/** * @license * Copyright 2025 Google LLC * SPDX-License-Identifier: Apache-2.0 */ import { describe, it, expect } from 'vitest'; import { applyAdminAllowlist, applyRequiredServers } from './mcpUtils.js'; import type { MCPServerConfig } from '../../config/config.js'; import { AuthProviderType } from '../../config/config.js'; import type { RequiredMcpServerConfig } from '../types.js'; describe('applyAdminAllowlist', () => { it('should return original servers if no allowlist provided', () => { const localServers: Record = { server1: { command: 'cmd1' }, }; expect(applyAdminAllowlist(localServers, undefined)).toEqual({ mcpServers: localServers, blockedServerNames: [], }); }); it('should return original servers if allowlist is empty', () => { const localServers: Record = { server1: { command: 'cmd1' }, }; expect(applyAdminAllowlist(localServers, {})).toEqual({ mcpServers: localServers, blockedServerNames: [], }); }); it('should filter servers not in allowlist', () => { const localServers: Record = { server1: { command: 'cmd1' }, server2: { command: 'cmd2' }, }; const allowlist: Record = { server1: { url: 'http://server1' }, }; const result = applyAdminAllowlist(localServers, allowlist); expect(Object.keys(result.mcpServers)).toEqual(['server1']); expect(result.blockedServerNames).toEqual(['server2']); }); it('should override connection details with allowlist values', () => { const localServers: Record = { server1: { command: 'local-cmd', args: ['local-arg'], env: { LOCAL: 'true' }, description: 'Local description', }, }; const allowlist: Record = { server1: { url: 'http://admin-url', type: 'sse', trust: true, }, }; const result = applyAdminAllowlist(localServers, allowlist); const server = result.mcpServers['server1']; expect(server).toBeDefined(); expect(server?.url).toBe('http://admin-url'); expect(server?.type).toBe('sse'); expect(server?.trust).toBe(true); // Should preserve other local fields expect(server?.description).toBe('Local description'); // Should remove local connection fields expect(server?.command).toBeUndefined(); expect(server?.args).toBeUndefined(); expect(server?.env).toBeUndefined(); }); it('should apply tool restrictions from allowlist', () => { const localServers: Record = { server1: { command: 'cmd1' }, }; const allowlist: Record = { server1: { url: 'http://url', includeTools: ['tool1'], excludeTools: ['tool2'], }, }; const result = applyAdminAllowlist(localServers, allowlist); expect(result.mcpServers['server1']?.includeTools).toEqual(['tool1']); expect(result.mcpServers['server1']?.excludeTools).toEqual(['tool2']); }); it('should not apply empty tool restrictions from allowlist', () => { const localServers: Record = { server1: { command: 'cmd1', includeTools: ['local-tool'], }, }; const allowlist: Record = { server1: { url: 'http://url', includeTools: [], }, }; const result = applyAdminAllowlist(localServers, allowlist); // Should keep local tool restrictions if admin ones are empty/undefined expect(result.mcpServers['server1']?.includeTools).toEqual(['local-tool']); }); }); describe('applyRequiredServers', () => { it('should return original servers if no required servers provided', () => { const mcpServers: Record = { server1: { command: 'cmd1' }, }; const result = applyRequiredServers(mcpServers, undefined); expect(result.mcpServers).toEqual(mcpServers); expect(result.requiredServerNames).toEqual([]); }); it('should return original servers if required servers is empty', () => { const mcpServers: Record = { server1: { command: 'cmd1' }, }; const result = applyRequiredServers(mcpServers, {}); expect(result.mcpServers).toEqual(mcpServers); expect(result.requiredServerNames).toEqual([]); }); it('should inject required servers when no local config exists', () => { const mcpServers: Record = { 'local-server': { command: 'cmd1' }, }; const required: Record = { 'corp-tool': { url: 'https://mcp.corp.internal/tool', type: 'http', description: 'Corp compliance tool', }, }; const result = applyRequiredServers(mcpServers, required); expect(Object.keys(result.mcpServers)).toContain('local-server'); expect(Object.keys(result.mcpServers)).toContain('corp-tool'); expect(result.requiredServerNames).toEqual(['corp-tool']); const corpTool = result.mcpServers['corp-tool']; expect(corpTool).toBeDefined(); expect(corpTool?.url).toBe('https://mcp.corp.internal/tool'); expect(corpTool?.type).toBe('http'); expect(corpTool?.description).toBe('Corp compliance tool'); // trust defaults to true for admin-forced servers expect(corpTool?.trust).toBe(true); // stdio fields should not be set expect(corpTool?.command).toBeUndefined(); expect(corpTool?.args).toBeUndefined(); }); it('should override local server with same name', () => { const mcpServers: Record = { 'shared-server': { command: 'local-cmd', args: ['local-arg'], description: 'Local version', }, }; const required: Record = { 'shared-server': { url: 'https://admin.corp/shared', type: 'sse', trust: false, description: 'Admin-mandated version', }, }; const result = applyRequiredServers(mcpServers, required); const server = result.mcpServers['shared-server']; // Admin config should completely override local expect(server?.url).toBe('https://admin.corp/shared'); expect(server?.type).toBe('sse'); expect(server?.trust).toBe(false); expect(server?.description).toBe('Admin-mandated version'); // Local fields should NOT be preserved expect(server?.command).toBeUndefined(); expect(server?.args).toBeUndefined(); }); it('should preserve auth configuration', () => { const required: Record = { 'auth-server': { url: 'https://auth.corp/tool', type: 'http', authProviderType: AuthProviderType.GOOGLE_CREDENTIALS, oauth: { scopes: ['https://www.googleapis.com/auth/scope1'], }, targetAudience: 'client-id.apps.googleusercontent.com', headers: { 'X-Custom': 'value' }, }, }; const result = applyRequiredServers({}, required); const server = result.mcpServers['auth-server']; expect(server?.authProviderType).toBe(AuthProviderType.GOOGLE_CREDENTIALS); expect(server?.oauth).toEqual({ scopes: ['https://www.googleapis.com/auth/scope1'], }); expect(server?.targetAudience).toBe('client-id.apps.googleusercontent.com'); expect(server?.headers).toEqual({ 'X-Custom': 'value' }); }); it('should preserve tool filtering', () => { const required: Record = { 'filtered-server': { url: 'https://corp/tool', type: 'http', includeTools: ['toolA', 'toolB'], excludeTools: ['toolC'], }, }; const result = applyRequiredServers({}, required); const server = result.mcpServers['filtered-server']; expect(server?.includeTools).toEqual(['toolA', 'toolB']); expect(server?.excludeTools).toEqual(['toolC']); }); it('should coexist with allowlisted servers', () => { // Simulate post-allowlist filtering const afterAllowlist: Record = { 'allowed-server': { url: 'http://allowed', type: 'sse', trust: true, }, }; const required: Record = { 'required-server': { url: 'https://required.corp/tool', type: 'http', }, }; const result = applyRequiredServers(afterAllowlist, required); expect(Object.keys(result.mcpServers)).toHaveLength(2); expect(result.mcpServers['allowed-server']).toBeDefined(); expect(result.mcpServers['required-server']).toBeDefined(); expect(result.requiredServerNames).toEqual(['required-server']); }); });