/**
* mysql-mcp - HTTP Transport Unit Tests
*
* Tests for HTTP transport functionality including CORS,
* health checks, OAuth metadata, and request routing.
*/
import { describe, it, expect, vi, beforeEach } from 'vitest';
import { HttpTransport, createHttpTransport } from '../http.js';
import type { IncomingMessage, ServerResponse } from 'node:http';
import { createServer } from 'node:http';
// Mock node:http
vi.mock('node:http', () => {
const mockServer = {
listen: vi.fn((port, host, cb) => cb()),
close: vi.fn((cb) => cb && cb()),
on: vi.fn()
};
return {
createServer: vi.fn(() => mockServer),
IncomingMessage: vi.fn(),
ServerResponse: vi.fn()
};
});
// Mock SDK StreamableHTTPServerTransport
vi.mock('@modelcontextprotocol/sdk/server/streamableHttp.js', () => {
return {
StreamableHTTPServerTransport: vi.fn(function () {
return {
start: vi.fn().mockResolvedValue(undefined),
handleRequest: vi.fn().mockResolvedValue(undefined)
};
})
};
});
// Mock logger to avoid console output
vi.mock('../../utils/logger.js', () => ({
logger: {
info: vi.fn(),
error: vi.fn(),
warn: vi.fn(),
debug: vi.fn()
}
}));
describe('HttpTransport', () => {
let transport: HttpTransport;
beforeEach(() => {
vi.clearAllMocks();
transport = new HttpTransport({
port: 3000,
host: 'localhost'
});
});
describe('Lifecycle', () => {
it('should start server on start()', async () => {
await transport.start();
expect(createServer).toHaveBeenCalled();
const server = (createServer as any).mock.results[0].value;
expect(server.listen).toHaveBeenCalledWith(3000, 'localhost', expect.any(Function));
expect(server.on).toHaveBeenCalledWith('error', expect.any(Function));
});
it('should stop server on stop()', async () => {
await transport.start();
await transport.stop();
const server = (createServer as any).mock.results[0].value;
expect(server.close).toHaveBeenCalled();
});
it('should do nothing on stop() if not started', async () => {
const result = await transport.stop();
expect(result).toBeUndefined();
});
});
describe('Construction', () => {
it('should create transport with config', () => {
expect(transport).toBeInstanceOf(HttpTransport);
});
it('should use default host when not provided', () => {
const t = new HttpTransport({ port: 8080 });
expect(t).toBeInstanceOf(HttpTransport);
});
});
describe('setCorsHeaders()', () => {
it('should not set CORS headers when origin not in allowed list', () => {
const transportWithCors = new HttpTransport({
port: 3000,
corsOrigins: ['https://allowed.example.com']
});
const mockReq = {
headers: { origin: 'https://notallowed.example.com' }
} as IncomingMessage;
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
// Access private method via prototype
(transportWithCors as unknown as { setCorsHeaders: (req: IncomingMessage, res: ServerResponse) => void })
.setCorsHeaders(mockReq, mockRes);
expect(mockRes.setHeader).not.toHaveBeenCalled();
});
it('should set CORS headers when origin is allowed', () => {
const transportWithCors = new HttpTransport({
port: 3000,
corsOrigins: ['https://allowed.example.com']
});
const mockReq = {
headers: { origin: 'https://allowed.example.com' }
} as IncomingMessage;
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transportWithCors as unknown as { setCorsHeaders: (req: IncomingMessage, res: ServerResponse) => void })
.setCorsHeaders(mockReq, mockRes);
expect(mockRes.setHeader).toHaveBeenCalledWith(
'Access-Control-Allow-Origin',
'https://allowed.example.com'
);
expect(mockRes.setHeader).toHaveBeenCalledWith(
'Access-Control-Allow-Methods',
'GET, POST, OPTIONS'
);
expect(mockRes.setHeader).toHaveBeenCalledWith(
'Access-Control-Allow-Headers',
'Content-Type, Authorization'
);
});
it('should not set CORS when no origin header', () => {
const transportWithCors = new HttpTransport({
port: 3000,
corsOrigins: ['https://allowed.example.com']
});
const mockReq = {
headers: {}
} as IncomingMessage;
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transportWithCors as unknown as { setCorsHeaders: (req: IncomingMessage, res: ServerResponse) => void })
.setCorsHeaders(mockReq, mockRes);
expect(mockRes.setHeader).not.toHaveBeenCalled();
});
});
describe('handleHealthCheck()', () => {
it('should return healthy status', () => {
const mockRes = {
writeHead: vi.fn(),
end: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { handleHealthCheck: (res: ServerResponse) => void })
.handleHealthCheck(mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(200, {
'Content-Type': 'application/json'
});
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
const response = JSON.parse(endCall as string);
expect(response).toHaveProperty('status', 'healthy');
expect(response).toHaveProperty('timestamp');
});
it('should include ISO timestamp', () => {
const mockRes = {
writeHead: vi.fn(),
end: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { handleHealthCheck: (res: ServerResponse) => void })
.handleHealthCheck(mockRes);
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
const response = JSON.parse(endCall as string);
// Validate ISO timestamp format
expect(() => new Date(response.timestamp as string)).not.toThrow();
});
});
describe('handleProtectedResourceMetadata()', () => {
it('should return 404 when OAuth not configured', () => {
const mockRes = {
writeHead: vi.fn(),
end: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { handleProtectedResourceMetadata: (res: ServerResponse) => void })
.handleProtectedResourceMetadata(mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(404);
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
const response = JSON.parse(endCall as string);
expect(response).toHaveProperty('error');
});
it('should return metadata when OAuth configured', () => {
const mockResourceServer = {
getMetadata: () => ({
resource: 'https://mysql-mcp.example.com',
authorization_servers: ['https://auth.example.com'],
scopes_supported: ['read', 'write']
})
};
const transportWithOAuth = new HttpTransport({
port: 3000,
resourceServer: mockResourceServer as never
});
const mockRes = {
writeHead: vi.fn(),
end: vi.fn()
} as unknown as ServerResponse;
(transportWithOAuth as unknown as { handleProtectedResourceMetadata: (res: ServerResponse) => void })
.handleProtectedResourceMetadata(mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(200, {
'Content-Type': 'application/json'
});
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
const response = JSON.parse(endCall as string);
expect(response).toHaveProperty('resource');
expect(response).toHaveProperty('authorization_servers');
});
});
describe('setSecurityHeaders()', () => {
it('should set X-Content-Type-Options header', () => {
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
.setSecurityHeaders(mockRes);
expect(mockRes.setHeader).toHaveBeenCalledWith('X-Content-Type-Options', 'nosniff');
});
it('should set X-Frame-Options header', () => {
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
.setSecurityHeaders(mockRes);
expect(mockRes.setHeader).toHaveBeenCalledWith('X-Frame-Options', 'DENY');
});
it('should set X-XSS-Protection header', () => {
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
.setSecurityHeaders(mockRes);
expect(mockRes.setHeader).toHaveBeenCalledWith('X-XSS-Protection', '1; mode=block');
});
it('should set Cache-Control header', () => {
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
.setSecurityHeaders(mockRes);
expect(mockRes.setHeader).toHaveBeenCalledWith('Cache-Control', 'no-store, no-cache, must-revalidate');
});
it('should set Content-Security-Policy header', () => {
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
.setSecurityHeaders(mockRes);
expect(mockRes.setHeader).toHaveBeenCalledWith(
'Content-Security-Policy',
"default-src 'none'; frame-ancestors 'none'"
);
});
it('should set all 5 security headers', () => {
const mockRes = {
setHeader: vi.fn()
} as unknown as ServerResponse;
(transport as unknown as { setSecurityHeaders: (res: ServerResponse) => void })
.setSecurityHeaders(mockRes);
// Verify exactly 5 headers were set
expect(mockRes.setHeader).toHaveBeenCalledTimes(5);
});
});
});
describe('handleRequest()', () => {
let transport: HttpTransport;
beforeEach(() => {
transport = new HttpTransport({
port: 3000,
corsOrigins: ['https://example.com']
});
});
it('should handle OPTIONS preflight request', async () => {
const mockReq = {
method: 'OPTIONS',
url: '/mcp',
headers: { host: 'localhost:3000', origin: 'https://example.com' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(204);
expect(mockRes.end).toHaveBeenCalled();
});
it('should route to health check endpoint', async () => {
const mockReq = {
method: 'GET',
url: '/health',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(200, { 'Content-Type': 'application/json' });
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
expect(JSON.parse(endCall as string)).toHaveProperty('status', 'healthy');
});
it('should route to OAuth metadata endpoint', async () => {
const mockReq = {
method: 'GET',
url: '/.well-known/oauth-protected-resource',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
// Without OAuth configured, should return 404
expect(mockRes.writeHead).toHaveBeenCalledWith(404);
});
it('should return 404 for unknown paths', async () => {
const mockReq = {
method: 'GET',
url: '/unknown-path',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(404);
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
expect(JSON.parse(endCall as string)).toHaveProperty('error', 'Not found');
});
it('should reject unauthenticated requests when OAuth is configured', async () => {
const mockTokenValidator = {
validate: vi.fn().mockResolvedValue({ valid: false, error: 'Token missing' })
};
const mockResourceServer = {
getMetadata: vi.fn().mockReturnValue({ resource: 'test' })
};
const transportWithOAuth = new HttpTransport({
port: 3000,
resourceServer: mockResourceServer as never,
tokenValidator: mockTokenValidator as never
});
const mockReq = {
method: 'GET',
url: '/mcp',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
await (transportWithOAuth as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(401, expect.objectContaining({
'WWW-Authenticate': 'Bearer'
}));
});
it('should allow authenticated requests when OAuth is configured', async () => {
const mockTokenValidator = {
validate: vi.fn().mockResolvedValue({
valid: true,
claims: { sub: 'user1', scopes: ['read'], exp: 0, iat: 0 }
})
};
const mockResourceServer = {
getMetadata: vi.fn().mockReturnValue({ resource: 'test' })
};
const transportWithOAuth = new HttpTransport({
port: 3000,
resourceServer: mockResourceServer as never,
tokenValidator: mockTokenValidator as never
});
const mockReq = {
method: 'GET',
url: '/mcp',
headers: {
host: 'localhost:3000',
authorization: 'Bearer valid_token'
}
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
await (transportWithOAuth as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
// After successful auth, should return 404 (no MCP handling yet)
expect(mockRes.writeHead).toHaveBeenCalledWith(404);
});
});
describe('SSE Support', () => {
it('should route to SSE endpoint', async () => {
const mockReq = {
method: 'GET',
url: '/sse',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
// Spy on onConnect callback
const onConnect = vi.fn();
const transportWithCallback = createHttpTransport({ port: 3000 }, onConnect);
const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
await (transportWithCallback as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(StreamableHTTPServerTransport).toHaveBeenCalled();
// Verify start called (mocked)
const mockTransportInstance = (StreamableHTTPServerTransport as unknown as ReturnType<typeof vi.fn>).mock.results[0].value;
expect(mockTransportInstance.start).toHaveBeenCalled();
expect(onConnect).toHaveBeenCalledWith(mockTransportInstance);
expect(mockTransportInstance.handleRequest).toHaveBeenCalledWith(mockReq, mockRes);
});
it('should route to messages endpoint', async () => {
const mockReq = {
method: 'POST',
url: '/messages',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
// Setup transport with active SSE connection
const transport = new HttpTransport({ port: 3000 });
const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
const mockTransportInstance = new StreamableHTTPServerTransport();
// Manually set transport (private)
Object.defineProperty(transport, 'transport', {
value: mockTransportInstance,
writable: true
});
await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(mockTransportInstance.handleRequest).toHaveBeenCalledWith(mockReq, mockRes);
});
it('should return 400 for messages without active connection', async () => {
const mockReq = {
method: 'POST',
url: '/messages',
headers: { host: 'localhost:3000' }
} as IncomingMessage;
const mockRes = {
writeHead: vi.fn(),
end: vi.fn(),
setHeader: vi.fn()
} as unknown as ServerResponse;
const transport = new HttpTransport({ port: 3000 });
await (transport as unknown as { handleRequest: (req: IncomingMessage, res: ServerResponse) => Promise<void> })
.handleRequest(mockReq, mockRes);
expect(mockRes.writeHead).toHaveBeenCalledWith(400);
const endCall = (mockRes.end as ReturnType<typeof vi.fn>).mock.calls[0][0];
expect(JSON.parse(endCall as string)).toHaveProperty('error', 'No active connection');
});
});
describe('createHttpTransport()', () => {
it('should create HttpTransport instance', () => {
const transport = createHttpTransport({ port: 8080 });
expect(transport).toBeInstanceOf(HttpTransport);
});
it('should pass config to transport', () => {
const transport = createHttpTransport({
port: 3000,
host: '0.0.0.0',
corsOrigins: ['https://example.com']
});
expect(transport).toBeInstanceOf(HttpTransport);
});
});
