17e797f
@@ -0,0 +1,150 @@
/**
 * The `limits` tool (#7149): a forge admin lists every limit, plans a change
 * first and applies it only with an admin-scope token; `""` restores the
 * default; an unknown key and a value out of bounds are refused with the limit
 * unchanged; a non-admin and an agent are told there is no such tool.
 */
import { afterAll, beforeAll, describe, expect, test } from "bun:test";
import { mkdtemp, rm } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { createApp, type App } from "../src/app.ts";
import { createAgent } from "../src/actions/crew.ts";
import { createToken } from "../src/core/tokens.ts";
import { createUser } from "../src/core/users.ts";
import { serve, type Servers } from "../src/http/server.ts";
import { LIMIT_KEYS, limitValue } from "../src/settings/limits.ts";
import { quietLogs } from "./helpers/globals.ts";
quietLogs();
const KEY = "front.pinned_max";
describe("MCP limits", () => {
  let dataDir: string;
  let app: App;
  let servers: Servers;
  let adaAdmin = "";
  let adaRw = "";
  let cyToken = "";
  let botToken = "";
  let id = 1;
  const call = async (token: string, args: Record<string, unknown>) => {
    const res = await fetch(`${servers.url}/mcp`, {
      method: "POST",
      headers: {
        "content-type": "application/json",
        accept: "application/json, text/event-stream",
        authorization: `Bearer ${token}`,
      },
      body: JSON.stringify({
        jsonrpc: "2.0",
        id: id++,
        method: "tools/call",
        params: { name: "limits", arguments: args },
      }),
    });
    const body = (await res.json()) as any;
    if (body.error) return { text: body.error.message as string, error: true };
    return { text: body.result.content[0].text as string, error: body.result.isError === true };
  };
  const now = () => limitValue(app.db, KEY);
  beforeAll(async () => {
    dataDir = await mkdtemp(join(tmpdir(), "forge-mcp-limits-"));
    app = createApp({ dataDir, port: 0, host: "forge.test" });
    servers = await serve(app);
    const make = async (username: string, adminIfFirst = false) => {
      const made = await createUser(app.db, {
        origin: "seed",
        trusted: true,
        username,
        email: `${username}@forge.local`,
        password: "a-good-passphrase",
        adminIfFirst,
      });
      if (!made.ok) throw new Error(made.error);
      return made.value;
    };
    const ada = await make("ada", true);
    const cy = await make("cy");
    const bot = await createAgent(app, ada, { username: "botty", brief: "b", model: "m" });
    if (!bot.ok) throw new Error(String(bot.error));
    app.db.query("UPDATE user SET is_admin = 1 WHERE id = ?1").run(bot.value.user.id);
    adaAdmin = createToken(app.db, ada.id, "admin", "admin").token;
    adaRw = createToken(app.db, ada.id, "rw", "rw").token;
    cyToken = createToken(app.db, cy.id, "admin", "admin").token;
    botToken = createToken(app.db, bot.value.user.id, "admin", "admin").token;
  }, 60_000);
  afterAll(async () => {
    servers?.stop();
    app?.close();
    if (dataDir) await rm(dataDir, { recursive: true, force: true });
  });
  test("a forge admin lists every limit with value, default and bounds", async () => {
    const res = await call(adaAdmin, {});
    expect(res.error).toBe(false);
    const { limits } = JSON.parse(res.text);
    expect(limits.map((l: any) => l.key)).toEqual([...LIMIT_KEYS]);
    const row = limits.find((l: any) => l.key === KEY);
    expect(row.value).toBe(row.defaultValue);
    expect(row.min).toBe(1);
    expect(row.max).toBe(100);
  });
  test("setting plans first; dryRun false applies; an empty value restores the default", async () => {
    const before = now();
    const planned = await call(adaAdmin, { key: KEY, value: "7" });
    expect(planned.error).toBe(false);
    expect(JSON.parse(planned.text).says).toContain("Would set");
    expect(now()).toBe(before);
    const applied = await call(adaAdmin, { key: KEY, value: "7", dryRun: false });
    expect(applied.error).toBe(false);
    expect(JSON.parse(applied.text).to).toBe(7);
    expect(now()).toBe(7);
    const restored = await call(adaAdmin, { key: KEY, value: "", dryRun: false });
    expect(restored.error).toBe(false);
    expect(now()).toBe(before);
  });
  test("a token below admin scope plans but cannot apply", async () => {
    const before = now();
    const refused = await call(adaRw, { key: KEY, value: "7", dryRun: false });
    expect(refused.error).toBe(true);
    expect(refused.text).toContain("admin-scope");
    expect(now()).toBe(before);
  });
  test("an unknown key is no_such_limit and names the key", async () => {
    for (const dryRun of [true, false]) {
      const res = await call(adaAdmin, { key: "no_such_thing", value: "5", dryRun });
      expect(res.error).toBe(true);
      expect(res.text).toContain("no_such_limit");
      expect(res.text).toContain("no_such_thing");
    }
  });
  test("a value outside the bounds is refused and the limit unchanged", async () => {
    const before = now();
    for (const value of ["0", "101", "-1", "abc", "1.5"]) {
      const res = await call(adaAdmin, { key: KEY, value, dryRun: false });
      expect(res.error).toBe(true);
      expect(now()).toBe(before);
    }
  });
  test("a non-admin and an agent are refused, the limit unchanged", async () => {
    const before = now();
    for (const token of [cyToken, botToken]) {
      for (const args of [{}, { key: KEY, value: "9" }, { key: KEY, value: "9", dryRun: false }]) {
        expect((await call(token, args)).error).toBe(true);
      }
    }
    expect(now()).toBe(before);
  });
});
		@@ -0,0 +1,150 @@
	1	/**
	2	* The `limits` tool (#7149): a forge admin lists every limit, plans a change
	3	* first and applies it only with an admin-scope token; `""` restores the
	4	* default; an unknown key and a value out of bounds are refused with the limit
	5	* unchanged; a non-admin and an agent are told there is no such tool.
	6	*/
	7	import { afterAll, beforeAll, describe, expect, test } from "bun:test";
	8	import { mkdtemp, rm } from "node:fs/promises";
	9	import { tmpdir } from "node:os";
	10	import { join } from "node:path";
	11	import { createApp, type App } from "../src/app.ts";
	12	import { createAgent } from "../src/actions/crew.ts";
	13	import { createToken } from "../src/core/tokens.ts";
	14	import { createUser } from "../src/core/users.ts";
	15	import { serve, type Servers } from "../src/http/server.ts";
	16	import { LIMIT_KEYS, limitValue } from "../src/settings/limits.ts";
	17	import { quietLogs } from "./helpers/globals.ts";
	18
	19	quietLogs();
	20
	21	const KEY = "front.pinned_max";
	22
	23	describe("MCP limits", () => {
	24	let dataDir: string;
	25	let app: App;
	26	let servers: Servers;
	27	let adaAdmin = "";
	28	let adaRw = "";
	29	let cyToken = "";
	30	let botToken = "";
	31	let id = 1;
	32
	33	const call = async (token: string, args: Record<string, unknown>) => {
	34	const res = await fetch(`${servers.url}/mcp`, {
	35	method: "POST",
	36	headers: {
	37	"content-type": "application/json",
	38	accept: "application/json, text/event-stream",
	39	authorization: `Bearer ${token}`,
	40	},
	41	body: JSON.stringify({
	42	jsonrpc: "2.0",
	43	id: id++,
	44	method: "tools/call",
	45	params: { name: "limits", arguments: args },
	46	}),
	47	});
	48	const body = (await res.json()) as any;
	49	if (body.error) return { text: body.error.message as string, error: true };
	50	return { text: body.result.content[0].text as string, error: body.result.isError === true };
	51	};
	52	const now = () => limitValue(app.db, KEY);
	53
	54	beforeAll(async () => {
	55	dataDir = await mkdtemp(join(tmpdir(), "forge-mcp-limits-"));
	56	app = createApp({ dataDir, port: 0, host: "forge.test" });
	57	servers = await serve(app);
	58	const make = async (username: string, adminIfFirst = false) => {
	59	const made = await createUser(app.db, {
	60	origin: "seed",
	61	trusted: true,
	62	username,
	63	email: `${username}@forge.local`,
	64	password: "a-good-passphrase",
	65	adminIfFirst,
	66	});
	67	if (!made.ok) throw new Error(made.error);
	68	return made.value;
	69	};
	70	const ada = await make("ada", true);
	71	const cy = await make("cy");
	72	const bot = await createAgent(app, ada, { username: "botty", brief: "b", model: "m" });
	73	if (!bot.ok) throw new Error(String(bot.error));
	74	app.db.query("UPDATE user SET is_admin = 1 WHERE id = ?1").run(bot.value.user.id);
	75	adaAdmin = createToken(app.db, ada.id, "admin", "admin").token;
	76	adaRw = createToken(app.db, ada.id, "rw", "rw").token;
	77	cyToken = createToken(app.db, cy.id, "admin", "admin").token;
	78	botToken = createToken(app.db, bot.value.user.id, "admin", "admin").token;
	79	}, 60_000);
	80
	81	afterAll(async () => {
	82	servers?.stop();
	83	app?.close();
	84	if (dataDir) await rm(dataDir, { recursive: true, force: true });
	85	});
	86
	87	test("a forge admin lists every limit with value, default and bounds", async () => {
	88	const res = await call(adaAdmin, {});
	89	expect(res.error).toBe(false);
	90	const { limits } = JSON.parse(res.text);
	91	expect(limits.map((l: any) => l.key)).toEqual([...LIMIT_KEYS]);
	92	const row = limits.find((l: any) => l.key === KEY);
	93	expect(row.value).toBe(row.defaultValue);
	94	expect(row.min).toBe(1);
	95	expect(row.max).toBe(100);
	96	});
	97
	98	test("setting plans first; dryRun false applies; an empty value restores the default", async () => {
	99	const before = now();
	100	const planned = await call(adaAdmin, { key: KEY, value: "7" });
	101	expect(planned.error).toBe(false);
	102	expect(JSON.parse(planned.text).says).toContain("Would set");
	103	expect(now()).toBe(before);
	104
	105	const applied = await call(adaAdmin, { key: KEY, value: "7", dryRun: false });
	106	expect(applied.error).toBe(false);
	107	expect(JSON.parse(applied.text).to).toBe(7);
	108	expect(now()).toBe(7);
	109
	110	const restored = await call(adaAdmin, { key: KEY, value: "", dryRun: false });
	111	expect(restored.error).toBe(false);
	112	expect(now()).toBe(before);
	113	});
	114
	115	test("a token below admin scope plans but cannot apply", async () => {
	116	const before = now();
	117	const refused = await call(adaRw, { key: KEY, value: "7", dryRun: false });
	118	expect(refused.error).toBe(true);
	119	expect(refused.text).toContain("admin-scope");
	120	expect(now()).toBe(before);
	121	});
	122
	123	test("an unknown key is no_such_limit and names the key", async () => {
	124	for (const dryRun of [true, false]) {
	125	const res = await call(adaAdmin, { key: "no_such_thing", value: "5", dryRun });
	126	expect(res.error).toBe(true);
	127	expect(res.text).toContain("no_such_limit");
	128	expect(res.text).toContain("no_such_thing");
	129	}
	130	});
	131
	132	test("a value outside the bounds is refused and the limit unchanged", async () => {
	133	const before = now();
	134	for (const value of ["0", "101", "-1", "abc", "1.5"]) {
	135	const res = await call(adaAdmin, { key: KEY, value, dryRun: false });
	136	expect(res.error).toBe(true);
	137	expect(now()).toBe(before);
	138	}
	139	});
	140
	141	test("a non-admin and an agent are refused, the limit unchanged", async () => {
	142	const before = now();
	143	for (const token of [cyToken, botToken]) {
	144	for (const args of [{}, { key: KEY, value: "9" }, { key: KEY, value: "9", dryRun: false }]) {
	145	expect((await call(token, args)).error).toBe(true);
	146	}
	147	}
	148	expect(now()).toBe(before);
	149	});
	150	});