|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * The MCP `delete_record` tool takes `run_action`'s confirmation gate: a call |
| 5 | + * without `confirm: true` is REFUSED with `ACTION_CONFIRMATION_REQUIRED` and |
| 6 | + * nothing is deleted. |
| 7 | + * |
| 8 | + * ## Why |
| 9 | + * |
| 10 | + * A delete over MCP is hard and permanent, and before this gate one call did |
| 11 | + * it: `annotations.destructiveHint` is a hint a client may ignore, and the |
| 12 | + * bridge's own checks (API exposure, credentials, the caller's permissions) |
| 13 | + * say whether the caller MAY delete, never whether a human asked for it. An |
| 14 | + * instruction planted in a record's text could lead an agent to delete rows |
| 15 | + * its user may delete with no human asked. The maintainer chose option B: the |
| 16 | + * server-side backstop `run_action` already has, widened to this one tool, |
| 17 | + * with the same member, code, status and `details`. |
| 18 | + * |
| 19 | + * ## What is pinned, and where |
| 20 | + * |
| 21 | + * - The door, over the HTTP `/mcp` transport, against the REAL stdio data |
| 22 | + * bridge on an engine double that holds the row: the member is advertised, |
| 23 | + * an unconfirmed call (absent, `false`, the string `'true'`) is refused and |
| 24 | + * the row is still there, a confirmed call deletes it. |
| 25 | + * - The refusal's code, status and `details` keys are `run_action`'s, served |
| 26 | + * through the same door from a bridge throwing what the runtime gate |
| 27 | + * throws. The real runtime gate beside the real `delete_record` refusal, and |
| 28 | + * REST `DELETE /data/:object/:id` (outside the gate), are driven together in |
| 29 | + * `packages/qa/dogfood/test/mcp-delete-record-confirmation.dogfood.test.ts`. |
| 30 | + * - The long-lived server the stdio transport serves gates too: both |
| 31 | + * transports register their tools through `wireBridgeTools`. |
| 32 | + * - Controls: `update_record` is not gated, and the bridge is never reached |
| 33 | + * by a refused call. |
| 34 | + */ |
| 35 | + |
| 36 | +import { describe, it, expect, vi, beforeEach } from 'vitest'; |
| 37 | +import { Client } from '@modelcontextprotocol/sdk/client/index.js'; |
| 38 | +import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js'; |
| 39 | +import { AI_ACTION_CONFIRMATION_MEMBER } from '@objectstack/spec/contracts'; |
| 40 | +import type { IDataEngine, IMetadataService } from '@objectstack/spec/contracts'; |
| 41 | +import type { ExecutionContext } from '@objectstack/spec/kernel'; |
| 42 | +import { |
| 43 | + assertEngineDeleteDispatch, |
| 44 | + assertEngineUpdateDispatch, |
| 45 | + assertEngineFindOnePredicate, |
| 46 | + type EngineFindOneQueryInput, |
| 47 | +} from '@objectstack/metadata-core'; |
| 48 | + |
| 49 | +import { MCPServerRuntime } from './mcp-server-runtime.js'; |
| 50 | +import { createStdioDataBridge } from './stdio-data-bridge.js'; |
| 51 | +import type { McpActionBridge, McpDataBridge } from './mcp-http-tools.js'; |
| 52 | + |
| 53 | +const OBJECT = 'dlc_note'; |
| 54 | + |
| 55 | +const NOTE = { |
| 56 | + name: OBJECT, |
| 57 | + label: 'Note', |
| 58 | + fields: { |
| 59 | + id: { name: 'id', type: 'text' }, |
| 60 | + title: { name: 'title', type: 'text' }, |
| 61 | + }, |
| 62 | + enable: {}, |
| 63 | +}; |
| 64 | + |
| 65 | +/** A store of `dlc_note` rows behind an engine that applies every write it is handed. */ |
| 66 | +function engineDouble(rows: Map<string, Record<string, unknown>>) { |
| 67 | + return { |
| 68 | + find: vi.fn(async (_o: string, query?: any) => { |
| 69 | + const id = query?.where?.id; |
| 70 | + const all = [...rows.values()].filter((r) => id === undefined || r.id === id); |
| 71 | + return typeof query?.limit === 'number' ? all.slice(0, query.limit) : all; |
| 72 | + }), |
| 73 | + findOne: vi.fn(async (object: string, query?: EngineFindOneQueryInput) => { |
| 74 | + assertEngineFindOnePredicate(object, query); |
| 75 | + return rows.get(String((query as any)?.where?.id)) ?? null; |
| 76 | + }), |
| 77 | + insert: vi.fn(async () => { |
| 78 | + throw new Error('not used'); |
| 79 | + }), |
| 80 | + update: vi.fn(async (_o: string, data: Record<string, unknown>, options?: any) => { |
| 81 | + assertEngineUpdateDispatch(data, options); |
| 82 | + const id = String(options?.where?.id); |
| 83 | + rows.set(id, { ...rows.get(id), ...data }); |
| 84 | + return rows.get(id); |
| 85 | + }), |
| 86 | + delete: vi.fn(async (_o: string, options?: any) => { |
| 87 | + assertEngineDeleteDispatch(options); |
| 88 | + rows.delete(String(options?.where?.id)); |
| 89 | + return { deleted: 1 }; |
| 90 | + }), |
| 91 | + count: vi.fn(async () => rows.size), |
| 92 | + }; |
| 93 | +} |
| 94 | + |
| 95 | +function metadataDouble(): IMetadataService { |
| 96 | + return { |
| 97 | + listObjects: vi.fn(async () => [NOTE]), |
| 98 | + getObject: vi.fn(async () => NOTE), |
| 99 | + } as unknown as IMetadataService; |
| 100 | +} |
| 101 | + |
| 102 | +function stdioBridge(engine: ReturnType<typeof engineDouble>): McpDataBridge { |
| 103 | + return createStdioDataBridge({ |
| 104 | + engine: engine as unknown as IDataEngine, |
| 105 | + metadataService: metadataDouble(), |
| 106 | + resolvePrincipal: async () => ({ userId: 'u1' }) as unknown as ExecutionContext, |
| 107 | + }); |
| 108 | +} |
| 109 | + |
| 110 | +/** What the runtime's `run_action` gate throws for an author-gated action. */ |
| 111 | +function runtimeGateRefusal(): Error { |
| 112 | + return Object.assign( |
| 113 | + new Error( |
| 114 | + "Action 'archive_note' on 'dlc_note' declares ai.requiresConfirmation: true — nothing was run. " |
| 115 | + + "Confirm with the human in the loop, then retry this call with 'confirm': true on the request.", |
| 116 | + ), |
| 117 | + { |
| 118 | + code: 'ACTION_CONFIRMATION_REQUIRED', |
| 119 | + status: 428, |
| 120 | + details: { actionName: 'archive_note', objectName: OBJECT, confirmationMember: AI_ACTION_CONFIRMATION_MEMBER }, |
| 121 | + }, |
| 122 | + ); |
| 123 | +} |
| 124 | + |
| 125 | +let nextId = 1; |
| 126 | +async function rpc(bridge: McpDataBridge, method: string, params?: Record<string, unknown>) { |
| 127 | + const body = { jsonrpc: '2.0', id: nextId++, method, ...(params ? { params } : {}) }; |
| 128 | + const runtime = new MCPServerRuntime({ name: 'pin', version: '0.0.0' }); |
| 129 | + const res = await runtime.handleHttpRequest( |
| 130 | + new Request('http://localhost/api/v1/mcp', { |
| 131 | + method: 'POST', |
| 132 | + headers: { 'content-type': 'application/json', accept: 'application/json, text/event-stream' }, |
| 133 | + body: JSON.stringify(body), |
| 134 | + }), |
| 135 | + { bridge: bridge as any, parsedBody: body }, |
| 136 | + ); |
| 137 | + expect(res.status).toBe(200); |
| 138 | + const json = (await res.json()) as { result?: any; error?: unknown }; |
| 139 | + expect(json.error, JSON.stringify(json.error)).toBeUndefined(); |
| 140 | + return json.result; |
| 141 | +} |
| 142 | + |
| 143 | +async function callTool(bridge: McpDataBridge, name: string, args: Record<string, unknown>) { |
| 144 | + return (await rpc(bridge, 'tools/call', { name, arguments: args })) as { |
| 145 | + content: Array<{ text: string }>; |
| 146 | + isError?: boolean; |
| 147 | + }; |
| 148 | +} |
| 149 | + |
| 150 | +const envelopeOf = (result: { content: Array<{ text: string }> }) => JSON.parse(result.content[0]!.text) as { error: any }; |
| 151 | + |
| 152 | +describe('MCP delete_record refuses a call without confirm: true (ACTION_CONFIRMATION_REQUIRED)', () => { |
| 153 | + let rows: Map<string, Record<string, unknown>>; |
| 154 | + let engine: ReturnType<typeof engineDouble>; |
| 155 | + let bridge: McpDataBridge; |
| 156 | + |
| 157 | + beforeEach(() => { |
| 158 | + rows = new Map([['n1', { id: 'n1', title: 'keep me' }]]); |
| 159 | + engine = engineDouble(rows); |
| 160 | + bridge = stdioBridge(engine); |
| 161 | + }); |
| 162 | + |
| 163 | + it('advertises the confirmation member on the tool schema, so a model can discover the retry', async () => { |
| 164 | + const listed = await rpc(bridge, 'tools/list'); |
| 165 | + const tool = (listed.tools as any[]).find((t) => t.name === 'delete_record'); |
| 166 | + expect(tool, 'delete_record is registered').toBeDefined(); |
| 167 | + const props = tool.inputSchema.properties; |
| 168 | + // Control: the members that were already there are still advertised. |
| 169 | + expect(Object.keys(props)).toEqual(expect.arrayContaining(['objectName', 'recordId'])); |
| 170 | + expect(props[AI_ACTION_CONFIRMATION_MEMBER]?.type).toBe('boolean'); |
| 171 | + // Optional in the schema: a call without it must reach the handler, which |
| 172 | + // answers the coded refusal. Required there, it would be refused as a bare |
| 173 | + // input-validation error naming no code and no retry. |
| 174 | + expect(tool.inputSchema.required ?? []).not.toContain(AI_ACTION_CONFIRMATION_MEMBER); |
| 175 | + // The description tells the agent the order: ask the human, then retry. |
| 176 | + expect(tool.description).toContain('confirm: true'); |
| 177 | + expect(tool.description).toMatch(/ask the human/i); |
| 178 | + expect(tool.annotations?.destructiveHint).toBe(true); |
| 179 | + }); |
| 180 | + |
| 181 | + it('refuses a call without the member: code, status and the retry details; the record is intact', async () => { |
| 182 | + const result = await callTool(bridge, 'delete_record', { objectName: OBJECT, recordId: 'n1' }); |
| 183 | + |
| 184 | + expect(result.isError).toBe(true); |
| 185 | + const { error } = envelopeOf(result); |
| 186 | + expect(error.code).toBe('ACTION_CONFIRMATION_REQUIRED'); |
| 187 | + expect(error.status).toBe(428); |
| 188 | + expect(error.details).toEqual({ |
| 189 | + actionName: 'delete_record', |
| 190 | + objectName: OBJECT, |
| 191 | + confirmationMember: AI_ACTION_CONFIRMATION_MEMBER, |
| 192 | + }); |
| 193 | + expect(String(error.message)).toContain('nothing was deleted'); |
| 194 | + |
| 195 | + // Nothing was deleted: the engine was never asked, and the row is there. |
| 196 | + expect(engine.delete).not.toHaveBeenCalled(); |
| 197 | + expect(rows.get('n1')).toEqual({ id: 'n1', title: 'keep me' }); |
| 198 | + }); |
| 199 | + |
| 200 | + it.each([ |
| 201 | + ['false', false], |
| 202 | + ['the string "true"', 'true'], |
| 203 | + ['1', 1], |
| 204 | + ])('refuses %s as the member: only the boolean true attests, and the record is intact', async (_label, value) => { |
| 205 | + const result = await callTool(bridge, 'delete_record', { |
| 206 | + objectName: OBJECT, |
| 207 | + recordId: 'n1', |
| 208 | + [AI_ACTION_CONFIRMATION_MEMBER]: value, |
| 209 | + }); |
| 210 | + |
| 211 | + expect(result.isError).toBe(true); |
| 212 | + expect(engine.delete).not.toHaveBeenCalled(); |
| 213 | + expect(rows.has('n1')).toBe(true); |
| 214 | + }); |
| 215 | + |
| 216 | + it('deletes on the retry with confirm: true, once', async () => { |
| 217 | + const result = await callTool(bridge, 'delete_record', { |
| 218 | + objectName: OBJECT, |
| 219 | + recordId: 'n1', |
| 220 | + [AI_ACTION_CONFIRMATION_MEMBER]: true, |
| 221 | + }); |
| 222 | + |
| 223 | + expect(result.isError, result.content[0]?.text).toBeFalsy(); |
| 224 | + expect(JSON.parse(result.content[0]!.text)).toEqual({ object: OBJECT, id: 'n1', success: true }); |
| 225 | + expect(engine.delete).toHaveBeenCalledTimes(1); |
| 226 | + expect(rows.has('n1')).toBe(false); |
| 227 | + }); |
| 228 | + |
| 229 | + it('answers with run_action\'s refusal shape: the same code, status, envelope keys and details keys', async () => { |
| 230 | + const actionBridge: McpDataBridge & McpActionBridge = { |
| 231 | + ...bridge, |
| 232 | + async listActions() { |
| 233 | + return [{ name: 'archive_note', objectName: OBJECT, requiresRecord: true, requiresConfirmation: true }]; |
| 234 | + }, |
| 235 | + async runAction() { |
| 236 | + throw runtimeGateRefusal(); |
| 237 | + }, |
| 238 | + }; |
| 239 | + |
| 240 | + const viaAction = envelopeOf(await callTool(actionBridge, 'run_action', { actionName: 'archive_note', objectName: OBJECT, recordId: 'n1' })).error; |
| 241 | + const viaDelete = envelopeOf(await callTool(actionBridge, 'delete_record', { objectName: OBJECT, recordId: 'n1' })).error; |
| 242 | + |
| 243 | + // Lit control: the run_action half really is the gate's refusal. |
| 244 | + expect(viaAction.code).toBe('ACTION_CONFIRMATION_REQUIRED'); |
| 245 | + |
| 246 | + expect(viaDelete.code).toBe(viaAction.code); |
| 247 | + expect(viaDelete.status).toBe(viaAction.status); |
| 248 | + expect(Object.keys(viaDelete)).toEqual(Object.keys(viaAction)); |
| 249 | + expect(Object.keys(viaDelete.details).sort()).toEqual(Object.keys(viaAction.details).sort()); |
| 250 | + expect(viaDelete.details.confirmationMember).toBe(viaAction.details.confirmationMember); |
| 251 | + expect(viaDelete.details.objectName).toBe(viaAction.details.objectName); |
| 252 | + expect(rows.has('n1')).toBe(true); |
| 253 | + }); |
| 254 | + |
| 255 | + it('control: update_record is not gated, and writes without the member', async () => { |
| 256 | + const result = await callTool(bridge, 'update_record', { objectName: OBJECT, recordId: 'n1', data: { title: 'changed' } }); |
| 257 | + |
| 258 | + expect(result.isError, result.content[0]?.text).toBeFalsy(); |
| 259 | + expect(engine.update).toHaveBeenCalledTimes(1); |
| 260 | + expect(rows.get('n1')).toMatchObject({ title: 'changed' }); |
| 261 | + }); |
| 262 | + |
| 263 | + it('the long-lived server the stdio transport serves gates the same way', async () => { |
| 264 | + const runtime = new MCPServerRuntime({ name: 'pin-stdio', version: '0.0.0' }); |
| 265 | + runtime.bridgeDataTools(bridge); |
| 266 | + const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair(); |
| 267 | + await runtime.server.connect(serverTransport); |
| 268 | + const client = new Client({ name: 'pin-client', version: '0.0.0' }); |
| 269 | + await client.connect(clientTransport); |
| 270 | + try { |
| 271 | + const refused: any = await client.callTool({ name: 'delete_record', arguments: { objectName: OBJECT, recordId: 'n1' } }); |
| 272 | + expect(refused.isError).toBe(true); |
| 273 | + const { error } = JSON.parse(refused.content[0].text); |
| 274 | + expect(error.code).toBe('ACTION_CONFIRMATION_REQUIRED'); |
| 275 | + expect(error.status).toBe(428); |
| 276 | + expect(error.details).toEqual({ actionName: 'delete_record', objectName: OBJECT, confirmationMember: AI_ACTION_CONFIRMATION_MEMBER }); |
| 277 | + expect(rows.has('n1')).toBe(true); |
| 278 | + |
| 279 | + const confirmed: any = await client.callTool({ |
| 280 | + name: 'delete_record', |
| 281 | + arguments: { objectName: OBJECT, recordId: 'n1', [AI_ACTION_CONFIRMATION_MEMBER]: true }, |
| 282 | + }); |
| 283 | + expect(confirmed.isError, confirmed.content?.[0]?.text).toBeFalsy(); |
| 284 | + expect(rows.has('n1')).toBe(false); |
| 285 | + } finally { |
| 286 | + await client.close(); |
| 287 | + } |
| 288 | + }); |
| 289 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments