mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 05:56:53 +00:00
Maurice
ddf97c5a21
The MCP tool suites seeded trips, places, bookings, packing, vacay and settings rows and read back what a tool call left behind through raw better-sqlite3 statements on the sync handle. They now go through the ORM factories and readers in tests/helpers/factories, so the rows are written and read the way the repositories do it. Every assertion keeps its meaning: a missing row that read back as undefined now reads back as null, and a partial SELECT is replaced by the same fields picked off the full row.
1007 lines
44 KiB
TypeScript
1007 lines
44 KiB
TypeScript
/**
|
|
* Unit tests for the trip MCP surface (TripsMcp, DI-discovered): create_trip,
|
|
* update_trip, delete_trip, list_trips, get_trip_summary tools, the
|
|
* trek://trips / trek://trips/{tripId} resources (moved here from
|
|
* resources.test.ts with the DI port — the withTools harness attaches the
|
|
* nest-mcp registry that now registers them), the fire-once deprecation
|
|
* notice riding the attach ctx, and the scope gating (declarative
|
|
* trips:write markers + the canReadTrips/canDeleteTrips predicates).
|
|
*/
|
|
import { describe, it, expect, vi, beforeAll, beforeEach, afterEach, afterAll } from 'vitest';
|
|
import { db as testDb } from '../../../src/db/database';
|
|
|
|
|
|
vi.mock('../../../src/db/database', async () => {
|
|
const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
|
|
return buildDbMock(createSnapshotTestDb());
|
|
});
|
|
vi.mock('../../../src/config', () => ({
|
|
JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
|
|
ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
|
|
updateJwtSecret: () => {},
|
|
}));
|
|
|
|
const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
|
|
vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
|
|
|
|
import { resetTestDb } from '../../helpers/test-db';
|
|
import { createUser, createTrip, createDay, createPlace, addTripMember, createBudgetItem, createPackingItem, createReservation, createDayNote, createCollabNote, createDayAssignment, createDayAccommodation } from '../../helpers/factories';
|
|
import { createMcpHarness, parseToolResult, parseResourceResult, type McpHarness } from '../../helpers/mcp-harness';
|
|
import { MAX_TRIP_DAYS } from '@trek/shared';
|
|
import { createTestOrm, type TestOrm } from '../../helpers/test-orm';
|
|
import { countRows, findRow, findRows, insertRow, insertRows, updateRows } from '../../helpers/factories/rows';
|
|
import { setUserSetting } from '../../helpers/factories/settings';
|
|
import { makeVacayEntry, makeVacayPlan, addVacayPlanMember } from '../../helpers/factories/vacay';
|
|
import { makePackingItem } from '../../helpers/factories/packing';
|
|
import { Days } from '../../../src/db/entities/Days.entity';
|
|
import { Trips } from '../../../src/db/entities/Trips.entity';
|
|
import { VacayEntries } from '../../../src/db/entities/VacayEntries.entity';
|
|
import { VacayUserYears } from '../../../src/db/entities/VacayUserYears.entity';
|
|
import { VacayYears } from '../../../src/db/entities/VacayYears.entity';
|
|
|
|
let orm: TestOrm;
|
|
|
|
beforeAll(async () => {
|
|
orm = await createTestOrm(testDb);
|
|
});
|
|
|
|
beforeEach(() => {
|
|
resetTestDb(testDb);
|
|
broadcastMock.mockClear();
|
|
delete process.env.DEMO_MODE;
|
|
});
|
|
|
|
// Only search_cover_images stubs fetch, and it stubs a different response per case.
|
|
afterEach(() => {
|
|
vi.unstubAllGlobals();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await orm.close();
|
|
testDb.close();
|
|
});
|
|
|
|
async function tripRow(id: number) {
|
|
return (await findRow(orm, Trips, { id }))!;
|
|
}
|
|
|
|
/** The vacay entry dates of the user in the plan between `from` and `to`, both included, in date order. */
|
|
async function vacayDatesBetween(planId: number, userId: number, from: string, to: string): Promise<string[]> {
|
|
const rows = await findRows(orm, VacayEntries, { plan: planId, user: userId, date: { $gte: from, $lte: to } }, { date: 'asc' });
|
|
return rows.map(r => r.date);
|
|
}
|
|
|
|
/** A vacay plan for the user with the year 2026 open and 30 days in it. */
|
|
async function vacayPlanWithYear(userId: number): Promise<number> {
|
|
const { id: planId } = await makeVacayPlan(orm, userId);
|
|
await insertRow(orm, VacayYears, { plan: planId, year: 2026 });
|
|
await insertRow(orm, VacayUserYears, { user: userId, plan: planId, year: 2026, vacation_days: 30, carried_over: 0 });
|
|
return planId;
|
|
}
|
|
|
|
async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
|
|
const h = await createMcpHarness({ userId, withResources: false });
|
|
try { await fn(h); } finally { await h.cleanup(); }
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// create_trip
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: create_trip', () => {
|
|
it('creates a trip with title only and generates 7 default days', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Summer Escape' } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip).toBeTruthy();
|
|
expect(data.trip.title).toBe('Summer Escape');
|
|
const days = await countRows(orm, Days, { trip: data.trip.id });
|
|
expect(days).toBe(7);
|
|
});
|
|
});
|
|
|
|
it('creates a trip with dates and auto-generates correct number of days', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip',
|
|
arguments: { title: 'Paris Trip', start_date: '2026-07-01', end_date: '2026-07-05' },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
const days = await countRows(orm, Days, { trip: data.trip.id });
|
|
expect(days).toBe(5);
|
|
});
|
|
});
|
|
|
|
it('generates every day of a trip longer than a year (#2403)', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip',
|
|
arguments: { title: 'Long Trip', start_date: '2025-01-26', end_date: '2026-01-28' },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
const days = await countRows(orm, Days, { trip: data.trip.id });
|
|
expect(days).toBe(368);
|
|
});
|
|
});
|
|
|
|
it('refuses a date range longer than MAX_TRIP_DAYS instead of cutting the days short', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip',
|
|
arguments: { title: 'Decade', start_date: '2026-01-01', end_date: '2036-01-01' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(JSON.stringify(result.content)).toContain(`at most ${MAX_TRIP_DAYS} days`);
|
|
expect(await countRows(orm, Trips)).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('returns error for invalid start_date format', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Trip', start_date: 'not-a-date' } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('returns error when end_date is before start_date', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip',
|
|
arguments: { title: 'Trip', start_date: '2026-07-05', end_date: '2026-07-01' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Demo Trip' } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('gives a dateless trip the requested day_count instead of the default 7', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Open Ended', day_count: 12 } });
|
|
const data = parseToolResult(result) as any;
|
|
const days = await countRows(orm, Days, { trip: data.trip.id });
|
|
expect(days).toBe(12);
|
|
const row = await tripRow(data.trip.id);
|
|
expect(row.start_date).toBeNull();
|
|
expect(row.end_date).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('refuses a day_count outside 1..MAX_TRIP_DAYS', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
expect((await h.client.callTool({ name: 'create_trip', arguments: { title: 'Zero', day_count: 0 } })).isError).toBe(true);
|
|
expect((await h.client.callTool({ name: 'create_trip', arguments: { title: 'Huge', day_count: MAX_TRIP_DAYS + 1 } })).isError).toBe(true);
|
|
expect(await countRows(orm, Trips)).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('stores the requested reminder_days', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Reminded', reminder_days: 14 } });
|
|
const data = parseToolResult(result) as any;
|
|
const row = await tripRow(data.trip.id);
|
|
expect(row.reminder_days).toBe(14);
|
|
});
|
|
});
|
|
|
|
it('turns the reminder off with reminder_days 0 rather than falling back to 3', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Quiet', reminder_days: 0 } });
|
|
const data = parseToolResult(result) as any;
|
|
const row = await tripRow(data.trip.id);
|
|
expect(row.reminder_days).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('refuses a reminder_days outside 0..30', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
expect((await h.client.callTool({ name: 'create_trip', arguments: { title: 'Early', reminder_days: 31 } })).isError).toBe(true);
|
|
expect((await h.client.callTool({ name: 'create_trip', arguments: { title: 'Negative', reminder_days: -1 } })).isError).toBe(true);
|
|
expect(await countRows(orm, Trips)).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('gives a trip without a currency the display currency from the settings, not EUR', async () => {
|
|
const { user } = createUser(testDb);
|
|
await setUserSetting(orm, user.id, 'default_currency', JSON.stringify('USD'));
|
|
await withHarness(user.id, async (h) => {
|
|
const fromSettings = parseToolResult(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Road trip' } })) as any;
|
|
expect(fromSettings.trip.currency).toBe('USD');
|
|
const explicit = parseToolResult(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Tokyo', currency: 'JPY' } })) as any;
|
|
expect(explicit.trip.currency).toBe('JPY');
|
|
});
|
|
});
|
|
|
|
it('falls back to EUR when neither the user nor the admin set a display currency', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const data = parseToolResult(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Plain' } })) as any;
|
|
expect(data.trip.currency).toBe('EUR');
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// update_trip
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: update_trip', () => {
|
|
it('updates trip title', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Old Title' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'New Title' } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip.title).toBe('New Title');
|
|
});
|
|
});
|
|
|
|
it('partial update preserves unspecified fields', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'My Trip', description: 'A great trip' });
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Renamed' } });
|
|
const updated = await tripRow(trip.id);
|
|
expect(updated.title).toBe('Renamed');
|
|
expect(updated.description).toBe('A great trip');
|
|
});
|
|
});
|
|
|
|
it('broadcasts trip:updated event', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Updated' } });
|
|
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'trip:updated', expect.any(Object));
|
|
});
|
|
});
|
|
|
|
it('returns access denied for non-member', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, other.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Hack' } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'New' } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('shifts owner vacay entries when update_trip moves trip window by fixed offset', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { start_date: '2026-08-01', end_date: '2026-08-09' });
|
|
|
|
// Materialize active vacay plan for owner and entries in old trip window.
|
|
const planId = await vacayPlanWithYear(user.id);
|
|
for (const d of ['2026-08-03', '2026-08-04', '2026-08-05', '2026-08-06', '2026-08-07']) {
|
|
await makeVacayEntry(orm, planId, user.id, d, { note: '' });
|
|
}
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'update_trip',
|
|
arguments: { tripId: trip.id, start_date: '2026-08-08', end_date: '2026-08-16' },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip.start_date).toBe('2026-08-08');
|
|
expect(data.trip.end_date).toBe('2026-08-16');
|
|
});
|
|
|
|
const oldWindow = await vacayDatesBetween(planId, user.id, '2026-08-01', '2026-08-09');
|
|
expect(oldWindow).toHaveLength(0);
|
|
|
|
const shifted = await vacayDatesBetween(planId, user.id, '2026-08-08', '2026-08-16');
|
|
expect(shifted).toEqual([
|
|
'2026-08-10',
|
|
'2026-08-11',
|
|
'2026-08-12',
|
|
'2026-08-13',
|
|
'2026-08-14',
|
|
]);
|
|
});
|
|
|
|
it('shifts entries from the owners own plan even if another vacay plan is active', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: otherOwner } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { start_date: '2026-09-01', end_date: '2026-09-07' });
|
|
|
|
// Own plan with entries that should be shifted.
|
|
const ownPlanId = await vacayPlanWithYear(user.id);
|
|
for (const d of ['2026-09-02', '2026-09-03']) {
|
|
await makeVacayEntry(orm, ownPlanId, user.id, d, { note: '' });
|
|
}
|
|
|
|
// Different accepted plan becomes "active" for the owner.
|
|
const { id: foreignPlanId } = await makeVacayPlan(orm, otherOwner.id);
|
|
await addVacayPlanMember(orm, foreignPlanId, user.id, 'accepted');
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'update_trip',
|
|
arguments: { tripId: trip.id, start_date: '2026-09-08', end_date: '2026-09-14' },
|
|
});
|
|
expect(result.isError).toBeFalsy();
|
|
});
|
|
|
|
const oldWindow = await vacayDatesBetween(ownPlanId, user.id, '2026-09-01', '2026-09-07');
|
|
expect(oldWindow).toHaveLength(0);
|
|
|
|
const shifted = await vacayDatesBetween(ownPlanId, user.id, '2026-09-08', '2026-09-14');
|
|
expect(shifted).toEqual(['2026-09-09', '2026-09-10']);
|
|
});
|
|
|
|
it('clear_dates turns a dated trip back into a dateless one and un-dates its days', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, clear_dates: true } });
|
|
expect(result.isError).toBeFalsy();
|
|
const row = await tripRow(trip.id);
|
|
expect(row.start_date).toBeNull();
|
|
expect(row.end_date).toBeNull();
|
|
const dated = await countRows(orm, Days, { trip: trip.id, date: { $ne: null } });
|
|
expect(dated).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('clear_dates with a day_count resizes the now dateless trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, clear_dates: true, day_count: 3 } });
|
|
const days = await countRows(orm, Days, { trip: trip.id });
|
|
expect(days).toBe(3);
|
|
});
|
|
});
|
|
|
|
it('refuses clear_dates alongside a start_date and leaves the trip untouched', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'update_trip',
|
|
arguments: { tripId: trip.id, clear_dates: true, start_date: '2026-08-01' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
const row = await tripRow(trip.id);
|
|
expect(row.start_date).toBe('2026-07-01');
|
|
});
|
|
});
|
|
|
|
it('resizes a dateless trip with day_count', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await insertRows(orm, Days, [
|
|
{ trip: trip.id, day_number: 1, date: null },
|
|
{ trip: trip.id, day_number: 2, date: null },
|
|
]);
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, day_count: 6 } });
|
|
const days = await countRows(orm, Days, { trip: trip.id });
|
|
expect(days).toBe(6);
|
|
});
|
|
});
|
|
|
|
it('refuses a day_count outside 1..MAX_TRIP_DAYS', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Untouched' });
|
|
await withHarness(user.id, async (h) => {
|
|
expect((await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, day_count: 0 } })).isError).toBe(true);
|
|
expect((await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, day_count: MAX_TRIP_DAYS + 1 } })).isError).toBe(true);
|
|
expect(await countRows(orm, Days, { trip: trip.id })).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('says in its description what shortening a dated trip takes, and where the result lists it', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (h) => {
|
|
const tool = (await h.client.listTools()).tools.find(t => t.name === 'update_trip');
|
|
expect(tool?.description).toContain('Shortening a dated trip deletes its last days by position');
|
|
expect(tool?.description).toContain('removed_days');
|
|
});
|
|
});
|
|
|
|
it('lists the days an earlier end removed, as they stood before, and none for a rename', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
|
|
const days = await findRows(orm, Days, { trip: trip.id }, { day_number: 'asc' });
|
|
await withHarness(user.id, async (h) => {
|
|
type Answer = { trip: { end_date: string; title: string }; removed_days?: unknown[] };
|
|
const shortened = parseToolResult(await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, end_date: '2026-07-03' } })) as Answer;
|
|
expect(shortened.trip.end_date).toBe('2026-07-03');
|
|
expect(shortened.removed_days).toEqual([
|
|
{ id: days[3].id, day_number: 4, date: '2026-07-04', reason: 'overflow' },
|
|
{ id: days[4].id, day_number: 5, date: '2026-07-05', reason: 'overflow' },
|
|
]);
|
|
const renamed = parseToolResult(await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Shorter' } })) as Answer;
|
|
expect(renamed.trip.title).toBe('Shorter');
|
|
expect(renamed).not.toHaveProperty('removed_days');
|
|
});
|
|
});
|
|
|
|
it('refuses a date range longer than MAX_TRIP_DAYS and leaves the trip untouched', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Untouched', start_date: '2026-07-01', end_date: '2026-07-07' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, end_date: '2036-07-01' } });
|
|
expect(result.isError).toBe(true);
|
|
expect(JSON.stringify(result.content)).toContain(`at most ${MAX_TRIP_DAYS} days`);
|
|
const row = await tripRow(trip.id);
|
|
expect(row.end_date).toBe('2026-07-07');
|
|
});
|
|
});
|
|
|
|
it('changes reminder_days and can turn the reminder off', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, reminder_days: 10 } });
|
|
expect((await tripRow(trip.id)).reminder_days).toBe(10);
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, reminder_days: 0 } });
|
|
expect((await tripRow(trip.id)).reminder_days).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('refuses a reminder_days outside 0..30 and keeps the stored value', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, reminder_days: 31 } });
|
|
expect(result.isError).toBe(true);
|
|
expect((await tripRow(trip.id)).reminder_days).toBe(3);
|
|
});
|
|
});
|
|
|
|
it('clears the description with an explicit null', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { description: 'A great trip' });
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, description: null } });
|
|
const row = await tripRow(trip.id);
|
|
expect(row.description).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('clears the cover image with an explicit null', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await updateRows(orm, Trips, { id: trip.id }, { cover_image: '/uploads/covers/old.jpg' });
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, cover_image: null } });
|
|
const row = await tripRow(trip.id);
|
|
expect(row.cover_image).toBeNull();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// search_cover_images
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: search_cover_images', () => {
|
|
function stubUnsplash(body: unknown, init: { ok?: boolean; status?: number } = {}) {
|
|
vi.stubGlobal('fetch', vi.fn(async () => ({
|
|
ok: init.ok ?? true,
|
|
status: init.status ?? 200,
|
|
json: async () => body,
|
|
})));
|
|
}
|
|
|
|
it('returns the photo candidates for a query', async () => {
|
|
const { user } = createUser(testDb);
|
|
stubUnsplash({
|
|
results: [{
|
|
id: 'p1',
|
|
urls: { regular: 'https://images.unsplash.com/photo-1.jpg', small: 'https://images.unsplash.com/thumb-1.jpg' },
|
|
alt_description: 'Rooftops at sunset',
|
|
user: { name: 'Ada L.' },
|
|
links: { html: 'https://unsplash.com/photos/p1' },
|
|
}],
|
|
});
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'search_cover_images', arguments: { query: 'Lisbon rooftops' } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.photos).toHaveLength(1);
|
|
expect(data.photos[0].url).toBe('https://images.unsplash.com/photo-1.jpg');
|
|
expect(data.photos[0].photographer).toBe('Ada L.');
|
|
});
|
|
});
|
|
|
|
it('reports an upstream failure as a tool error', async () => {
|
|
const { user } = createUser(testDb);
|
|
stubUnsplash({ errors: ['Rate Limit Exceeded'] }, { ok: false, status: 429 });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'search_cover_images', arguments: { query: 'Lisbon' } });
|
|
expect(result.isError).toBe(true);
|
|
expect((result.content as { text: string }[])[0].text).toBe('Rate Limit Exceeded');
|
|
});
|
|
});
|
|
|
|
it('refuses an empty query without reaching Unsplash', async () => {
|
|
const { user } = createUser(testDb);
|
|
const fetchMock = vi.fn();
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'search_cover_images', arguments: { query: '' } });
|
|
expect(result.isError).toBe(true);
|
|
expect(fetchMock).not.toHaveBeenCalled();
|
|
});
|
|
});
|
|
|
|
it('saves nothing on the trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
stubUnsplash({ results: [] });
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'search_cover_images', arguments: { query: 'Lisbon' } });
|
|
const row = await tripRow(trip.id);
|
|
expect(row.cover_image).toBeNull();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// delete_trip
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: delete_trip', () => {
|
|
it('owner can delete trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.success).toBe(true);
|
|
const gone = await findRow(orm, Trips, { id: trip.id });
|
|
expect(gone).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('non-owner member cannot delete trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
const stillExists = await findRow(orm, Trips, { id: trip.id });
|
|
expect(stillExists).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// list_trips
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: list_trips', () => {
|
|
it('returns owned and member trips', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
createTrip(testDb, user.id, { title: 'My Trip' });
|
|
const shared = createTrip(testDb, other.id, { title: 'Shared' });
|
|
addTripMember(testDb, shared.id, user.id);
|
|
createTrip(testDb, other.id, { title: 'Inaccessible' });
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'list_trips', arguments: {} });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trips).toHaveLength(2);
|
|
const titles = data.trips.map((t: any) => t.title);
|
|
expect(titles).toContain('My Trip');
|
|
expect(titles).toContain('Shared');
|
|
});
|
|
});
|
|
|
|
it('excludes archived trips by default', async () => {
|
|
const { user } = createUser(testDb);
|
|
createTrip(testDb, user.id, { title: 'Active' });
|
|
const archived = createTrip(testDb, user.id, { title: 'Archived' });
|
|
await updateRows(orm, Trips, { id: archived.id }, { is_archived: 1 });
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'list_trips', arguments: {} });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trips).toHaveLength(1);
|
|
expect(data.trips[0].title).toBe('Active');
|
|
});
|
|
});
|
|
|
|
it('includes archived trips when include_archived is true', async () => {
|
|
const { user } = createUser(testDb);
|
|
createTrip(testDb, user.id, { title: 'Active' });
|
|
const archived = createTrip(testDb, user.id, { title: 'Archived' });
|
|
await updateRows(orm, Trips, { id: archived.id }, { is_archived: 1 });
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'list_trips', arguments: { include_archived: true } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trips).toHaveLength(2);
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// get_trip_summary
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: get_trip_summary', () => {
|
|
it('returns full denormalized trip snapshot', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Full Trip' });
|
|
addTripMember(testDb, trip.id, member.id);
|
|
const day = createDay(testDb, trip.id);
|
|
const place = createPlace(testDb, trip.id, { name: 'Colosseum' });
|
|
const assignment = createDayAssignment(testDb, day.id, place.id);
|
|
createDayNote(testDb, day.id, trip.id, { text: 'Check in' });
|
|
createBudgetItem(testDb, trip.id, { name: 'Hotel', total_price: 300 });
|
|
createPackingItem(testDb, trip.id, { name: 'Passport' });
|
|
createReservation(testDb, trip.id, { title: 'Flight', type: 'flight' });
|
|
createCollabNote(testDb, trip.id, user.id, { title: 'Plan' });
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip.title).toBe('Full Trip');
|
|
expect(data.members.owner.id).toBe(user.id);
|
|
expect(data.members.collaborators).toHaveLength(1);
|
|
expect(data.days).toHaveLength(1);
|
|
expect(data.days[0].assignments).toHaveLength(1);
|
|
expect(data.days[0].notes).toHaveLength(1);
|
|
expect(data.budget.item_count).toBe(1);
|
|
expect(data.budget.total).toBe(300);
|
|
expect(data.packing.total).toBe(1);
|
|
expect(data.reservations).toHaveLength(1);
|
|
expect(data.collab_notes).toHaveLength(1);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for non-member', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, other.id);
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('is not blocked for demo user (read-only tool)', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id, { title: 'Demo Trip' });
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBeFalsy();
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip.title).toBe('Demo Trip');
|
|
});
|
|
});
|
|
|
|
it('includes todos, files, pollCount, messageCount in response', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Summary Test' });
|
|
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(Array.isArray(data.todos)).toBe(true);
|
|
expect(typeof data.pollCount).toBe('number');
|
|
expect(typeof data.messageCount).toBe('number');
|
|
});
|
|
});
|
|
|
|
// Regression — GHSA-qvw8-w937-vcmq: a token WITHOUT trips:read must not receive
|
|
// member emails, the itinerary, or accommodations. The tool stays registered for
|
|
// navigation but only surfaces the trip id + title.
|
|
it('withholds members, days and accommodations from a token without trips:read', async () => {
|
|
const { user } = createUser(testDb, { email: 'owner@test.example.com' });
|
|
const { user: member } = createUser(testDb, { email: 'member@test.example.com' });
|
|
const trip = createTrip(testDb, user.id, { title: 'Confidential Trip' });
|
|
addTripMember(testDb, trip.id, member.id);
|
|
const day = createDay(testDb, trip.id);
|
|
const place = createPlace(testDb, trip.id, { name: 'Colosseum', lat: 41.89, lng: 12.49 });
|
|
createDayAssignment(testDb, day.id, place.id);
|
|
createDayAccommodation(testDb, trip.id, place.id, day.id, day.id);
|
|
|
|
const h = await createMcpHarness({ userId: user.id, withResources: false, scopes: ['weather:read'] });
|
|
try {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
// Navigation still works…
|
|
expect(data.trip.id).toBe(trip.id);
|
|
expect(data.trip.title).toBe('Confidential Trip');
|
|
// …but the confidential core bucket is withheld.
|
|
expect(data.members).toBeUndefined();
|
|
expect(data.days).toBeUndefined();
|
|
expect(data.accommodations).toBeUndefined();
|
|
// No member email must leak anywhere in the payload.
|
|
expect(JSON.stringify(data)).not.toContain('owner@test.example.com');
|
|
expect(JSON.stringify(data)).not.toContain('member@test.example.com');
|
|
} finally {
|
|
await h.cleanup();
|
|
}
|
|
});
|
|
|
|
it('returns the full core bucket for a token that has trips:read', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Scoped Trip' });
|
|
addTripMember(testDb, trip.id, member.id);
|
|
createDay(testDb, trip.id);
|
|
|
|
const h = await createMcpHarness({ userId: user.id, withResources: false, scopes: ['trips:read'] });
|
|
try {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip.title).toBe('Scoped Trip');
|
|
expect(data.members.owner.id).toBe(user.id);
|
|
expect(data.members.collaborators).toHaveLength(1);
|
|
expect(data.days).toHaveLength(1);
|
|
} finally {
|
|
await h.cleanup();
|
|
}
|
|
});
|
|
|
|
// Regression: get_trip_summary must hide another member's private packing items (#858).
|
|
it('hides another member\'s private packing item from the summary', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id, { title: 'Shared Trip' });
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await makePackingItem(orm, trip.id, { name: 'Secret gift', category: 'Misc', checked: 0, is_private: 1, owner: owner.id });
|
|
await makePackingItem(orm, trip.id, { name: 'Sunscreen', category: 'Misc', checked: 0, is_private: 0, owner: owner.id });
|
|
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
const names = (data.packing?.items || []).map((i: any) => i.name);
|
|
expect(names).toContain('Sunscreen'); // common item visible
|
|
expect(names).not.toContain('Secret gift'); // owner's private item hidden from the member
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Resources (moved from resources.test.ts with the DI port — the registry the
|
|
// withTools harness attaches now registers them)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Resource: trek://trips', () => {
|
|
it('returns all trips the user owns or is a member of', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
createTrip(testDb, user.id, { title: 'My Trip' });
|
|
const sharedTrip = createTrip(testDb, other.id, { title: 'Shared Trip' });
|
|
addTripMember(testDb, sharedTrip.id, user.id);
|
|
// Trip from another user (not accessible)
|
|
createTrip(testDb, other.id, { title: 'Other Trip' });
|
|
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: 'trek://trips' });
|
|
const trips = parseResourceResult(result) as any[];
|
|
expect(trips).toHaveLength(2);
|
|
const titles = trips.map((t) => t.title);
|
|
expect(titles).toContain('My Trip');
|
|
expect(titles).toContain('Shared Trip');
|
|
expect(titles).not.toContain('Other Trip');
|
|
});
|
|
});
|
|
|
|
it('excludes archived trips', async () => {
|
|
const { user } = createUser(testDb);
|
|
createTrip(testDb, user.id, { title: 'Active Trip' });
|
|
const archived = createTrip(testDb, user.id, { title: 'Archived Trip' });
|
|
await updateRows(orm, Trips, { id: archived.id }, { is_archived: 1 });
|
|
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: 'trek://trips' });
|
|
const trips = parseResourceResult(result) as any[];
|
|
expect(trips).toHaveLength(1);
|
|
expect(trips[0].title).toBe('Active Trip');
|
|
});
|
|
});
|
|
|
|
it('returns empty array when user has no trips', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: 'trek://trips' });
|
|
const trips = parseResourceResult(result) as any[];
|
|
expect(trips).toEqual([]);
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Resource: trek://trips/{tripId}', () => {
|
|
it('returns trip data for an accessible trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Paris Trip' });
|
|
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}` });
|
|
const data = parseResourceResult(result) as any;
|
|
expect(data.title).toBe('Paris Trip');
|
|
expect(data.id).toBe(trip.id);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for inaccessible trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const otherTrip = createTrip(testDb, other.id, { title: 'Private' });
|
|
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: `trek://trips/${otherTrip.id}` });
|
|
const data = parseResourceResult(result) as any;
|
|
expect(data.error).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('returns access denied for non-existent ID', async () => {
|
|
const { user } = createUser(testDb);
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: 'trek://trips/99999' });
|
|
const data = parseResourceResult(result) as any;
|
|
expect(data.error).toBeTruthy();
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Resource: trek://trips/{tripId}/members', () => {
|
|
it('returns owner and collaborators', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/members` });
|
|
const data = parseResourceResult(result) as any;
|
|
expect(data.owner).toBeTruthy();
|
|
expect(data.owner.id).toBe(user.id);
|
|
expect(data.members).toHaveLength(1);
|
|
expect(data.members[0].id).toBe(member.id);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for unauthorized trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, other.id);
|
|
|
|
await withHarness(user.id, async (harness) => {
|
|
const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/members` });
|
|
const data = parseResourceResult(result) as any;
|
|
expect(data.error).toBeTruthy();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Deprecation notice (fire-once closure riding the registry attach ctx)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('static-token deprecation notice', () => {
|
|
it('list_trips surfaces the notice exactly once and still carries the payload', async () => {
|
|
const { user } = createUser(testDb);
|
|
createTrip(testDb, user.id, { title: 'Noticed' });
|
|
// Mirror the fire-once closure built per session in src/mcp/index.ts.
|
|
let emitted = false;
|
|
const getDeprecationNotice = () => {
|
|
if (emitted) return null;
|
|
emitted = true;
|
|
return 'static tokens are deprecated';
|
|
};
|
|
const h = await createMcpHarness({ userId: user.id, withResources: false, isStaticToken: true, getDeprecationNotice });
|
|
try {
|
|
const first = await h.client.callTool({ name: 'list_trips', arguments: {} });
|
|
expect(first.isError).toBe(true);
|
|
const texts = (first.content as { type: string; text: string }[]).map((c) => c.text);
|
|
expect(texts[0]).toContain('deprecated');
|
|
expect(JSON.parse(texts[1]).trips[0].title).toBe('Noticed');
|
|
// Second call: the closure already fired — plain payload, no error.
|
|
const second = await h.client.callTool({ name: 'list_trips', arguments: {} });
|
|
expect(second.isError).toBeFalsy();
|
|
expect((parseToolResult(second) as any).trips).toHaveLength(1);
|
|
} finally {
|
|
await h.cleanup();
|
|
}
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Scope gating — declarative trips:write markers plus the predicate escape
|
|
// hatches (canReadTrips accepts trips:delete / trips:share; delete_trip rides
|
|
// trips:delete, the share tools trips:share)
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('scope gating', () => {
|
|
async function toolNames(scopes: string[] | null): Promise<string[]> {
|
|
const h = await createMcpHarness({ userId: 1, withResources: false, scopes });
|
|
try {
|
|
const { tools } = await h.client.listTools();
|
|
return tools.map((t) => t.name);
|
|
} finally {
|
|
await h.cleanup();
|
|
}
|
|
}
|
|
|
|
const WRITE_TOOLS = ['create_trip', 'update_trip', 'add_trip_member', 'remove_trip_member', 'leave_trip', 'copy_trip'];
|
|
const READ_TOOLS = ['list_trip_members', 'export_trip_ics', 'search_cover_images'];
|
|
const NAV_TOOLS = ['list_trips', 'get_trip_summary'];
|
|
const SHARE_TOOLS = ['get_share_link', 'create_share_link', 'delete_share_link'];
|
|
|
|
it('null scopes (trek_ PAT) exposes the full surface', async () => {
|
|
const names = await toolNames(null);
|
|
for (const t of [...WRITE_TOOLS, ...READ_TOOLS, ...NAV_TOOLS, 'delete_trip', ...SHARE_TOOLS]) {
|
|
expect(names).toContain(t);
|
|
}
|
|
});
|
|
|
|
it('trips:read exposes reads + navigation but no writes/delete/share', async () => {
|
|
const names = await toolNames(['trips:read']);
|
|
for (const t of [...READ_TOOLS, ...NAV_TOOLS]) expect(names).toContain(t);
|
|
for (const t of [...WRITE_TOOLS, 'delete_trip', ...SHARE_TOOLS]) expect(names).not.toContain(t);
|
|
});
|
|
|
|
it('trips:delete alone still grants the trip reads (canReadTrips parity) plus delete_trip', async () => {
|
|
const names = await toolNames(['trips:delete']);
|
|
expect(names).toContain('delete_trip');
|
|
for (const t of [...READ_TOOLS, ...NAV_TOOLS]) expect(names).toContain(t);
|
|
for (const t of WRITE_TOOLS) expect(names).not.toContain(t);
|
|
});
|
|
|
|
it('trips:share alone grants the share tools and the trip reads, nothing else', async () => {
|
|
const names = await toolNames(['trips:share']);
|
|
for (const t of [...SHARE_TOOLS, ...READ_TOOLS, ...NAV_TOOLS]) expect(names).toContain(t);
|
|
for (const t of [...WRITE_TOOLS, 'delete_trip']) expect(names).not.toContain(t);
|
|
});
|
|
|
|
it('an unrelated scope keeps only the navigation tools', async () => {
|
|
const names = await toolNames(['weather:read']);
|
|
for (const t of NAV_TOOLS) expect(names).toContain(t);
|
|
for (const t of [...WRITE_TOOLS, ...READ_TOOLS, 'delete_trip', ...SHARE_TOOLS]) expect(names).not.toContain(t);
|
|
});
|
|
});
|