feat: initial public release

2026-08-17 03:04:09 +00:00
commit 504145aec6
62 changed files with 18318 additions and 0 deletions
@@ -0,0 +1,247 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { InMemoryTransport } from "@modelcontextprotocol/sdk/inMemory.js";
+import type { AppConfig } from "../src/config.js";
+import type { ApprovalService } from "../src/approval-service.js";
+import type { XftApprovalProvider } from "../src/xft.js";
+import { approvalBatchSummary, APPROVAL_MCP_INSTRUCTIONS, compactResult, createApprovalMcpServer, isLoopbackAddress, mcpAllowedHosts, oauthHtmlContentSecurityPolicy } from "../src/server.js";
+
+function config(): AppConfig {
+  return {
+    clientId: "client",
+    clientSecret: "secret",
+    apiBaseUrl: "https://api.test",
+    oapiBaseUrl: "https://oapi.test",
+    publicBaseUrl: "http://localhost:3000",
+    trustedLocalUser: { userId: "user-1" },
+    port: 3000,
+    requestTimeoutMs: 1_000,
+    officialLookbackDays: 120,
+    officialScanConcurrency: 2,
+    officialClientOnlyProcessCodes: [],
+    batchLimit: 20,
+    approvalRefSecret: "fixed-reference-secret-for-tests",
+  };
+}
+
+test("MCP initialization teaches the workflow while tools/list stays compact", async () => {
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  const server = createApprovalMcpServer(config(), {} as ApprovalService);
+  const client = new Client({ name: "instructions-test", version: "1.0.0" });
+  await server.connect(serverTransport);
+  try {
+    await client.connect(clientTransport);
+    assert.equal(client.getInstructions(), APPROVAL_MCP_INSTRUCTIONS);
+    assert.match(client.getInstructions() ?? "", /approval_list_todos.*approval_get_detail/s);
+    assert.match(client.getInstructions() ?? "", /approval_list_history.*只读/s);
+    assert.match(client.getInstructions() ?? "", /approval_process_batch/);
+    assert.match(client.getInstructions() ?? "", /completed.*followUpRequired/);
+    assert.match(client.getInstructions() ?? "", /不会通过其他消息通道.*directUrl.*当前面向用户的回复/s);
+    assert.doesNotMatch(client.getInstructions() ?? "", /通过当前 Messenger/);
+    assert.match(client.getInstructions() ?? "", /必填字段缺失.*继续询问/s);
+    assert.match(client.getInstructions() ?? "", /非必填字段.*是否补充/s);
+    assert.match(client.getInstructions() ?? "", /出差申请.*外出.*业务招待申请.*差旅费用报销.*业务招待费用报销/s);
+    assert.match(client.getInstructions() ?? "", /revokeId.*approval_revoke_submission/);
+    assert.match(client.getInstructions() ?? "", /最多(?:处理 )?20 条.*零写入.*禁止自动.*重试/s);
+    assert.match(client.getInstructions() ?? "", /近30天.*allowDuplicateInvoices=true/s);
+
+    const tools = await client.listTools();
+    assert.deepEqual(tools.tools.map((tool) => tool.name), [
+      "approval_list_todos",
+      "approval_list_history",
+      "approval_get_detail",
+      "approval_get_actions",
+      "approval_process_batch",
+      "approval_list_submission_templates",
+      "approval_get_submission_schema",
+      "approval_get_submission_options",
+      "approval_prepare_submission",
+      "approval_submit",
+      "approval_revoke_submission",
+      "approval_get_submission_status",
+    ]);
+    const descriptions = Object.fromEntries(tools.tools.map((tool) => [tool.name, tool.description ?? ""]));
+    assert.match(descriptions.approval_list_todos ?? "", /入口.*approvalId/);
+    assert.match(descriptions.approval_list_history ?? "", /handled.*处理过.*submitted.*本人发起.*只读/s);
+    assert.match(descriptions.approval_get_detail ?? "", /expenseItems.*raw/);
+    assert.match(descriptions.approval_process_batch ?? "", /outcome_uncertain|禁止自动重试/);
+    assert.match(descriptions.approval_get_actions ?? "", /targetId.*approval_process_batch/);
+    const historySchema = tools.tools.find((tool) => tool.name === "approval_list_history")?.inputSchema as any;
+    assert.equal(historySchema.properties.startDate.default, "");
+    assert.equal(historySchema.properties.endDate.default, "");
+    assert.match(historySchema.properties.startDate.description, /最近30天/);
+    assert.match(descriptions.approval_process_batch ?? "", /用户明确.*不二次确认/);
+    assert.match(descriptions.approval_process_batch ?? "", /succeeded.*completed.*followUpRequired/);
+    assert.match(descriptions.approval_process_batch ?? "", /最多 20 条.*任一无效.*零写入/s);
+    assert.match(descriptions.approval_prepare_submission ?? "", /明确确认|确认/);
+    assert.match(descriptions.approval_get_submission_schema ?? "", /必填字段齐全.*可选字段/);
+    assert.match(descriptions.approval_get_submission_options ?? "", /承担部门.*城市编码/);
+    assert.match(descriptions.approval_prepare_submission ?? "", /继续询问/);
+    assert.match(descriptions.approval_prepare_submission ?? "", /查重.*allowDuplicateInvoices/s);
+    const prepareSchema = tools.tools.find((tool) => tool.name === "approval_prepare_submission")?.inputSchema as any;
+    assert.equal(prepareSchema.properties.allowDuplicateInvoices.default, false);
+    assert.match(descriptions.approval_list_submission_templates ?? "", /出差申请.*外出.*差旅费用报销.*业务招待费用报销/);
+    assert.match(descriptions.approval_submit ?? "", /禁止自动重试/);
+    assert.match(descriptions.approval_revoke_submission ?? "", /禁止自动重试.*薪福通.*实验能力/);
+    assert.match(descriptions.approval_get_submission_status ?? "", /本人.*归属/);
+    const batchTool = tools.tools.find((tool) => tool.name === "approval_process_batch")!;
+    const itemSchema = (batchTool.inputSchema as any).properties.items;
+    assert.equal(itemSchema.maxItems, 20);
+    const tooMany = await client.callTool({
+      name: "approval_process_batch",
+      arguments: {
+        action: "approve",
+        remark: "",
+        items: Array.from({ length: 21 }, () => ({ approvalId: "v4.this-reference-is-long-enough" })),
+      },
+    });
+    assert.equal(tooMany.isError, true);
+    assert.match(JSON.stringify(tooMany.content), /一次最多处理 20 条审批/);
+  } finally {
+    await client.close();
+    await server.close();
+  }
+});
+
+test("local-only server recognizes loopback addresses", () => {
+  assert.equal(isLoopbackAddress("127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("::1"), true);
+  assert.equal(isLoopbackAddress("::ffff:127.0.0.1"), true);
+  assert.equal(isLoopbackAddress("192.168.1.13"), false);
+  assert.equal(isLoopbackAddress(undefined), false);
+});
+
+test("HTTP MCP accepts the configured public host without dropping loopback health checks", () => {
+  assert.deepEqual(mcpAllowedHosts("https://approval.justconn.top"), [
+    "approval.justconn.top", "127.0.0.1", "localhost", "[::1]",
+  ]);
+});
+
+test("OAuth consent CSP permits only the DingTalk login redirect after same-origin submit", () => {
+  const policy = oauthHtmlContentSecurityPolicy();
+  assert.match(policy, /form-action 'self' https:\/\/login\.dingtalk\.com(?:;|\s)/);
+  assert.doesNotMatch(policy, /form-action[^;]*\*/);
+});
+
+test("remote gateway lists DingTalk OA and XFT through one authenticated MCP session", async () => {
+  const dingTalk = {
+    async listMyTodos() {
+      return { items: [{ source: "official_oa", processInstanceId: "oa-1", taskId: "task-1", title: "采购审批", raw: {} }] };
+    },
+  } as unknown as ApprovalService;
+  const xft = {
+    async listMyTodos() {
+      return { items: [{ source: "xft", billId: "xft-1", title: "费用报销" }], totalCount: 1, identity: {}, diagnostics: {} };
+    },
+  } as unknown as XftApprovalProvider;
+  const [clientTransport, serverTransport] = InMemoryTransport.createLinkedPair();
+  const server = createApprovalMcpServer(
+    { ...config(), appMode: "gateway", trustedLocalUser: undefined },
+    dingTalk, xft, undefined, undefined, { userId: "user-1" },
+  );
+  const client = new Client({ name: "unified-gateway-test", version: "1.0.0" });
+  await server.connect(serverTransport);
+  try {
+    await client.connect(clientTransport);
+    const response = await client.callTool({ name: "approval_list_todos", arguments: { source: "all", query: "", limit: 20 } });
+    const result = (response.structuredContent as { result: { items: Array<{ source: string; approvalId: string }>; selectionId: string } }).result;
+    assert.deepEqual(result.items.map((item) => item.source).sort(), ["dingtalk", "xft"]);
+    const blocks = response.content as Array<{ type: string; text?: string }>;
+    const text = blocks.find((item) => item.type === "text")?.text ?? "";
+    assert.match(text, /采购审批/);
+    assert.match(text, /费用报销/);
+    assert.ok(result.items.every((item) => text.includes(item.approvalId)));
+    assert.ok(text.includes(result.selectionId));
+    assert.doesNotMatch(text, /diagnostics|enterpriseUserId|processInstanceId|taskId|userId/);
+  } finally {
+    await client.close();
+    await server.close();
+  }
+});
+
+test("batch summaries distinguish total failure, partial success, and full success", () => {
+  assert.match(approvalBatchSummary({ total: 2, succeeded: 0 }), /未有任何.*成功/);
+  assert.match(approvalBatchSummary({ total: 2, succeeded: 1 }), /部分成功.*1\/2/);
+  assert.match(approvalBatchSummary({ total: 2, succeeded: 2 }), /全部提交成功.*2\/2/);
+  assert.match(approvalBatchSummary({ total: 2, succeeded: 0, uncertain: 1 }), /禁止自动重试/);
+  assert.match(approvalBatchSummary({ status: "preflight_failed", writesStarted: false, invalidItems: [{}] }), /未开始.*0 张已写入.*禁止自动重试/);
+});
+
+test("portable tool output exposes compact domain data without upstream internals", () => {
+  const response = compactResult("已完成。", {
+    action: "approve",
+    total: 1,
+    results: [{
+      approvalId: "v3.portable.reference.value",
+      processInstanceId: "internal-instance",
+      taskId: "internal-task",
+      userId: "internal-user",
+      status: "processed",
+      success: true,
+      response: { traceId: "upstream-trace" },
+    }],
+    diagnostics: { realtimeValidation: true },
+  });
+  const text = (response.content[0] as { type: "text"; text: string }).text;
+  assert.match(text, /v3\.portable\.reference\.value/);
+  assert.match(text, /"status":"processed"/);
+  assert.doesNotMatch(text, /internal-instance|internal-task|internal-user|upstream-trace|diagnostics/);
+  assert.deepEqual(response.structuredContent.result, JSON.parse(text.split("\n")[1]!));
+});
+
+test("QR auth challenges instruct the agent to reply directly instead of claiming a separate push", () => {
+  const response = compactResult("需要重新登录。", {
+    sourceStatus: {
+      xft: {
+        status: "auth_required",
+        authChallenge: {
+          provider: "xft", type: "qr", challengeId: "qr-1",
+          directUrl: "https://approval.example.test/xft/login",
+        },
+      },
+    },
+  }, {
+    async getOrStart() {
+      return {
+        provider: "xft" as const, type: "qr" as const, challengeId: "qr-1",
+        qrImageUrl: "https://approval.example.test/xft/qr",
+        directUrl: "https://approval.example.test/xft/login",
+        expiresAt: new Date(Date.now() + 60_000).toISOString(), pollAfterSeconds: 3,
+      };
+    },
+    getImage: () => Buffer.from("png"),
+  });
+  const text = (response.content[0] as { type: "text"; text: string }).text;
+  assert.match(text, /不会另行推送登录内容/);
+  assert.match(text, /原样写入当前回复/);
+  assert.doesNotMatch(text, /通过当前 Messenger/);
+  assert.equal(response.content[1]?.type, "image");
+});
+
+test("portable presentation preserves submission fields and opaque write references", () => {
+  const response = compactResult("审批尚未提交。", {
+    templateId: "v3.template.reference.value",
+    fields: [{ fieldNumber: "trip_reason", name: "出差事由", required: true, valueFormat: "文本字符串" }],
+    inputContract: { values: { required: ["businessTrip"] } },
+    confirmationId: "v3.confirmation.reference.value",
+    preview: {
+      template: { name: "出差申请", processCode: "internal-process-code" },
+      formSummary: { businessTrip: { reason: "客户拜访" } },
+      identityValidation: { validated: true, employeeNumber: "internal-employee" },
+    },
+    revokeId: "v3.revoke.reference.value",
+    billId: "2026081300000001",
+    diagnostics: { persistedBusinessData: false },
+  });
+  const visible = response.structuredContent.result as Record<string, any>;
+  assert.equal(visible.templateId, "v3.template.reference.value");
+  assert.equal(visible.confirmationId, "v3.confirmation.reference.value");
+  assert.equal(visible.revokeId, "v3.revoke.reference.value");
+  assert.equal(visible.businessId, "2026081300000001");
+  assert.equal(visible.fields[0].fieldNumber, "trip_reason");
+  assert.equal(visible.preview.formSummary.businessTrip.reason, "客户拜访");
+  assert.equal(visible.preview.template.processCode, undefined);
+  assert.equal(visible.preview.identityValidation.employeeNumber, undefined);
+  assert.equal(visible.diagnostics, undefined);
+});