Complete P2: Integration tests (29 integration + enhanced fixtures)

Author: Mohammod Al Amin Ashik

tests/rust/src/lib.rs

@@ -1,10 +1,11 @@
 //! Shared test utilities and fixtures for McpMux integration tests.
 
-pub use mcpmux_core::domain::{InstalledServer, Space};
+pub use mcpmux_core::domain::{InstalledServer, Space, FeatureSet, FeatureSetType};
 
 /// Test fixture utilities
 pub mod fixtures {
     use super::*;
+    use uuid::Uuid;
 
     /// Create a test space with default values
     pub fn test_space(name: &str) -> Space {
@@ -25,6 +26,33 @@ pub mod fixtures {
         InstalledServer::new(space_id, server_id)
             .with_enabled(true)
     }
+
+    /// Create a test feature set
+    pub fn test_feature_set(name: &str, space_id: &str) -> FeatureSet {
+        FeatureSet::new_custom(name, space_id)
+            .with_icon("🔧")
+            .with_description(format!("Test feature set: {}", name))
+    }
+
+    /// Create an "all features" feature set
+    pub fn all_features_set(space_id: &str) -> FeatureSet {
+        FeatureSet::new_all(space_id)
+    }
+
+    /// Create a "default" feature set
+    pub fn default_feature_set(space_id: &str) -> FeatureSet {
+        FeatureSet::new_default(space_id)
+    }
+
+    /// Create a server-all feature set
+    pub fn server_all_feature_set(space_id: &str, server_id: &str, server_name: &str) -> FeatureSet {
+        FeatureSet::new_server_all(space_id, server_id, server_name)
+    }
+
+    /// Generate a random UUID string
+    pub fn random_id() -> String {
+        Uuid::new_v4().to_string()
+    }
 }
 
 /// Database test helpers

tests/rust/tests/database/repositories.rs

@@ -145,3 +145,62 @@ async fn test_space_repository_set_default() {
     let space1_reloaded = SpaceRepository::get(&repo, &space1_id).await.unwrap().unwrap();
     assert!(!space1_reloaded.is_default);
 }
+
+#[tokio::test]
+async fn test_space_repository_concurrent_reads() {
+    let test_db = TestDatabase::new();
+    let db = Arc::new(Mutex::new(test_db.db));
+    let repo = Arc::new(SqliteSpaceRepository::new(db));
+    
+    // Create a space
+    let space = fixtures::test_space("Concurrent Test");
+    let space_id = space.id.clone();
+    SpaceRepository::create(repo.as_ref(), &space).await.unwrap();
+    
+    // Spawn multiple concurrent reads
+    let mut handles = vec![];
+    for _ in 0..5 {
+        let repo_clone = Arc::clone(&repo);
+        let id = space_id.clone();
+        handles.push(tokio::spawn(async move {
+            SpaceRepository::get(repo_clone.as_ref(), &id).await
+        }));
+    }
+    
+    // All reads should succeed
+    for handle in handles {
+        let result = handle.await.expect("Task panicked");
+        assert!(result.is_ok());
+        assert!(result.unwrap().is_some());
+    }
+}
+
+#[tokio::test]
+async fn test_space_repository_concurrent_writes() {
+    let test_db = TestDatabase::new();
+    let db = Arc::new(Mutex::new(test_db.db));
+    let repo = Arc::new(SqliteSpaceRepository::new(db));
+    
+    // Spawn multiple concurrent creates
+    let mut handles = vec![];
+    for i in 0..5 {
+        let repo_clone = Arc::clone(&repo);
+        handles.push(tokio::spawn(async move {
+            let space = fixtures::test_space(&format!("Concurrent Space {}", i));
+            SpaceRepository::create(repo_clone.as_ref(), &space).await
+        }));
+    }
+    
+    // All writes should succeed
+    for handle in handles {
+        let result = handle.await.expect("Task panicked");
+        assert!(result.is_ok());
+    }
+    
+    // Verify all spaces were created
+    let all_spaces = SpaceRepository::list(repo.as_ref()).await.unwrap();
+    let concurrent_count = all_spaces.iter()
+        .filter(|s| s.name.starts_with("Concurrent Space"))
+        .count();
+    assert_eq!(concurrent_count, 5);
+}

tests/rust/tests/security/jwt.rs

@@ -0,0 +1,111 @@
+//! JWT integration tests
+//!
+//! Tests for token creation and validation using mcpmux-gateway auth module.
+
+use mcpmux_gateway::auth::{create_access_token, create_refresh_token, validate_token};
+
+const TEST_SECRET: &[u8] = b"test_secret_key_that_is_32_bytes";
+
+#[test]
+fn test_create_access_token() {
+    let token = create_access_token("client-123", Some("mcp read write"), 3600, TEST_SECRET);
+    
+    // Token should have two parts separated by '.'
+    let parts: Vec<&str> = token.split('.').collect();
+    assert_eq!(parts.len(), 2, "Token should have payload.signature format");
+    
+    // Both parts should be valid base64
+    assert!(!parts[0].is_empty());
+    assert!(!parts[1].is_empty());
+}
+
+#[test]
+fn test_create_refresh_token() {
+    let token = create_refresh_token("client-123", Some("mcp"), TEST_SECRET);
+    
+    let parts: Vec<&str> = token.split('.').collect();
+    assert_eq!(parts.len(), 2);
+}
+
+#[test]
+fn test_validate_token_success() {
+    let token = create_access_token("test-client", Some("read"), 3600, TEST_SECRET);
+    
+    let claims = validate_token(&token, TEST_SECRET);
+    assert!(claims.is_some(), "Valid token should return claims");
+    
+    let claims = claims.unwrap();
+    assert_eq!(claims.client_id, "test-client");
+    assert_eq!(claims.scope, Some("read".to_string()));
+}
+
+#[test]
+fn test_validate_token_wrong_secret() {
+    let token = create_access_token("client", None, 3600, TEST_SECRET);
+    let wrong_secret = b"different_secret_key_32_bytes!!!";
+    
+    let claims = validate_token(&token, wrong_secret);
+    assert!(claims.is_none(), "Token signed with different secret should fail");
+}
+
+#[test]
+fn test_validate_expired_token() {
+    // Create token that expired 1 hour ago
+    let token = create_access_token("client", None, -3600, TEST_SECRET);
+    
+    let claims = validate_token(&token, TEST_SECRET);
+    assert!(claims.is_none(), "Expired token should fail validation");
+}
+
+#[test]
+fn test_validate_malformed_token() {
+    let claims = validate_token("not.a.valid.token", TEST_SECRET);
+    assert!(claims.is_none());
+    
+    let claims = validate_token("", TEST_SECRET);
+    assert!(claims.is_none());
+    
+    let claims = validate_token("single_part_token", TEST_SECRET);
+    assert!(claims.is_none());
+}
+
+#[test]
+fn test_token_contains_timestamps() {
+    let token = create_access_token("client", None, 3600, TEST_SECRET);
+    
+    let claims = validate_token(&token, TEST_SECRET).unwrap();
+    
+    // iat should be recent (within last minute)
+    let now = chrono::Utc::now().timestamp();
+    assert!(claims.iat >= now - 60);
+    assert!(claims.iat <= now);
+    
+    // exp should be in the future
+    assert!(claims.exp > now);
+}
+
+#[test]
+fn test_token_scope_optional() {
+    // Token without scope
+    let token = create_access_token("client", None, 3600, TEST_SECRET);
+    let claims = validate_token(&token, TEST_SECRET).unwrap();
+    
+    // Scope can be None when passed as null
+    // The implementation may serialize None as null in JSON
+    // Just verify token validates
+    assert_eq!(claims.client_id, "client");
+}
+
+#[test]
+fn test_different_clients_different_tokens() {
+    let token1 = create_access_token("client-a", None, 3600, TEST_SECRET);
+    let token2 = create_access_token("client-b", None, 3600, TEST_SECRET);
+    
+    assert_ne!(token1, token2);
+    
+    let claims1 = validate_token(&token1, TEST_SECRET).unwrap();
+    let claims2 = validate_token(&token2, TEST_SECRET).unwrap();
+    
+    assert_eq!(claims1.client_id, "client-a");
+    assert_eq!(claims2.client_id, "client-b");
+}

tests/rust/tests/security/mod.rs

@@ -3,3 +3,4 @@
 //! Tests for crypto, keychain, and JWT handling.
 
 mod crypto;
+mod jwt;