WIP: test(integration#34): real MCP session over-the-wire — peer-ACL + GLOBAL memory-scope (internal#765) #35

2026-06-03T00:46:12Z

2026-06-03 00:46:12 +00:00

Closes #34

What

Adds the FIRST real integration-layer regression test for this repo (SOP rule internal#765, P15). The repo was otherwise 100% fetch-mocked Jest; the security-bearing peer-ACL boundary, the GLOBAL memory-scope write boundary, and the highest-frequency list_peers / delegate / commit_memory / reply paths had no real over-the-wire gate, and async_delegate had zero tests.

Why this is the REAL layer (not mock-only)

Real MCP server via createServer() — real McpServer, real tool registration, real Zod validation, real handlers, real api.ts apiCall()/platformGet() -> real fetch. No SDK mock, no fetch mock (contrast index.test.ts which jest.mock()s both).
Real client <-> server over a real InMemoryTransport linked pair — every tool call is genuine JSON-RPC serialized over-the-wire through the transport boundary, exercising the same client -> Protocol -> Server -> handler -> fetch loop a stdio host drives. InMemory (not a spawned child) keeps CI hermetic while still crossing the real transport.
Real node:http fake-but-real platform — speaks the actual REST contract api.ts targets and enforces the same authorization the Go control plane does:
- peer-ACL: GET /registry/:id/peers returns only reachable peers; unknown/cross-org -> 403.
- GLOBAL memory scope: POST /workspaces/:id/memories with scope=GLOBAL succeeds only for a tier-0 root; non-root -> 403 AUTH_ERROR.

Coverage

list_peers: ACL-scoped peer set; cross-org (ws-foreign) denial surfaces as HTTP 403; ws-foreign never leaks into the peer set.
async_delegate (was zero tests): asserts {target_id, task} actually reach POST /workspaces/:id/delegate; reachable target returns a delegation_id; unreachable target is ACL-denied and records no delegation; missing required args rejected by real Zod validation before any platform call.
commit_memory: LOCAL ok for non-root + scope carried on the wire; GLOBAL ok for tier-0 root; GLOBAL from a non-root is rejected and persists nothing.
notify_user: the canvas reply primitive (this server's surface analog of reply_to_workspace) delivers over the wire.

Watch-fail intent

Each assertion fails against a regression of the covered behavior: drop target_id/task from the delegate body, drop scope from commit_memory, stop threading workspace_id into the registry path, or remove the platform-side GLOBAL/peer-ACL gate -> the corresponding assertion goes red. It passes against current-correct source.

Wiring / gating

New jest.integration.cjs (maps the real, non-mocked SDK client/inMemory/types to their CJS builds for ts-jest).
New npm run test:integration script.
jest.config.cjs now ignores *.integration.test.ts so unit and integration runs stay separated.
.gitea/workflows/ci.yml gains a separate merge-gating integration job so a regression fails CI loudly instead of hiding behind the fetch-mocked unit suite.

DRAFT — what CI + CR2 must confirm (cannot compile/run locally)

SDK CJS dist paths resolve under ts-jest for @modelcontextprotocol/sdk 1.29.0: dist/cjs/client/index.js, dist/cjs/inMemory.js, dist/cjs/types.js. If the dual-package layout differs, adjust moduleNameMapper in jest.integration.cjs (the unit config already proves the dist/cjs/server/* layout).
jest.isolateModules(() => require("../index.js")) re-reads MOLECULE_API_URL so the server's PLATFORM_URL (a module-load-time const in api.ts) points at the fake platform. Confirm the env override lands before module load.
The real integration job runs green and is added as a required check.

🤖 Generated with Claude Code

Closes #34 ## What Adds the FIRST real integration-layer regression test for this repo (SOP rule internal#765, P15). The repo was otherwise 100% fetch-mocked Jest; the security-bearing **peer-ACL** boundary, the **GLOBAL memory-scope** write boundary, and the highest-frequency **list_peers / delegate / commit_memory / reply** paths had no real over-the-wire gate, and `async_delegate` had **zero** tests. ## Why this is the REAL layer (not mock-only) - **Real MCP server** via `createServer()` — real `McpServer`, real tool registration, real Zod validation, real handlers, real `api.ts` `apiCall()`/`platformGet()` -> real `fetch`. **No SDK mock, no fetch mock** (contrast `index.test.ts` which `jest.mock()`s both). - **Real client <-> server over a real `InMemoryTransport` linked pair** — every tool call is genuine JSON-RPC serialized over-the-wire through the transport boundary, exercising the same `client -> Protocol -> Server -> handler -> fetch` loop a stdio host drives. InMemory (not a spawned child) keeps CI hermetic while still crossing the real transport. - **Real `node:http` fake-but-real platform** — speaks the actual REST contract `api.ts` targets and enforces the same authorization the Go control plane does: - peer-ACL: `GET /registry/:id/peers` returns only reachable peers; unknown/cross-org -> 403. - GLOBAL memory scope: `POST /workspaces/:id/memories` with `scope=GLOBAL` succeeds only for a tier-0 root; non-root -> 403 `AUTH_ERROR`. ## Coverage - `list_peers`: ACL-scoped peer set; cross-org (`ws-foreign`) denial surfaces as `HTTP 403`; `ws-foreign` never leaks into the peer set. - `async_delegate` (was zero tests): asserts `{target_id, task}` actually reach `POST /workspaces/:id/delegate`; reachable target returns a `delegation_id`; **unreachable target is ACL-denied and records no delegation**; missing required args rejected by real Zod validation before any platform call. - `commit_memory`: LOCAL ok for non-root + `scope` carried on the wire; GLOBAL ok for tier-0 root; **GLOBAL from a non-root is rejected and persists nothing**. - `notify_user`: the canvas reply primitive (this server's surface analog of `reply_to_workspace`) delivers over the wire. ## Watch-fail intent Each assertion fails against a regression of the covered behavior: drop `target_id`/`task` from the delegate body, drop `scope` from `commit_memory`, stop threading `workspace_id` into the registry path, or remove the platform-side GLOBAL/peer-ACL gate -> the corresponding assertion goes red. It passes against current-correct source. ## Wiring / gating - New `jest.integration.cjs` (maps the real, non-mocked SDK `client`/`inMemory`/`types` to their CJS builds for ts-jest). - New `npm run test:integration` script. - `jest.config.cjs` now ignores `*.integration.test.ts` so unit and integration runs stay separated. - `.gitea/workflows/ci.yml` gains a separate **merge-gating `integration` job** so a regression fails CI loudly instead of hiding behind the fetch-mocked unit suite. ## DRAFT — what CI + CR2 must confirm (cannot compile/run locally) 1. SDK CJS dist paths resolve under ts-jest for **@modelcontextprotocol/sdk 1.29.0**: `dist/cjs/client/index.js`, `dist/cjs/inMemory.js`, `dist/cjs/types.js`. If the dual-package layout differs, adjust `moduleNameMapper` in `jest.integration.cjs` (the unit config already proves the `dist/cjs/server/*` layout). 2. `jest.isolateModules(() => require("../index.js"))` re-reads `MOLECULE_API_URL` so the server's `PLATFORM_URL` (a module-load-time const in `api.ts`) points at the fake platform. Confirm the env override lands before module load. 3. The real integration job runs green and is added as a required check. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

molecule-code-reviewer added 5 commits 2026-06-03 00:46:12 +00:00

test(integration#34): real MCP session over-the-wire — peer-ACL + GLOBAL memory-scope (internal#765) 4a6d343687

test(integration#34): dedicated integration jest config (real non-mocked SDK + transport) 473ee8ce2a

test(integration#34): exclude *.integration.test.ts from the unit jest run 4a255ce0f2

test(integration#34): add test:integration script 6728791734

ci(integration#34): add merge-gating integration job (internal#765)

CI / test (pull_request) Successful in 42s

Details

CI / integration (pull_request) Failing after 40s

Details

fac7328f8a

core-be added 1 commit 2026-06-07 03:59:20 +00:00

test(integration#34): fix async_delegate Zod validation assertion — MCP returns isError, not rejection

CI / test (pull_request) Successful in 40s

Details

CI / integration (pull_request) Successful in 2m4s

Details

a1d3030c35

The real MCP client resolves with an {isError:true} result when Zod
validation fails; it does not throw. Update the assertion to match the
actual SDK contract.

All 10 integration tests now pass.

agent-dev-b commented

2026-06-07 12:34:11 +00:00

Closed: superseded by #50 (clean integration test); #35 removed required merge-queue workflow + auth — unsafe.

agent-dev-b closed this pull request

2026-06-07 12:34:11 +00:00

CI / test (pull_request) Successful in 40s

Required

Details

CI / integration (pull_request) Successful in 2m4s

Details

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-mcp-server#35