import { beforeEach, describe, expect, it, vi } from "vitest";
import { authenticate, clearAuthCache } from "../../src/auth";
// Mock the logger to prevent actual logging during tests
vi.mock("@snapback/infrastructure", async () => {
const actual = await vi.importActual("@snapback/infrastructure");
return {
...actual,
logger: {
debug: vi.fn(),
info: vi.fn(),
warn: vi.fn(),
error: vi.fn(),
},
};
});
describe("MCP requiresBackend Enforcement", () => {
beforeEach(() => {
// Clear the auth cache before each test
clearAuthCache();
// Reset environment variables
delete process.env.SNAPBACK_NO_NETWORK;
delete process.env.SNAPBACK_BACKEND_URL;
delete process.env.SNAPBACK_API_KEY;
});
it("mcp-001: should allow Pro-tier tools for Pro users", async () => {
// Set no_network mode to use mock auth
process.env.SNAPBACK_NO_NETWORK = "true";
// Pro user with checkpoint scope
process.env.SNAPBACK_API_KEY = "sb_live_1234567890abcdef";
const authResult = await authenticate(process.env.SNAPBACK_API_KEY);
// All tools should be accessible for Pro users
expect(authResult.valid).toBe(true);
expect(authResult.tier).toBe("pro");
expect(authResult.scopes).toEqual(["analyze", "checkpoint", "context"]);
});
it("mcp-002: should restrict Pro-tier tools for Free users", async () => {
// Set no_network mode to use mock auth
process.env.SNAPBACK_NO_NETWORK = "true";
// Free user with only analyze scope
process.env.SNAPBACK_API_KEY = "sb_test_1234567890abcdef";
const authResult = await authenticate(process.env.SNAPBACK_API_KEY);
expect(authResult.valid).toBe(true);
expect(authResult.tier).toBe("free");
expect(authResult.scopes).toEqual(["analyze"]);
// Tools requiring checkpoint or context scopes should be restricted
// This will be enforced at the tool level in the server implementation
});
it("mcp-003: should restrict Pro-tier tools for unauthenticated users", async () => {
// Set no_network mode to use mock auth
process.env.SNAPBACK_NO_NETWORK = "true";
// No API key provided
process.env.SNAPBACK_API_KEY = "";
const authResult = await authenticate(process.env.SNAPBACK_API_KEY);
expect(authResult.valid).toBe(true);
expect(authResult.tier).toBe("free");
expect(authResult.scopes).toEqual([]);
// Tools requiring any scopes should be restricted
});
it("mcp-004: should return SARIF note when Free user accesses Pro-only tool", () => {
// This test will be implemented in the server integration tests
// where we can actually call the tools and verify the SARIF output
expect(true).toBe(true);
});
it("mcp-005: should allow Free-tier tools for all users", () => {
expect(true).toBe(true);
});
it("mcp-006: should properly identify Pro-only tools", () => {
expect(true).toBe(true);
});
});