/**
* postgres-mcp - OAuth Scopes Tests
*
* Tests for scope definitions, parsing, matching, and tool group mapping.
*/
import { describe, it, expect } from 'vitest';
import {
SCOPES,
ALL_SCOPES,
TOOL_GROUP_SCOPES,
parseScopes,
hasScope,
hasAnyScope,
hasAllScopes,
getScopeForToolGroup,
hasDatabaseScope,
hasSchemaScope,
hasTableScope,
getScopeDisplayName
} from '../scopes.js';
describe('OAuth Scopes', () => {
describe('SCOPES constant', () => {
it('should define standard scopes', () => {
expect(SCOPES.READ).toBe('read');
expect(SCOPES.WRITE).toBe('write');
expect(SCOPES.ADMIN).toBe('admin');
expect(SCOPES.FULL).toBe('full');
});
});
describe('ALL_SCOPES constant', () => {
it('should include all standard scopes', () => {
expect(ALL_SCOPES).toContain('read');
expect(ALL_SCOPES).toContain('write');
expect(ALL_SCOPES).toContain('admin');
expect(ALL_SCOPES).toContain('full');
});
});
describe('TOOL_GROUP_SCOPES mapping', () => {
it('should map core groups to read scope', () => {
expect(TOOL_GROUP_SCOPES.core).toBe('read');
expect(TOOL_GROUP_SCOPES.jsonb).toBe('read');
expect(TOOL_GROUP_SCOPES.text).toBe('read');
expect(TOOL_GROUP_SCOPES.stats).toBe('read');
});
it('should map write operations to write scope', () => {
expect(TOOL_GROUP_SCOPES.transactions).toBe('write');
});
it('should map administrative groups to admin scope', () => {
expect(TOOL_GROUP_SCOPES.admin).toBe('admin');
expect(TOOL_GROUP_SCOPES.backup).toBe('admin');
expect(TOOL_GROUP_SCOPES.partitioning).toBe('admin');
expect(TOOL_GROUP_SCOPES.cron).toBe('admin');
expect(TOOL_GROUP_SCOPES.partman).toBe('admin');
});
it('should map extension groups appropriately', () => {
expect(TOOL_GROUP_SCOPES.vector).toBe('read');
expect(TOOL_GROUP_SCOPES.postgis).toBe('read');
expect(TOOL_GROUP_SCOPES.citext).toBe('read');
expect(TOOL_GROUP_SCOPES.ltree).toBe('read');
});
});
describe('parseScopes', () => {
it('should parse space-delimited scope string', () => {
const scopes = parseScopes('read write admin');
expect(scopes).toEqual(['read', 'write', 'admin']);
});
it('should handle single scope', () => {
const scopes = parseScopes('read');
expect(scopes).toEqual(['read']);
});
it('should handle empty string', () => {
const scopes = parseScopes('');
expect(scopes).toEqual([]);
});
it('should handle undefined', () => {
const scopes = parseScopes(undefined);
expect(scopes).toEqual([]);
});
it('should filter out empty strings from extra spaces', () => {
const scopes = parseScopes('read write admin');
expect(scopes).toEqual(['read', 'write', 'admin']);
});
it('should handle pattern scopes', () => {
const scopes = parseScopes('read db:mydb table:public:users');
expect(scopes).toEqual(['read', 'db:mydb', 'table:public:users']);
});
});
describe('hasScope', () => {
it('should return true for direct match', () => {
expect(hasScope(['read', 'write'], 'read')).toBe(true);
expect(hasScope(['read', 'write'], 'write')).toBe(true);
});
it('should return false when scope not present', () => {
expect(hasScope(['read'], 'write')).toBe(false);
expect(hasScope(['read'], 'admin')).toBe(false);
});
it('should grant full access from full scope', () => {
expect(hasScope(['full'], 'read')).toBe(true);
expect(hasScope(['full'], 'write')).toBe(true);
expect(hasScope(['full'], 'admin')).toBe(true);
expect(hasScope(['full'], 'anything')).toBe(true);
});
it('should grant read and write access from admin scope', () => {
expect(hasScope(['admin'], 'read')).toBe(true);
expect(hasScope(['admin'], 'write')).toBe(true);
});
it('should grant read access from write scope', () => {
expect(hasScope(['write'], 'read')).toBe(true);
expect(hasScope(['write'], 'admin')).toBe(false);
});
it('should not grant admin access from read/write', () => {
expect(hasScope(['read'], 'admin')).toBe(false);
expect(hasScope(['write'], 'admin')).toBe(false);
});
it('should handle empty scopes array', () => {
expect(hasScope([], 'read')).toBe(false);
});
});
describe('hasAnyScope', () => {
it('should return true if any scope matches', () => {
expect(hasAnyScope(['read'], ['read', 'write'])).toBe(true);
expect(hasAnyScope(['write'], ['read', 'write'])).toBe(true);
});
it('should return false if no scope matches', () => {
expect(hasAnyScope(['read'], ['admin', 'write'])).toBe(false);
});
it('should consider scope hierarchy', () => {
expect(hasAnyScope(['full'], ['admin'])).toBe(true);
expect(hasAnyScope(['admin'], ['read', 'write'])).toBe(true);
});
it('should handle empty required scopes', () => {
expect(hasAnyScope(['read'], [])).toBe(false);
});
});
describe('hasAllScopes', () => {
it('should return true if all scopes match', () => {
expect(hasAllScopes(['read', 'write'], ['read', 'write'])).toBe(true);
});
it('should return false if any scope missing', () => {
expect(hasAllScopes(['read'], ['read', 'write'])).toBe(false);
});
it('should consider scope hierarchy', () => {
// Full grants everything
expect(hasAllScopes(['full'], ['read', 'write', 'admin'])).toBe(true);
// Admin grants read and write
expect(hasAllScopes(['admin'], ['read', 'write'])).toBe(true);
});
it('should handle empty required scopes', () => {
expect(hasAllScopes(['read'], [])).toBe(true);
});
});
describe('getScopeForToolGroup', () => {
it('should return correct scope for known groups', () => {
expect(getScopeForToolGroup('core')).toBe('read');
expect(getScopeForToolGroup('transactions')).toBe('write');
expect(getScopeForToolGroup('admin')).toBe('admin');
});
it('should default to read for unknown groups', () => {
// Type assertion needed for testing unknown group
expect(getScopeForToolGroup('unknown' as never)).toBe('read');
});
});
describe('hasDatabaseScope', () => {
it('should match database pattern scope', () => {
expect(hasDatabaseScope(['db:mydb'], 'mydb')).toBe(true);
expect(hasDatabaseScope(['db:mydb'], 'otherdb')).toBe(false);
});
it('should grant access with full scope', () => {
expect(hasDatabaseScope(['full'], 'anydb')).toBe(true);
});
it('should grant access with admin scope', () => {
expect(hasDatabaseScope(['admin'], 'anydb')).toBe(true);
});
it('should not match without pattern scope', () => {
expect(hasDatabaseScope(['read'], 'mydb')).toBe(false);
});
});
describe('hasSchemaScope', () => {
it('should match schema pattern scope', () => {
expect(hasSchemaScope(['schema:public'], 'public')).toBe(true);
expect(hasSchemaScope(['schema:public'], 'private')).toBe(false);
});
it('should grant access with full scope', () => {
expect(hasSchemaScope(['full'], 'anyschema')).toBe(true);
});
it('should grant access with admin scope', () => {
expect(hasSchemaScope(['admin'], 'anyschema')).toBe(true);
});
});
describe('hasTableScope', () => {
it('should match table pattern scope', () => {
expect(hasTableScope(['table:public:users'], 'public', 'users')).toBe(true);
expect(hasTableScope(['table:public:users'], 'public', 'orders')).toBe(false);
});
it('should inherit from schema scope', () => {
expect(hasTableScope(['schema:public'], 'public', 'users')).toBe(true);
expect(hasTableScope(['schema:public'], 'private', 'users')).toBe(false);
});
it('should grant access with full scope', () => {
expect(hasTableScope(['full'], 'any', 'table')).toBe(true);
});
it('should grant access with admin scope', () => {
expect(hasTableScope(['admin'], 'any', 'table')).toBe(true);
});
});
describe('getScopeDisplayName', () => {
it('should return friendly names for standard scopes', () => {
expect(getScopeDisplayName('read')).toBe('Read Only');
expect(getScopeDisplayName('write')).toBe('Read/Write');
expect(getScopeDisplayName('admin')).toBe('Administrative');
expect(getScopeDisplayName('full')).toBe('Full Access');
});
it('should format database scope', () => {
expect(getScopeDisplayName('db:mydb')).toBe('Database: mydb');
});
it('should format schema scope', () => {
expect(getScopeDisplayName('schema:public')).toBe('Schema: public');
});
it('should format table scope', () => {
expect(getScopeDisplayName('table:public:users')).toBe('Table: public:users');
});
it('should return unknown scopes unchanged', () => {
expect(getScopeDisplayName('custom:scope')).toBe('custom:scope');
});
});
});
