fleetgner-core.test.ts

import { afterEach, beforeEach, describe, expect, test } from "bun:test";
import { generateSecretKey } from "nostr-tools";
import { createDatabase } from "../src/db/client";
import { createRepositories, type Repositories } from "../src/db/repositories";
import { createFleetgnerMcpServer } from "../src/cvm/server";
import { Keyring } from "../src/keys/keyring";
import { Nip46Gateway } from "../src/nip46/gateway";
import { PolicyRegistry } from "../src/policy/registry";
import { SigningCore, SigningDeniedError } from "../src/signing/core";

function stubExtra(clientPubkey: string) {
  return { _meta: { clientPubkey } };
}

async function callRegisteredTool(
  server: ReturnType<typeof createFleetgnerMcpServer>,
  name: string,
  args: Record<string, unknown>,
  clientPubkey: string,
): Promise<{ structuredContent: unknown }> {
  const tool = (
    server as unknown as {
      _registeredTools: Record<string, unknown>;
      executeToolHandler: (
        tool: unknown,
        args: Record<string, unknown>,
        extra: { _meta: { clientPubkey: string } },
      ) => Promise<{ structuredContent: unknown }>;
    }
  )._registeredTools[name];

  return await (
    server as unknown as {
      executeToolHandler: (
        tool: unknown,
        args: Record<string, unknown>,
        extra: { _meta: { clientPubkey: string } },
      ) => Promise<{ structuredContent: unknown }>;
    }
  ).executeToolHandler(tool, args, stubExtra(clientPubkey));
}

function toHex(bytes: Uint8Array): string {
  return Buffer.from(bytes).toString("hex");
}

describe("database repositories", () => {
  test("stores grants and policies in normalized tables", () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);

    repos.users.upsert({
      pubkey: "u".repeat(64),
      enabled: true,
      label: "user",
    });
    repos.keys.upsert({
      pubkey: "k".repeat(64).replace(/k/g, "a"),
      secretRef: "key:test:nsec",
      enabled: true,
      label: "key",
    });

    repos.grants.upsert({
      userPubkey: "u".repeat(64),
      keyPubkey: "a".repeat(64),
      enabled: true,
    });

    repos.policies.upsert({
      userPubkey: "u".repeat(64),
      keyPubkey: "a".repeat(64),
      policyKey: "allow_kinds",
      enabled: true,
      value: "1,30078",
    });
    repos.policies.upsert({
      userPubkey: "u".repeat(64),
      keyPubkey: "a".repeat(64),
      policyKey: "max_content_length",
      enabled: true,
      value: "42",
    });

    const policies = repos.policies.listByGrant("u".repeat(64), "a".repeat(64));
    expect(policies).toHaveLength(2);
    expect(policies.find((p) => p.policy_key === "allow_kinds")?.value).toBe(
      "1,30078",
    );
    expect(
      repos.policies.delete("u".repeat(64), "a".repeat(64), "allow_kinds"),
    ).not.toBeNull();

    db.close();
  });

  test("deleting grant cascades related policies", () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);

    const userPubkey = "u".repeat(64);
    const keyPubkey = "a".repeat(64);

    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: "user" });
    repos.keys.upsert({
      pubkey: keyPubkey,
      secretRef: "key:cascade:nsec",
      enabled: true,
      label: "key",
    });
    repos.grants.upsert({ userPubkey, keyPubkey, enabled: true });
    repos.policies.upsert({
      userPubkey,
      keyPubkey,
      policyKey: "allow_kinds",
      enabled: true,
      value: "1",
    });
    repos.policies.upsert({
      userPubkey,
      keyPubkey,
      policyKey: "max_content_length",
      enabled: true,
      value: "120",
    });

    expect(repos.policies.listByGrant(userPubkey, keyPubkey)).toHaveLength(2);
    expect(repos.grants.delete(userPubkey, keyPubkey)).not.toBeNull();
    expect(repos.policies.listByGrant(userPubkey, keyPubkey)).toHaveLength(0);

    db.close();
  });

  test("listEnabledKeyPubkeysByUser returns only enabled grants for enabled keys", () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);

    const userPubkey = "f".repeat(64);
    const keyA = "a".repeat(64);
    const keyB = "b".repeat(64);
    const keyC = "c".repeat(64);

    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: keyA,
      secretRef: "key:a",
      enabled: true,
      label: null,
    });
    repos.keys.upsert({
      pubkey: keyB,
      secretRef: "key:b",
      enabled: false,
      label: null,
    });
    repos.keys.upsert({
      pubkey: keyC,
      secretRef: "key:c",
      enabled: true,
      label: null,
    });

    repos.grants.upsert({ userPubkey, keyPubkey: keyA, enabled: true });
    repos.grants.upsert({ userPubkey, keyPubkey: keyB, enabled: true });
    repos.grants.upsert({ userPubkey, keyPubkey: keyC, enabled: false });

    const keyPubkeys = repos.grants.listEnabledKeyPubkeysByUser(userPubkey);
    expect(keyPubkeys).toEqual([keyA]);

    db.close();
  });

  test("policy upsert patch keeps existing value when only enabled changes", () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);

    const userPubkey = "d".repeat(64);
    const keyPubkey = "e".repeat(64);

    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: keyPubkey,
      secretRef: "key:patch:nsec",
      enabled: true,
      label: null,
    });
    repos.grants.upsert({ userPubkey, keyPubkey, enabled: true });

    repos.policies.upsert({
      userPubkey,
      keyPubkey,
      policyKey: "allow_kinds",
      enabled: true,
      value: "1,30078",
    });

    repos.policies.upsert({
      userPubkey,
      keyPubkey,
      policyKey: "allow_kinds",
      enabled: false,
    });

    const policy = repos.policies.get(userPubkey, keyPubkey, "allow_kinds");
    expect(policy).not.toBeNull();
    expect(policy?.enabled).toBe(0);
    expect(policy?.value).toBe("1,30078");

    db.close();
  });

  test("deleting key cascades grants, policies and nip46 connections", () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);

    const userPubkey = "9".repeat(64);
    const keyPubkey = "8".repeat(64);

    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: keyPubkey,
      secretRef: "key:cascade:key-remove",
      enabled: true,
      label: null,
    });
    repos.grants.upsert({ userPubkey, keyPubkey, enabled: true });
    repos.policies.upsert({
      userPubkey,
      keyPubkey,
      policyKey: "allow_kinds",
      enabled: true,
      value: "1",
    });
    repos.nip46Connections.create({
      id: "conn-key-remove",
      userPubkey,
      keyPubkey,
      mode: "bunker",
      relays: ["wss://relay.example"],
      secretHash: "s".repeat(64),
    });

    expect(repos.grants.get(userPubkey, keyPubkey)).not.toBeNull();
    expect(repos.policies.listByGrant(userPubkey, keyPubkey)).toHaveLength(1);
    expect(repos.nip46Connections.listByKeyPubkey(keyPubkey)).toHaveLength(1);

    expect(repos.keys.delete(keyPubkey)).not.toBeNull();

    expect(repos.grants.get(userPubkey, keyPubkey)).toBeNull();
    expect(repos.policies.listByGrant(userPubkey, keyPubkey)).toHaveLength(0);
    expect(repos.nip46Connections.listByKeyPubkey(keyPubkey)).toHaveLength(0);

    db.close();
  });
});

describe("keyring", () => {
  const keyring = new Keyring();
  const createdRefs: string[] = [];

  afterEach(async () => {
    for (const ref of createdRefs.splice(0)) {
      await keyring.deleteSecretByRef(ref);
    }
  });

  test("imports, reads and deletes signing key secret", async () => {
    const nsecHex = toHex(generateSecretKey());
    const imported = await keyring.importSigningKey(nsecHex);
    createdRefs.push(imported.secretRef);

    const loaded = await keyring.getSecretByRef(imported.secretRef);
    expect(loaded).toBe(imported.nsec);

    await keyring.deleteSecretByRef(imported.secretRef);

    await expect(keyring.getSecretByRef(imported.secretRef)).rejects.toThrow(
      `missing secret for ref: ${imported.secretRef}`,
    );
  });

  test("getOrCreateCommsSecret is stable for same ref", async () => {
    const ref = `comms:test:${Date.now()}:${Math.random()}`;
    createdRefs.push(ref);

    const first = await keyring.getOrCreateCommsSecret(ref);
    const second = await keyring.getOrCreateCommsSecret(ref);

    expect(first).toBe(second);
    expect(first).toHaveLength(64);
  });
});

describe("signing core", () => {
  let repos: Repositories;
  let keyring: Keyring;
  let signing: SigningCore;

  beforeEach(() => {
    const db = createDatabase({ filename: ":memory:" });
    repos = createRepositories(db);
    keyring = new Keyring();
    signing = new SigningCore(repos, keyring, new PolicyRegistry());
  });

  test("signs when grant and policies allow", async () => {
    const callerPubkey = "b".repeat(64);
    const imported = await keyring.importSigningKey(toHex(generateSecretKey()));

    repos.users.upsert({ pubkey: callerPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: imported.pubkey,
      secretRef: imported.secretRef,
      enabled: true,
      label: null,
    });
    repos.grants.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      enabled: true,
    });
    repos.policies.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      policyKey: "allow_kinds",
      enabled: true,
      value: "1",
    });

    const signed = await signing.signDraft({
      callerPubkey,
      channel: "cvm",
      draft: {
        pubkey: imported.pubkey,
        kind: 1,
        tags: [],
        content: "hello",
      },
    });

    expect(signed.pubkey).toBe(imported.pubkey);
    expect(signed.kind).toBe(1);
    expect(signed.id).toHaveLength(64);
    expect(signed.sig).toHaveLength(128);

    await keyring.deleteSecretByRef(imported.secretRef);
  });

  test("denies signing when policy rejects", async () => {
    const callerPubkey = "c".repeat(64);
    const imported = await keyring.importSigningKey(toHex(generateSecretKey()));

    repos.users.upsert({ pubkey: callerPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: imported.pubkey,
      secretRef: imported.secretRef,
      enabled: true,
      label: null,
    });
    repos.grants.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      enabled: true,
    });
    repos.policies.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      policyKey: "deny_kinds",
      enabled: true,
      value: "1",
    });

    await expect(
      signing.signDraft({
        callerPubkey,
        channel: "nip46",
        draft: {
          pubkey: imported.pubkey,
          kind: 1,
          tags: [],
          content: "blocked",
        },
      }),
    ).rejects.toBeInstanceOf(SigningDeniedError);

    await keyring.deleteSecretByRef(imported.secretRef);
  });

  test("denies signing when grant exists but is disabled", async () => {
    const callerPubkey = "d".repeat(64);
    const imported = await keyring.importSigningKey(toHex(generateSecretKey()));

    repos.users.upsert({ pubkey: callerPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: imported.pubkey,
      secretRef: imported.secretRef,
      enabled: true,
      label: null,
    });
    repos.grants.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      enabled: false,
    });

    await expect(
      signing.signDraft({
        callerPubkey,
        channel: "cvm",
        draft: {
          pubkey: imported.pubkey,
          kind: 1,
          tags: [],
          content: "blocked-by-disabled-grant",
        },
      }),
    ).rejects.toMatchObject({ reason: "grant_not_enabled" });

    await keyring.deleteSecretByRef(imported.secretRef);
  });

  test("disabled denying policy is ignored", async () => {
    const callerPubkey = "e".repeat(64);
    const imported = await keyring.importSigningKey(toHex(generateSecretKey()));

    repos.users.upsert({ pubkey: callerPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: imported.pubkey,
      secretRef: imported.secretRef,
      enabled: true,
      label: null,
    });
    repos.grants.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      enabled: true,
    });
    repos.policies.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      policyKey: "deny_kinds",
      enabled: false,
      value: "1",
    });

    const signed = await signing.signDraft({
      callerPubkey,
      channel: "nip46",
      draft: {
        pubkey: imported.pubkey,
        kind: 1,
        tags: [],
        content: "allowed-because-policy-disabled",
      },
    });

    expect(signed.pubkey).toBe(imported.pubkey);
    expect(signed.sig).toHaveLength(128);

    await keyring.deleteSecretByRef(imported.secretRef);
  });
});

describe("cvm server tool behavior", () => {
  test("user_list includes admin self and user labels", async () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);
    const keyring = new Keyring();
    const policyRegistry = new PolicyRegistry();
    const signingCore = new SigningCore(repos, keyring, policyRegistry);
    const adminPubkey = "a".repeat(64);
    const userPubkey = "b".repeat(64);

    repos.serverConfig.set({
      adminPubkey,
      commsSecretRef: "comms:test",
      relayUrls: ["wss://relay.example"],
    });
    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: "alice" });

    const gatewayStub = {
      refreshConnectionsForUser: async () => {},
      refreshConnectionsForKey: async () => {},
      refreshConnectionsForGrant: async () => {},
      stopConnectionsForUser: async () => {},
      stopConnectionsForKey: async () => {},
      stopAndDeleteConnectionsForGrant: async () => {},
      createBunkerUri: async () => "bunker://uri",
      addNostrConnectUri: async () => {},
    } as unknown as Nip46Gateway;

    const server = createFleetgnerMcpServer({
      repos,
      keyring,
      policyRegistry,
      signingCore,
      nip46Gateway: gatewayStub,
    });

    const result = await callRegisteredTool(
      server,
      "user_list",
      {},
      adminPubkey,
    );
    const users = (
      result.structuredContent as { users: Array<Record<string, unknown>> }
    ).users;

    expect(users).toHaveLength(2);
    expect(users[0]).toMatchObject({
      pubkey: adminPubkey,
      label: "",
      isAdmin: true,
    });
    expect(users[1]).toMatchObject({
      pubkey: userPubkey,
      label: "alice",
      isAdmin: false,
    });

    db.close();
  });

  test("grant_set allows creating a restricted zero-policy grant before policies exist", async () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);
    const keyring = new Keyring();
    const policyRegistry = new PolicyRegistry();
    const signingCore = new SigningCore(repos, keyring, policyRegistry);
    const adminPubkey = "c".repeat(64);
    const userPubkey = "d".repeat(64);
    const keyPubkey = "e".repeat(64);

    repos.serverConfig.set({
      adminPubkey,
      commsSecretRef: "comms:test-2",
      relayUrls: ["wss://relay.example"],
    });
    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: "user" });
    repos.keys.upsert({
      pubkey: keyPubkey,
      secretRef: "key:test-grant",
      enabled: true,
      label: "key",
    });
    const gatewayCalls: string[] = [];
    const gatewayStub = {
      refreshConnectionsForUser: async () => {},
      refreshConnectionsForKey: async () => {},
      refreshConnectionsForGrant: async (user: string, key: string) => {
        gatewayCalls.push(`${user}:${key}`);
      },
      stopConnectionsForUser: async () => {},
      stopConnectionsForKey: async () => {},
      stopAndDeleteConnectionsForGrant: async () => {},
      createBunkerUri: async () => "bunker://uri",
      addNostrConnectUri: async () => {},
    } as unknown as Nip46Gateway;

    const server = createFleetgnerMcpServer({
      repos,
      keyring,
      policyRegistry,
      signingCore,
      nip46Gateway: gatewayStub,
    });

    const result = await callRegisteredTool(
      server,
      "grant_set",
      { user_pubkey: userPubkey, key_pubkey: keyPubkey },
      adminPubkey,
    );

    expect(result.structuredContent).toMatchObject({
      user_pubkey: userPubkey,
      key_pubkey: keyPubkey,
      grant_enabled: true,
      is_unrestricted: false,
    });
    expect(repos.grants.get(userPubkey, keyPubkey)).toMatchObject({
      allow_unrestricted: 0,
      enabled: 1,
    });
    expect(gatewayCalls).toEqual([`${userPubkey}:${keyPubkey}`]);

    db.close();
  });

  test("signing denies a restricted zero-policy grant until a policy is added", async () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);
    const keyring = new Keyring();
    const signing = new SigningCore(repos, keyring, new PolicyRegistry());
    const callerPubkey = "f".repeat(64);
    const imported = await keyring.importSigningKey(toHex(generateSecretKey()));

    repos.users.upsert({ pubkey: callerPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: imported.pubkey,
      secretRef: imported.secretRef,
      enabled: true,
      label: null,
    });
    repos.grants.upsert({
      userPubkey: callerPubkey,
      keyPubkey: imported.pubkey,
      enabled: true,
      allowUnrestricted: false,
    });

    await expect(
      signing.signDraft({
        callerPubkey,
        channel: "cvm",
        draft: {
          pubkey: imported.pubkey,
          kind: 1,
          tags: [],
          content: "blocked-until-policy-exists",
        },
      }),
    ).rejects.toMatchObject({
      reason: "grant_not_ready_requires_policy_or_allow_unrestricted",
    });

    await keyring.deleteSecretByRef(imported.secretRef);
    db.close();
  });
});

describe("nip46 gateway lifecycle", () => {
  test("stopConnectionsForGrant keeps persisted rows and refreshConnectionsForGrant restarts eligible ones", async () => {
    const db = createDatabase({ filename: ":memory:" });
    const repos = createRepositories(db);
    const signingCore = {
      signDraft: async () => ({}) as never,
    } as unknown as SigningCore;
    const commsSigner = {} as ConstructorParameters<typeof Nip46Gateway>[2];
    const gateway = new Nip46Gateway(repos, signingCore, commsSigner);
    const userPubkey = "1".repeat(64);
    const keyPubkey = "2".repeat(64);

    repos.users.upsert({ pubkey: userPubkey, enabled: true, label: null });
    repos.keys.upsert({
      pubkey: keyPubkey,
      secretRef: "key:test-gateway",
      enabled: true,
      label: null,
    });
    repos.grants.upsert({
      userPubkey,
      keyPubkey,
      enabled: true,
      allowUnrestricted: true,
    });
    repos.nip46Connections.create({
      id: "conn-1",
      userPubkey,
      keyPubkey,
      mode: "bunker",
      relays: ["wss://relay.example"],
      secretHash: "s".repeat(64),
    });

    const stopCalls: string[] = [];
    const startCalls: string[] = [];
    (
      gateway as unknown as {
        providers: Map<string, { stop: () => Promise<void> }>;
      }
    ).providers.set("conn-1", {
      stop: async () => {
        stopCalls.push("conn-1");
      },
    });
    gateway.startConnection = async (connectionId: string) => {
      startCalls.push(connectionId);
      return { connectionId, provider: {} as never };
    };

    await gateway.stopConnectionsForGrant(userPubkey, keyPubkey);
    expect(stopCalls).toEqual(["conn-1"]);
    expect(repos.nip46Connections.get("conn-1")).not.toBeNull();

    await gateway.refreshConnectionsForGrant(userPubkey, keyPubkey);
    expect(startCalls).toEqual(["conn-1"]);

    db.close();
  });
});