fix: input validation across all API routes — Issue #359

src/__tests__/input-validation.test.ts

@@ -0,0 +1,243 @@
+import { describe, it, expect } from 'vitest';
+import {
+  authKeySchema,
+  sendMessageSchema,
+  commandSchema,
+  bashSchema,
+  screenshotSchema,
+  permissionHookSchema,
+  stopHookSchema,
+  batchSessionSchema,
+  pipelineSchema,
+  UUID_REGEX,
+  clamp,
+  parseIntSafe,
+  isValidUUID,
+} from '../validation.js';
+
+describe('authKeySchema', () => {
+  it('accepts valid input', () => {
+    expect(authKeySchema.safeParse({ name: 'my-key', rateLimit: 100 }).success).toBe(true);
+  });
+  it('rejects missing name', () => {
+    expect(authKeySchema.safeParse({ rateLimit: 100 }).success).toBe(false);
+  });
+  it('rejects negative rateLimit', () => {
+    expect(authKeySchema.safeParse({ name: 'k', rateLimit: -1 }).success).toBe(false);
+  });
+  it('rejects zero rateLimit', () => {
+    expect(authKeySchema.safeParse({ name: 'k', rateLimit: 0 }).success).toBe(false);
+  });
+  it('accepts without rateLimit', () => {
+    expect(authKeySchema.safeParse({ name: 'k' }).success).toBe(true);
+  });
+  it('rejects extra fields', () => {
+    expect(authKeySchema.safeParse({ name: 'k', extra: true }).success).toBe(false);
+  });
+});
+
+describe('sendMessageSchema', () => {
+  it('accepts string text', () => {
+    expect(sendMessageSchema.safeParse({ text: 'hello' }).success).toBe(true);
+  });
+  it('rejects missing text', () => {
+    expect(sendMessageSchema.safeParse({}).success).toBe(false);
+  });
+  it('rejects non-string text', () => {
+    expect(sendMessageSchema.safeParse({ text: 123 }).success).toBe(false);
+  });
+  it('rejects empty string text', () => {
+    expect(sendMessageSchema.safeParse({ text: '' }).success).toBe(false);
+  });
+});
+
+describe('commandSchema', () => {
+  it('accepts string command', () => {
+    expect(commandSchema.safeParse({ command: '/help' }).success).toBe(true);
+  });
+  it('rejects missing command', () => {
+    expect(commandSchema.safeParse({}).success).toBe(false);
+  });
+  it('rejects empty string command', () => {
+    expect(commandSchema.safeParse({ command: '' }).success).toBe(false);
+  });
+});
+
+describe('bashSchema', () => {
+  it('accepts string command', () => {
+    expect(bashSchema.safeParse({ command: 'ls -la' }).success).toBe(true);
+  });
+  it('rejects missing command', () => {
+    expect(bashSchema.safeParse({}).success).toBe(false);
+  });
+});
+
+describe('screenshotSchema', () => {
+  it('accepts url only', () => {
+    expect(screenshotSchema.safeParse({ url: 'https://example.com' }).success).toBe(true);
+  });
+  it('accepts all fields', () => {
+    expect(screenshotSchema.safeParse({
+      url: 'https://example.com',
+      fullPage: true,
+      width: 1280,
+      height: 720,
+    }).success).toBe(true);
+  });
+  it('rejects missing url', () => {
+    expect(screenshotSchema.safeParse({}).success).toBe(false);
+  });
+  it('rejects negative width', () => {
+    expect(screenshotSchema.safeParse({ url: 'https://example.com', width: -1 }).success).toBe(false);
+  });
+  it('rejects zero height', () => {
+    expect(screenshotSchema.safeParse({ url: 'https://example.com', height: 0 }).success).toBe(false);
+  });
+  it('rejects excessively large dimensions', () => {
+    expect(screenshotSchema.safeParse({ url: 'https://example.com', width: 50000 }).success).toBe(false);
+  });
+});
+
+describe('permissionHookSchema', () => {
+  it('accepts valid body', () => {
+    expect(permissionHookSchema.safeParse({
+      tool_name: 'Bash',
+      tool_input: { command: 'ls' },
+      permission_mode: 'default',
+    }).success).toBe(true);
+  });
+  it('accepts empty body', () => {
+    expect(permissionHookSchema.safeParse({}).success).toBe(true);
+  });
+  it('rejects non-string tool_name', () => {
+    expect(permissionHookSchema.safeParse({ tool_name: 123 }).success).toBe(false);
+  });
+});
+
+describe('stopHookSchema', () => {
+  it('accepts valid body', () => {
+    expect(stopHookSchema.safeParse({ stop_reason: 'end_turn' }).success).toBe(true);
+  });
+  it('accepts empty body', () => {
+    expect(stopHookSchema.safeParse({}).success).toBe(true);
+  });
+  it('rejects non-string stop_reason', () => {
+    expect(stopHookSchema.safeParse({ stop_reason: 42 }).success).toBe(false);
+  });
+});
+
+describe('batchSessionSchema', () => {
+  it('accepts valid batch', () => {
+    const result = batchSessionSchema.safeParse({
+      sessions: [{ workDir: '/tmp' }],
+    });
+    expect(result.success).toBe(true);
+  });
+  it('rejects empty sessions array', () => {
+    expect(batchSessionSchema.safeParse({ sessions: [] }).success).toBe(false);
+  });
+  it('rejects batch exceeding 50', () => {
+    const sessions = Array.from({ length: 51 }, () => ({ workDir: '/tmp' }));
+    expect(batchSessionSchema.safeParse({ sessions }).success).toBe(false);
+  });
+  it('accepts batch of exactly 50', () => {
+    const sessions = Array.from({ length: 50 }, () => ({ workDir: '/tmp' }));
+    expect(batchSessionSchema.safeParse({ sessions }).success).toBe(true);
+  });
+  it('rejects session without workDir', () => {
+    expect(batchSessionSchema.safeParse({ sessions: [{ name: 'x' }] }).success).toBe(false);
+  });
+});
+
+describe('pipelineSchema', () => {
+  it('accepts valid pipeline', () => {
+    expect(pipelineSchema.safeParse({
+      name: 'my-pipeline',
+      workDir: '/tmp',
+      stages: [{ name: 'build', prompt: 'npm run build' }],
+    }).success).toBe(true);
+  });
+  it('rejects missing name', () => {
+    expect(pipelineSchema.safeParse({
+      workDir: '/tmp',
+      stages: [{ name: 'build', prompt: 'npm run build' }],
+    }).success).toBe(false);
+  });
+  it('rejects missing workDir', () => {
+    expect(pipelineSchema.safeParse({
+      name: 'p',
+      stages: [{ name: 'build', prompt: 'npm run build' }],
+    }).success).toBe(false);
+  });
+  it('rejects empty stages', () => {
+    expect(pipelineSchema.safeParse({
+      name: 'p',
+      workDir: '/tmp',
+      stages: [],
+    }).success).toBe(false);
+  });
+  it('rejects stage without prompt', () => {
+    expect(pipelineSchema.safeParse({
+      name: 'p',
+      workDir: '/tmp',
+      stages: [{ name: 'build' }],
+    }).success).toBe(false);
+  });
+});
+
+describe('UUID_REGEX', () => {
+  it('matches valid UUID', () => {
+    expect(UUID_REGEX.test('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+  });
+  it('rejects non-UUID', () => {
+    expect(UUID_REGEX.test('not-a-uuid')).toBe(false);
+  });
+  it('rejects empty string', () => {
+    expect(UUID_REGEX.test('')).toBe(false);
+  });
+  it('rejects path traversal', () => {
+    expect(UUID_REGEX.test('../../etc/passwd')).toBe(false);
+  });
+});
+
+describe('clamp', () => {
+  it('returns value within range', () => {
+    expect(clamp(50, 1, 100, 80)).toBe(50);
+  });
+  it('clamps to min', () => {
+    expect(clamp(0, 1, 100, 80)).toBe(1);
+  });
+  it('clamps to max', () => {
+    expect(clamp(200, 1, 100, 80)).toBe(100);
+  });
+  it('returns fallback for NaN', () => {
+    expect(clamp(NaN, 1, 100, 80)).toBe(80);
+  });
+  it('returns fallback for Infinity', () => {
+    expect(clamp(Infinity, 1, 100, 80)).toBe(100);
+  });
+});
+
+describe('parseIntSafe', () => {
+  it('parses valid number', () => {
+    expect(parseIntSafe('42', 0)).toBe(42);
+  });
+  it('returns fallback for undefined', () => {
+    expect(parseIntSafe(undefined, 99)).toBe(99);
+  });
+  it('returns fallback for NaN string', () => {
+    expect(parseIntSafe('abc', 99)).toBe(99);
+  });
+  it('returns fallback for Infinity string', () => {
+    expect(parseIntSafe('Infinity', 99)).toBe(99);
+  });
+});
+
+describe('isValidUUID', () => {
+  it('returns true for valid UUID', () => {
+    expect(isValidUUID('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+  });
+  it('returns false for invalid', () => {
+    expect(isValidUUID('abc')).toBe(false);
+  });
+});

src/__tests__/mcp-server.test.ts

@@ -12,6 +12,7 @@ import { AegisClient, createMcpServer } from '../mcp-server.js';
 
 describe('AegisClient', () => {
   const client = new AegisClient('http://127.0.0.1:9100', 'test-token');
+  const UUID = 'aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee';
 
   beforeEach(() => {
     vi.stubGlobal('fetch', vi.fn());
@@ -58,32 +59,34 @@ describe('AegisClient', () => {
     expect(result[0].id).toBe('s1');
   });
 
-  it('listSessions filters by workDir substring', async () => {
+  it('listSessions filters by workDir exact and prefix match', async () => {
     const mockSessions = [
       { id: 's1', status: 'idle', windowName: 'cc-1', workDir: '/home/user/my-project' },
-      { id: 's2', status: 'working', windowName: 'cc-2', workDir: '/home/user/other' },
+      { id: 's2', status: 'working', windowName: 'cc-2', workDir: '/home/user/my-project/src' },
+      { id: 's3', status: 'working', windowName: 'cc-3', workDir: '/home/user/other-project' },
     ];
     (fetch as any).mockResolvedValue({
       ok: true,
-      json: () => Promise.resolve({ sessions: mockSessions, total: 2 }),
+      json: () => Promise.resolve({ sessions: mockSessions, total: 3 }),
     });
 
-    const result = await client.listSessions({ workDir: 'my-project' });
-    expect(result).toHaveLength(1);
+    const result = await client.listSessions({ workDir: '/home/user/my-project' });
+    expect(result).toHaveLength(2);
     expect(result[0].id).toBe('s1');
+    expect(result[1].id).toBe('s2');
   });
 
   it('getSession sends GET /v1/sessions/:id', async () => {
-    const mockSession = { id: 's1', status: 'idle' };
+    const mockSession = { id: UUID, status: 'idle' };
     (fetch as any).mockResolvedValue({
       ok: true,
       json: () => Promise.resolve(mockSession),
     });
 
-    const result = await client.getSession('s1');
-    expect(result.id).toBe('s1');
+    const result = await client.getSession(UUID);
+    expect(result.id).toBe(UUID);
     expect(fetch).toHaveBeenCalledWith(
-      'http://127.0.0.1:9100/v1/sessions/s1',
+      `http://127.0.0.1:9100/v1/sessions/${UUID}`,
       expect.anything(),
     );
   });
@@ -95,7 +98,7 @@ describe('AegisClient', () => {
       json: () => Promise.resolve(mockHealth),
     });
 
-    const result = await client.getHealth('s1');
+    const result = await client.getHealth(UUID);
     expect(result.alive).toBe(true);
   });
 
@@ -106,7 +109,7 @@ describe('AegisClient', () => {
       json: () => Promise.resolve(mockTranscript),
     });
 
-    const result = await client.getTranscript('s1');
+    const result = await client.getTranscript(UUID);
     expect(result.entries).toHaveLength(1);
   });
 
@@ -117,10 +120,10 @@ describe('AegisClient', () => {
       json: () => Promise.resolve(mockResult),
     });
 
-    const result = await client.sendMessage('s1', 'Hello session!');
+    const result = await client.sendMessage(UUID, 'Hello session!');
     expect(result.delivered).toBe(true);
     expect(fetch).toHaveBeenCalledWith(
-      'http://127.0.0.1:9100/v1/sessions/s1/send',
+      `http://127.0.0.1:9100/v1/sessions/${UUID}/send`,
       expect.objectContaining({
         method: 'POST',
         body: JSON.stringify({ text: 'Hello session!' }),
@@ -154,7 +157,7 @@ describe('AegisClient', () => {
       json: () => Promise.resolve({ error: 'Session not found' }),
     });
 
-    await expect(client.getSession('nonexistent')).rejects.toThrow('Session not found');
+    await expect(client.getSession(UUID)).rejects.toThrow('Session not found');
   });
 
   it('throws on non-ok response with fallback error', async () => {
@@ -165,7 +168,7 @@ describe('AegisClient', () => {
       json: () => Promise.reject(new Error('not json')),
     });
 
-    await expect(client.getSession('s1')).rejects.toThrow('Internal Server Error');
+    await expect(client.getSession(UUID)).rejects.toThrow('Internal Server Error');
   });
 
   it('works without auth token', async () => {
@@ -181,17 +184,12 @@ describe('AegisClient', () => {
     expect(callHeaders.Authorization).toBeUndefined();
   });
 
-  it('URL-encodes session IDs', async () => {
-    (fetch as any).mockResolvedValue({
-      ok: true,
-      json: () => Promise.resolve({ id: 'a/b' }),
-    });
+  it('rejects invalid session IDs', async () => {
+    await expect(client.getSession('not-a-uuid')).rejects.toThrow('Invalid session ID: not-a-uuid');
+  });
 
-    await client.getSession('a/b');
-    expect(fetch).toHaveBeenCalledWith(
-      'http://127.0.0.1:9100/v1/sessions/a%2Fb',
-      expect.anything(),
-    );
+  it('rejects path-traversal session IDs', async () => {
+    await expect(client.getSession('a/b')).rejects.toThrow('Invalid session ID: a/b');
   });
 });