@@ -428,17 +432,17 @@ taskRouter.get('/:id/edit', requireSessionOrRedirect, async (req: Request, res:
-
+
-
+
-
+
@@ -447,7 +451,7 @@ taskRouter.get('/:id/edit', requireSessionOrRedirect, async (req: Request, res:
-
diff --git a/joyus-ai-mcp-server/src/tools/executor.ts b/joyus-ai-mcp-server/src/tools/executor.ts
index dc1a471..7ed01ea 100644
--- a/joyus-ai-mcp-server/src/tools/executor.ts
+++ b/joyus-ai-mcp-server/src/tools/executor.ts
@@ -43,6 +43,26 @@ export function setPipelineContext(deps: PipelineContextDeps): void {
_pipelineContext = deps;
}
+// ============================================================
+// CONTENT CONTEXT (injected during content module startup)
+// ============================================================
+
+import type { SearchService } from '../content/search/index.js';
+
+interface ContentContextDeps {
+ searchService: SearchService;
+}
+
+let _contentContext: ContentContextDeps | null = null;
+
+/**
+ * Inject content module dependencies for tool execution.
+ * Called once during content module initialization.
+ */
+export function setContentContext(deps: ContentContextDeps): void {
+ _contentContext = deps;
+}
+
/**
* Execute a tool by name with the given input
*/
@@ -53,7 +73,12 @@ export async function executeTool(userId: string, toolName: string, input: Recor
if (toolName.startsWith('content_')) {
const tenantId = userId; // tenant resolution deferred to WP12; use userId as tenantId for now
- return executeContentTool(toolName, input, { userId, tenantId, db });
+ return executeContentTool(toolName, input, {
+ userId,
+ tenantId,
+ db,
+ searchService: _contentContext?.searchService,
+ });
}
if (toolName.startsWith('pipeline_') || toolName.startsWith('template_') || toolName.startsWith('review_')) {
diff --git a/joyus-ai-mcp-server/src/tools/executors/content-executor.ts b/joyus-ai-mcp-server/src/tools/executors/content-executor.ts
index 9468ac2..62b0a23 100644
--- a/joyus-ai-mcp-server/src/tools/executors/content-executor.ts
+++ b/joyus-ai-mcp-server/src/tools/executors/content-executor.ts
@@ -16,6 +16,8 @@ import {
contentDriftReports,
contentEntitlements,
} from '../../content/schema.js';
+import type { SearchService } from '../../content/search/index.js';
+import type { ResolvedEntitlements } from '../../content/types.js';
type DrizzleClient = ReturnType
;
@@ -23,6 +25,7 @@ export interface ContentExecutorContext {
userId: string;
tenantId: string;
db: DrizzleClient;
+ searchService?: SearchService;
}
/**
@@ -213,7 +216,48 @@ export async function executeContentTool(
const limit = Math.min((input.limit as number | undefined) ?? 10, 50);
const offset = (input.offset as number | undefined) ?? 0;
- // Get sources this tenant can access
+ // Use SearchService with FTS when available
+ if (context.searchService) {
+ // Build minimal entitlements from tenant's active products
+ const tenantProducts = await db
+ .select({ id: contentProducts.id })
+ .from(contentProducts)
+ .where(and(eq(contentProducts.tenantId, tenantId), eq(contentProducts.isActive, true)));
+
+ const entitlements: ResolvedEntitlements = {
+ productIds: tenantProducts.map((p) => p.id),
+ sourceIds: [],
+ profileIds: [],
+ resolvedFrom: 'tool-executor',
+ resolvedAt: new Date(),
+ };
+
+ const results = await context.searchService.search(query, entitlements, {
+ limit,
+ offset,
+ sourceId: sourceIds?.[0],
+ });
+
+ return {
+ items: results.map((r) => ({
+ id: r.itemId,
+ sourceId: r.sourceId,
+ title: r.title,
+ excerpt: r.excerpt,
+ score: r.score,
+ sourceName: r.sourceName,
+ sourceType: r.sourceType,
+ isStale: r.isStale,
+ stalenessWarning: r.stalenessWarning,
+ })),
+ total: results.length,
+ query,
+ limit,
+ offset,
+ };
+ }
+
+ // Fallback: LIKE search when SearchService is not wired
const tenantSources = await db
.select({ id: contentSources.id })
.from(contentSources)
@@ -224,7 +268,6 @@ export async function executeContentTool(
return { items: [], total: 0, query };
}
- // Restrict to requested sourceIds if provided, intersected with tenant sources
const effectiveSourceIds =
sourceIds && sourceIds.length > 0
? sourceIds.filter((id) => tenantSourceIds.includes(id))
@@ -234,7 +277,6 @@ export async function executeContentTool(
return { items: [], total: 0, query };
}
- // Simple LIKE search on title and body (FTS wired via SearchService in WP12)
const searchPattern = `%${query}%`;
const rows = await db
.select({
@@ -270,7 +312,6 @@ export async function executeContentTool(
query,
limit,
offset,
- note: 'Full-text search will be available after SearchService integration (WP12).',
};
}
diff --git a/joyus-ai-mcp-server/tests/auth/routes.test.ts b/joyus-ai-mcp-server/tests/auth/routes.test.ts
new file mode 100644
index 0000000..299235a
--- /dev/null
+++ b/joyus-ai-mcp-server/tests/auth/routes.test.ts
@@ -0,0 +1,843 @@
+/**
+ * Route handler tests for auth/routes.ts
+ *
+ * Tests the OAuth callback flows (Google, Jira, Slack, GitHub),
+ * the disconnect route, logout, and the portal home page.
+ *
+ * Pattern: mock all external dependencies (DB, axios, encryption),
+ * extract route handlers from authRouter.stack, and call them with
+ * mock req/res objects — matching the approach in middleware.test.ts.
+ *
+ * NOTE: The disconnect route is currently GET /:service/disconnect.
+ * Tests below are written for POST to be forward-compatible with the
+ * planned migration to POST. When the route is changed, remove the
+ * "expected to fail until route is POST" comment from the POST test.
+ */
+
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import type { Request, Response, NextFunction } from 'express';
+import type { Router } from 'express';
+
+// ─── Module mocks (must be declared before imports) ───────────────────────────
+
+vi.mock('../../src/db/client.js', () => {
+ const mockDb = {
+ select: vi.fn(),
+ insert: vi.fn(),
+ update: vi.fn(),
+ delete: vi.fn(),
+ };
+ return {
+ db: mockDb,
+ users: 'users_table',
+ connections: 'connections_table',
+ oauthStates: 'oauth_states_table',
+ };
+});
+
+vi.mock('../../src/db/encryption.js', () => ({
+ encryptToken: vi.fn((t: string) => `enc(${t})`),
+ generateMcpToken: vi.fn(() => 'generated-mcp-token'),
+ generateOAuthState: vi.fn(() => 'random-state-abc'),
+}));
+
+vi.mock('axios');
+
+// requireSessionOrRedirect used by start/disconnect routes
+vi.mock('../../src/auth/middleware.js', () => ({
+ requireSessionOrRedirect: vi.fn(
+ (req: Request, res: Response, next: NextFunction) => {
+ if (!req.session?.userId) {
+ res.redirect('/auth');
+ return;
+ }
+ next();
+ }
+ ),
+}));
+
+// ─── Imports (after mocks) ────────────────────────────────────────────────────
+
+import axios from 'axios';
+import { db } from '../../src/db/client.js';
+import { authRouter } from '../../src/auth/routes.js';
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+type RouteLayer = {
+ route?: {
+ path: string;
+ methods: Record;
+ stack: Array<{ handle: (req: Request, res: Response, next: NextFunction) => unknown }>;
+ };
+};
+
+/**
+ * Find the last registered handler for a given method + path on the router.
+ * Returns the final handler in the middleware stack for that route.
+ */
+function findHandler(
+ router: Router,
+ method: string,
+ path: string
+): ((req: Request, res: Response, next: NextFunction) => unknown) | undefined {
+ const stack = (router as unknown as { stack: RouteLayer[] }).stack;
+ const layer = stack.find(
+ (l) =>
+ l.route &&
+ l.route.path === path &&
+ l.route.methods[method.toLowerCase()]
+ );
+ if (!layer?.route) return undefined;
+ // Return the last handler (the actual route handler, not middleware)
+ const handlers = layer.route.stack;
+ return handlers[handlers.length - 1].handle;
+}
+
+function createMockReq(overrides: Record = {}): Request {
+ return {
+ headers: {},
+ query: {},
+ params: {},
+ session: {},
+ body: {},
+ ...overrides,
+ } as unknown as Request;
+}
+
+function createMockRes() {
+ const res = {
+ _status: 200,
+ _body: null as unknown,
+ _redirect: null as string | null,
+ _sent: false,
+ status(code: number) {
+ res._status = code;
+ return res;
+ },
+ send(body: unknown) {
+ res._body = body;
+ res._sent = true;
+ return res;
+ },
+ json(data: unknown) {
+ res._body = data;
+ res._sent = true;
+ return res;
+ },
+ redirect(url: string) {
+ res._redirect = url;
+ return res;
+ },
+ };
+ return res as unknown as Response & {
+ _status: number;
+ _body: unknown;
+ _redirect: string | null;
+ _sent: boolean;
+ };
+}
+
+/**
+ * Build a fluent select chain that resolves to `rows` via .limit().
+ * Use for queries that call .select().from().where().limit(1).
+ */
+function selectReturning(rows: unknown[]) {
+ const chain = {
+ from: vi.fn().mockReturnThis(),
+ where: vi.fn().mockReturnThis(),
+ limit: vi.fn().mockResolvedValue(rows),
+ };
+ vi.mocked(db.select).mockReturnValueOnce(chain as never);
+ return chain;
+}
+
+/**
+ * Build a fluent select chain that resolves to `rows` via .where() (no .limit()).
+ * Use for queries that call .select().from().where() and await the result directly,
+ * such as the connections fetch in the dashboard route.
+ */
+function selectResolvingOnWhere(rows: unknown[]) {
+ const chain = {
+ from: vi.fn().mockReturnThis(),
+ where: vi.fn().mockResolvedValue(rows),
+ };
+ vi.mocked(db.select).mockReturnValueOnce(chain as never);
+ return chain;
+}
+
+/** Build an insert chain that returns `rows` from .returning() */
+function insertReturning(rows: unknown[]) {
+ const chain = {
+ values: vi.fn().mockReturnThis(),
+ returning: vi.fn().mockResolvedValue(rows),
+ };
+ vi.mocked(db.insert).mockReturnValueOnce(chain as never);
+ return chain;
+}
+
+/** Build an insert chain that resolves without .returning() */
+function insertResolving() {
+ const chain = {
+ values: vi.fn().mockResolvedValue(undefined),
+ };
+ vi.mocked(db.insert).mockReturnValueOnce(chain as never);
+ return chain;
+}
+
+/** Build an update chain */
+function updateResolving() {
+ const chain = {
+ set: vi.fn().mockReturnThis(),
+ where: vi.fn().mockResolvedValue(undefined),
+ };
+ vi.mocked(db.update).mockReturnValueOnce(chain as never);
+ return chain;
+}
+
+/** Build a delete chain */
+function deleteResolving() {
+ const chain = {
+ where: vi.fn().mockResolvedValue(undefined),
+ };
+ vi.mocked(db.delete).mockReturnValueOnce(chain as never);
+ return chain;
+}
+
+// ─── Helper data ──────────────────────────────────────────────────────────────
+
+const VALID_STATE_ROW = {
+ id: 'state-id-1',
+ state: 'valid-state',
+ userId: 'pending',
+ service: 'GOOGLE',
+ expiresAt: new Date(Date.now() + 5 * 60 * 1000), // valid for 5 min
+};
+
+const EXISTING_USER = {
+ id: 'user-1',
+ email: 'operator@example.com',
+ name: 'Operator A',
+ mcpToken: 'existing-mcp-token',
+};
+
+// ─── escapeHtml (tested through dashboard HTML output) ───────────────────────
+
+describe('escapeHtml (via dashboard route)', () => {
+ let handler: ReturnType;
+
+ beforeEach(() => {
+ vi.clearAllMocks();
+ handler = findHandler(authRouter, 'get', '/');
+ });
+
+ it('escapes special HTML characters in user display name', async () => {
+ const xssUser = {
+ ...EXISTING_USER,
+ name: '',
+ };
+ selectReturning([xssUser]); // user lookup (.limit(1))
+ selectResolvingOnWhere([]); // connections lookup (no .limit())
+
+ const req = createMockReq({ session: { userId: 'user-1' } });
+ const res = createMockRes();
+
+ await handler!(req, res, vi.fn());
+
+ const html = res._body as string;
+ expect(html).toContain('<script>');
+ expect(html).not.toContain('