",
|
||||
]);
|
||||
});
|
||||
|
||||
it("setEventConsumer with an empty queue flushes nothing", () => {
|
||||
const session = new RemoteSession("s7");
|
||||
const consumer = vi.fn();
|
||||
session.setEventConsumer(consumer);
|
||||
expect(consumer).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("setTransport stores the transport", () => {
|
||||
const session = new RemoteSession("s8");
|
||||
const transport = { foo: "bar" } as unknown as Transport;
|
||||
session.setTransport(transport);
|
||||
expect(session.transport).toBe(transport);
|
||||
});
|
||||
|
||||
it("hasEventConsumer reflects whether a consumer is attached", () => {
|
||||
const session = new RemoteSession("s9");
|
||||
expect(session.hasEventConsumer()).toBe(false);
|
||||
session.setEventConsumer(() => {});
|
||||
expect(session.hasEventConsumer()).toBe(true);
|
||||
});
|
||||
|
||||
it("delivers events live to an attached consumer (pushEvent direct path)", () => {
|
||||
const session = new RemoteSession("s10");
|
||||
const received: { type: string; data: unknown }[] = [];
|
||||
session.setEventConsumer((event) =>
|
||||
received.push({ type: event.type, data: event.data }),
|
||||
);
|
||||
session.onMessage({ jsonrpc: "2.0", id: 1, result: {} });
|
||||
session.onFetchResponseBody("req-1", "the-body");
|
||||
expect(received.map((e) => e.type)).toEqual([
|
||||
"message",
|
||||
"fetch_request_body_update",
|
||||
]);
|
||||
expect(received[1]?.data).toEqual({
|
||||
id: "req-1",
|
||||
responseBody: "the-body",
|
||||
});
|
||||
});
|
||||
|
||||
it("onFetchRequest serializes a Date timestamp to an ISO string", () => {
|
||||
const session = new RemoteSession("s11");
|
||||
const received: { type: string; data: unknown }[] = [];
|
||||
session.setEventConsumer((event) =>
|
||||
received.push({ type: event.type, data: event.data }),
|
||||
);
|
||||
session.onFetchRequest(
|
||||
makeFetchEntry({ timestamp: new Date("2026-01-01T00:00:00Z") }),
|
||||
);
|
||||
expect(received[0]?.type).toBe("fetch_request");
|
||||
expect((received[0]?.data as { timestamp: string }).timestamp).toBe(
|
||||
"2026-01-01T00:00:00.000Z",
|
||||
);
|
||||
});
|
||||
|
||||
it("onFetchRequest leaves a non-Date timestamp untouched", () => {
|
||||
const session = new RemoteSession("s12");
|
||||
const received: { data: unknown }[] = [];
|
||||
session.setEventConsumer((event) => received.push({ data: event.data }));
|
||||
// A pre-serialized (string) timestamp exercises the ternary's else branch.
|
||||
session.onFetchRequest(
|
||||
makeFetchEntry({
|
||||
timestamp: "2026-01-01T00:00:00.000Z" as unknown as Date,
|
||||
}),
|
||||
);
|
||||
expect((received[0]?.data as { timestamp: string }).timestamp).toBe(
|
||||
"2026-01-01T00:00:00.000Z",
|
||||
);
|
||||
});
|
||||
});
|
||||
|
|
|
|||
|
|
@ -0,0 +1,611 @@
|
|||
/**
|
||||
* Focused unit tests for RemoteClientTransport that drive the error and
|
||||
* SSE-parsing branches that the full e2e remote-server harness does not
|
||||
* reliably reach (connect/events/send non-OK responses, missing sessionId,
|
||||
* missing event-stream body, transport_error events, malformed SSE JSON,
|
||||
* stream read errors, and the SSE final-buffer flush path).
|
||||
*
|
||||
* These use a hand-built mock `fetchFn` plus a controllable SSE
|
||||
* ReadableStream rather than a real Hono backend so each branch can be
|
||||
* exercised deterministically.
|
||||
*/
|
||||
|
||||
import { describe, it, expect, vi } from "vitest";
|
||||
import { RemoteClientTransport } from "@inspector/core/mcp/remote/remoteClientTransport.js";
|
||||
import type { RemoteTransportOptions } from "@inspector/core/mcp/remote/remoteClientTransport.js";
|
||||
import type { MCPServerConfig } from "@inspector/core/mcp/types.js";
|
||||
import type { RemoteEvent } from "@inspector/core/mcp/remote/types.js";
|
||||
import type { JSONRPCMessage } from "@modelcontextprotocol/sdk/types.js";
|
||||
|
||||
const CONFIG: MCPServerConfig = {
|
||||
type: "sse",
|
||||
url: "http://upstream.test/sse",
|
||||
};
|
||||
|
||||
/** Build a JSON Response. */
|
||||
function jsonResponse(body: unknown, init?: ResponseInit): Response {
|
||||
return new Response(JSON.stringify(body), {
|
||||
status: 200,
|
||||
headers: { "Content-Type": "application/json" },
|
||||
...init,
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Build an SSE Response whose body streams the supplied chunks (raw strings).
|
||||
* The returned `pushDone` flag is implicit: chunks are enqueued immediately
|
||||
* and the stream then closes.
|
||||
*/
|
||||
function sseResponse(chunks: string[], init?: ResponseInit): Response {
|
||||
const encoder = new TextEncoder();
|
||||
const stream = new ReadableStream<Uint8Array>({
|
||||
start(controller) {
|
||||
for (const c of chunks) controller.enqueue(encoder.encode(c));
|
||||
controller.close();
|
||||
},
|
||||
});
|
||||
return new Response(stream, { status: 200, ...init });
|
||||
}
|
||||
|
||||
/** Encode a RemoteEvent as a single SSE `data:` frame. */
|
||||
function sseFrame(event: RemoteEvent): string {
|
||||
return `data: ${JSON.stringify(event)}\n\n`;
|
||||
}
|
||||
|
||||
interface MockFetchPlan {
|
||||
connect?: () => Response | Promise<Response>;
|
||||
events?: () => Response | Promise<Response>;
|
||||
send?: () => Response | Promise<Response>;
|
||||
disconnect?: () => Response | Promise<Response>;
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns a fetch implementation that dispatches by URL path to the plan's
|
||||
* handlers, defaulting to sensible success responses when a handler is omitted.
|
||||
*/
|
||||
function mockFetch(plan: MockFetchPlan): typeof fetch {
|
||||
const fn = vi.fn(async (input: RequestInfo | URL): Promise<Response> => {
|
||||
const url = typeof input === "string" ? input : input.toString();
|
||||
if (url.includes("/api/mcp/connect")) {
|
||||
return plan.connect
|
||||
? plan.connect()
|
||||
: jsonResponse({ sessionId: "sess-1" });
|
||||
}
|
||||
if (url.includes("/api/mcp/events")) {
|
||||
return plan.events ? plan.events() : sseResponse([]);
|
||||
}
|
||||
if (url.includes("/api/mcp/send")) {
|
||||
return plan.send ? plan.send() : jsonResponse({ ok: true });
|
||||
}
|
||||
if (url.includes("/api/mcp/disconnect")) {
|
||||
return plan.disconnect ? plan.disconnect() : jsonResponse({ ok: true });
|
||||
}
|
||||
throw new Error(`unexpected fetch to ${url}`);
|
||||
});
|
||||
return fn as unknown as typeof fetch;
|
||||
}
|
||||
|
||||
function makeTransport(
|
||||
plan: MockFetchPlan,
|
||||
extra: Partial<RemoteTransportOptions> = {},
|
||||
): RemoteClientTransport {
|
||||
return new RemoteClientTransport(
|
||||
{
|
||||
baseUrl: "http://remote.test/", // trailing slash exercises baseUrl trim
|
||||
authToken: "tok",
|
||||
fetchFn: mockFetch(plan),
|
||||
...extra,
|
||||
},
|
||||
CONFIG,
|
||||
);
|
||||
}
|
||||
|
||||
/** Wait a tick so the detached consumeEventStream loop can advance. */
|
||||
const tick = () => new Promise<void>((r) => setTimeout(r, 10));
|
||||
|
||||
describe("RemoteClientTransport (focused branch coverage)", () => {
|
||||
describe("start()", () => {
|
||||
it("throws Remote connect failed with status on non-OK connect", async () => {
|
||||
const t = makeTransport({
|
||||
connect: () =>
|
||||
new Response("nope", { status: 401, statusText: "Unauthorized" }),
|
||||
});
|
||||
await expect(t.start()).rejects.toThrow(/Remote connect failed \(401\)/);
|
||||
try {
|
||||
await t.start();
|
||||
} catch (e) {
|
||||
expect((e as { status?: number }).status).toBe(401);
|
||||
}
|
||||
});
|
||||
|
||||
it("throws when the remote returns no sessionId", async () => {
|
||||
const t = makeTransport({
|
||||
connect: () => jsonResponse({ sessionId: "" }),
|
||||
});
|
||||
await expect(t.start()).rejects.toThrow(/did not return sessionId/);
|
||||
});
|
||||
|
||||
it("throws Remote events stream failed on non-OK events response", async () => {
|
||||
const t = makeTransport({
|
||||
events: () => new Response("bad", { status: 500 }),
|
||||
});
|
||||
await expect(t.start()).rejects.toThrow(
|
||||
/Remote events stream failed \(500\)/,
|
||||
);
|
||||
});
|
||||
|
||||
it("throws when the events stream has no body", async () => {
|
||||
const t = makeTransport({
|
||||
// A 204 No Content has a null body.
|
||||
events: () => new Response(null, { status: 200 }),
|
||||
});
|
||||
await expect(t.start()).rejects.toThrow(/no body/);
|
||||
});
|
||||
|
||||
it("forwards OAuth tokens from authProvider into the connect body", async () => {
|
||||
let connectBody: unknown;
|
||||
const fetchFn = vi.fn(
|
||||
async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
const url = typeof input === "string" ? input : input.toString();
|
||||
if (url.includes("/connect")) {
|
||||
connectBody = JSON.parse(init!.body as string);
|
||||
return jsonResponse({ sessionId: "s" });
|
||||
}
|
||||
return sseResponse([]);
|
||||
},
|
||||
);
|
||||
const authProvider = {
|
||||
tokens: async () => ({
|
||||
access_token: "AT",
|
||||
token_type: "Bearer",
|
||||
expires_in: 3600,
|
||||
refresh_token: "RT",
|
||||
}),
|
||||
} as unknown as NonNullable<RemoteTransportOptions["authProvider"]>;
|
||||
const t = new RemoteClientTransport(
|
||||
{
|
||||
baseUrl: "http://remote.test",
|
||||
fetchFn: fetchFn as unknown as typeof fetch,
|
||||
authProvider,
|
||||
},
|
||||
CONFIG,
|
||||
);
|
||||
await t.start();
|
||||
expect(connectBody).toMatchObject({
|
||||
oauthTokens: { access_token: "AT", refresh_token: "RT" },
|
||||
});
|
||||
await t.close();
|
||||
});
|
||||
|
||||
it("handles an authProvider that has no tokens", async () => {
|
||||
const authProvider = {
|
||||
tokens: async () => undefined,
|
||||
} as unknown as NonNullable<RemoteTransportOptions["authProvider"]>;
|
||||
const t = makeTransport({}, { authProvider });
|
||||
await t.start();
|
||||
await t.close();
|
||||
});
|
||||
|
||||
it("start() is a no-op when already closed throws closed", async () => {
|
||||
const t = makeTransport({});
|
||||
await t.close();
|
||||
await expect(t.start()).rejects.toThrow(/Transport is closed/);
|
||||
});
|
||||
});
|
||||
|
||||
describe("consumeEventStream() event handling", () => {
|
||||
it("delivers message events to onmessage", async () => {
|
||||
const msg: JSONRPCMessage = { jsonrpc: "2.0", id: 1, result: {} };
|
||||
const t = makeTransport({
|
||||
events: () => sseResponse([sseFrame({ type: "message", data: msg })]),
|
||||
});
|
||||
const received: JSONRPCMessage[] = [];
|
||||
t.onmessage = (m) => received.push(m);
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(received).toHaveLength(1);
|
||||
expect(received[0]).toMatchObject({ id: 1 });
|
||||
});
|
||||
|
||||
it("delivers fetch_request events (string timestamp coerced to Date)", async () => {
|
||||
const ts = new Date().toISOString();
|
||||
const entry = {
|
||||
id: "f1",
|
||||
url: "http://x",
|
||||
method: "GET",
|
||||
timestamp: ts,
|
||||
};
|
||||
const onFetchRequest = vi.fn();
|
||||
const t = makeTransport(
|
||||
{
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({
|
||||
type: "fetch_request",
|
||||
data: entry as never,
|
||||
}),
|
||||
]),
|
||||
},
|
||||
{ onFetchRequest },
|
||||
);
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onFetchRequest).toHaveBeenCalledTimes(1);
|
||||
const arg = onFetchRequest.mock.calls[0]![0] as { timestamp: Date };
|
||||
expect(arg.timestamp).toBeInstanceOf(Date);
|
||||
});
|
||||
|
||||
it("delivers fetch_request events keeping a Date timestamp as-is", async () => {
|
||||
const onFetchRequest = vi.fn();
|
||||
// A numeric/Date timestamp triggers the non-string branch.
|
||||
const entry = { id: "f2", url: "u", method: "POST", timestamp: 123 };
|
||||
const t = makeTransport(
|
||||
{
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({ type: "fetch_request", data: entry as never }),
|
||||
]),
|
||||
},
|
||||
{ onFetchRequest },
|
||||
);
|
||||
await t.start();
|
||||
await tick();
|
||||
const arg = onFetchRequest.mock.calls[0]![0] as { timestamp: unknown };
|
||||
expect(arg.timestamp).toBe(123);
|
||||
});
|
||||
|
||||
it("delivers fetch_request_body_update events", async () => {
|
||||
const onFetchResponseBody = vi.fn();
|
||||
const t = makeTransport(
|
||||
{
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({
|
||||
type: "fetch_request_body_update",
|
||||
data: { id: "f1", responseBody: "BODY" },
|
||||
}),
|
||||
]),
|
||||
},
|
||||
{ onFetchResponseBody },
|
||||
);
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onFetchResponseBody).toHaveBeenCalledWith("f1", "BODY");
|
||||
});
|
||||
|
||||
it("delivers stdio_log events to onStderr", async () => {
|
||||
const onStderr = vi.fn();
|
||||
const t = makeTransport(
|
||||
{
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({
|
||||
type: "stdio_log",
|
||||
data: {
|
||||
timestamp: new Date().toISOString(),
|
||||
message: "stderr line",
|
||||
},
|
||||
}),
|
||||
]),
|
||||
},
|
||||
{ onStderr },
|
||||
);
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onStderr).toHaveBeenCalledTimes(1);
|
||||
expect(onStderr.mock.calls[0]![0].message).toBe("stderr line");
|
||||
});
|
||||
|
||||
it("handles transport_error events: onerror + onclose, with code", async () => {
|
||||
const onerror = vi.fn();
|
||||
const onclose = vi.fn();
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({
|
||||
type: "transport_error",
|
||||
data: { error: "boom", code: 1006 },
|
||||
}),
|
||||
]),
|
||||
});
|
||||
t.onerror = onerror;
|
||||
t.onclose = onclose;
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onerror).toHaveBeenCalledTimes(1);
|
||||
const err = onerror.mock.calls[0]![0] as {
|
||||
message: string;
|
||||
code?: number;
|
||||
};
|
||||
expect(err.message).toBe("boom");
|
||||
expect(err.code).toBe(1006);
|
||||
expect(onclose).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("handles transport_error events without a code", async () => {
|
||||
const onerror = vi.fn();
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({ type: "transport_error", data: { error: "no-code" } }),
|
||||
]),
|
||||
});
|
||||
t.onerror = onerror;
|
||||
await t.start();
|
||||
await tick();
|
||||
const err = onerror.mock.calls[0]![0] as { code?: number };
|
||||
expect(err.code).toBeUndefined();
|
||||
});
|
||||
|
||||
it("reports malformed SSE JSON via onerror but keeps consuming", async () => {
|
||||
const onerror = vi.fn();
|
||||
const msg: JSONRPCMessage = { jsonrpc: "2.0", id: 7, result: {} };
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
// First frame is invalid JSON (parse error), second is a valid message.
|
||||
sseResponse([
|
||||
`data: {not json}\n\n`,
|
||||
sseFrame({ type: "message", data: msg }),
|
||||
]),
|
||||
});
|
||||
const received: JSONRPCMessage[] = [];
|
||||
t.onerror = onerror;
|
||||
t.onmessage = (m) => received.push(m);
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onerror).toHaveBeenCalled();
|
||||
// Consumption continued: the valid message after the bad frame arrived.
|
||||
expect(received).toHaveLength(1);
|
||||
});
|
||||
|
||||
it("flushes a trailing SSE frame with no terminating blank line", async () => {
|
||||
const msg: JSONRPCMessage = { jsonrpc: "2.0", id: 9, result: {} };
|
||||
// No trailing \n\n — exercises the post-loop buffer-flush path in parseSSE.
|
||||
const frame = `event: message\ndata: ${JSON.stringify({
|
||||
type: "message",
|
||||
data: msg,
|
||||
})}`;
|
||||
const t = makeTransport({
|
||||
events: () => sseResponse([frame]),
|
||||
});
|
||||
const received: JSONRPCMessage[] = [];
|
||||
t.onmessage = (m) => received.push(m);
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(received).toHaveLength(1);
|
||||
expect(received[0]).toMatchObject({ id: 9 });
|
||||
});
|
||||
|
||||
it("handles a trailing buffer whose final unterminated line is an event:", async () => {
|
||||
// The stream ends mid-frame on an `event:` line (no terminating blank
|
||||
// line and no data), exercising the event-line branch of parseSSE's
|
||||
// post-loop buffer flush. Nothing is yielded (no data), but the branch
|
||||
// runs without error.
|
||||
const onmessage = vi.fn();
|
||||
const t = makeTransport({
|
||||
events: () => sseResponse([`data: ignored\n\nevent: trailing`]),
|
||||
});
|
||||
t.onmessage = onmessage;
|
||||
await t.start();
|
||||
await tick();
|
||||
// event-only trailing frame yields nothing
|
||||
expect(onmessage).not.toHaveBeenCalled();
|
||||
});
|
||||
|
||||
it("stops delivering once the transport is closed mid-stream", async () => {
|
||||
// Two frames arrive; closing the transport from the first onmessage
|
||||
// handler makes the `if (this.closed) break` guard fire before the
|
||||
// second frame is delivered.
|
||||
const m1: JSONRPCMessage = { jsonrpc: "2.0", id: 1, result: {} };
|
||||
const m2: JSONRPCMessage = { jsonrpc: "2.0", id: 2, result: {} };
|
||||
const received: JSONRPCMessage[] = [];
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({ type: "message", data: m1 }),
|
||||
sseFrame({ type: "message", data: m2 }),
|
||||
]),
|
||||
});
|
||||
t.onmessage = (m) => {
|
||||
received.push(m);
|
||||
// Close after the first message; the loop's closed-check breaks before
|
||||
// the second frame is processed.
|
||||
void t.close();
|
||||
};
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(received).toHaveLength(1);
|
||||
expect(received[0]).toMatchObject({ id: 1 });
|
||||
});
|
||||
|
||||
it("coerces a non-Error thrown during event processing into an Error", async () => {
|
||||
// onmessage throws a string (not an Error); the per-frame catch coerces
|
||||
// it via `err instanceof Error ? err : new Error(String(err))`.
|
||||
const onerror = vi.fn();
|
||||
const m: JSONRPCMessage = { jsonrpc: "2.0", id: 3, result: {} };
|
||||
const t = makeTransport({
|
||||
events: () => sseResponse([sseFrame({ type: "message", data: m })]),
|
||||
});
|
||||
t.onmessage = () => {
|
||||
throw "string failure";
|
||||
};
|
||||
t.onerror = onerror;
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onerror).toHaveBeenCalled();
|
||||
const err = onerror.mock.calls[0]![0] as Error;
|
||||
expect(err).toBeInstanceOf(Error);
|
||||
expect(err.message).toBe("string failure");
|
||||
});
|
||||
|
||||
it("reports a stream read error via onerror (non-abort)", async () => {
|
||||
const onerror = vi.fn();
|
||||
const onclose = vi.fn();
|
||||
const stream = new ReadableStream<Uint8Array>({
|
||||
start(controller) {
|
||||
controller.error(new Error("stream blew up"));
|
||||
},
|
||||
});
|
||||
const t = makeTransport({
|
||||
events: () => new Response(stream, { status: 200 }),
|
||||
});
|
||||
t.onerror = onerror;
|
||||
t.onclose = onclose;
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onerror).toHaveBeenCalled();
|
||||
expect(onerror.mock.calls[0]![0].message).toMatch(/stream blew up/);
|
||||
// finally{} closes the transport.
|
||||
expect(onclose).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("closes via finally when the stream ends without error", async () => {
|
||||
const onclose = vi.fn();
|
||||
const t = makeTransport({ events: () => sseResponse([]) });
|
||||
t.onclose = onclose;
|
||||
await t.start();
|
||||
await tick();
|
||||
expect(onclose).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
});
|
||||
|
||||
describe("send()", () => {
|
||||
it("throws when not started", async () => {
|
||||
const t = makeTransport({});
|
||||
await expect(
|
||||
t.send({ jsonrpc: "2.0", id: 1, method: "ping" }),
|
||||
).rejects.toThrow(/not started/);
|
||||
});
|
||||
|
||||
it("throws closed when send() runs after a transport_error closed it", async () => {
|
||||
// close() clears _sessionId so send() would hit the "not started" guard
|
||||
// first. The transport_error event path sets closed=true while LEAVING
|
||||
// _sessionId populated, which is the only way to reach send()'s
|
||||
// "Transport is closed" guard.
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
sseResponse([
|
||||
sseFrame({ type: "transport_error", data: { error: "died" } }),
|
||||
]),
|
||||
});
|
||||
await t.start();
|
||||
await tick();
|
||||
await expect(
|
||||
t.send({ jsonrpc: "2.0", id: 1, method: "ping" }),
|
||||
).rejects.toThrow(/Transport is closed/);
|
||||
});
|
||||
|
||||
it("posts a message including relatedRequestId and succeeds", async () => {
|
||||
let sentBody: { relatedRequestId?: unknown } | undefined;
|
||||
const fetchFn = vi.fn(
|
||||
async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
const url = typeof input === "string" ? input : input.toString();
|
||||
if (url.includes("/connect")) return jsonResponse({ sessionId: "s" });
|
||||
if (url.includes("/events"))
|
||||
return new Response(
|
||||
new ReadableStream<Uint8Array>({ start() {} }),
|
||||
{ status: 200 },
|
||||
);
|
||||
if (url.includes("/send")) {
|
||||
sentBody = JSON.parse(init!.body as string);
|
||||
return jsonResponse({ ok: true });
|
||||
}
|
||||
return jsonResponse({ ok: true });
|
||||
},
|
||||
);
|
||||
const t = new RemoteClientTransport(
|
||||
{
|
||||
baseUrl: "http://remote.test",
|
||||
fetchFn: fetchFn as unknown as typeof fetch,
|
||||
},
|
||||
CONFIG,
|
||||
);
|
||||
await t.start();
|
||||
await t.send(
|
||||
{ jsonrpc: "2.0", id: 5, method: "ping" },
|
||||
{ relatedRequestId: 42 },
|
||||
);
|
||||
expect(sentBody?.relatedRequestId).toBe(42);
|
||||
await t.close();
|
||||
});
|
||||
|
||||
it("throws Remote send failed with status on non-OK send", async () => {
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
new Response(new ReadableStream<Uint8Array>({ start() {} }), {
|
||||
status: 200,
|
||||
}),
|
||||
send: () => new Response("err", { status: 503 }),
|
||||
});
|
||||
await t.start();
|
||||
try {
|
||||
await t.send({ jsonrpc: "2.0", id: 1, method: "ping" });
|
||||
throw new Error("expected send to throw");
|
||||
} catch (e) {
|
||||
expect((e as Error).message).toMatch(/Remote send failed \(503\)/);
|
||||
expect((e as { status?: number }).status).toBe(503);
|
||||
}
|
||||
await t.close();
|
||||
});
|
||||
});
|
||||
|
||||
describe("close()", () => {
|
||||
it("is idempotent and swallows disconnect errors", async () => {
|
||||
const onclose = vi.fn();
|
||||
const t = makeTransport({
|
||||
events: () =>
|
||||
new Response(new ReadableStream<Uint8Array>({ start() {} }), {
|
||||
status: 200,
|
||||
}),
|
||||
disconnect: () => {
|
||||
throw new Error("disconnect failed");
|
||||
},
|
||||
});
|
||||
t.onclose = onclose;
|
||||
await t.start();
|
||||
await t.close(); // disconnect throws but is swallowed; onclose fires
|
||||
await t.close(); // second close is a no-op (early return)
|
||||
expect(onclose).toHaveBeenCalledTimes(1);
|
||||
});
|
||||
|
||||
it("close() before start() returns early without calling disconnect", async () => {
|
||||
const disconnect = vi.fn(() => jsonResponse({ ok: true }));
|
||||
const t = makeTransport({ disconnect });
|
||||
await t.close();
|
||||
// No sessionId yet → disconnect branch is skipped, but onclose still fires.
|
||||
expect(disconnect).not.toHaveBeenCalled();
|
||||
});
|
||||
});
|
||||
|
||||
describe("sessionId getter", () => {
|
||||
it("always returns undefined (intentional)", () => {
|
||||
const t = makeTransport({});
|
||||
expect(t.sessionId).toBeUndefined();
|
||||
});
|
||||
});
|
||||
|
||||
describe("headers/fetchFn defaults", () => {
|
||||
it("omits auth header when no authToken is configured", async () => {
|
||||
const seen: Array<Record<string, string>> = [];
|
||||
const fetchFn = vi.fn(
|
||||
async (input: RequestInfo | URL, init?: RequestInit) => {
|
||||
const url = typeof input === "string" ? input : input.toString();
|
||||
seen.push((init?.headers as Record<string, string>) ?? {});
|
||||
if (url.includes("/connect")) return jsonResponse({ sessionId: "s" });
|
||||
return sseResponse([]);
|
||||
},
|
||||
);
|
||||
const t = new RemoteClientTransport(
|
||||
{
|
||||
baseUrl: "http://remote.test",
|
||||
fetchFn: fetchFn as unknown as typeof fetch,
|
||||
},
|
||||
CONFIG,
|
||||
);
|
||||
await t.start();
|
||||
await t.close();
|
||||
// connect headers should not include the auth header
|
||||
expect(seen[0]!["x-mcp-remote-auth"]).toBeUndefined();
|
||||
});
|
||||
});
|
||||
});
|
||||
|
|
@ -0,0 +1,791 @@
|
|||
/**
|
||||
* Supplemental coverage for createRemoteApp (core/mcp/remote/node/server.ts).
|
||||
*
|
||||
* Targets the remaining uncovered branches the broader suites don't exercise:
|
||||
* - forwardLogEvent message/binding shape variants (/api/log)
|
||||
* - validateSettings per-field rejection branches
|
||||
* - /api/fetch headers / streaming content-type / network-error paths
|
||||
* - normalizeMcpServers malformed-field drops, on both the logger and the
|
||||
* console.warn fallback path
|
||||
* - generic (non-keychain) 500 catch on POST / PUT / DELETE / order
|
||||
* - keychain-unavailable migration with a logger (fileLogger.warn branch)
|
||||
* - GET fast-path re-check when a concurrent write removed the plaintext
|
||||
*/
|
||||
|
||||
import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
|
||||
import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { serve } from "@hono/node-server";
|
||||
import type { ServerType } from "@hono/node-server";
|
||||
import type pinoType from "pino";
|
||||
import { createRemoteApp } from "@inspector/core/mcp/remote/node/server.js";
|
||||
import {
|
||||
InMemorySecretStore,
|
||||
KeychainUnavailableError,
|
||||
type SecretStore,
|
||||
} from "@inspector/core/auth/node/secret-store.js";
|
||||
|
||||
interface Harness {
|
||||
baseUrl: string;
|
||||
server: ServerType;
|
||||
configPath: string;
|
||||
tempDir: string;
|
||||
}
|
||||
|
||||
interface StartOpts {
|
||||
secretStore?: SecretStore;
|
||||
logger?: pinoType.Logger;
|
||||
seedConfig?: string;
|
||||
}
|
||||
|
||||
async function start(opts: StartOpts = {}): Promise<Harness> {
|
||||
const tempDir = mkdtempSync(join(tmpdir(), "inspector-server-extra-"));
|
||||
const configPath = join(tempDir, "mcp.json");
|
||||
if (opts.seedConfig !== undefined) {
|
||||
writeFileSync(configPath, opts.seedConfig);
|
||||
}
|
||||
const { app } = createRemoteApp({
|
||||
dangerouslyOmitAuth: true,
|
||||
mcpConfigPath: configPath,
|
||||
initialConfig: { defaultEnvironment: {} },
|
||||
secretStore: opts.secretStore ?? new InMemorySecretStore(),
|
||||
logger: opts.logger,
|
||||
});
|
||||
const { baseUrl, server } = await new Promise<{
|
||||
baseUrl: string;
|
||||
server: ServerType;
|
||||
}>((resolve, reject) => {
|
||||
const s = serve(
|
||||
{ fetch: app.fetch, port: 0, hostname: "127.0.0.1" },
|
||||
(info) => {
|
||||
const port =
|
||||
info && typeof info === "object" && "port" in info
|
||||
? (info as { port: number }).port
|
||||
: 0;
|
||||
resolve({ baseUrl: `http://127.0.0.1:${port}`, server: s });
|
||||
},
|
||||
);
|
||||
s.on("error", reject);
|
||||
});
|
||||
return { baseUrl, server, configPath, tempDir };
|
||||
}
|
||||
|
||||
async function stop(h: Harness): Promise<void> {
|
||||
await new Promise<void>((r) => h.server.close(() => r()));
|
||||
try {
|
||||
rmSync(h.tempDir, { recursive: true });
|
||||
} catch {
|
||||
/* ignore */
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Minimal in-memory pino-shaped logger that captures forwarded records so a
|
||||
* test can assert which level/object/message the server emitted.
|
||||
*/
|
||||
function makeCapturingLogger(): {
|
||||
logger: pinoType.Logger;
|
||||
records: Array<{ level: string; args: unknown[] }>;
|
||||
} {
|
||||
const records: Array<{ level: string; args: unknown[] }> = [];
|
||||
const mk =
|
||||
(level: string) =>
|
||||
(...args: unknown[]) => {
|
||||
records.push({ level, args });
|
||||
};
|
||||
// Only the methods the server reaches are needed; cast through unknown to
|
||||
// satisfy the pino.Logger surface without pulling in the full type.
|
||||
const logger = {
|
||||
info: mk("info"),
|
||||
warn: mk("warn"),
|
||||
error: mk("error"),
|
||||
debug: mk("debug"),
|
||||
trace: mk("trace"),
|
||||
fatal: mk("fatal"),
|
||||
} as unknown as pinoType.Logger;
|
||||
return { logger, records };
|
||||
}
|
||||
|
||||
describe("server.ts supplemental coverage", () => {
|
||||
describe("/api/log forwardLogEvent shapes", () => {
|
||||
let h: Harness;
|
||||
let records: Array<{ level: string; args: unknown[] }>;
|
||||
|
||||
beforeEach(async () => {
|
||||
const cap = makeCapturingLogger();
|
||||
records = cap.records;
|
||||
h = await start({ logger: cap.logger });
|
||||
});
|
||||
afterEach(async () => {
|
||||
await stop(h);
|
||||
});
|
||||
|
||||
async function postLog(body: unknown): Promise<Response> {
|
||||
return fetch(`${h.baseUrl}/api/log`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify(body),
|
||||
});
|
||||
}
|
||||
|
||||
it("forwards an event whose first message is an object (obj + msg + args)", async () => {
|
||||
const res = await postLog({
|
||||
level: { label: "warn", value: 40 },
|
||||
bindings: [{ component: "x" }, { category: "y" }],
|
||||
messages: [{ extra: 1 }, "hello", "a", "b"],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const rec = records.find((r) => r.level === "warn");
|
||||
expect(rec).toBeDefined();
|
||||
expect(rec!.args[0]).toMatchObject({
|
||||
component: "x",
|
||||
category: "y",
|
||||
extra: 1,
|
||||
});
|
||||
expect(rec!.args[1]).toBe("hello");
|
||||
expect(rec!.args.slice(2)).toEqual(["a", "b"]);
|
||||
});
|
||||
|
||||
it("forwards an event with no messages (bindings-only object)", async () => {
|
||||
const res = await postLog({
|
||||
level: { label: "info", value: 30 },
|
||||
bindings: [{ a: 1 }],
|
||||
messages: [],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const rec = records.find((r) => r.level === "info");
|
||||
expect(rec).toBeDefined();
|
||||
expect(rec!.args).toEqual([{ a: 1 }]);
|
||||
});
|
||||
|
||||
it("forwards a string-first message (bindings + msg + args)", async () => {
|
||||
const res = await postLog({
|
||||
level: { label: "info", value: 30 },
|
||||
bindings: [{ b: 2 }],
|
||||
messages: ["just a string", 1, 2],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const rec = records.find(
|
||||
(r) => r.level === "info" && r.args[1] === "just a string",
|
||||
);
|
||||
expect(rec).toBeDefined();
|
||||
expect(rec!.args[0]).toMatchObject({ b: 2 });
|
||||
expect(rec!.args.slice(2)).toEqual([1, 2]);
|
||||
});
|
||||
|
||||
it("defaults the level to info and tolerates non-array bindings/messages", async () => {
|
||||
const res = await postLog({ bindings: "nope", messages: "nope" });
|
||||
expect(res.status).toBe(200);
|
||||
const rec = records.find((r) => r.level === "info");
|
||||
expect(rec).toBeDefined();
|
||||
// bindings non-array → {} ; messages non-array → [] → bindings-only call
|
||||
expect(rec!.args).toEqual([{}]);
|
||||
});
|
||||
|
||||
it("drops an event whose level has no matching logger method", async () => {
|
||||
const res = await postLog({
|
||||
level: { label: "nonsense", value: 1 },
|
||||
messages: ["x"],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
// No record captured for an unknown level.
|
||||
expect(records.length).toBe(0);
|
||||
});
|
||||
});
|
||||
|
||||
describe("/api/log without a logger is a no-op", () => {
|
||||
it("returns 200 and swallows the event", async () => {
|
||||
const h = await start();
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/log`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ messages: ["x"] }),
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
// Invalid JSON also tolerated (catch → {}).
|
||||
const res2 = await fetch(`${h.baseUrl}/api/log`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: "not json",
|
||||
});
|
||||
expect(res2.status).toBe(200);
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("/api/fetch", () => {
|
||||
let h: Harness;
|
||||
let target: ServerType;
|
||||
let targetUrl: string;
|
||||
|
||||
beforeEach(async () => {
|
||||
h = await start();
|
||||
// A tiny upstream HTTP server we can point /api/fetch at.
|
||||
const { createServer } = await import("node:http");
|
||||
const srv = createServer((req, res) => {
|
||||
if (req.url === "/stream") {
|
||||
res.writeHead(200, { "Content-Type": "text/event-stream" });
|
||||
res.write("data: hi\n\n");
|
||||
res.end();
|
||||
return;
|
||||
}
|
||||
if (req.url === "/echo-headers") {
|
||||
res.writeHead(200, { "Content-Type": "application/json" });
|
||||
res.end(JSON.stringify({ got: req.headers["x-probe"] ?? null }));
|
||||
return;
|
||||
}
|
||||
res.writeHead(200, { "Content-Type": "text/plain" });
|
||||
res.end("plain body");
|
||||
});
|
||||
await new Promise<void>((resolve) =>
|
||||
srv.listen(0, "127.0.0.1", () => resolve()),
|
||||
);
|
||||
target = srv as unknown as ServerType;
|
||||
const addr = srv.address();
|
||||
const port = typeof addr === "object" && addr !== null ? addr.port : 0;
|
||||
targetUrl = `http://127.0.0.1:${port}`;
|
||||
});
|
||||
|
||||
afterEach(async () => {
|
||||
await new Promise<void>((r) =>
|
||||
(target as unknown as { close: (cb: () => void) => void }).close(() =>
|
||||
r(),
|
||||
),
|
||||
);
|
||||
await stop(h);
|
||||
});
|
||||
|
||||
it("forwards method + headers and returns the response body", async () => {
|
||||
const res = await fetch(`${h.baseUrl}/api/fetch`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
url: `${targetUrl}/echo-headers`,
|
||||
method: "GET",
|
||||
headers: { "x-probe": "abc" },
|
||||
}),
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
ok: boolean;
|
||||
status: number;
|
||||
headers: Record<string, string>;
|
||||
body?: string;
|
||||
};
|
||||
expect(body.ok).toBe(true);
|
||||
expect(body.status).toBe(200);
|
||||
expect(body.headers["content-type"]).toContain("application/json");
|
||||
expect(JSON.parse(body.body!)).toEqual({ got: "abc" });
|
||||
});
|
||||
|
||||
it("omits the body for an event-stream content type", async () => {
|
||||
const res = await fetch(`${h.baseUrl}/api/fetch`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ url: `${targetUrl}/stream` }),
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as { body?: string; status: number };
|
||||
expect(body.status).toBe(200);
|
||||
expect(body.body).toBeUndefined();
|
||||
});
|
||||
|
||||
it("returns 400 when url is missing", async () => {
|
||||
const res = await fetch(`${h.baseUrl}/api/fetch`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ method: "GET" }),
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it("returns 400 on invalid JSON", async () => {
|
||||
const res = await fetch(`${h.baseUrl}/api/fetch`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: "{bad",
|
||||
});
|
||||
expect(res.status).toBe(400);
|
||||
});
|
||||
|
||||
it("returns 500 when the upstream fetch throws", async () => {
|
||||
const res = await fetch(`${h.baseUrl}/api/fetch`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ url: "http://127.0.0.1:1/nope" }),
|
||||
});
|
||||
expect(res.status).toBe(500);
|
||||
const body = (await res.json()) as { error: string };
|
||||
expect(typeof body.error).toBe("string");
|
||||
});
|
||||
});
|
||||
|
||||
describe("validateSettings rejection branches (POST /api/servers)", () => {
|
||||
let h: Harness;
|
||||
beforeEach(async () => {
|
||||
h = await start();
|
||||
});
|
||||
afterEach(async () => {
|
||||
await stop(h);
|
||||
});
|
||||
|
||||
async function postSettings(settings: unknown): Promise<Response> {
|
||||
return fetch(`${h.baseUrl}/api/servers`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
id: "srv",
|
||||
config: { type: "stdio", command: "node" },
|
||||
settings,
|
||||
}),
|
||||
});
|
||||
}
|
||||
|
||||
const base = {
|
||||
headers: [],
|
||||
metadata: [],
|
||||
connectionTimeout: 0,
|
||||
requestTimeout: 0,
|
||||
};
|
||||
|
||||
it("rejects a non-object settings value", async () => {
|
||||
const res = await postSettings([1, 2, 3]);
|
||||
expect(res.status).toBe(400);
|
||||
expect((await res.json()).error).toMatch(/must be an object/);
|
||||
});
|
||||
|
||||
it("rejects malformed headers", async () => {
|
||||
const res = await postSettings({ ...base, headers: "oops" });
|
||||
expect((await res.json()).error).toMatch(/headers/);
|
||||
});
|
||||
|
||||
it("rejects malformed metadata", async () => {
|
||||
const res = await postSettings({
|
||||
...base,
|
||||
metadata: [{ key: 1, value: "x" }],
|
||||
});
|
||||
expect((await res.json()).error).toMatch(/metadata/);
|
||||
});
|
||||
|
||||
it("rejects malformed env", async () => {
|
||||
const res = await postSettings({ ...base, env: "oops" });
|
||||
expect((await res.json()).error).toMatch(/env/);
|
||||
});
|
||||
|
||||
it("rejects a non-string cwd", async () => {
|
||||
const res = await postSettings({ ...base, cwd: 42 });
|
||||
expect((await res.json()).error).toMatch(/cwd/);
|
||||
});
|
||||
|
||||
it("rejects a negative connectionTimeout", async () => {
|
||||
const res = await postSettings({ ...base, connectionTimeout: -1 });
|
||||
expect((await res.json()).error).toMatch(/connectionTimeout/);
|
||||
});
|
||||
|
||||
it("rejects a non-numeric requestTimeout", async () => {
|
||||
const res = await postSettings({ ...base, requestTimeout: "x" });
|
||||
expect((await res.json()).error).toMatch(/requestTimeout/);
|
||||
});
|
||||
|
||||
it("rejects a negative taskTtl", async () => {
|
||||
const res = await postSettings({ ...base, taskTtl: -5 });
|
||||
expect((await res.json()).error).toMatch(/taskTtl/);
|
||||
});
|
||||
|
||||
it("rejects a non-boolean autoRefreshOnListChanged", async () => {
|
||||
const res = await postSettings({
|
||||
...base,
|
||||
autoRefreshOnListChanged: "yes",
|
||||
});
|
||||
expect((await res.json()).error).toMatch(/autoRefreshOnListChanged/);
|
||||
});
|
||||
|
||||
it("rejects a negative maxFetchRequests", async () => {
|
||||
const res = await postSettings({ ...base, maxFetchRequests: -2 });
|
||||
expect((await res.json()).error).toMatch(/maxFetchRequests/);
|
||||
});
|
||||
|
||||
it("rejects a non-string OAuth field", async () => {
|
||||
const res = await postSettings({ ...base, oauthClientId: 7 });
|
||||
expect((await res.json()).error).toMatch(/oauthClientId/);
|
||||
});
|
||||
|
||||
it("rejects a non-boolean enterpriseManaged", async () => {
|
||||
const res = await postSettings({ ...base, enterpriseManaged: "yes" });
|
||||
expect((await res.json()).error).toMatch(/enterpriseManaged/);
|
||||
});
|
||||
|
||||
it("rejects malformed roots", async () => {
|
||||
const res = await postSettings({ ...base, roots: [{ uri: 1 }] });
|
||||
expect((await res.json()).error).toMatch(/roots/);
|
||||
});
|
||||
|
||||
it("accepts a fully-populated valid settings payload", async () => {
|
||||
const res = await postSettings({
|
||||
...base,
|
||||
env: [{ key: "K", value: "V" }],
|
||||
cwd: "/tmp",
|
||||
taskTtl: 1000,
|
||||
autoRefreshOnListChanged: true,
|
||||
maxFetchRequests: 5,
|
||||
oauthClientId: "cid",
|
||||
oauthScopes: "a b",
|
||||
enterpriseManaged: true,
|
||||
roots: [{ uri: "file:///x", name: "x" }],
|
||||
});
|
||||
expect(res.status).toBe(200);
|
||||
});
|
||||
});
|
||||
|
||||
describe("normalizeMcpServers malformed-field drops (console fallback, no logger)", () => {
|
||||
let warnSpy: ReturnType<typeof vi.spyOn>;
|
||||
beforeEach(() => {
|
||||
warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
|
||||
});
|
||||
afterEach(() => {
|
||||
warnSpy.mockRestore();
|
||||
});
|
||||
|
||||
it("drops a legacy settings node and every malformed field, logging to console.warn", async () => {
|
||||
const h = await start({
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: {
|
||||
// non-object entry → skipped
|
||||
bad: 5,
|
||||
srv: {
|
||||
type: "http",
|
||||
url: "https://x.test/mcp",
|
||||
settings: { legacy: true },
|
||||
// object with a non-string value → isStringRecord inner branch
|
||||
headers: { Authorization: 123 },
|
||||
metadata: [{ key: 1 }],
|
||||
connectionTimeout: Infinity,
|
||||
requestTimeout: -1,
|
||||
taskTtl: "x",
|
||||
maxFetchRequests: -1,
|
||||
// enterpriseManaged non-boolean → isOauthObject inner branch
|
||||
oauth: { enterpriseManaged: "yes" },
|
||||
// a non-string `name` → isRootArray inner branch
|
||||
roots: [{ uri: "file:///ok", name: 5 }],
|
||||
},
|
||||
},
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers`);
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
mcpServers: Record<string, Record<string, unknown>>;
|
||||
};
|
||||
const srv = body.mcpServers.srv;
|
||||
expect(srv).toBeDefined();
|
||||
// type:"http" normalized to streamable-http
|
||||
expect(srv.type).toBe("streamable-http");
|
||||
// Every malformed field dropped.
|
||||
for (const k of [
|
||||
"settings",
|
||||
"headers",
|
||||
"metadata",
|
||||
"connectionTimeout",
|
||||
"requestTimeout",
|
||||
"taskTtl",
|
||||
"maxFetchRequests",
|
||||
"oauth",
|
||||
"roots",
|
||||
]) {
|
||||
expect(srv).not.toHaveProperty(k);
|
||||
}
|
||||
expect(body.mcpServers.bad).toBeUndefined();
|
||||
expect(warnSpy).toHaveBeenCalled();
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("normalizeMcpServers additional validator inner branches", () => {
|
||||
let warnSpy: ReturnType<typeof vi.spyOn>;
|
||||
beforeEach(() => {
|
||||
warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
|
||||
});
|
||||
afterEach(() => {
|
||||
warnSpy.mockRestore();
|
||||
});
|
||||
|
||||
it("drops oauth with a non-string clientId and roots with a null entry", async () => {
|
||||
const h = await start({
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: {
|
||||
srv: {
|
||||
type: "streamable-http",
|
||||
url: "https://x.test/mcp",
|
||||
// clientId non-string → isOauthObject clientId branch
|
||||
oauth: { clientId: 5 },
|
||||
// a null entry → isRootArray `e === null` branch
|
||||
roots: [null],
|
||||
},
|
||||
},
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers`);
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
mcpServers: Record<string, Record<string, unknown>>;
|
||||
};
|
||||
expect(body.mcpServers.srv).not.toHaveProperty("oauth");
|
||||
expect(body.mcpServers.srv).not.toHaveProperty("roots");
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("plaintext-secret migration over a mixed config", () => {
|
||||
it("migrates servers with secrets and passes through servers without", async () => {
|
||||
// With an available keychain, the GET slow path migrates plaintext into
|
||||
// the store. A mixed config (one server with a secret, one without)
|
||||
// exercises both the migrate branch and the no-secret continue branch.
|
||||
const store = new InMemorySecretStore();
|
||||
const h = await start({
|
||||
secretStore: store,
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: {
|
||||
plain: { type: "stdio", command: "node" },
|
||||
withSecret: {
|
||||
type: "streamable-http",
|
||||
url: "https://x.test/mcp",
|
||||
oauth: { clientId: "cid", clientSecret: "shh" },
|
||||
},
|
||||
},
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers`);
|
||||
expect(res.status).toBe(200);
|
||||
const body = (await res.json()) as {
|
||||
mcpServers: Record<string, Record<string, unknown>>;
|
||||
};
|
||||
// Both entries present; the secret value is rehydrated from keychain.
|
||||
expect(body.mcpServers.plain).toBeDefined();
|
||||
expect(body.mcpServers.withSecret).toBeDefined();
|
||||
// Disk no longer holds the plaintext clientSecret (migrated out).
|
||||
const onDisk = readFileSync(h.configPath, "utf-8");
|
||||
expect(onDisk).not.toContain("shh");
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("normalizeMcpServers malformed-field drops (logger path)", () => {
|
||||
it("routes the drop warnings through fileLogger.warn", async () => {
|
||||
const cap = makeCapturingLogger();
|
||||
const h = await start({
|
||||
logger: cap.logger,
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: {
|
||||
srv: {
|
||||
type: "stdio",
|
||||
command: "node",
|
||||
headers: 123,
|
||||
},
|
||||
},
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers`);
|
||||
expect(res.status).toBe(200);
|
||||
const warned = cap.records.filter((r) => r.level === "warn");
|
||||
expect(warned.length).toBeGreaterThan(0);
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("generic 500 catch on mutating routes", () => {
|
||||
// A secret store whose deleteAllForServer throws a plain (non-keychain)
|
||||
// error drives the generic 500 catch on POST and DELETE; the writeKeychain
|
||||
// path covers PUT.
|
||||
class ThrowingSecretStore implements SecretStore {
|
||||
async get(): Promise<string | null> {
|
||||
return null;
|
||||
}
|
||||
async set(): Promise<void> {
|
||||
throw new Error("boom-set");
|
||||
}
|
||||
async delete(): Promise<void> {
|
||||
/* no-op */
|
||||
}
|
||||
async deleteAllForServer(): Promise<void> {
|
||||
throw new Error("boom-sweep");
|
||||
}
|
||||
}
|
||||
|
||||
it("POST returns 500 when the keychain sweep throws a generic error", async () => {
|
||||
const h = await start({ secretStore: new ThrowingSecretStore() });
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers`, {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
id: "srv",
|
||||
config: { type: "stdio", command: "node" },
|
||||
}),
|
||||
});
|
||||
expect(res.status).toBe(500);
|
||||
expect((await res.json()).error).toMatch(/Failed to add server/);
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
|
||||
it("DELETE returns 500 when the keychain sweep throws a generic error", async () => {
|
||||
const h = await start({
|
||||
secretStore: new ThrowingSecretStore(),
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: { srv: { type: "stdio", command: "node" } },
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers/srv`, {
|
||||
method: "DELETE",
|
||||
});
|
||||
expect(res.status).toBe(500);
|
||||
expect((await res.json()).error).toMatch(/Failed to delete server/);
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
|
||||
it("PUT returns 500 when the keychain write throws a generic error", async () => {
|
||||
const h = await start({
|
||||
secretStore: new ThrowingSecretStore(),
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: {
|
||||
srv: { type: "streamable-http", url: "https://x.test/mcp" },
|
||||
},
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const res = await fetch(`${h.baseUrl}/api/servers/srv`, {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
config: { type: "streamable-http", url: "https://x.test/mcp" },
|
||||
settings: {
|
||||
headers: [],
|
||||
metadata: [],
|
||||
connectionTimeout: 0,
|
||||
requestTimeout: 0,
|
||||
oauthClientSecret: "shh",
|
||||
},
|
||||
}),
|
||||
});
|
||||
expect(res.status).toBe(500);
|
||||
expect((await res.json()).error).toMatch(/Failed to update server/);
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
|
||||
it("order returns 500 when the disk write throws", async () => {
|
||||
// Point the config at a path whose parent is a file, so the atomic
|
||||
// write fails with ENOTDIR — a generic error surfaced as 500.
|
||||
const tempDir = mkdtempSync(join(tmpdir(), "inspector-order-500-"));
|
||||
const filePath = join(tempDir, "afile");
|
||||
writeFileSync(filePath, "x");
|
||||
const badConfigPath = join(filePath, "mcp.json");
|
||||
const { app } = createRemoteApp({
|
||||
dangerouslyOmitAuth: true,
|
||||
mcpConfigPath: badConfigPath,
|
||||
initialConfig: { defaultEnvironment: {} },
|
||||
secretStore: new InMemorySecretStore(),
|
||||
});
|
||||
const { baseUrl, server } = await new Promise<{
|
||||
baseUrl: string;
|
||||
server: ServerType;
|
||||
}>((resolve, reject) => {
|
||||
const s = serve(
|
||||
{ fetch: app.fetch, port: 0, hostname: "127.0.0.1" },
|
||||
(info) => {
|
||||
const port =
|
||||
info && typeof info === "object" && "port" in info
|
||||
? (info as { port: number }).port
|
||||
: 0;
|
||||
resolve({ baseUrl: `http://127.0.0.1:${port}`, server: s });
|
||||
},
|
||||
);
|
||||
s.on("error", reject);
|
||||
});
|
||||
try {
|
||||
// readMcpConfig sees ENOENT (parent is a file) → empty list, so an
|
||||
// empty order set-matches and we proceed to the failing write.
|
||||
const res = await fetch(`${baseUrl}/api/servers/order`, {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ order: [] }),
|
||||
});
|
||||
expect(res.status).toBe(500);
|
||||
expect((await res.json()).error).toMatch(/Failed to reorder servers/);
|
||||
} finally {
|
||||
await new Promise<void>((r) => server.close(() => r()));
|
||||
rmSync(tempDir, { recursive: true });
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
describe("keychain-unavailable migration with a logger", () => {
|
||||
class UnavailableStore implements SecretStore {
|
||||
async get(): Promise<string | null> {
|
||||
return null;
|
||||
}
|
||||
async set(): Promise<void> {
|
||||
throw new KeychainUnavailableError(new Error("libsecret missing"));
|
||||
}
|
||||
async delete(): Promise<void> {
|
||||
/* no-op */
|
||||
}
|
||||
async deleteAllForServer(): Promise<void> {
|
||||
/* no-op */
|
||||
}
|
||||
}
|
||||
|
||||
it("warns via the logger and preserves on-disk plaintext", async () => {
|
||||
const cap = makeCapturingLogger();
|
||||
const h = await start({
|
||||
secretStore: new UnavailableStore(),
|
||||
logger: cap.logger,
|
||||
seedConfig: JSON.stringify({
|
||||
mcpServers: {
|
||||
srv: {
|
||||
type: "streamable-http",
|
||||
url: "https://x.test/mcp",
|
||||
oauth: { clientId: "cid", clientSecret: "plaintext" },
|
||||
},
|
||||
},
|
||||
}),
|
||||
});
|
||||
try {
|
||||
const before = readFileSync(h.configPath, "utf-8");
|
||||
const res = await fetch(`${h.baseUrl}/api/servers`);
|
||||
expect(res.status).toBe(200);
|
||||
// Disk plaintext preserved (migration abandoned).
|
||||
expect(readFileSync(h.configPath, "utf-8")).toBe(before);
|
||||
const warned = cap.records.filter(
|
||||
(r) =>
|
||||
r.level === "warn" &&
|
||||
JSON.stringify(r.args).includes("Keychain unavailable"),
|
||||
);
|
||||
expect(warned.length).toBeGreaterThan(0);
|
||||
} finally {
|
||||
await stop(h);
|
||||
}
|
||||
});
|
||||
});
|
||||
});
|
||||
Loading…
Reference in a new issue