/** * Unit tests for the todo MCP surface (TodoMcp, DI-discovered): * create_todo, update_todo, toggle_todo, delete_todo, reorder_todos, * list_todos, get_todo_category_assignees, set_todo_category_assignees, * plus the trek://trips/{tripId}/todos resource. * * All of it attaches via the nest-mcp registry inside registerTools, so every * harness here keeps withTools on (the resource is NOT registered by the * legacy registerResources fan-out anymore). */ import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest'; import { db as testDb } from '../../../src/db/database'; vi.mock('../../../src/db/database', async () => { const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock'); return buildDbMock(createSnapshotTestDb()); }); vi.mock('../../../src/config', () => ({ JWT_SECRET: 'test-jwt-secret-for-trek-testing-only', ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2', updateJwtSecret: () => {}, })); const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() })); vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock })); import { resetTestDb } from '../../helpers/test-db'; import { createUser, createTrip, createTodoItem } from '../../helpers/factories'; import { createMcpHarness, parseToolResult, parseResourceResult, type McpHarness } from '../../helpers/mcp-harness'; import { ADDON_IDS } from '../../../src/addons'; import { createTestOrm, type TestOrm } from '../../helpers/test-orm'; import { findRow, insertRow } from '../../helpers/factories/rows'; import { makeTodoItem } from '../../helpers/factories/todos'; import { setAddonEnabled } from '../../helpers/factories/settings'; import { TodoItems } from '../../../src/db/entities/TodoItems.entity'; import { TodoCategoryAssignees } from '../../../src/db/entities/TodoCategoryAssignees.entity'; beforeEach(() => { resetTestDb(testDb); broadcastMock.mockClear(); delete process.env.DEMO_MODE; }); let orm: TestOrm; beforeAll(async () => { orm = await createTestOrm(testDb); }); afterAll(async () => { await orm.close(); testDb.close(); }); async function withHarness(userId: number, fn: (h: McpHarness) => Promise) { const h = await createMcpHarness({ userId, withResources: false }); try { await fn(h); } finally { await h.cleanup(); } } // --------------------------------------------------------------------------- // list_todos // --------------------------------------------------------------------------- describe('Tool: list_todos', () => { it('returns empty list for a new trip', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'list_todos', arguments: { tripId: trip.id } }); const data = parseToolResult(result) as any; expect(data.items).toEqual([]); }); }); it('returns todos ordered by sort_order', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); createTodoItem(testDb, trip.id, { name: 'First' }); createTodoItem(testDb, trip.id, { name: 'Second' }); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'list_todos', arguments: { tripId: trip.id } }); const data = parseToolResult(result) as any; expect(data.items).toHaveLength(2); expect(data.items[0].name).toBe('First'); }); }); it('returns access denied for non-member', async () => { const { user } = createUser(testDb); const { user: other } = createUser(testDb); const trip = createTrip(testDb, other.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'list_todos', arguments: { tripId: trip.id } }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // create_todo // --------------------------------------------------------------------------- describe('Tool: create_todo', () => { it('creates a todo item with all fields', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'create_todo', arguments: { tripId: trip.id, name: 'Book hotel', category: 'Booking', due_date: '2025-06-01', description: 'Find a good deal', priority: 2, }, }); const data = parseToolResult(result) as any; expect(data.item.name).toBe('Book hotel'); expect(data.item.category).toBe('Booking'); expect(data.item.due_date).toBe('2025-06-01'); expect(data.item.priority).toBe(2); expect(data.item.checked).toBe(0); }); }); it('creates a minimal todo item', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'create_todo', arguments: { tripId: trip.id, name: 'Pack bags' }, }); const data = parseToolResult(result) as any; expect(data.item.name).toBe('Pack bags'); expect(data.item.checked).toBe(0); }); }); it('broadcasts todo:created event', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { await h.client.callTool({ name: 'create_todo', arguments: { tripId: trip.id, name: 'Test' } }); expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'todo:created', expect.any(Object)); }); }); it('returns access denied for non-member', async () => { const { user } = createUser(testDb); const { user: other } = createUser(testDb); const trip = createTrip(testDb, other.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'create_todo', arguments: { tripId: trip.id, name: 'X' } }); expect(result.isError).toBe(true); }); }); it('blocks demo user', async () => { process.env.DEMO_MODE = 'true'; const { user } = createUser(testDb, { email: 'demo@nomad.app' }); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'create_todo', arguments: { tripId: trip.id, name: 'X' } }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // update_todo // --------------------------------------------------------------------------- describe('Tool: update_todo', () => { it('updates todo name and category', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id, { name: 'Old name', category: 'General' }); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'update_todo', arguments: { tripId: trip.id, itemId: item.id, name: 'New name', category: 'Booking' }, }); const data = parseToolResult(result) as any; expect(data.item.name).toBe('New name'); expect(data.item.category).toBe('Booking'); }); }); it('clears due_date when passed null', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = await makeTodoItem(orm, trip.id, { name: 'Task', checked: 0, sort_order: 0, due_date: '2025-01-01' }); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'update_todo', arguments: { tripId: trip.id, itemId: item.id, due_date: null }, }); const data = parseToolResult(result) as any; expect(data.item.due_date).toBeNull(); }); }); it('broadcasts todo:updated event', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { await h.client.callTool({ name: 'update_todo', arguments: { tripId: trip.id, itemId: item.id, name: 'Updated' } }); expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'todo:updated', expect.any(Object)); }); }); it('returns error for item not found', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'update_todo', arguments: { tripId: trip.id, itemId: 99999, name: 'X' } }); expect(result.isError).toBe(true); }); }); it('returns access denied for non-member', async () => { const { user } = createUser(testDb); const { user: other } = createUser(testDb); const trip = createTrip(testDb, other.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'update_todo', arguments: { tripId: trip.id, itemId: item.id, name: 'X' } }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // toggle_todo // --------------------------------------------------------------------------- describe('Tool: toggle_todo', () => { it('marks a todo as done', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'toggle_todo', arguments: { tripId: trip.id, itemId: item.id, checked: true }, }); const data = parseToolResult(result) as any; expect(data.item.checked).toBe(1); }); }); it('unchecks a done todo', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id, { checked: 1 }); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'toggle_todo', arguments: { tripId: trip.id, itemId: item.id, checked: false }, }); const data = parseToolResult(result) as any; expect(data.item.checked).toBe(0); }); }); it('broadcasts todo:updated event', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { await h.client.callTool({ name: 'toggle_todo', arguments: { tripId: trip.id, itemId: item.id, checked: true } }); expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'todo:updated', expect.any(Object)); }); }); it('returns error for item not found', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'toggle_todo', arguments: { tripId: trip.id, itemId: 99999, checked: true } }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // delete_todo // --------------------------------------------------------------------------- describe('Tool: delete_todo', () => { it('deletes an existing todo item', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'delete_todo', arguments: { tripId: trip.id, itemId: item.id } }); const data = parseToolResult(result) as any; expect(data.success).toBe(true); expect(await findRow(orm, TodoItems, { id: item.id })).toBeNull(); }); }); it('broadcasts todo:deleted event', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { await h.client.callTool({ name: 'delete_todo', arguments: { tripId: trip.id, itemId: item.id } }); expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'todo:deleted', expect.any(Object)); }); }); it('returns error for item not found', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'delete_todo', arguments: { tripId: trip.id, itemId: 99999 } }); expect(result.isError).toBe(true); }); }); it('returns access denied for non-member', async () => { const { user } = createUser(testDb); const { user: other } = createUser(testDb); const trip = createTrip(testDb, other.id); const item = createTodoItem(testDb, trip.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'delete_todo', arguments: { tripId: trip.id, itemId: item.id } }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // reorder_todos // --------------------------------------------------------------------------- describe('Tool: reorder_todos', () => { it('reorders todo items', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); const item1 = createTodoItem(testDb, trip.id, { name: 'First' }); const item2 = createTodoItem(testDb, trip.id, { name: 'Second' }); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'reorder_todos', arguments: { tripId: trip.id, orderedIds: [item2.id, item1.id] }, }); const data = parseToolResult(result) as any; expect(data.success).toBe(true); // item2 should now have sort_order 0 const updated = await findRow(orm, TodoItems, { id: item2.id }); expect(updated?.sort_order).toBe(0); }); }); it('returns access denied for non-member', async () => { const { user } = createUser(testDb); const { user: other } = createUser(testDb); const trip = createTrip(testDb, other.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'reorder_todos', arguments: { tripId: trip.id, orderedIds: [1] } }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // get_todo_category_assignees // --------------------------------------------------------------------------- describe('Tool: get_todo_category_assignees', () => { it('returns empty object for a new trip', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'get_todo_category_assignees', arguments: { tripId: trip.id } }); const data = parseToolResult(result) as any; expect(data.assignees).toEqual({}); }); }); }); // --------------------------------------------------------------------------- // set_todo_category_assignees // --------------------------------------------------------------------------- describe('Tool: set_todo_category_assignees', () => { it('sets category assignees and broadcasts', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'set_todo_category_assignees', arguments: { tripId: trip.id, categoryName: 'Booking', userIds: [user.id] }, }); const data = parseToolResult(result) as any; expect(Array.isArray(data.assignees)).toBe(true); expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'todo:assignees', expect.any(Object)); }); }); it('clears assignees when passed empty array', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); // Set then clear await insertRow(orm, TodoCategoryAssignees, { trip: trip.id, category_name: 'Booking', user: user.id }); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'set_todo_category_assignees', arguments: { tripId: trip.id, categoryName: 'Booking', userIds: [] }, }); const data = parseToolResult(result) as any; expect(data.assignees).toEqual([]); }); }); it('blocks demo user', async () => { process.env.DEMO_MODE = 'true'; const { user } = createUser(testDb, { email: 'demo@nomad.app' }); const trip = createTrip(testDb, user.id); await withHarness(user.id, async (h) => { const result = await h.client.callTool({ name: 'set_todo_category_assignees', arguments: { tripId: trip.id, categoryName: 'Test', userIds: [] }, }); expect(result.isError).toBe(true); }); }); }); // --------------------------------------------------------------------------- // Scope gating (todos read/write, registration-time) // --------------------------------------------------------------------------- describe('Todo tools — scope gating', () => { const READ_TOOLS = ['list_todos', 'get_todo_category_assignees']; const WRITE_TOOLS = ['create_todo', 'update_todo', 'toggle_todo', 'delete_todo', 'reorder_todos', 'set_todo_category_assignees']; async function listToolNames(userId: number, scopes: string[] | null): Promise { const h = await createMcpHarness({ userId, withResources: false, scopes }); try { return (await h.client.listTools()).tools.map((t) => t.name); } finally { await h.cleanup(); } } it('registers all eight tools with null scopes (full access)', async () => { const { user } = createUser(testDb); const names = await listToolNames(user.id, null); for (const tool of [...READ_TOOLS, ...WRITE_TOOLS]) expect(names).toContain(tool); }); it('registers only the read tools with todos:read', async () => { const { user } = createUser(testDb); const names = await listToolNames(user.id, ['todos:read']); for (const tool of READ_TOOLS) expect(names).toContain(tool); for (const tool of WRITE_TOOLS) expect(names).not.toContain(tool); }); it('registers no todo tools for an unrelated scope', async () => { const { user } = createUser(testDb); const names = await listToolNames(user.id, ['budget:read']); for (const tool of [...READ_TOOLS, ...WRITE_TOOLS]) expect(names).not.toContain(tool); }); }); // --------------------------------------------------------------------------- // Addon gating (packing addon, the legacy whole-registrar early return — // now the `when` predicate on every TodoMcp entry) // --------------------------------------------------------------------------- describe('Todo tools — packing addon gating', () => { it('registers nothing (tools or resource) when the packing addon is disabled', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); await setAddonEnabled(orm, ADDON_IDS.PACKING, false); try { await withHarness(user.id, async (h) => { const names = (await h.client.listTools()).tools.map((t) => t.name); expect(names).not.toContain('list_todos'); expect(names).not.toContain('create_todo'); await expect(h.client.readResource({ uri: `trek://trips/${trip.id}/todos` })).rejects.toThrow(); }); } finally { await setAddonEnabled(orm, ADDON_IDS.PACKING, true); } }); }); // --------------------------------------------------------------------------- // trek://trips/{tripId}/todos resource (moved from the legacy registerResources) // --------------------------------------------------------------------------- describe('Resource: trek://trips/{tripId}/todos', () => { it('returns the trip todos ordered by position', async () => { const { user } = createUser(testDb); const trip = createTrip(testDb, user.id); createTodoItem(testDb, trip.id, { name: 'First' }); createTodoItem(testDb, trip.id, { name: 'Second' }); await withHarness(user.id, async (h) => { const result = await h.client.readResource({ uri: `trek://trips/${trip.id}/todos` }); const items = parseResourceResult(result) as any[]; expect(items).toHaveLength(2); expect(items[0].name).toBe('First'); expect(items[1].name).toBe('Second'); }); }); it('returns the access-denied payload for a non-member', async () => { const { user } = createUser(testDb); const { user: other } = createUser(testDb); const trip = createTrip(testDb, other.id); await withHarness(user.id, async (h) => { const result = await h.client.readResource({ uri: `trek://trips/${trip.id}/todos` }); expect(parseResourceResult(result)).toEqual({ error: 'Trip not found or access denied' }); }); }); it('returns the access-denied payload for a malformed trip id', async () => { const { user } = createUser(testDb); await withHarness(user.id, async (h) => { const result = await h.client.readResource({ uri: 'trek://trips/not-a-number/todos' }); expect(parseResourceResult(result)).toEqual({ error: 'Trip not found or access denied' }); }); }); });