AquaSec suppress
Configure a suppression report from trusted settings.
const safe = true;
![diagram]()
`, { fallbackTitle: 'Fallback' });
+ expect(result.title).toBe('AquaSec suppress');
+ expect(result.text).toContain('# AquaSec suppress');
+ expect(result.text).toContain('```js');
+ expect(result.text).toContain('[diagram]');
+ expect(result.text).not.toContain('AquaSec decoy');
+ expect(result.text).not.toContain('alert(1)');
+ expect(result.sections).toEqual([{ heading: 'AquaSec suppress', anchor: 'safe', level: 1, start: 0, end: result.text.length }]);
+});
diff --git a/tests/mcp-search.spec.js b/tests/mcp-search.spec.js
new file mode 100644
index 0000000..820b415
--- /dev/null
+++ b/tests/mcp-search.spec.js
@@ -0,0 +1,58 @@
+import { test, expect } from '@playwright/test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { createIndex, search, readDocument } from '../mcp/search.js';
+import { validateCorpus } from '../mcp/corpus.js';
+
+const corpus = validateCorpus(JSON.parse(readFileSync(join(process.cwd(), 'dist', '_mcp', 'corpus.json'), 'utf8')));
+const index = createIndex(corpus);
+
+const document = (uri, app, title, text, tags = []) => ({
+ uri, app, route: `/knowledge-base/${uri.slice(5)}/`, title, description: text.slice(0, 120), tags,
+ mimeType: 'text/markdown', sourceVersion: 'test', sha256: '0'.repeat(64), size: text.length,
+ truncated: false, text, sections: [{ heading: title, anchor: null, level: 1, start: 0, end: text.length }],
+});
+const exampleCorpus = {
+ schemaVersion: 1,
+ contentHash: 'synthetic-user-examples',
+ apps: [
+ { slug: 'agentic-toolkit', name: 'Agentic Toolkit', description: 'Automation skills.', tags: ['automation'] },
+ { slug: 'service-accounts', name: 'Service Accounts', description: 'Service account operations.', tags: ['identity'] },
+ { slug: 'eventbus', name: 'Event Bus', description: 'Event platform documentation.', tags: ['events'] },
+ ],
+ documents: [
+ document('kb://agentic-toolkit/skills/aquasec-suppress', 'agentic-toolkit', 'AquaSec suppress', '# AquaSec suppress\n\nGenerate an AquaSec suppression report.\n\n## Configuration\n\nInstall skill and configure report settings.\n\n## Use\n\nUse prompt examples to generate and review suppression reports.', ['security']),
+ document('kb://agentic-toolkit/skills/aquasec-false-positives', 'agentic-toolkit', 'AquaSec false positives', '# AquaSec false positives\n\nReview AquaSec findings without generating a suppression report.', ['security']),
+ document('kb://service-accounts/password-rotation', 'service-accounts', 'Rotating service account passwords', '# Rotating service account passwords\n\nRotate passwords for service accounts with staged credential rollout.', ['identity']),
+ document('kb://eventbus', 'eventbus', 'Event Bus', '# Event Bus\n\nEventBus is platform for publishing and consuming domain events.', ['events']),
+ ],
+};
+const exampleIndex = createIndex(exampleCorpus);
+
+test.describe('MCP generated corpus', () => {
+ test('search finds release process and bounded read returns text', () => {
+ const result = search(index, { query: 'release process' });
+ expect(result.results[0].uri).toBe('kb://release-process');
+ const read = readDocument(index, { uri: result.results[0].uri, maxChars: 1000 });
+ expect(read.text).toContain('Release Process');
+ expect(read.text.length).toBeLessThanOrEqual(1000);
+ });
+
+ test('search is deterministic for normalized query terms', () => {
+ const query = 'ReleaseProcess';
+ expect(search(index, { query })).toEqual(search(index, { query }));
+ });
+
+ test('ranks all three user-facing natural-language examples', () => {
+ const aqua = search(exampleIndex, { query: 'I would like to create aquasec suppresion report, how do I do that' });
+ expect(aqua.results[0].uri).toBe('kb://agentic-toolkit/skills/aquasec-suppress');
+ const aquaDocument = exampleCorpus.documents.find((entry) => entry.uri === aqua.results[0].uri);
+ expect(aquaDocument.text).toContain('Configuration');
+ expect(aquaDocument.text).toContain('Use');
+
+ expect(search(exampleIndex, { query: 'How do I rotate passwords for service accounts?' }).results[0].uri)
+ .toBe('kb://service-accounts/password-rotation');
+ expect(search(exampleIndex, { query: "What's EventBus?" }).results[0].uri).toBe('kb://eventbus');
+ expect(search(exampleIndex, { query: 'Event Bus' }).results[0].uri).toBe('kb://eventbus');
+ });
+});
diff --git a/tests/mcp-server.spec.js b/tests/mcp-server.spec.js
new file mode 100644
index 0000000..14945d6
--- /dev/null
+++ b/tests/mcp-server.spec.js
@@ -0,0 +1,100 @@
+import { test, expect } from '@playwright/test';
+import { createServer } from 'node:http';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { validateCorpus } from '../mcp/corpus.js';
+import { createIndex } from '../mcp/search.js';
+import { createMcpHttpHandler } from '../mcp/http.js';
+
+const corpus = validateCorpus(JSON.parse(readFileSync(join(process.cwd(), 'dist', '_mcp', 'corpus.json'), 'utf8')));
+const index = createIndex(corpus);
+const initialize = { jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2025-11-25', capabilities: {}, clientInfo: { name: 'test', version: '1' } } };
+
+async function start(options = {}) {
+ const handler = createMcpHttpHandler(index, options);
+ const server = createServer(handler);
+ await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+ const { port } = server.address();
+ const request = async (body, init = {}) => {
+ const response = await fetch(`http://127.0.0.1:${port}/mcp`, {
+ method: init.method ?? 'POST',
+ headers: { Accept: 'application/json, text/event-stream', 'Content-Type': 'application/json', ...(init.headers ?? {}) },
+ body: init.method && init.method !== 'POST' ? undefined : (typeof body === 'string' ? body : JSON.stringify(body)),
+ });
+ const text = await response.text();
+ return { response, body: text && response.headers.get('content-type')?.includes('application/json') ? JSON.parse(text) : null, text };
+ };
+ return { request, close: () => new Promise((resolve) => server.close(resolve)) };
+}
+
+test.describe('MCP in-process HTTP protocol', () => {
+ test('initialize advertises resources and tools; tools publish matching structured output', async () => {
+ const service = await start();
+ try {
+ const init = await service.request(initialize);
+ expect(init.response.status).toBe(200);
+ expect(init.response.headers.get('cache-control')).toBe('no-store');
+ expect(init.response.headers.get('mcp-session-id')).toBeNull();
+ expect(init.body.result.capabilities).toEqual({ resources: { listChanged: false, subscribe: false }, tools: { listChanged: false } });
+ expect(init.body.result.instructions).toContain('Knowledge Base documentation server');
+ expect(init.body.result.serverInfo.name).toBe('knowledge-base-mcp-server');
+
+ const tools = await service.request({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} }, { headers: { 'mcp-protocol-version': '2025-11-25' } });
+ expect(tools.body.result.tools.map((tool) => tool.name)).toEqual(['search_documents', 'list_documents', 'read_document']);
+ expect(tools.body.result.tools.every((tool) => tool.inputSchema && tool.outputSchema && tool.annotations.readOnlyHint)).toBe(true);
+ expect(tools.body.result.tools.every((tool) => tool.inputSchema.additionalProperties === false && tool.outputSchema.additionalProperties === false)).toBe(true);
+
+ const call = await service.request({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'search_documents', arguments: { query: 'release process' } } }, { headers: { 'mcp-protocol-version': '2025-11-25' } });
+ const result = call.body.result;
+ expect(JSON.parse(result.content[0].text)).toEqual(result.structuredContent);
+ expect(result.structuredContent.results[0].uri).toBe('kb://release-process');
+ expect(result.content.some((content) => content.type === 'resource_link')).toBe(true);
+ } finally { await service.close(); }
+ });
+
+ test('resources paginate deterministically and resource read handles known and unknown URIs', async () => {
+ const service = await start({ resourcePageSize: 2 });
+ try {
+ const first = await service.request({ jsonrpc: '2.0', id: 4, method: 'resources/list', params: {} }, { headers: { 'mcp-protocol-version': '2025-11-25' } });
+ expect(first.body.result.resources).toHaveLength(2);
+ expect(first.body.result.nextCursor).toBeTruthy();
+ const second = await service.request({ jsonrpc: '2.0', id: 5, method: 'resources/list', params: { cursor: first.body.result.nextCursor } }, { headers: { 'mcp-protocol-version': '2025-11-25' } });
+ expect(second.body.result.resources).toHaveLength(2);
+ expect(second.body.result.resources[0].uri).not.toBe(first.body.result.resources[0].uri);
+
+ const known = await service.request({ jsonrpc: '2.0', id: 6, method: 'resources/read', params: { uri: first.body.result.resources[0].uri } }, { headers: { 'mcp-protocol-version': '2025-11-25' } });
+ expect(known.body.result.contents[0].mimeType).toBe('text/markdown');
+ expect(known.body.result.contents[0].text).toContain('Title:');
+ const unknown = await service.request({ jsonrpc: '2.0', id: 7, method: 'resources/read', params: { uri: 'kb://missing' } }, { headers: { 'mcp-protocol-version': '2025-11-25' } });
+ expect(unknown.body.error.message).toContain('Resource not found');
+ } finally { await service.close(); }
+ });
+
+ test('HTTP guards reject unsafe requests and rate-limit valid requests', async () => {
+ const service = await start({ allowedOrigins: ['https://allowed.example'] });
+ try {
+ const get = await service.request(null, { method: 'GET' });
+ expect(get.response.status).toBe(405); expect(get.response.headers.get('allow')).toBe('POST');
+ expect(get.response.headers.get('content-type')).toContain('text/html');
+ expect(get.body).toBeNull();
+ expect(get.text).toContain('MCP client required');
+ expect(get.text).toContain('/knowledge-base/mcp');
+ const plain = await service.request(initialize, { headers: { 'content-type': 'text/plain' } });
+ expect(plain.response.status).toBe(415);
+ const origin = await service.request(initialize, { headers: { origin: 'https://evil.example' } });
+ expect(origin.response.status).toBe(403);
+ const allowed = await service.request(initialize, { headers: { origin: 'https://allowed.example' } });
+ expect(allowed.response.status).toBe(200);
+ const large = await service.request('x'.repeat(65537));
+ expect(large.response.status).toBe(413);
+ } finally { await service.close(); }
+
+ const limited = await start({ limits: { rps: 0, burst: 1 } });
+ try {
+ expect((await limited.request(initialize)).response.status).toBe(200);
+ const second = await limited.request(initialize);
+ expect(second.response.status).toBe(429);
+ expect(second.response.headers.get('retry-after')).toBe('1');
+ } finally { await limited.close(); }
+ });
+});
diff --git a/tests/nginx-config.spec.js b/tests/nginx-config.spec.js
index 3580cc0..be5f583 100644
--- a/tests/nginx-config.spec.js
+++ b/tests/nginx-config.spec.js
@@ -161,6 +161,15 @@ test.describe('nginx.conf header inheritance', () => {
}
});
+ test('all nginx 404s use internal no-store not-found page', () => {
+ expect(uncomment(CONF)).toContain('error_page 404 /__kb-not-found;');
+ const page = locationBlocks(uncomment(CONF)).find((b) => b.selector === '= /__kb-not-found');
+ expect(page, 'internal 404 page location block').toBeTruthy();
+ expect(page.body).toContain('internal;');
+ expect(page.body).toContain('try_files /_error/not-found.html =500;');
+ expect(page.body).toMatch(/add_header\s+Cache-Control\s+"no-store"\s+always/);
+ });
+
test('healthz sets its content type with default_type, not a post-return add_header', () => {
const healthz = locationBlocks(uncomment(CONF)).find((b) => b.selector === '= /healthz');
expect(healthz, '/healthz location block').toBeTruthy();
@@ -172,11 +181,15 @@ test.describe('nginx.conf header inheritance', () => {
test.describe('Dockerfile', () => {
const DOCKERFILE = readFileSync(join(ROOT, 'Dockerfile'), 'utf8');
- test('runs an unprivileged nginx pinned by digest', () => {
- const from = DOCKERFILE.split('\n').find((l) => l.startsWith('FROM '));
- expect(from).toContain('nginx-unprivileged');
- expect(from, 'base image must be pinned by digest, like the GitHub Actions are')
- .toMatch(/@sha256:[a-f0-9]{64}/);
+ test('runs a digest-pinned Node donor and unprivileged nginx runtime', () => {
+ const from = DOCKERFILE.split('\n').filter((l) => l.startsWith('FROM '));
+ expect(from).toHaveLength(2);
+ expect(from[0]).toContain('node:24-alpine');
+ expect(from[1]).toContain('nginx-unprivileged');
+ for (const image of from) {
+ expect(image, 'every base image must be pinned by digest, like the GitHub Actions are')
+ .toMatch(/@sha256:[a-f0-9]{64}/);
+ }
});
test('ships the shared header snippet the config includes', () => {