xpeditis2.0/apps/backend/src/application/mcp/mcp-entitlement.security.spec.ts

70 lines
2.3 KiB
TypeScript

import { Subscription } from '@domain/entities/subscription.entity';
import { SubscriptionPlan } from '@domain/value-objects/subscription-plan.vo';
import {
SubscriptionStatus,
SubscriptionStatusType,
} from '@domain/value-objects/subscription-status.vo';
import { McpController } from './mcp.controller';
import { CapabilityRegistry } from './capability.registry';
import { SubscriptionService } from '../services/subscription.service';
// Real registry and account capability: stale client claims must not be echoed as rights.
describe('MCP current entitlement', () => {
it.each<[SubscriptionStatusType, string, string]>([
['UNPAID', 'MANAGER', 'BRONZE'],
['PAUSED', 'MANAGER', 'BRONZE'],
['ACTIVE', 'MANAGER', 'GOLD'],
['TRIALING', 'MANAGER', 'GOLD'],
['PAST_DUE', 'MANAGER', 'GOLD'],
['UNPAID', 'ADMIN', 'PLATINIUM'],
])('%s resolves live rights for %s', async (status, role, expected) => {
const subscription = Subscription.create({
id: 'sub',
organizationId: 'org',
plan: SubscriptionPlan.gold(),
}).updateStatus(SubscriptionStatus.create(status));
const subscriptions = { getOrCreateSubscription: jest.fn().mockResolvedValue(subscription) };
const registry = new CapabilityRegistry(
{} as never,
{} as never,
{} as never,
subscriptions as unknown as SubscriptionService,
{} as never,
{} as never,
{ log: jest.fn().mockResolvedValue(undefined) } as never
);
const controller = new McpController(registry, subscriptions as unknown as SubscriptionService);
const user = {
id: 'user',
organizationId: 'org',
email: 'test@example.test',
firstName: 'Test',
lastName: 'User',
role,
plan: 'GOLD',
};
const result = await controller.rpc(user, {
jsonrpc: '2.0',
id: 1,
method: 'tools/call',
params: { name: 'whoami' },
});
expect(result).toMatchObject({
result: {
isError: false,
content: [
{
type: 'text',
text: JSON.stringify(
{ userId: 'user', organizationId: 'org', role, plan: expected },
null,
2
),
},
],
},
});
expect(subscriptions.getOrCreateSubscription).toHaveBeenCalledWith('org');
});
});