k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-20 05:56:53 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
09227ec0d1e7bbc8cfedf423926e96f2b3e85bea
TREK/server/tests/unit/mcp/tools-trips.test.ts
T

1093 lines
45 KiB
TypeScript
Raw Blame History

/**
* Unit tests for the trip MCP surface (TripsMcp, DI-discovered): create_trip,
* update_trip, delete_trip, list_trips, get_trip_summary tools, the
* trek://trips / trek://trips/{tripId} resources (moved here from
* resources.test.ts with the DI port — the withTools harness attaches the
* nest-mcp registry that now registers them), the fire-once deprecation
* notice riding the attach ctx, and the scope gating (declarative
* trips:write markers + the canReadTrips/canDeleteTrips predicates).
*/
import { db as testDb } from '../../../src/db/database';
import { Days } from '../../../src/db/entities/Days.entity';
import { Trips } from '../../../src/db/entities/Trips.entity';
import { VacayEntries } from '../../../src/db/entities/VacayEntries.entity';
import { VacayUserYears } from '../../../src/db/entities/VacayUserYears.entity';
import { VacayYears } from '../../../src/db/entities/VacayYears.entity';
import {
createUser,
createTrip,
createDay,
createPlace,
addTripMember,
createBudgetItem,
createPackingItem,
createReservation,
createDayNote,
createCollabNote,
createDayAssignment,
createDayAccommodation,
} from '../../helpers/factories';
import { makePackingItem } from '../../helpers/factories/packing';
import { countRows, findRow, findRows, insertRow, insertRows, updateRows } from '../../helpers/factories/rows';
import { setUserSetting } from '../../helpers/factories/settings';
import { makeVacayEntry, makeVacayPlan, addVacayPlanMember } from '../../helpers/factories/vacay';
import { FakeRealtimeService } from '../../helpers/fake-realtime';
import { createMcpHarness, parseToolResult, parseResourceResult, type McpHarness } from '../../helpers/mcp-harness';
import { resetTestDb } from '../../helpers/test-db';
import { createTestOrm, type TestOrm } from '../../helpers/test-orm';
import { MAX_TRIP_DAYS } from '@trek/shared';
import { describe, it, expect, vi, beforeAll, beforeEach, afterEach, afterAll } from 'vitest';
vi.mock('../../../src/db/database', async () => {
const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
return buildDbMock(createSnapshotTestDb());
});
const realtime = new FakeRealtimeService();
const broadcastMock = realtime.broadcastMock;
let orm: TestOrm;
beforeAll(async () => {
orm = await createTestOrm(testDb);
});
beforeEach(() => {
resetTestDb(testDb);
broadcastMock.mockClear();
delete process.env.DEMO_MODE;
});
// Only search_cover_images stubs fetch, and it stubs a different response per case.
afterEach(() => {
vi.unstubAllGlobals();
});
afterAll(async () => {
await orm.close();
testDb.close();
});
async function tripRow(id: number) {
return (await findRow(orm, Trips, { id }))!;
}
/** The vacay entry dates of the user in the plan between `from` and `to`, both included, in date order. */
async function vacayDatesBetween(planId: number, userId: number, from: string, to: string): Promise<string[]> {
const rows = await findRows(
orm,
VacayEntries,
{ plan: planId, user: userId, date: { $gte: from, $lte: to } },
{ date: 'asc' },
);
return rows.map((r) => r.date);
}
/** A vacay plan for the user with the year 2026 open and 30 days in it. */
async function vacayPlanWithYear(userId: number): Promise<number> {
const { id: planId } = await makeVacayPlan(orm, userId);
await insertRow(orm, VacayYears, { plan: planId, year: 2026 });
await insertRow(orm, VacayUserYears, { user: userId, plan: planId, year: 2026, vacation_days: 30, carried_over: 0 });
return planId;
}
async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
const h = await createMcpHarness({ realtime, userId, withResources: false });
try {
await fn(h);
} finally {
await h.cleanup();
}
}
// ---------------------------------------------------------------------------
// create_trip
// ---------------------------------------------------------------------------
describe('Tool: create_trip', () => {
it('creates a trip with title only and generates 7 default days', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Summer Escape' } });
const data = parseToolResult(result) as any;
expect(data.trip).toBeTruthy();
expect(data.trip.title).toBe('Summer Escape');
const days = await countRows(orm, Days, { trip: data.trip.id });
expect(days).toBe(7);
});
});
it('creates a trip with dates and auto-generates correct number of days', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Paris Trip', start_date: '2026-07-01', end_date: '2026-07-05' },
});
const data = parseToolResult(result) as any;
const days = await countRows(orm, Days, { trip: data.trip.id });
expect(days).toBe(5);
});
});
it('generates every day of a trip longer than a year (#2403)', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Long Trip', start_date: '2025-01-26', end_date: '2026-01-28' },
});
const data = parseToolResult(result) as any;
const days = await countRows(orm, Days, { trip: data.trip.id });
expect(days).toBe(368);
});
});
it('refuses a date range longer than MAX_TRIP_DAYS instead of cutting the days short', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Decade', start_date: '2026-01-01', end_date: '2036-01-01' },
});
expect(result.isError).toBe(true);
expect(JSON.stringify(result.content)).toContain(`at most ${MAX_TRIP_DAYS} days`);
expect(await countRows(orm, Trips)).toBe(0);
});
});
it('returns error for invalid start_date format', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Trip', start_date: 'not-a-date' },
});
expect(result.isError).toBe(true);
});
});
it('returns error when end_date is before start_date', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Trip', start_date: '2026-07-05', end_date: '2026-07-01' },
});
expect(result.isError).toBe(true);
});
});
it('blocks demo user', async () => {
process.env.DEMO_MODE = 'true';
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Demo Trip' } });
expect(result.isError).toBe(true);
});
});
it('gives a dateless trip the requested day_count instead of the default 7', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Open Ended', day_count: 12 },
});
const data = parseToolResult(result) as any;
const days = await countRows(orm, Days, { trip: data.trip.id });
expect(days).toBe(12);
const row = await tripRow(data.trip.id);
expect(row.start_date).toBeNull();
expect(row.end_date).toBeNull();
});
});
it('refuses a day_count outside 1..MAX_TRIP_DAYS', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
expect(
(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Zero', day_count: 0 } })).isError,
).toBe(true);
expect(
(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Huge', day_count: MAX_TRIP_DAYS + 1 } }))
.isError,
).toBe(true);
expect(await countRows(orm, Trips)).toBe(0);
});
});
it('stores the requested reminder_days', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'create_trip',
arguments: { title: 'Reminded', reminder_days: 14 },
});
const data = parseToolResult(result) as any;
const row = await tripRow(data.trip.id);
expect(row.reminder_days).toBe(14);
});
});
it('turns the reminder off with reminder_days 0 rather than falling back to 3', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'create_trip', arguments: { title: 'Quiet', reminder_days: 0 } });
const data = parseToolResult(result) as any;
const row = await tripRow(data.trip.id);
expect(row.reminder_days).toBe(0);
});
});
it('refuses a reminder_days outside 0..30', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
expect(
(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Early', reminder_days: 31 } })).isError,
).toBe(true);
expect(
(await h.client.callTool({ name: 'create_trip', arguments: { title: 'Negative', reminder_days: -1 } })).isError,
).toBe(true);
expect(await countRows(orm, Trips)).toBe(0);
});
});
it('gives a trip without a currency the display currency from the settings, not EUR', async () => {
const { user } = createUser(testDb);
await setUserSetting(orm, user.id, 'default_currency', JSON.stringify('USD'));
await withHarness(user.id, async (h) => {
const fromSettings = parseToolResult(
await h.client.callTool({ name: 'create_trip', arguments: { title: 'Road trip' } }),
) as any;
expect(fromSettings.trip.currency).toBe('USD');
const explicit = parseToolResult(
await h.client.callTool({ name: 'create_trip', arguments: { title: 'Tokyo', currency: 'JPY' } }),
) as any;
expect(explicit.trip.currency).toBe('JPY');
});
});
it('falls back to EUR when neither the user nor the admin set a display currency', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const data = parseToolResult(
await h.client.callTool({ name: 'create_trip', arguments: { title: 'Plain' } }),
) as any;
expect(data.trip.currency).toBe('EUR');
});
});
});
// ---------------------------------------------------------------------------
// update_trip
// ---------------------------------------------------------------------------
describe('Tool: update_trip', () => {
it('updates trip title', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Old Title' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, title: 'New Title' },
});
const data = parseToolResult(result) as any;
expect(data.trip.title).toBe('New Title');
});
});
it('partial update preserves unspecified fields', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'My Trip', description: 'A great trip' });
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Renamed' } });
const updated = await tripRow(trip.id);
expect(updated.title).toBe('Renamed');
expect(updated.description).toBe('A great trip');
});
});
it('broadcasts trip:updated event', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Updated' } });
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'trip:updated', expect.any(Object));
});
});
it('returns access denied for non-member', async () => {
const { user } = createUser(testDb);
const { user: other } = createUser(testDb);
const trip = createTrip(testDb, other.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Hack' } });
expect(result.isError).toBe(true);
});
});
it('blocks demo user', async () => {
process.env.DEMO_MODE = 'true';
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
const trip = createTrip(testDb, user.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'New' } });
expect(result.isError).toBe(true);
});
});
it('shifts owner vacay entries when update_trip moves trip window by fixed offset', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { start_date: '2026-08-01', end_date: '2026-08-09' });
// Materialize active vacay plan for owner and entries in old trip window.
const planId = await vacayPlanWithYear(user.id);
for (const d of ['2026-08-03', '2026-08-04', '2026-08-05', '2026-08-06', '2026-08-07']) {
await makeVacayEntry(orm, planId, user.id, d, { note: '' });
}
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, start_date: '2026-08-08', end_date: '2026-08-16' },
});
const data = parseToolResult(result) as any;
expect(data.trip.start_date).toBe('2026-08-08');
expect(data.trip.end_date).toBe('2026-08-16');
});
const oldWindow = await vacayDatesBetween(planId, user.id, '2026-08-01', '2026-08-09');
expect(oldWindow).toHaveLength(0);
const shifted = await vacayDatesBetween(planId, user.id, '2026-08-08', '2026-08-16');
expect(shifted).toEqual(['2026-08-10', '2026-08-11', '2026-08-12', '2026-08-13', '2026-08-14']);
});
it('shifts the owner entries in the plan they are active in, a shared plan they joined included (#2604)', async () => {
const { user } = createUser(testDb);
const { user: otherOwner } = createUser(testDb);
const trip = createTrip(testDb, user.id, { start_date: '2026-09-01', end_date: '2026-09-07' });
// Joining a plan moves the owner's days into it, so that is where they live.
const { id: sharedPlanId } = await makeVacayPlan(orm, otherOwner.id);
await addVacayPlanMember(orm, sharedPlanId, user.id, 'accepted');
for (const d of ['2026-09-02', '2026-09-03']) {
await makeVacayEntry(orm, sharedPlanId, user.id, d, { note: '' });
}
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, start_date: '2026-09-08', end_date: '2026-09-14' },
});
expect(result.isError).toBeFalsy();
});
const oldWindow = await vacayDatesBetween(sharedPlanId, user.id, '2026-09-01', '2026-09-07');
expect(oldWindow).toHaveLength(0);
const shifted = await vacayDatesBetween(sharedPlanId, user.id, '2026-09-08', '2026-09-14');
expect(shifted).toEqual(['2026-09-09', '2026-09-10']);
});
it('clear_dates turns a dated trip back into a dateless one and un-dates its days', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, clear_dates: true },
});
expect(result.isError).toBeFalsy();
const row = await tripRow(trip.id);
expect(row.start_date).toBeNull();
expect(row.end_date).toBeNull();
const dated = await countRows(orm, Days, { trip: trip.id, date: { $ne: null } });
expect(dated).toBe(0);
});
});
it('clear_dates with a day_count resizes the now dateless trip', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, clear_dates: true, day_count: 3 } });
const days = await countRows(orm, Days, { trip: trip.id });
expect(days).toBe(3);
});
});
it('refuses clear_dates alongside a start_date and leaves the trip untouched', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, clear_dates: true, start_date: '2026-08-01' },
});
expect(result.isError).toBe(true);
const row = await tripRow(trip.id);
expect(row.start_date).toBe('2026-07-01');
});
});
it('resizes a dateless trip with day_count', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
await insertRows(orm, Days, [
{ trip: trip.id, day_number: 1, date: null },
{ trip: trip.id, day_number: 2, date: null },
]);
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, day_count: 6 } });
const days = await countRows(orm, Days, { trip: trip.id });
expect(days).toBe(6);
});
});
it('refuses a day_count outside 1..MAX_TRIP_DAYS', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Untouched' });
await withHarness(user.id, async (h) => {
expect(
(await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, day_count: 0 } })).isError,
).toBe(true);
expect(
(await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, day_count: MAX_TRIP_DAYS + 1 } }))
.isError,
).toBe(true);
expect(await countRows(orm, Days, { trip: trip.id })).toBe(0);
});
});
it('says in its description what shortening a dated trip takes, and where the result lists it', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (h) => {
const tool = (await h.client.listTools()).tools.find((t) => t.name === 'update_trip');
expect(tool?.description).toContain('Shortening a dated trip deletes its last days by position');
expect(tool?.description).toContain('removed_days');
});
});
it('lists the days an earlier end removed, as they stood before, and none for a rename', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { start_date: '2026-07-01', end_date: '2026-07-05' });
const days = await findRows(orm, Days, { trip: trip.id }, { day_number: 'asc' });
await withHarness(user.id, async (h) => {
type Answer = { trip: { end_date: string; title: string }; removed_days?: unknown[] };
const shortened = parseToolResult(
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, end_date: '2026-07-03' } }),
) as Answer;
expect(shortened.trip.end_date).toBe('2026-07-03');
expect(shortened.removed_days).toEqual([
{ id: days[3].id, day_number: 4, date: '2026-07-04', reason: 'overflow' },
{ id: days[4].id, day_number: 5, date: '2026-07-05', reason: 'overflow' },
]);
const renamed = parseToolResult(
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, title: 'Shorter' } }),
) as Answer;
expect(renamed.trip.title).toBe('Shorter');
expect(renamed).not.toHaveProperty('removed_days');
});
});
it('refuses a date range longer than MAX_TRIP_DAYS and leaves the trip untouched', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Untouched', start_date: '2026-07-01', end_date: '2026-07-07' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, end_date: '2036-07-01' },
});
expect(result.isError).toBe(true);
expect(JSON.stringify(result.content)).toContain(`at most ${MAX_TRIP_DAYS} days`);
const row = await tripRow(trip.id);
expect(row.end_date).toBe('2026-07-07');
});
});
it('changes reminder_days and can turn the reminder off', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, reminder_days: 10 } });
expect((await tripRow(trip.id)).reminder_days).toBe(10);
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, reminder_days: 0 } });
expect((await tripRow(trip.id)).reminder_days).toBe(0);
});
});
it('refuses a reminder_days outside 0..30 and keeps the stored value', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({
name: 'update_trip',
arguments: { tripId: trip.id, reminder_days: 31 },
});
expect(result.isError).toBe(true);
expect((await tripRow(trip.id)).reminder_days).toBe(3);
});
});
it('clears the description with an explicit null', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { description: 'A great trip' });
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, description: null } });
const row = await tripRow(trip.id);
expect(row.description).toBeNull();
});
});
it('clears the cover image with an explicit null', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
await updateRows(orm, Trips, { id: trip.id }, { cover_image: '/uploads/covers/old.jpg' });
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'update_trip', arguments: { tripId: trip.id, cover_image: null } });
const row = await tripRow(trip.id);
expect(row.cover_image).toBeNull();
});
});
});
// ---------------------------------------------------------------------------
// search_cover_images
// ---------------------------------------------------------------------------
describe('Tool: search_cover_images', () => {
function stubUnsplash(body: unknown, init: { ok?: boolean; status?: number } = {}) {
vi.stubGlobal(
'fetch',
vi.fn(async () => ({
ok: init.ok ?? true,
status: init.status ?? 200,
json: async () => body,
})),
);
}
it('returns the photo candidates for a query', async () => {
const { user } = createUser(testDb);
stubUnsplash({
results: [
{
id: 'p1',
urls: {
regular: 'https://images.unsplash.com/photo-1.jpg',
small: 'https://images.unsplash.com/thumb-1.jpg',
},
alt_description: 'Rooftops at sunset',
user: { name: 'Ada L.' },
links: { html: 'https://unsplash.com/photos/p1' },
},
],
});
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'search_cover_images', arguments: { query: 'Lisbon rooftops' } });
const data = parseToolResult(result) as any;
expect(data.photos).toHaveLength(1);
expect(data.photos[0].url).toBe('https://images.unsplash.com/photo-1.jpg');
expect(data.photos[0].photographer).toBe('Ada L.');
});
});
it('reports an upstream failure as a tool error', async () => {
const { user } = createUser(testDb);
stubUnsplash({ errors: ['Rate Limit Exceeded'] }, { ok: false, status: 429 });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'search_cover_images', arguments: { query: 'Lisbon' } });
expect(result.isError).toBe(true);
expect((result.content as { text: string }[])[0].text).toBe('Rate Limit Exceeded');
});
});
it('refuses an empty query without reaching Unsplash', async () => {
const { user } = createUser(testDb);
const fetchMock = vi.fn();
vi.stubGlobal('fetch', fetchMock);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'search_cover_images', arguments: { query: '' } });
expect(result.isError).toBe(true);
expect(fetchMock).not.toHaveBeenCalled();
});
});
it('saves nothing on the trip', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
stubUnsplash({ results: [] });
await withHarness(user.id, async (h) => {
await h.client.callTool({ name: 'search_cover_images', arguments: { query: 'Lisbon' } });
const row = await tripRow(trip.id);
expect(row.cover_image).toBeNull();
});
});
});
// ---------------------------------------------------------------------------
// delete_trip
// ---------------------------------------------------------------------------
describe('Tool: delete_trip', () => {
it('owner can delete trip', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
const data = parseToolResult(result) as any;
expect(data.success).toBe(true);
const gone = await findRow(orm, Trips, { id: trip.id });
expect(gone).toBeNull();
});
});
it('non-owner member cannot delete trip', async () => {
const { user } = createUser(testDb);
const { user: owner } = createUser(testDb);
const trip = createTrip(testDb, owner.id);
addTripMember(testDb, trip.id, user.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
expect(result.isError).toBe(true);
const stillExists = await findRow(orm, Trips, { id: trip.id });
expect(stillExists).toBeTruthy();
});
});
it('blocks demo user', async () => {
process.env.DEMO_MODE = 'true';
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
const trip = createTrip(testDb, user.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'delete_trip', arguments: { tripId: trip.id } });
expect(result.isError).toBe(true);
});
});
});
// ---------------------------------------------------------------------------
// list_trips
// ---------------------------------------------------------------------------
describe('Tool: list_trips', () => {
it('returns owned and member trips', async () => {
const { user } = createUser(testDb);
const { user: other } = createUser(testDb);
createTrip(testDb, user.id, { title: 'My Trip' });
const shared = createTrip(testDb, other.id, { title: 'Shared' });
addTripMember(testDb, shared.id, user.id);
createTrip(testDb, other.id, { title: 'Inaccessible' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'list_trips', arguments: {} });
const data = parseToolResult(result) as any;
expect(data.trips).toHaveLength(2);
const titles = data.trips.map((t: any) => t.title);
expect(titles).toContain('My Trip');
expect(titles).toContain('Shared');
});
});
it('excludes archived trips by default', async () => {
const { user } = createUser(testDb);
createTrip(testDb, user.id, { title: 'Active' });
const archived = createTrip(testDb, user.id, { title: 'Archived' });
await updateRows(orm, Trips, { id: archived.id }, { is_archived: 1 });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'list_trips', arguments: {} });
const data = parseToolResult(result) as any;
expect(data.trips).toHaveLength(1);
expect(data.trips[0].title).toBe('Active');
});
});
it('includes archived trips when include_archived is true', async () => {
const { user } = createUser(testDb);
createTrip(testDb, user.id, { title: 'Active' });
const archived = createTrip(testDb, user.id, { title: 'Archived' });
await updateRows(orm, Trips, { id: archived.id }, { is_archived: 1 });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'list_trips', arguments: { include_archived: true } });
const data = parseToolResult(result) as any;
expect(data.trips).toHaveLength(2);
});
});
});
// ---------------------------------------------------------------------------
// get_trip_summary
// ---------------------------------------------------------------------------
describe('Tool: get_trip_summary', () => {
it('returns full denormalized trip snapshot', async () => {
const { user } = createUser(testDb);
const { user: member } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Full Trip' });
addTripMember(testDb, trip.id, member.id);
const day = createDay(testDb, trip.id);
const place = createPlace(testDb, trip.id, { name: 'Colosseum' });
const assignment = createDayAssignment(testDb, day.id, place.id);
createDayNote(testDb, day.id, trip.id, { text: 'Check in' });
createBudgetItem(testDb, trip.id, { name: 'Hotel', total_price: 300 });
createPackingItem(testDb, trip.id, { name: 'Passport' });
createReservation(testDb, trip.id, { title: 'Flight', type: 'flight' });
createCollabNote(testDb, trip.id, user.id, { title: 'Plan' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
const data = parseToolResult(result) as any;
expect(data.trip.title).toBe('Full Trip');
expect(data.members.owner.id).toBe(user.id);
expect(data.members.collaborators).toHaveLength(1);
expect(data.days).toHaveLength(1);
expect(data.days[0].assignments).toHaveLength(1);
expect(data.days[0].notes).toHaveLength(1);
expect(data.budget.item_count).toBe(1);
expect(data.budget.total).toBe(300);
expect(data.packing.total).toBe(1);
expect(data.reservations).toHaveLength(1);
expect(data.collab_notes).toHaveLength(1);
});
});
it('returns access denied for non-member', async () => {
const { user } = createUser(testDb);
const { user: other } = createUser(testDb);
const trip = createTrip(testDb, other.id);
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
expect(result.isError).toBe(true);
});
});
it('is not blocked for demo user (read-only tool)', async () => {
process.env.DEMO_MODE = 'true';
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
const trip = createTrip(testDb, user.id, { title: 'Demo Trip' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
expect(result.isError).toBeFalsy();
const data = parseToolResult(result) as any;
expect(data.trip.title).toBe('Demo Trip');
});
});
it('includes todos, files, pollCount, messageCount in response', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Summary Test' });
await withHarness(user.id, async (h) => {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
const data = parseToolResult(result) as any;
expect(Array.isArray(data.todos)).toBe(true);
expect(typeof data.pollCount).toBe('number');
expect(typeof data.messageCount).toBe('number');
});
});
// Regression — GHSA-qvw8-w937-vcmq: a token WITHOUT trips:read must not receive
// member emails, the itinerary, or accommodations. The tool stays registered for
// navigation but only surfaces the trip id + title.
it('withholds members, days and accommodations from a token without trips:read', async () => {
const { user } = createUser(testDb, { email: 'owner@test.example.com' });
const { user: member } = createUser(testDb, { email: 'member@test.example.com' });
const trip = createTrip(testDb, user.id, { title: 'Confidential Trip' });
addTripMember(testDb, trip.id, member.id);
const day = createDay(testDb, trip.id);
const place = createPlace(testDb, trip.id, { name: 'Colosseum', lat: 41.89, lng: 12.49 });
createDayAssignment(testDb, day.id, place.id);
createDayAccommodation(testDb, trip.id, place.id, day.id, day.id);
const h = await createMcpHarness({ realtime, userId: user.id, withResources: false, scopes: ['weather:read'] });
try {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
const data = parseToolResult(result) as any;
// Navigation still works…
expect(data.trip.id).toBe(trip.id);
expect(data.trip.title).toBe('Confidential Trip');
// …but the confidential core bucket is withheld.
expect(data.members).toBeUndefined();
expect(data.days).toBeUndefined();
expect(data.accommodations).toBeUndefined();
// No member email must leak anywhere in the payload.
expect(JSON.stringify(data)).not.toContain('owner@test.example.com');
expect(JSON.stringify(data)).not.toContain('member@test.example.com');
} finally {
await h.cleanup();
}
});
it('returns the full core bucket for a token that has trips:read', async () => {
const { user } = createUser(testDb);
const { user: member } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Scoped Trip' });
addTripMember(testDb, trip.id, member.id);
createDay(testDb, trip.id);
const h = await createMcpHarness({ realtime, userId: user.id, withResources: false, scopes: ['trips:read'] });
try {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
const data = parseToolResult(result) as any;
expect(data.trip.title).toBe('Scoped Trip');
expect(data.members.owner.id).toBe(user.id);
expect(data.members.collaborators).toHaveLength(1);
expect(data.days).toHaveLength(1);
} finally {
await h.cleanup();
}
});
// Regression: get_trip_summary must hide another member's private packing items (#858).
it("hides another member's private packing item from the summary", async () => {
const { user: owner } = createUser(testDb);
const { user: member } = createUser(testDb);
const trip = createTrip(testDb, owner.id, { title: 'Shared Trip' });
addTripMember(testDb, trip.id, member.id);
await makePackingItem(orm, trip.id, {
name: 'Secret gift',
category: 'Misc',
checked: 0,
is_private: 1,
owner: owner.id,
});
await makePackingItem(orm, trip.id, {
name: 'Sunscreen',
category: 'Misc',
checked: 0,
is_private: 0,
owner: owner.id,
});
await withHarness(member.id, async (h) => {
const result = await h.client.callTool({ name: 'get_trip_summary', arguments: { tripId: trip.id } });
const data = parseToolResult(result) as any;
const names = (data.packing?.items || []).map((i: any) => i.name);
expect(names).toContain('Sunscreen'); // common item visible
expect(names).not.toContain('Secret gift'); // owner's private item hidden from the member
});
});
});
// ---------------------------------------------------------------------------
// Resources (moved from resources.test.ts with the DI port — the registry the
// withTools harness attaches now registers them)
// ---------------------------------------------------------------------------
describe('Resource: trek://trips', () => {
it('returns all trips the user owns or is a member of', async () => {
const { user } = createUser(testDb);
const { user: other } = createUser(testDb);
createTrip(testDb, user.id, { title: 'My Trip' });
const sharedTrip = createTrip(testDb, other.id, { title: 'Shared Trip' });
addTripMember(testDb, sharedTrip.id, user.id);
// Trip from another user (not accessible)
createTrip(testDb, other.id, { title: 'Other Trip' });
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: 'trek://trips' });
const trips = parseResourceResult(result) as any[];
expect(trips).toHaveLength(2);
const titles = trips.map((t) => t.title);
expect(titles).toContain('My Trip');
expect(titles).toContain('Shared Trip');
expect(titles).not.toContain('Other Trip');
});
});
it('excludes archived trips', async () => {
const { user } = createUser(testDb);
createTrip(testDb, user.id, { title: 'Active Trip' });
const archived = createTrip(testDb, user.id, { title: 'Archived Trip' });
await updateRows(orm, Trips, { id: archived.id }, { is_archived: 1 });
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: 'trek://trips' });
const trips = parseResourceResult(result) as any[];
expect(trips).toHaveLength(1);
expect(trips[0].title).toBe('Active Trip');
});
});
it('returns empty array when user has no trips', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: 'trek://trips' });
const trips = parseResourceResult(result) as any[];
expect(trips).toEqual([]);
});
});
});
describe('Resource: trek://trips/{tripId}', () => {
it('returns trip data for an accessible trip', async () => {
const { user } = createUser(testDb);
const trip = createTrip(testDb, user.id, { title: 'Paris Trip' });
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}` });
const data = parseResourceResult(result) as any;
expect(data.title).toBe('Paris Trip');
expect(data.id).toBe(trip.id);
});
});
it('returns access denied for inaccessible trip', async () => {
const { user } = createUser(testDb);
const { user: other } = createUser(testDb);
const otherTrip = createTrip(testDb, other.id, { title: 'Private' });
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: `trek://trips/${otherTrip.id}` });
const data = parseResourceResult(result) as any;
expect(data.error).toBeTruthy();
});
});
it('returns access denied for non-existent ID', async () => {
const { user } = createUser(testDb);
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: 'trek://trips/99999' });
const data = parseResourceResult(result) as any;
expect(data.error).toBeTruthy();
});
});
});
describe('Resource: trek://trips/{tripId}/members', () => {
it('returns owner and collaborators', async () => {
const { user } = createUser(testDb);
const { user: member } = createUser(testDb);
const trip = createTrip(testDb, user.id);
addTripMember(testDb, trip.id, member.id);
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/members` });
const data = parseResourceResult(result) as any;
expect(data.owner).toBeTruthy();
expect(data.owner.id).toBe(user.id);
expect(data.members).toHaveLength(1);
expect(data.members[0].id).toBe(member.id);
});
});
it('returns access denied for unauthorized trip', async () => {
const { user } = createUser(testDb);
const { user: other } = createUser(testDb);
const trip = createTrip(testDb, other.id);
await withHarness(user.id, async (harness) => {
const result = await harness.client.readResource({ uri: `trek://trips/${trip.id}/members` });
const data = parseResourceResult(result) as any;
expect(data.error).toBeTruthy();
});
});
});
// ---------------------------------------------------------------------------
// Deprecation notice (fire-once closure riding the registry attach ctx)
// ---------------------------------------------------------------------------
describe('static-token deprecation notice', () => {
it('list_trips surfaces the notice exactly once and still carries the payload', async () => {
const { user } = createUser(testDb);
createTrip(testDb, user.id, { title: 'Noticed' });
// Mirror the fire-once closure built per session in src/mcp/index.ts.
let emitted = false;
const getDeprecationNotice = () => {
if (emitted) return null;
emitted = true;
return 'static tokens are deprecated';
};
const h = await createMcpHarness({
realtime,
userId: user.id,
withResources: false,
isStaticToken: true,
getDeprecationNotice,
});
try {
const first = await h.client.callTool({ name: 'list_trips', arguments: {} });
expect(first.isError).toBe(true);
const texts = (first.content as { type: string; text: string }[]).map((c) => c.text);
expect(texts[0]).toContain('deprecated');
expect(JSON.parse(texts[1]).trips[0].title).toBe('Noticed');
// Second call: the closure already fired — plain payload, no error.
const second = await h.client.callTool({ name: 'list_trips', arguments: {} });
expect(second.isError).toBeFalsy();
expect((parseToolResult(second) as any).trips).toHaveLength(1);
} finally {
await h.cleanup();
}
});
});
// ---------------------------------------------------------------------------
// Scope gating — declarative trips:write markers plus the predicate escape
// hatches (canReadTrips accepts trips:delete / trips:share; delete_trip rides
// trips:delete, the share tools trips:share)
// ---------------------------------------------------------------------------
describe('scope gating', () => {
async function toolNames(scopes: string[] | null): Promise<string[]> {
const h = await createMcpHarness({ realtime, userId: 1, withResources: false, scopes });
try {
const { tools } = await h.client.listTools();
return tools.map((t) => t.name);
} finally {
await h.cleanup();
}
}
const WRITE_TOOLS = [
'create_trip',
'update_trip',
'add_trip_member',
'remove_trip_member',
'leave_trip',
'copy_trip',
];
const READ_TOOLS = ['list_trip_members', 'export_trip_ics', 'search_cover_images'];
const NAV_TOOLS = ['list_trips', 'get_trip_summary'];
const SHARE_TOOLS = ['get_share_link', 'create_share_link', 'delete_share_link'];
it('null scopes (trek_ PAT) exposes the full surface', async () => {
const names = await toolNames(null);
for (const t of [...WRITE_TOOLS, ...READ_TOOLS, ...NAV_TOOLS, 'delete_trip', ...SHARE_TOOLS]) {
expect(names).toContain(t);
}
});
it('trips:read exposes reads + navigation but no writes/delete/share', async () => {
const names = await toolNames(['trips:read']);
for (const t of [...READ_TOOLS, ...NAV_TOOLS]) expect(names).toContain(t);
for (const t of [...WRITE_TOOLS, 'delete_trip', ...SHARE_TOOLS]) expect(names).not.toContain(t);
});
it('trips:delete alone still grants the trip reads (canReadTrips parity) plus delete_trip', async () => {
const names = await toolNames(['trips:delete']);
expect(names).toContain('delete_trip');
for (const t of [...READ_TOOLS, ...NAV_TOOLS]) expect(names).toContain(t);
for (const t of WRITE_TOOLS) expect(names).not.toContain(t);
});
it('trips:share alone grants the share tools and the trip reads, nothing else', async () => {
const names = await toolNames(['trips:share']);
for (const t of [...SHARE_TOOLS, ...READ_TOOLS, ...NAV_TOOLS]) expect(names).toContain(t);
for (const t of [...WRITE_TOOLS, 'delete_trip']) expect(names).not.toContain(t);
});
it('an unrelated scope keeps only the navigation tools', async () => {
const names = await toolNames(['weather:read']);
for (const t of NAV_TOOLS) expect(names).toContain(t);
for (const t of [...WRITE_TOOLS, ...READ_TOOLS, 'delete_trip', ...SHARE_TOOLS]) expect(names).not.toContain(t);
});
});
Reference in New Issue View Git Blame Copy Permalink