|
| 1 | +// --------------------------------------------------------------------------- |
| 2 | +// test/server-e2e.test.js |
| 3 | +// Drives the real Express `app` (exported from server.js) through supertest: |
| 4 | +// actual route + middleware chain (mcpLimiter -> requireMcpKey -> |
| 5 | +// requireAllowedIp -> handler), not a mock of any of it. |
| 6 | +// |
| 7 | +// config.js reads its env vars at import time, so the relevant env vars are |
| 8 | +// set here BEFORE server.js (and therefore config.js) is imported, via a |
| 9 | +// dynamic import. |
| 10 | +// --------------------------------------------------------------------------- |
| 11 | + |
| 12 | +import { describe, it, expect, beforeAll, vi } from "vitest"; |
| 13 | + |
| 14 | +process.env.NODE_ENV = "test"; |
| 15 | +process.env.MCP_SHARED_KEY = "test-shared-key-for-e2e"; |
| 16 | +process.env.IP_ALLOWLIST_ENABLED = "true"; |
| 17 | +process.env.ALLOWED_IP_RANGES = "203.0.113.0/24"; |
| 18 | +process.env.TRUST_PROXY_HOPS = "1"; |
| 19 | + |
| 20 | +const ALLOWED_IP = "203.0.113.42"; // inside 203.0.113.0/24 |
| 21 | +const DISALLOWED_IP = "198.51.100.7"; // outside the allowed CIDR |
| 22 | +const VALID_KEY = process.env.MCP_SHARED_KEY; |
| 23 | + |
| 24 | +let app; |
| 25 | +let request; |
| 26 | + |
| 27 | +beforeAll(async () => { |
| 28 | + ({ app } = await import("../server.js")); |
| 29 | + ({ default: request } = await import("supertest")); |
| 30 | +}); |
| 31 | + |
| 32 | +describe("GET /health", () => { |
| 33 | + it("returns 200 { status: 'ok' } with no auth required", async () => { |
| 34 | + const res = await request(app).get("/health"); |
| 35 | + expect(res.status).toBe(200); |
| 36 | + expect(res.body).toEqual({ status: "ok" }); |
| 37 | + }); |
| 38 | +}); |
| 39 | + |
| 40 | +describe("POST /mcp — auth + IP allowlist ordering", () => { |
| 41 | + it("returns 401 when no key is provided, even from an allowlisted IP", async () => { |
| 42 | + // requireMcpKey runs before requireAllowedIp, so a missing key always |
| 43 | + // short-circuits first regardless of IP. |
| 44 | + const res = await request(app) |
| 45 | + .post("/mcp") |
| 46 | + .set("X-Forwarded-For", ALLOWED_IP) |
| 47 | + .send({ jsonrpc: "2.0", method: "initialize", id: 1 }); |
| 48 | + |
| 49 | + expect(res.status).toBe(401); |
| 50 | + }); |
| 51 | + |
| 52 | + it("returns 403 when a valid key is provided from an IP outside the allowed CIDR", async () => { |
| 53 | + const res = await request(app) |
| 54 | + .post("/mcp") |
| 55 | + .set("x-manufact-key", VALID_KEY) |
| 56 | + .set("X-Forwarded-For", DISALLOWED_IP) |
| 57 | + .send({ jsonrpc: "2.0", method: "initialize", id: 1 }); |
| 58 | + |
| 59 | + expect(res.status).toBe(403); |
| 60 | + }); |
| 61 | +}); |
| 62 | + |
| 63 | +describe("POST /mcp — rate limiting", () => { |
| 64 | + let freshApp; |
| 65 | + |
| 66 | + beforeAll(async () => { |
| 67 | + // The earlier describe blocks already sent a couple of requests through |
| 68 | + // the shared `app` singleton's mcpLimiter, so re-importing it here would |
| 69 | + // start this test partway into that quota. vi.resetModules() forces a |
| 70 | + // brand-new module graph (and therefore a brand-new express-rate-limit |
| 71 | + // instance with its own untouched counter) isolated from those tests. |
| 72 | + vi.resetModules(); |
| 73 | + ({ app: freshApp } = await import("../server.js")); |
| 74 | + }); |
| 75 | + |
| 76 | + it("allows 30 unauthenticated requests then returns 429 on the 31st", async () => { |
| 77 | + // mcpLimiter is the first middleware in the chain, so it still counts |
| 78 | + // requests that go on to fail auth. Sending them with no key keeps each |
| 79 | + // one cheap (short-circuits at the 401 stage) instead of invoking the |
| 80 | + // real MCP handler 30 times. |
| 81 | + const statuses = []; |
| 82 | + for (let i = 0; i < 31; i++) { |
| 83 | + const res = await request(freshApp) |
| 84 | + .post("/mcp") |
| 85 | + .send({ jsonrpc: "2.0", method: "initialize", id: i }); |
| 86 | + statuses.push(res.status); |
| 87 | + } |
| 88 | + |
| 89 | + expect(statuses.slice(0, 30)).toEqual(Array(30).fill(401)); |
| 90 | + expect(statuses[30]).toBe(429); |
| 91 | + }, 20000); |
| 92 | +}); |
0 commit comments