server.test.ts

// src/__tests__/server.test.ts
import { describe, it, expect, vi } from "vitest";
import request from "supertest";
import type { Runtime } from "../types.js";

vi.mock("../mcp.js", () => ({
  createMcpServer: vi.fn().mockReturnValue({
    connect: vi.fn(),
  }),
}));

vi.mock("../store.js", async () => {
  const actual = await vi.importActual<typeof import("../store.js")>("../store.js");
  return {
    ...actual,
    saveState: vi.fn(),
  };
});

import { createApp } from "../server.js";

const now = new Date().toISOString();
const botHeaders = { "x-spawndock-bot-secret": "spawndock-dev-bot-secret" };

process.env.TELEGRAM_BOT_USERNAME ??= "rustgpt_bot";
process.env.TELEGRAM_MINI_APP_SHORT_NAME ??= "tma";

function createRuntime(): Runtime {
  return {
    state: { projects: [], pairingTokens: [], deviceCredentials: [], tunnelSessions: [] },
    connectionsBySlug: new Map(),
    pendingResponses: new Map(),
  };
}

function createAuthorizedRuntime(): Runtime {
  return {
    ...createRuntime(),
    state: {
      projects: [],
      pairingTokens: [],
      deviceCredentials: [{
        id: "device_1",
        projectId: "project_1",
        label: "Test Device",
        secret: "secret_1",
        mcpApiKey: "mcp_test_key",
        createdAt: now,
        revokedAt: null,
      }],
      tunnelSessions: [],
    },
  };
}

const authorizedHeaders = {
  authorization: "Bearer mcp_test_key",
};

const mockRuntime: Runtime = {
  state: { projects: [], pairingTokens: [], deviceCredentials: [], tunnelSessions: [] },
  connectionsBySlug: new Map(),
  pendingResponses: new Map(),
};

describe("Express server", () => {
  it("GET /health returns 200 with status ok", async () => {
    const app = createApp(mockRuntime);
    const res = await request(app).get("/health");
    expect(res.status).toBe(200);
    expect(res.body.status).toBe("ok");
  });

  it("GET /mcp/health returns 200 with status ok", async () => {
    const app = createApp(mockRuntime);
    const res = await request(app).get("/mcp/health");
    expect(res.status).toBe(200);
    expect(res.body.status).toBe("ok");
  });

  it("GET /mcp/sse requires MCP API key", async () => {
    const app = createApp(createRuntime());
    const res = await request(app).get("/mcp/sse");
    expect(res.status).toBe(401);
    expect(res.body.error).toBe("mcp_unauthorized");
  });

  it("GET /mcp/sse accepts valid MCP API key before route handling", async () => {
    const app = createApp(createAuthorizedRuntime());
    const res = await request(app)
      .get("/mcp/sse")
      .set(authorizedHeaders);
    expect(res.status).toBe(405);
  });

  it("POST /messages with unknown session returns 400", async () => {
    const app = createApp(createAuthorizedRuntime());
    const res = await request(app)
      .post("/messages?sessionId=nonexistent")
      .set(authorizedHeaders)
      .send({});
    expect(res.status).toBe(400);
    expect(res.body.error).toBe("Unknown session");
  });

  it("POST /mcp/messages with unknown session returns 400", async () => {
    const app = createApp(createAuthorizedRuntime());
    const res = await request(app)
      .post("/mcp/messages?sessionId=nonexistent")
      .set(authorizedHeaders)
      .send({});
    expect(res.status).toBe(400);
    expect(res.body.error).toBe("Unknown session");
  });

  it("POST /v1/bootstrap/claim returns flat bootstrap fields", async () => {
    const app = createApp({
      state: { projects: [], pairingTokens: [], deviceCredentials: [], tunnelSessions: [] },
      connectionsBySlug: new Map(),
      pendingResponses: new Map(),
    });

    const created = await request(app)
      .post("/api/projects")
      .set(botHeaders)
      .send({ title: "Test App", ownerTelegramId: 42 });

    expect(created.status).toBe(201);
    expect(created.body.pairingToken.token).toBeTruthy();

    const claimed = await request(app)
      .post("/v1/bootstrap/claim")
      .send({ token: created.body.pairingToken.token });

    expect(claimed.status).toBe(201);
    expect(claimed.body.projectId).toBeTruthy();
    expect(claimed.body.projectSlug).toBeTruthy();
    expect(claimed.body.deviceSecret).toBeTruthy();
    expect(claimed.body.mcpApiKey).toBeTruthy();
    expect(claimed.body.controlPlaneUrl).toBeTruthy();
    expect(claimed.body.launchUrl).toBeTruthy();
  });

  it("POST /api/pairing/inspect returns project metadata without consuming the token", async () => {
    const app = createApp(createRuntime());

    const created = await request(app)
      .post("/api/projects")
      .set(botHeaders)
      .send({ title: "Test App", ownerTelegramId: 42 });

    expect(created.status).toBe(201);
    expect(created.body.pairingToken.token).toBeTruthy();

    const inspected = await request(app)
      .post("/api/pairing/inspect")
      .send({ token: created.body.pairingToken.token });

    expect(inspected.status).toBe(200);
    expect(inspected.body.projectId).toBe(created.body.project.id);
    expect(inspected.body.projectSlug).toBe(created.body.project.slug);
    expect(inspected.body.expiresAt).toBe(created.body.pairingToken.expiresAt);

    const claimed = await request(app)
      .post("/v1/bootstrap/claim")
      .send({ token: created.body.pairingToken.token });

    expect(claimed.status).toBe(201);
    expect(claimed.body.projectSlug).toBe(created.body.project.slug);
  });

  it("POST /v1/bootstrap/claim replays the same credential when the token was already claimed", async () => {
    const app = createApp({
      state: { projects: [], pairingTokens: [], deviceCredentials: [], tunnelSessions: [] },
      connectionsBySlug: new Map(),
      pendingResponses: new Map(),
    });

    const created = await request(app)
      .post("/api/projects")
      .set(botHeaders)
      .send({ title: "Replay App", ownerTelegramId: 42 });

    const firstClaim = await request(app)
      .post("/v1/bootstrap/claim")
      .send({ token: created.body.pairingToken.token });

    const secondClaim = await request(app)
      .post("/v1/bootstrap/claim")
      .send({ token: created.body.pairingToken.token });

    expect(firstClaim.status).toBe(201);
    expect(secondClaim.status).toBe(201);
    expect(secondClaim.body.projectId).toBe(firstClaim.body.projectId);
    expect(secondClaim.body.projectSlug).toBe(firstClaim.body.projectSlug);
    expect(secondClaim.body.deviceSecret).toBe(firstClaim.body.deviceSecret);
    expect(secondClaim.body.mcpApiKey).toBe(firstClaim.body.mcpApiKey);
  });

  it("POST /api/projects requires bot authorization", async () => {
    const app = createApp(createRuntime());

    const res = await request(app)
      .post("/api/projects")
      .send({ title: "Test App" });

    expect(res.status).toBe(401);
    expect(res.body.error).toBe("bot_unauthorized");
  });

  it("POST /projects accepts bot-authorized creation without /api prefix", async () => {
    const app = createApp(createRuntime());

    const res = await request(app)
      .post("/projects")
      .set(botHeaders)
      .send({ title: "Test App", ownerTelegramId: 42 });

    expect(res.status).toBe(201);
    expect(res.body.project.slug).toBe("test-app");
  });

  it("GET /api/projects/:slug/launch-url requires owner and bot authorization", async () => {
    const runtime = createRuntime();
    runtime.state.projects.push({
      id: "project_1",
      slug: "demo-app",
      title: "Demo App",
      templateId: "nextjs-template",
      ownerTelegramId: 42,
      createdAt: now,
      status: "draft",
    });
    const app = createApp(runtime);

    const unauthorized = await request(app).get("/api/projects/demo-app/launch-url");
    expect(unauthorized.status).toBe(401);

    const wrongOwner = await request(app)
      .get("/api/projects/demo-app/launch-url?ownerTelegramId=7")
      .set(botHeaders);
    expect(wrongOwner.status).toBe(404);

    const owner = await request(app)
      .get("/api/projects/demo-app/launch-url?ownerTelegramId=42")
      .set(botHeaders);
    expect(owner.status).toBe(200);
    expect(owner.body.slug).toBe("demo-app");
    expect(owner.body.status).toBe("offline");
  });

  it("GET /tma redirects to preview preserving query string", async () => {
    const app = createApp(mockRuntime);
    const res = await request(app)
      .get("/tma?tgWebAppStartParam=demo-app&foo=bar")
      .redirects(0);

    expect(res.status).toBe(302);
    expect(res.headers.location).toBe("https://spawn-dock.w3voice.net/preview/demo-app?tgWebAppStartParam=demo-app&foo=bar");
  });

  it("GET /tma returns 400 when project slug is missing", async () => {
    const app = createApp(mockRuntime);
    const res = await request(app).get("/tma");

    expect(res.status).toBe(400);
    expect(res.body.error).toBe("missing_project");
  });

  it("does not rate-limit preview requests", async () => {
    const runtime: Runtime = {
      state: {
        projects: [
          {
            id: "project_1",
            slug: "demo-app",
            title: "Demo App",
            templateId: "nextjs-template",
            ownerTelegramId: null,
            createdAt: new Date().toISOString(),
            status: "active",
          },
        ],
        pairingTokens: [],
        deviceCredentials: [],
        tunnelSessions: [],
      },
      connectionsBySlug: new Map(),
      pendingResponses: new Map(),
    };
    const app = createApp(runtime);

    const responses = await Promise.all(
      Array.from({ length: 12 }, () => request(app).get("/preview/demo-app")),
    );

    expect(responses.every((response) => response.status !== 429)).toBe(true);
  });
});