mcp-sanitizer/test/middleware/middleware.test.js

Comprehensive security sanitization library for Model Context Protocol (MCP) servers with trusted security libraries

/**
 * Test file for MCP Sanitizer Middleware
 *
 * This test file demonstrates and validates the middleware functionality
 * across different Node.js frameworks (Express, Fastify, Koa).
 */

const { describe, it, expect, beforeEach } = require('@jest/globals'); // afterEach unused
// const request = require('supertest') // Unused - commented to fix ESLint
const MCPSanitizer = require('../../src/index');

// Mock framework apps for testing
let mockExpress, mockFastify, mockKoa;

// Import middleware modules
const middlewareModule = require('../../src/middleware');
const { express, fastify, koa } = middlewareModule;

describe('MCP Sanitizer Middleware', () => {
  beforeEach(() => {
    // Reset mocks before each test
    mockExpress = createMockExpressApp();
    mockFastify = createMockFastifyApp();
    mockKoa = createMockKoaApp();
  });

  describe('Framework Detection', () => {
    it('should detect Express app correctly', () => {
      const framework = middlewareModule.detectFramework(mockExpress);
      expect(framework).toBe('express');
    });

    it('should detect Fastify app correctly', () => {
      const framework = middlewareModule.detectFramework(mockFastify);
      expect(framework).toBe('fastify');
    });

    it('should detect Koa app correctly', () => {
      const framework = middlewareModule.detectFramework(mockKoa);
      expect(framework).toBe('koa');
    });

    it('should return null for unknown framework', () => {
      const framework = middlewareModule.detectFramework({ unknown: true });
      expect(framework).toBe(null);
    });
  });

  describe('Configuration Validation', () => {
    it('should validate and normalize configuration', () => {
      const config = {
        mode: 'invalid',
        policy: 'INVALID',
        blockStatusCode: 999
      };

      const validated = middlewareModule.validateConfig(config);
      expect(validated.mode).toBe('sanitize');
      expect(validated.policy).toBe('PRODUCTION');
      expect(validated.blockStatusCode).toBe(400);
    });

    it('should preserve valid configuration', () => {
      const config = {
        mode: 'block',
        policy: 'STRICT',
        blockStatusCode: 403
      };

      const validated = middlewareModule.validateConfig(config);
      expect(validated.mode).toBe('block');
      expect(validated.policy).toBe('STRICT');
      expect(validated.blockStatusCode).toBe(403);
    });
  });

  describe('Express Middleware', () => {
    it('should create Express middleware with default configuration', () => {
      const middleware = express.createExpressMiddleware();
      expect(typeof middleware).toBe('function');
      expect(middleware.length).toBe(3); // req, res, next
    });

    it('should sanitize request body in sanitize mode', () => {
      const onWarning = jest.fn();
      const middleware = express.createExpressMiddleware({
        mode: 'sanitize',
        onWarning
      });

      const mockReq = createMockExpressRequest({
        body: {
          command: 'ls; rm -rf /', // Malicious command
          file_path: 'normal.txt'
        }
      });
      const mockRes = createMockExpressResponse();
      const mockNext = jest.fn();

      middleware(mockReq, mockRes, mockNext);

      // Should proceed to next middleware
      expect(mockNext).toHaveBeenCalled();
      // Should have sanitization warnings added to request
      expect(mockReq.sanitizationWarnings).toBeDefined();
    });

    it('should block request in block mode with malicious content', () => {
      const onBlocked = jest.fn(() => false); // Return false to prevent default response
      const middleware = express.createExpressMiddleware({
        mode: 'block',
        onBlocked
      });

      const mockReq = createMockExpressRequest({
        body: {
          command: 'ls; rm -rf /' // Malicious command
        }
      });
      const mockRes = createMockExpressResponse();
      const mockNext = jest.fn();

      middleware(mockReq, mockRes, mockNext);

      // Should not proceed to next middleware
      expect(mockNext).not.toHaveBeenCalled();
      // Should call onBlocked callback
      expect(onBlocked).toHaveBeenCalled();
    });

    it('should skip health check requests', () => {
      const middleware = express.createExpressMiddleware({
        skipHealthChecks: true
      });

      const mockReq = createMockExpressRequest({ path: '/health' });
      const mockRes = createMockExpressResponse();
      const mockNext = jest.fn();

      middleware(mockReq, mockRes, mockNext);

      // Should skip processing and go to next
      expect(mockNext).toHaveBeenCalled();
    });

    it('should create MCP tool-specific middleware', () => {
      const toolMiddleware = express.createMCPToolMiddleware({
        toolSpecificSanitization: true
      });

      expect(typeof toolMiddleware).toBe('function');

      const mockReq = createMockExpressRequest({
        params: { toolName: 'file_reader' },
        body: {
          parameters: {
            file_path: '../../../etc/passwd' // Path traversal attempt
          }
        }
      });
      const mockRes = createMockExpressResponse();
      const mockNext = jest.fn();

      toolMiddleware(mockReq, mockRes, mockNext);

      expect(mockReq.mcpContext).toBeDefined();
      expect(mockReq.mcpContext.toolName).toBe('file_reader');
    });
  });

  describe('Fastify Plugin', () => {
    it('should be a valid Fastify plugin function', () => {
      expect(typeof fastify).toBe('function');
      // Fastify plugins should be async functions
      expect(fastify.constructor.name).toBe('AsyncFunction');
    });

    it('should have plugin metadata', () => {
      // Check for fastify-plugin metadata
      expect(fastify[Symbol.for('skip-override')]).toBe(true);
      expect(fastify[Symbol.for('plugin-meta')]).toBeDefined();
    });

    it('should register hooks on Fastify instance', async () => {
      const mockFastifyInstance = createMockFastifyApp();
      const options = { policy: 'PRODUCTION' };

      await fastify(mockFastifyInstance, options);

      // Verify hooks were added
      expect(mockFastifyInstance.addHook).toHaveBeenCalled();
      expect(mockFastifyInstance.decorateRequest).toHaveBeenCalled();
    });
  });

  describe('Koa Middleware', () => {
    it('should create Koa middleware with default configuration', () => {
      const middleware = koa.createKoaMiddleware();
      expect(typeof middleware).toBe('function');
      expect(middleware.constructor.name).toBe('AsyncFunction');
    });

    it('should sanitize request context in sanitize mode', async () => {
      const onWarning = jest.fn();
      const middleware = koa.createKoaMiddleware({
        mode: 'sanitize',
        onWarning
      });

      const mockCtx = createMockKoaContext({
        request: {
          body: {
            query: 'SELECT * FROM users; DROP TABLE users;' // SQL injection
          }
        }
      });
      const mockNext = jest.fn().mockResolvedValue();

      await middleware(mockCtx, mockNext);

      expect(mockNext).toHaveBeenCalled();
      expect(mockCtx.sanitizationWarnings).toBeDefined();
    });

    it('should add sanitization data to state', async () => {
      const middleware = koa.createKoaMiddleware({
        addToState: true,
        contextKey: 'mcp'
      });

      const mockCtx = createMockKoaContext({
        request: { body: { test: 'safe content' } },
        state: {}
      });
      const mockNext = jest.fn().mockResolvedValue();

      await middleware(mockCtx, mockNext);

      expect(mockCtx.state.mcp).toBeDefined();
      expect(mockCtx.state.mcp.processed).toBe(true);
    });

    it('should create MCP server middleware', () => {
      const serverMiddleware = koa.createMCPServerMiddleware({
        toolSpecificSanitization: true
      });

      expect(typeof serverMiddleware).toBe('function');
      expect(serverMiddleware.constructor.name).toBe('AsyncFunction');
    });
  });

  describe('Universal Middleware Factory', () => {
    it('should create universal middleware with all frameworks', () => {
      const universal = middlewareModule.createUniversalMiddleware({
        policy: 'PRODUCTION',
        mode: 'block'
      });

      expect(universal.express).toBeDefined();
      expect(universal.fastify).toBeDefined();
      expect(universal.koa).toBeDefined();
      expect(universal.auto).toBeDefined();
      expect(universal.tool).toBeDefined();
    });

    it('should auto-detect framework and return appropriate middleware', () => {
      const universal = middlewareModule.createUniversalMiddleware();

      const expressMiddleware = universal.auto(mockExpress);
      const koaMiddleware = universal.auto(mockKoa);

      expect(typeof expressMiddleware).toBe('function');
      expect(typeof koaMiddleware).toBe('function');
      expect(expressMiddleware.length).toBe(3); // Express: req, res, next
      expect(koaMiddleware.constructor.name).toBe('AsyncFunction'); // Koa: async
    });
  });

  describe('Environment-specific Configuration', () => {
    it('should create development environment middleware', () => {
      const devMiddleware = middlewareModule.createEnvironmentMiddleware('development');

      expect(devMiddleware.express).toBeDefined();
      expect(devMiddleware.fastify).toBeDefined();
      expect(devMiddleware.koa).toBeDefined();
    });

    it('should create production environment middleware', () => {
      const prodMiddleware = middlewareModule.createEnvironmentMiddleware('production');

      expect(prodMiddleware.express).toBeDefined();
      expect(prodMiddleware.fastify).toBeDefined();
      expect(prodMiddleware.koa).toBeDefined();
    });

    it('should apply environment-specific defaults', () => {
      const testMiddleware = middlewareModule.createEnvironmentMiddleware('testing', {
        customOption: true
      });

      expect(testMiddleware).toBeDefined();
    });
  });

  describe('Tool-specific Sanitization', () => {
    it('should handle file_reader tool parameters', () => {
      const mockReq = createMockExpressRequest({
        params: { toolName: 'file_reader' },
        body: {
          parameters: {
            file_path: '../../../etc/passwd'
          }
        }
      });

      // This would normally be called internally by the middleware
      const sanitizer = new MCPSanitizer({ policy: 'PRODUCTION' });
      const result = sanitizer.sanitize(mockReq.body.parameters.file_path, { type: 'file_path' });

      expect(result.warnings.length).toBeGreaterThan(0);
      expect(result.warnings.some(w => typeof w === 'string' && w.includes('blocked pattern'))).toBe(true);
    });

    it('should handle command execution tool parameters', () => {
      const mockReq = createMockExpressRequest({
        params: { toolName: 'shell_executor' },
        body: {
          parameters: {
            command: 'ls; rm -rf /'
          }
        }
      });

      const sanitizer = new MCPSanitizer({ policy: 'PRODUCTION' });
      const result = sanitizer.sanitize(mockReq.body.parameters.command, { type: 'command' });

      expect(result.warnings.length).toBeGreaterThan(0);
      expect(result.warnings.some(w => typeof w === 'string' && w.includes('blocked pattern'))).toBe(true);
    });
  });
});

// Mock helper functions
function createMockExpressApp () {
  return {
    use: jest.fn(),
    get: jest.fn(),
    post: jest.fn(),
    constructor: { name: 'Function' }
  };
}

function createMockFastifyApp () {
  return {
    register: jest.fn(),
    addHook: jest.fn(),
    decorateRequest: jest.fn(),
    decorate: jest.fn(),
    setSchemaCompiler: jest.fn()
  };
}

function createMockKoaApp () {
  return {
    use: jest.fn(),
    constructor: { name: 'Application' }
  };
}

function createMockExpressRequest (overrides = {}) {
  return {
    ip: '127.0.0.1',
    path: '/api/test',
    method: 'POST',
    body: {},
    params: {},
    query: {},
    headers: { 'user-agent': 'test-agent' },
    get: jest.fn((header) => 'test-value'),
    ...overrides
  };
}

function createMockExpressResponse () {
  const res = {
    status: jest.fn().mockReturnThis(),
    json: jest.fn().mockReturnThis(),
    send: jest.fn().mockReturnThis()
  };
  return res;
}

function createMockKoaContext (overrides = {}) {
  return {
    ip: '127.0.0.1',
    path: '/api/test',
    method: 'POST',
    request: { body: {} },
    params: {},
    query: {},
    headers: { 'user-agent': 'test-agent' },
    get: jest.fn((header) => 'test-value'),
    state: {},
    ...overrides
  };
}