diff --git a/__tests__/create-story.test.ts b/__tests__/create-story.test.ts new file mode 100644 index 0000000..2bf1222 --- /dev/null +++ b/__tests__/create-story.test.ts @@ -0,0 +1,141 @@ +import { describe, it, expect, vi, beforeEach } from 'vitest' + +vi.mock('../src/prisma.js', () => ({ + prisma: { + pbi: { findUnique: vi.fn() }, + sprint: { findUnique: vi.fn() }, + story: { + findFirst: vi.fn(), + findMany: vi.fn(), + create: vi.fn(), + }, + }, +})) + +vi.mock('../src/auth.js', () => ({ + requireWriteAccess: vi.fn(), + PermissionDeniedError: class PermissionDeniedError extends Error { + constructor(message = 'Demo accounts cannot perform write operations') { + super(message) + this.name = 'PermissionDeniedError' + } + }, +})) + +vi.mock('../src/access.js', () => ({ + userCanAccessProduct: vi.fn(), +})) + +import { prisma } from '../src/prisma.js' +import { requireWriteAccess } from '../src/auth.js' +import { userCanAccessProduct } from '../src/access.js' +import { handleCreateStory } from '../src/tools/create-story.js' + +const mockPrisma = prisma as unknown as { + pbi: { findUnique: ReturnType } + sprint: { findUnique: ReturnType } + story: { + findFirst: ReturnType + findMany: ReturnType + create: ReturnType + } +} +const mockRequireWriteAccess = requireWriteAccess as ReturnType +const mockUserCanAccessProduct = userCanAccessProduct as ReturnType + +const PRODUCT_ID = 'prod-1' +const PBI_ID = 'pbi-1' +const SPRINT_ID = 'spr-1' +const USER_ID = 'user-1' + +beforeEach(() => { + vi.clearAllMocks() + mockRequireWriteAccess.mockResolvedValue({ userId: USER_ID, tokenId: 'tok-1', username: 'alice', isDemo: false }) + mockUserCanAccessProduct.mockResolvedValue(true) + mockPrisma.pbi.findUnique.mockResolvedValue({ product_id: PRODUCT_ID }) + mockPrisma.story.findMany.mockResolvedValue([]) + mockPrisma.story.findFirst.mockResolvedValue(null) + mockPrisma.story.create.mockImplementation((args: { data: Record }) => + Promise.resolve({ id: 'story-1', created_at: new Date('2026-05-14T10:00:00Z'), ...args.data }), + ) +}) + +function parseResult(result: Awaited>) { + const text = result.content?.[0]?.type === 'text' ? result.content[0].text : '' + try { return JSON.parse(text) } catch { return text } +} + +function errorText(result: Awaited>): string { + return result.content?.[0]?.type === 'text' ? result.content[0].text : '' +} + +describe('handleCreateStory', () => { + it('without sprint_id: creates story with status OPEN and no sprint', async () => { + const result = await handleCreateStory({ pbi_id: PBI_ID, title: 'A story', priority: 2 }) + + expect(mockPrisma.sprint.findUnique).not.toHaveBeenCalled() + const data = mockPrisma.story.create.mock.calls[0][0].data + expect(data.status).toBe('OPEN') + expect(data.sprint_id).toBeNull() + expect(data.product_id).toBe(PRODUCT_ID) + expect(parseResult(result).status).toBe('OPEN') + }) + + it('with valid sprint_id: links story to sprint with status IN_SPRINT', async () => { + mockPrisma.sprint.findUnique.mockResolvedValue({ product_id: PRODUCT_ID }) + + const result = await handleCreateStory({ + pbi_id: PBI_ID, + title: 'A story', + priority: 2, + sprint_id: SPRINT_ID, + }) + + expect(mockPrisma.sprint.findUnique).toHaveBeenCalledWith({ + where: { id: SPRINT_ID }, + select: { product_id: true }, + }) + const data = mockPrisma.story.create.mock.calls[0][0].data + expect(data.status).toBe('IN_SPRINT') + expect(data.sprint_id).toBe(SPRINT_ID) + expect(parseResult(result).sprint_id).toBe(SPRINT_ID) + }) + + it('rejects a non-existent sprint_id', async () => { + mockPrisma.sprint.findUnique.mockResolvedValue(null) + + const result = await handleCreateStory({ + pbi_id: PBI_ID, + title: 'A story', + priority: 2, + sprint_id: 'missing', + }) + + expect(mockPrisma.story.create).not.toHaveBeenCalled() + expect(errorText(result)).toMatch(/Sprint missing not found/) + }) + + it('rejects a sprint from a different product', async () => { + mockPrisma.sprint.findUnique.mockResolvedValue({ product_id: 'other-product' }) + + const result = await handleCreateStory({ + pbi_id: PBI_ID, + title: 'A story', + priority: 2, + sprint_id: SPRINT_ID, + }) + + expect(mockPrisma.story.create).not.toHaveBeenCalled() + expect(errorText(result)).toMatch(/different product/) + }) + + it('returns error when PBI not found', async () => { + mockPrisma.pbi.findUnique.mockResolvedValue(null) + + const result = await handleCreateStory({ pbi_id: 'missing', title: 'A story', priority: 2 }) + + expect(mockPrisma.sprint.findUnique).not.toHaveBeenCalled() + expect(mockPrisma.story.create).not.toHaveBeenCalled() + expect(errorText(result)).toMatch(/PBI missing not found/) + }) +}) diff --git a/src/tools/create-story.ts b/src/tools/create-story.ts index cfa099e..37caa59 100644 --- a/src/tools/create-story.ts +++ b/src/tools/create-story.ts @@ -1,8 +1,9 @@ // MCP authoring tool: create een Story onder een bestaande PBI. // // product_id wordt afgeleid uit de PBI (denormalized FK conform CLAUDE.md -// convention — nooit vertrouwen op client-input). status='OPEN' default; -// landt in de Product Backlog, niet auto in een sprint. +// convention — nooit vertrouwen op client-input). Zonder sprint_id is +// status='OPEN' en landt de story in de Product Backlog; mét sprint_id +// wordt de story direct aan die sprint gekoppeld (status='IN_SPRINT'). import { z } from 'zod' import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js' @@ -46,75 +47,108 @@ const inputSchema = z.object({ acceptance_criteria: z.string().max(4000).optional(), priority: z.number().int().min(1).max(4), sort_order: z.number().optional(), + // Optionele sprint-koppeling: bij creatie de story direct aan een sprint + // hangen (status=IN_SPRINT). De sprint moet bij hetzelfde product horen. + sprint_id: z.string().min(1).optional(), }) +export async function handleCreateStory( + { + pbi_id, + title, + description, + acceptance_criteria, + priority, + sort_order, + sprint_id, + }: z.infer, +) { + return withToolErrors(async () => { + const auth = await requireWriteAccess() + + const pbi = await prisma.pbi.findUnique({ + where: { id: pbi_id }, + select: { product_id: true }, + }) + if (!pbi) return toolError(`PBI ${pbi_id} not found`) + if (!(await userCanAccessProduct(pbi.product_id, auth.userId))) { + return toolError(`PBI ${pbi_id} not accessible`) + } + + // Optionele sprint-koppeling: valideer dat de sprint bestaat én bij + // hetzelfde product hoort — voorkomt een cross-product koppeling. + if (sprint_id !== undefined) { + const sprint = await prisma.sprint.findUnique({ + where: { id: sprint_id }, + select: { product_id: true }, + }) + if (!sprint) return toolError(`Sprint ${sprint_id} not found`) + if (sprint.product_id !== pbi.product_id) { + return toolError( + `Sprint ${sprint_id} belongs to a different product than PBI ${pbi_id}`, + ) + } + } + + let resolvedSortOrder = sort_order + if (resolvedSortOrder === undefined) { + const last = await prisma.story.findFirst({ + where: { pbi_id, priority }, + orderBy: { sort_order: 'desc' }, + select: { sort_order: true }, + }) + resolvedSortOrder = (last?.sort_order ?? 0) + 1.0 + } + + let lastError: unknown + for (let attempt = 0; attempt < MAX_CODE_ATTEMPTS; attempt++) { + const code = await generateNextStoryCode(pbi.product_id) + try { + const story = await prisma.story.create({ + data: { + pbi_id, + product_id: pbi.product_id, // denormalized uit DB-parent, niet uit input + sprint_id: sprint_id ?? null, + code, + title, + description: description ?? null, + acceptance_criteria: acceptance_criteria ?? null, + priority, + sort_order: resolvedSortOrder, + status: sprint_id ? 'IN_SPRINT' : 'OPEN', + }, + select: { + id: true, + code: true, + title: true, + description: true, + acceptance_criteria: true, + priority: true, + sort_order: true, + status: true, + sprint_id: true, + created_at: true, + }, + }) + return toolJson(story) + } catch (e) { + if (isCodeUniqueConflict(e)) { lastError = e; continue } + throw e + } + } + throw lastError ?? new Error('Kon geen unieke Story-code genereren') + }) +} + export function registerCreateStoryTool(server: McpServer) { server.registerTool( 'create_story', { title: 'Create story', description: - 'Add a story under an existing PBI. Status defaults to OPEN (lands in product backlog, not in a sprint). Sort_order auto-set to last+1 within the PBI/priority group if not provided. Forbidden for demo accounts.', + 'Add a story under an existing PBI. Optionally link it to a sprint via sprint_id — when given, the story is created with status=IN_SPRINT and the sprint must belong to the same product as the PBI; otherwise status=OPEN and the story lands in the product backlog. Sort_order auto-set to last+1 within the PBI/priority group if not provided. Forbidden for demo accounts.', inputSchema, }, - async ({ pbi_id, title, description, acceptance_criteria, priority, sort_order }) => - withToolErrors(async () => { - const auth = await requireWriteAccess() - - const pbi = await prisma.pbi.findUnique({ - where: { id: pbi_id }, - select: { product_id: true }, - }) - if (!pbi) return toolError(`PBI ${pbi_id} not found`) - if (!(await userCanAccessProduct(pbi.product_id, auth.userId))) { - return toolError(`PBI ${pbi_id} not accessible`) - } - - let resolvedSortOrder = sort_order - if (resolvedSortOrder === undefined) { - const last = await prisma.story.findFirst({ - where: { pbi_id, priority }, - orderBy: { sort_order: 'desc' }, - select: { sort_order: true }, - }) - resolvedSortOrder = (last?.sort_order ?? 0) + 1.0 - } - - let lastError: unknown - for (let attempt = 0; attempt < MAX_CODE_ATTEMPTS; attempt++) { - const code = await generateNextStoryCode(pbi.product_id) - try { - const story = await prisma.story.create({ - data: { - pbi_id, - product_id: pbi.product_id, // denormalized uit DB-parent, niet uit input - code, - title, - description: description ?? null, - acceptance_criteria: acceptance_criteria ?? null, - priority, - sort_order: resolvedSortOrder, - status: 'OPEN', - }, - select: { - id: true, - code: true, - title: true, - description: true, - acceptance_criteria: true, - priority: true, - sort_order: true, - status: true, - created_at: true, - }, - }) - return toolJson(story) - } catch (e) { - if (isCodeUniqueConflict(e)) { lastError = e; continue } - throw e - } - } - throw lastError ?? new Error('Kon geen unieke Story-code genereren') - }), + handleCreateStory, ) }