feat(esmole): readonly request guard

packages/esmole-mcp/test/unit/es/guard.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, it } from 'vitest'
+import { assertReadAllowed, EsGuardError } from '../../../src/es/guard.js'
+
+describe('assertReadAllowed', () => {
+    it('allows GET and HEAD anywhere', () => {
+        expect(() => assertReadAllowed('GET', '/idx/_doc/1')).not.toThrow()
+        expect(() => assertReadAllowed('HEAD', '/idx')).not.toThrow()
+    })
+    it('allows POST to read endpoints', () => {
+        for (const p of [
+            '/idx/_search',
+            '/_msearch',
+            '/idx/_count',
+            '/_field_caps',
+            '/_cat/indices',
+            '/idx/_mapping',
+            '/_search/scroll',
+            '/idx/_pit'
+        ]) {
+            expect(() => assertReadAllowed('POST', p), p).not.toThrow()
+        }
+    })
+    it('blocks POST to write endpoints', () => {
+        for (const p of [
+            '/idx/_doc',
+            '/idx/_bulk',
+            '/idx/_update/1',
+            '/idx/_delete_by_query',
+            '/_sql'
+        ]) {
+            expect(() => assertReadAllowed('POST', p), p).toThrow(EsGuardError)
+        }
+    })
+    it('blocks PUT and generic DELETE', () => {
+        expect(() => assertReadAllowed('PUT', '/idx')).toThrow(EsGuardError)
+        expect(() => assertReadAllowed('DELETE', '/idx/_doc/1')).toThrow(EsGuardError)
+    })
+    it('allows DELETE only for pit and scroll cleanup', () => {
+        expect(() => assertReadAllowed('DELETE', '/_pit')).not.toThrow()
+        expect(() => assertReadAllowed('DELETE', '/_search/scroll')).not.toThrow()
+    })
+    it('ignores query strings when matching', () => {
+        expect(() => assertReadAllowed('POST', '/idx/_search?scroll=1m')).not.toThrow()
+    })
+    it('ignores a trailing slash', () => {
+        expect(() => assertReadAllowed('POST', '/idx/_search/')).not.toThrow()
+    })
+    it('rejects an unknown method', () => {
+        expect(() => assertReadAllowed('PATCH', '/idx/_search')).toThrow(EsGuardError)
+    })
+})