mirror of
https://github.com/mauriceboe/TREK.git
synced 2026-10-20 22:16:26 +00:00
Maurice
ddf97c5a21
The MCP tool suites seeded trips, places, bookings, packing, vacay and settings rows and read back what a tool call left behind through raw better-sqlite3 statements on the sync handle. They now go through the ORM factories and readers in tests/helpers/factories, so the rows are written and read the way the repositories do it. Every assertion keeps its meaning: a missing row that read back as undefined now reads back as null, and a partial SELECT is replaced by the same fields picked off the full row.
911 lines
36 KiB
TypeScript
911 lines
36 KiB
TypeScript
/**
|
|
* Unit tests for MCP trip member, guest, copy, ICS, and share-link tools:
|
|
* list_trip_members, add_trip_member, remove_trip_member,
|
|
* create_trip_guest, rename_trip_guest, delete_trip_guest,
|
|
* copy_trip, export_trip_ics, get_share_link, create_share_link, delete_share_link.
|
|
*/
|
|
import { describe, it, expect, vi, beforeAll, beforeEach, afterAll } from 'vitest';
|
|
import { db as testDb } from '../../../src/db/database';
|
|
|
|
|
|
vi.mock('../../../src/db/database', async () => {
|
|
const { createSnapshotTestDb, buildDbMock } = await import('../../helpers/db-mock');
|
|
return buildDbMock(createSnapshotTestDb());
|
|
});
|
|
vi.mock('../../../src/config', () => ({
|
|
JWT_SECRET: 'test-jwt-secret-for-trek-testing-only',
|
|
ENCRYPTION_KEY: 'a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2a3b4c5d6a7b8c9d0e1f2',
|
|
updateJwtSecret: () => {},
|
|
}));
|
|
|
|
const { broadcastMock } = vi.hoisted(() => ({ broadcastMock: vi.fn() }));
|
|
vi.mock('../../../src/websocket', () => ({ broadcast: broadcastMock }));
|
|
|
|
import { resetTestDb } from '../../helpers/test-db';
|
|
import { invalidatePermissionsCache } from '../../../src/nest/permissions/permissions-cache';
|
|
import { createUser, createAdmin, createTrip, addTripMember } from '../../helpers/factories';
|
|
import { createMcpHarness, parseToolResult, type McpHarness } from '../../helpers/mcp-harness';
|
|
import { createTestOrm, type TestOrm } from '../../helpers/test-orm';
|
|
import { countRows, findRow } from '../../helpers/factories/rows';
|
|
import { setAppSetting } from '../../helpers/factories/settings';
|
|
import { makeShareToken } from '../../helpers/factories/trips';
|
|
import { ShareTokens } from '../../../src/db/entities/ShareTokens.entity';
|
|
import { TripMembers } from '../../../src/db/entities/TripMembers.entity';
|
|
import { Trips } from '../../../src/db/entities/Trips.entity';
|
|
import { Users } from '../../../src/db/entities/Users.entity';
|
|
|
|
let orm: TestOrm;
|
|
|
|
beforeAll(async () => {
|
|
orm = await createTestOrm(testDb);
|
|
});
|
|
|
|
function memberRow(tripId: number, userId: number) {
|
|
return findRow(orm, TripMembers, { trip: tripId, user: userId });
|
|
}
|
|
|
|
async function userRow(id: number) {
|
|
return (await findRow(orm, Users, { id }))!;
|
|
}
|
|
|
|
beforeEach(async () => {
|
|
resetTestDb(testDb);
|
|
broadcastMock.mockClear();
|
|
delete process.env.DEMO_MODE;
|
|
// resetTestDb truncates app_settings, but the permission cache is module-scoped
|
|
// and would keep serving whatever the previous case configured.
|
|
await invalidatePermissionsCache();
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await orm.close();
|
|
testDb.close();
|
|
});
|
|
|
|
async function withHarness(userId: number, fn: (h: McpHarness) => Promise<void>) {
|
|
const h = await createMcpHarness({ userId, withResources: false });
|
|
try { await fn(h); } finally { await h.cleanup(); }
|
|
}
|
|
|
|
/** Lower a configurable action the way the admin permission panel does. */
|
|
async function setPermission(action: string, level: string): Promise<void> {
|
|
await setAppSetting(orm, `perm_${action}`, level);
|
|
await invalidatePermissionsCache();
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// list_trip_members
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: list_trip_members', () => {
|
|
it('returns owner and empty members list for own trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'list_trip_members', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.owner.id).toBe(user.id);
|
|
expect(data.owner.role).toBe('owner');
|
|
expect(Array.isArray(data.members)).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for non-member', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, other.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'list_trip_members', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// add_trip_member
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: add_trip_member', () => {
|
|
it('adds a member by username', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: member.username },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.member.username).toBe(member.username);
|
|
expect(data.member.role).toBe('member');
|
|
});
|
|
});
|
|
|
|
it('broadcasts member:added event', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: member.email },
|
|
});
|
|
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'member:added', expect.any(Object));
|
|
});
|
|
});
|
|
|
|
it('returns error when user not found', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: 'nonexistent@example.com' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('returns error when non-owner tries to add', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const { user: outsider } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: outsider.username },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: 'someone@example.com' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('lets a collaborator add when member_manage sits at trip_member', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const { user: outsider } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
await setPermission('member_manage', 'trip_member');
|
|
await withHarness(collaborator.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: outsider.username },
|
|
});
|
|
expect(result.isError).toBeFalsy();
|
|
const row = await memberRow(trip.id, outsider.id);
|
|
expect(row).toBeTruthy();
|
|
expect(row!.invited_by).toBe(collaborator.id);
|
|
});
|
|
});
|
|
|
|
it('lets a site admin on the trip add a member without owning it', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: admin } = createAdmin(testDb);
|
|
const { user: outsider } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, admin.id);
|
|
await withHarness(admin.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: outsider.username },
|
|
});
|
|
expect(result.isError).toBeFalsy();
|
|
expect(await memberRow(trip.id, outsider.id)).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('still refuses a collaborator while member_manage sits at its trip_owner default', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const { user: outsider } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
await withHarness(collaborator.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'add_trip_member',
|
|
arguments: { tripId: trip.id, identifier: outsider.username },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(await memberRow(trip.id, outsider.id)).toBeNull();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// remove_trip_member
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: remove_trip_member', () => {
|
|
it('removes a member', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'remove_trip_member',
|
|
arguments: { tripId: trip.id, memberId: member.id },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.success).toBe(true);
|
|
const row = await memberRow(trip.id, member.id);
|
|
expect(row).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('broadcasts member:removed event', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
await h.client.callTool({ name: 'remove_trip_member', arguments: { tripId: trip.id, memberId: member.id } });
|
|
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'member:removed', expect.any(Object));
|
|
});
|
|
});
|
|
|
|
it('returns error when non-owner tries to remove', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'remove_trip_member',
|
|
arguments: { tripId: trip.id, memberId: owner.id },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('leaves another member in place when a collaborator has no member_manage', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
addTripMember(testDb, trip.id, other.id);
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'remove_trip_member',
|
|
arguments: { tripId: trip.id, memberId: other.id },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(await memberRow(trip.id, other.id)).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('lets a collaborator remove another member when member_manage sits at trip_member', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
addTripMember(testDb, trip.id, other.id);
|
|
await setPermission('member_manage', 'trip_member');
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'remove_trip_member',
|
|
arguments: { tripId: trip.id, memberId: other.id },
|
|
});
|
|
expect(result.isError).toBeFalsy();
|
|
expect(await memberRow(trip.id, other.id)).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('lets a site admin on the trip remove a member without owning it', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: admin } = createAdmin(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, admin.id);
|
|
addTripMember(testDb, trip.id, other.id);
|
|
await withHarness(admin.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'remove_trip_member',
|
|
arguments: { tripId: trip.id, memberId: other.id },
|
|
});
|
|
expect(result.isError).toBeFalsy();
|
|
expect(await memberRow(trip.id, other.id)).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('lets a member remove themselves without member_manage', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'remove_trip_member',
|
|
arguments: { tripId: trip.id, memberId: member.id },
|
|
});
|
|
expect((parseToolResult(result) as any).success).toBe(true);
|
|
expect(await memberRow(trip.id, member.id)).toBeNull();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// leave_trip
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: leave_trip', () => {
|
|
it('drops the caller from the roster', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(member.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'leave_trip', arguments: { tripId: trip.id } });
|
|
expect((parseToolResult(result) as any).success).toBe(true);
|
|
expect(await memberRow(trip.id, member.id)).toBeNull();
|
|
expect(await findRow(orm, Trips, { id: trip.id })).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('broadcasts member:removed for the leaving user', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
await withHarness(member.id, async (h) => {
|
|
await h.client.callTool({ name: 'leave_trip', arguments: { tripId: trip.id } });
|
|
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'member:removed', expect.objectContaining({ userId: member.id }));
|
|
});
|
|
});
|
|
|
|
it('leaves the other members alone', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: member } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, member.id);
|
|
addTripMember(testDb, trip.id, other.id);
|
|
await withHarness(member.id, async (h) => {
|
|
await h.client.callTool({ name: 'leave_trip', arguments: { tripId: trip.id } });
|
|
expect(await memberRow(trip.id, other.id)).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('refuses the owner and keeps the trip theirs', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'leave_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
const row = (await findRow(orm, Trips, { id: trip.id }))!;
|
|
expect(row.user_id).toBe(owner.id);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for a non-member', async () => {
|
|
const { user: outsider } = createUser(testDb);
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(outsider.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'leave_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user: owner } = createUser(testDb);
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'leave_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
expect(await memberRow(trip.id, user.id)).toBeTruthy();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// copy_trip
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: copy_trip', () => {
|
|
it('duplicates a trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Original', start_date: '2025-01-01', end_date: '2025-01-03' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'copy_trip', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.trip).toBeTruthy();
|
|
// New trip should be a different row
|
|
const count = await countRows(orm, Trips);
|
|
expect(count).toBe(2);
|
|
});
|
|
});
|
|
|
|
it('uses custom title when provided', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Original' });
|
|
await withHarness(user.id, async (h) => {
|
|
await h.client.callTool({ name: 'copy_trip', arguments: { tripId: trip.id, title: 'My Copy' } });
|
|
const newTrip = await findRow(orm, Trips, { title: 'My Copy' });
|
|
expect(newTrip).toBeTruthy();
|
|
});
|
|
});
|
|
|
|
it('returns access denied for non-member', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, other.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'copy_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'copy_trip', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// export_trip_ics
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: export_trip_ics', () => {
|
|
it('returns ICS content for a trip', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: 'Paris Trip', start_date: '2025-06-01', end_date: '2025-06-05' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'export_trip_ics', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.ics).toContain('BEGIN:VCALENDAR');
|
|
expect(data.ics).toContain('Paris Trip');
|
|
expect(data.filename).toMatch(/\.ics$/);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for non-member', async () => {
|
|
const { user } = createUser(testDb);
|
|
const { user: other } = createUser(testDb);
|
|
const trip = createTrip(testDb, other.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'export_trip_ics', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
// Same calendar filename as the REST route (#2165): U+3000 used to slip
|
|
// through the \s keep-class and crash the header there; it folds to _ now.
|
|
it('folds header-hostile whitespace out of the filename', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id, { title: '沖縄 4泊5日', start_date: '2025-06-01', end_date: '2025-06-05' });
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'export_trip_ics', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as { filename: string };
|
|
expect(data.filename).toBe('___4_5_.ics');
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// get_share_link / create_share_link / delete_share_link
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Tool: get_share_link', () => {
|
|
it('returns null when no share link exists', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_share_link', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.link).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('returns share link info when it exists', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
// Create a share link directly
|
|
await makeShareToken(orm, trip.id, user.id, {
|
|
token: 'test-token-123', share_map: 1, share_bookings: 1, share_packing: 0, share_budget: 0, share_collab: 0,
|
|
});
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'get_share_link', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.link.token).toBe('test-token-123');
|
|
expect(data.link.share_map).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Tool: create_share_link', () => {
|
|
it('creates a new share link', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_share_link',
|
|
arguments: { tripId: trip.id, share_map: true, share_bookings: false, share_packing: false },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.token).toBeTruthy();
|
|
expect(data.created).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('updates existing share link permissions', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await makeShareToken(orm, trip.id, user.id, {
|
|
token: 'existing-token', share_map: 1, share_bookings: 1, share_packing: 0, share_budget: 0, share_collab: 0,
|
|
});
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_share_link',
|
|
arguments: { tripId: trip.id, share_packing: true },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.created).toBe(false); // updated, not created
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'create_share_link', arguments: { tripId: trip.id } });
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Tool: delete_share_link', () => {
|
|
it('revokes the share link', async () => {
|
|
const { user } = createUser(testDb);
|
|
const trip = createTrip(testDb, user.id);
|
|
await makeShareToken(orm, trip.id, user.id, {
|
|
token: 'to-delete', share_map: 1, share_bookings: 1, share_packing: 0, share_budget: 0, share_collab: 0,
|
|
});
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({ name: 'delete_share_link', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.success).toBe(true);
|
|
const row = await findRow(orm, ShareTokens, { trip: trip.id });
|
|
expect(row).toBeNull();
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Guests (#1362)
|
|
//
|
|
// add_trip_member resolves an existing account, so these cover the companion who
|
|
// has none: created, renamed and deleted through the assistant, owner-gated the
|
|
// same way the /guests routes are, and trip-scoped so one trip's owner cannot
|
|
// reach another trip's guest.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/** The guest id the tool reports back, for the rename/delete cases. */
|
|
async function makeGuest(h: McpHarness, tripId: number, name: string): Promise<number> {
|
|
const result = await h.client.callTool({ name: 'create_trip_guest', arguments: { tripId, name } });
|
|
return (parseToolResult(result) as any).member.id;
|
|
}
|
|
|
|
describe('Tool: create_trip_guest', () => {
|
|
it('creates a credential-less guest and returns the display name', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip_guest',
|
|
arguments: { tripId: trip.id, name: 'Anna' },
|
|
});
|
|
const data = parseToolResult(result) as any;
|
|
expect(data.member.username).toBe('Anna');
|
|
expect(data.member.role).toBe('member');
|
|
expect(data.member.is_guest).toBe(true);
|
|
|
|
const row = await userRow(data.member.id);
|
|
expect(row.is_guest).toBe(1);
|
|
expect(row.password_hash).toBe('');
|
|
expect(row.display_name).toBe('Anna');
|
|
// A synthetic address on an undeliverable domain: a guest is never emailed.
|
|
expect(row.email).toMatch(/@guests\.invalid$/);
|
|
});
|
|
});
|
|
|
|
it('joins the guest into the trip roster', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
await makeGuest(h, trip.id, 'Jake');
|
|
const listed = await h.client.callTool({ name: 'list_trip_members', arguments: { tripId: trip.id } });
|
|
const data = parseToolResult(listed) as any;
|
|
expect(data.members.map((m: any) => m.username)).toContain('Jake');
|
|
});
|
|
});
|
|
|
|
it('broadcasts member:added event', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
await makeGuest(h, trip.id, 'Anna');
|
|
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'member:added', expect.any(Object));
|
|
});
|
|
});
|
|
|
|
it('rejects a whitespace-only name', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip_guest',
|
|
arguments: { tripId: trip.id, name: ' ' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(await countRows(orm, Users, { is_guest: 1 })).toBe(0);
|
|
});
|
|
});
|
|
|
|
it('returns error when a member who is not the owner tries to add a guest', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
await withHarness(collaborator.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip_guest',
|
|
arguments: { tripId: trip.id, name: 'Anna' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('returns access denied for a non-member', async () => {
|
|
const { user: outsider } = createUser(testDb);
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(outsider.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip_guest',
|
|
arguments: { tripId: trip.id, name: 'Anna' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'create_trip_guest',
|
|
arguments: { tripId: trip.id, name: 'Anna' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Tool: rename_trip_guest', () => {
|
|
it('renames the guest', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const guestId = await makeGuest(h, trip.id, 'Anna');
|
|
const result = await h.client.callTool({
|
|
name: 'rename_trip_guest',
|
|
arguments: { tripId: trip.id, guestId, name: 'Anna B.' },
|
|
});
|
|
expect((parseToolResult(result) as any).success).toBe(true);
|
|
const row = await userRow(guestId);
|
|
expect(row.display_name).toBe('Anna B.');
|
|
});
|
|
});
|
|
|
|
it('rejects a whitespace-only name', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const guestId = await makeGuest(h, trip.id, 'Anna');
|
|
const result = await h.client.callTool({
|
|
name: 'rename_trip_guest',
|
|
arguments: { tripId: trip.id, guestId, name: ' ' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
const row = await userRow(guestId);
|
|
expect(row.display_name).toBe('Anna');
|
|
});
|
|
});
|
|
|
|
it('will not rename a guest of another trip', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const ownTrip = createTrip(testDb, owner.id);
|
|
const otherTrip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const guestId = await makeGuest(h, otherTrip.id, 'Anna');
|
|
const result = await h.client.callTool({
|
|
name: 'rename_trip_guest',
|
|
arguments: { tripId: ownTrip.id, guestId, name: 'Renamed' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
const row = await userRow(guestId);
|
|
expect(row.display_name).toBe('Anna');
|
|
});
|
|
});
|
|
|
|
it('returns error when a member who is not the owner tries to rename', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
let guestId = 0;
|
|
await withHarness(owner.id, async (h) => { guestId = await makeGuest(h, trip.id, 'Anna'); });
|
|
await withHarness(collaborator.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'rename_trip_guest',
|
|
arguments: { tripId: trip.id, guestId, name: 'Renamed' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'rename_trip_guest',
|
|
arguments: { tripId: trip.id, guestId: 1, name: 'Anna' },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
describe('Tool: delete_trip_guest', () => {
|
|
it('deletes the guest outright', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const guestId = await makeGuest(h, trip.id, 'Anna');
|
|
const result = await h.client.callTool({
|
|
name: 'delete_trip_guest',
|
|
arguments: { tripId: trip.id, guestId },
|
|
});
|
|
expect((parseToolResult(result) as any).success).toBe(true);
|
|
expect(await findRow(orm, Users, { id: guestId })).toBeNull();
|
|
expect(await findRow(orm, TripMembers, { user: guestId })).toBeNull();
|
|
});
|
|
});
|
|
|
|
it('broadcasts member:removed event', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const guestId = await makeGuest(h, trip.id, 'Anna');
|
|
broadcastMock.mockClear();
|
|
await h.client.callTool({ name: 'delete_trip_guest', arguments: { tripId: trip.id, guestId } });
|
|
expect(broadcastMock).toHaveBeenCalledWith(trip.id, 'member:removed', expect.objectContaining({ userId: guestId }));
|
|
});
|
|
});
|
|
|
|
it('will not delete a guest of another trip', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const ownTrip = createTrip(testDb, owner.id);
|
|
const otherTrip = createTrip(testDb, owner.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const guestId = await makeGuest(h, otherTrip.id, 'Anna');
|
|
const result = await h.client.callTool({
|
|
name: 'delete_trip_guest',
|
|
arguments: { tripId: ownTrip.id, guestId },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(await findRow(orm, Users, { id: guestId })).not.toBeNull();
|
|
});
|
|
});
|
|
|
|
it('will not delete a real member through the guest route', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
await withHarness(owner.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'delete_trip_guest',
|
|
arguments: { tripId: trip.id, guestId: collaborator.id },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(await findRow(orm, Users, { id: collaborator.id })).not.toBeNull();
|
|
});
|
|
});
|
|
|
|
it('returns error when a member who is not the owner tries to delete', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
let guestId = 0;
|
|
await withHarness(owner.id, async (h) => { guestId = await makeGuest(h, trip.id, 'Anna'); });
|
|
await withHarness(collaborator.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'delete_trip_guest',
|
|
arguments: { tripId: trip.id, guestId },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
expect(await findRow(orm, Users, { id: guestId })).not.toBeNull();
|
|
});
|
|
});
|
|
|
|
it('blocks demo user', async () => {
|
|
process.env.DEMO_MODE = 'true';
|
|
const { user } = createUser(testDb, { email: 'demo@nomad.app' });
|
|
const trip = createTrip(testDb, user.id);
|
|
await withHarness(user.id, async (h) => {
|
|
const result = await h.client.callTool({
|
|
name: 'delete_trip_guest',
|
|
arguments: { tripId: trip.id, guestId: 1 },
|
|
});
|
|
expect(result.isError).toBe(true);
|
|
});
|
|
});
|
|
});
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// The guest routes carry TripOwnerGuard, which deliberately does NOT consult the
|
|
// permission matrix: handing a trip over and creating or deleting guests are the
|
|
// things a collaborator must never do, however generously the trip is configured.
|
|
// Lowering member_manage moves add/remove_trip_member and must move nothing here.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
describe('Guest tools stay owner-only', () => {
|
|
it('refuses a collaborator all three guest tools even with member_manage at trip_member', async () => {
|
|
const { user: owner } = createUser(testDb);
|
|
const { user: collaborator } = createUser(testDb);
|
|
const trip = createTrip(testDb, owner.id);
|
|
addTripMember(testDb, trip.id, collaborator.id);
|
|
let guestId = 0;
|
|
await withHarness(owner.id, async (h) => { guestId = await makeGuest(h, trip.id, 'Anna'); });
|
|
|
|
await setPermission('member_manage', 'trip_member');
|
|
await withHarness(collaborator.id, async (h) => {
|
|
expect((await h.client.callTool({
|
|
name: 'create_trip_guest', arguments: { tripId: trip.id, name: 'Bea' },
|
|
})).isError).toBe(true);
|
|
expect((await h.client.callTool({
|
|
name: 'rename_trip_guest', arguments: { tripId: trip.id, guestId, name: 'Renamed' },
|
|
})).isError).toBe(true);
|
|
expect((await h.client.callTool({
|
|
name: 'delete_trip_guest', arguments: { tripId: trip.id, guestId },
|
|
})).isError).toBe(true);
|
|
});
|
|
|
|
const row = await userRow(guestId);
|
|
expect(row.display_name).toBe('Anna');
|
|
expect(await countRows(orm, Users, { is_guest: 1 })).toBe(1);
|
|
});
|
|
});
|