refactor: modularize codebase and add 404 unit tests (#13)

compliance-mcp/src/tools/dast.rs

@@ -12,6 +12,66 @@ fn cap_limit(limit: Option<i64>) -> i64 {
     limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cap_limit_default() {
+        assert_eq!(cap_limit(None), DEFAULT_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_high() {
+        assert_eq!(cap_limit(Some(300)), MAX_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_low() {
+        assert_eq!(cap_limit(Some(0)), 1);
+    }
+
+    #[test]
+    fn list_dast_findings_params_deserialize() {
+        let json = serde_json::json!({
+            "target_id": "t1",
+            "scan_run_id": "sr1",
+            "severity": "critical",
+            "exploitable": true,
+            "vuln_type": "sql_injection",
+            "limit": 10
+        });
+        let params: ListDastFindingsParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.target_id.as_deref(), Some("t1"));
+        assert_eq!(params.scan_run_id.as_deref(), Some("sr1"));
+        assert_eq!(params.severity.as_deref(), Some("critical"));
+        assert_eq!(params.exploitable, Some(true));
+        assert_eq!(params.vuln_type.as_deref(), Some("sql_injection"));
+        assert_eq!(params.limit, Some(10));
+    }
+
+    #[test]
+    fn list_dast_findings_params_all_optional() {
+        let params: ListDastFindingsParams = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params.target_id.is_none());
+        assert!(params.scan_run_id.is_none());
+        assert!(params.severity.is_none());
+        assert!(params.exploitable.is_none());
+        assert!(params.vuln_type.is_none());
+        assert!(params.limit.is_none());
+    }
+
+    #[test]
+    fn dast_scan_summary_params_deserialize() {
+        let params: DastScanSummaryParams =
+            serde_json::from_value(serde_json::json!({ "target_id": "abc" })).unwrap();
+        assert_eq!(params.target_id.as_deref(), Some("abc"));
+
+        let params2: DastScanSummaryParams = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params2.target_id.is_none());
+    }
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct ListDastFindingsParams {
     /// Filter by DAST target ID

compliance-mcp/src/tools/findings.rs

@@ -12,6 +12,89 @@ fn cap_limit(limit: Option<i64>) -> i64 {
     limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cap_limit_default() {
+        assert_eq!(cap_limit(None), DEFAULT_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_normal_value() {
+        assert_eq!(cap_limit(Some(100)), 100);
+    }
+
+    #[test]
+    fn cap_limit_exceeds_max() {
+        assert_eq!(cap_limit(Some(500)), MAX_LIMIT);
+        assert_eq!(cap_limit(Some(201)), MAX_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_zero_clamped_to_one() {
+        assert_eq!(cap_limit(Some(0)), 1);
+    }
+
+    #[test]
+    fn cap_limit_negative_clamped_to_one() {
+        assert_eq!(cap_limit(Some(-10)), 1);
+    }
+
+    #[test]
+    fn cap_limit_boundary_values() {
+        assert_eq!(cap_limit(Some(1)), 1);
+        assert_eq!(cap_limit(Some(MAX_LIMIT)), MAX_LIMIT);
+    }
+
+    #[test]
+    fn list_findings_params_deserialize() {
+        let json = serde_json::json!({
+            "repo_id": "abc",
+            "severity": "high",
+            "status": "open",
+            "scan_type": "sast",
+            "limit": 25
+        });
+        let params: ListFindingsParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.repo_id.as_deref(), Some("abc"));
+        assert_eq!(params.severity.as_deref(), Some("high"));
+        assert_eq!(params.status.as_deref(), Some("open"));
+        assert_eq!(params.scan_type.as_deref(), Some("sast"));
+        assert_eq!(params.limit, Some(25));
+    }
+
+    #[test]
+    fn list_findings_params_all_optional() {
+        let json = serde_json::json!({});
+        let params: ListFindingsParams = serde_json::from_value(json).unwrap();
+        assert!(params.repo_id.is_none());
+        assert!(params.severity.is_none());
+        assert!(params.status.is_none());
+        assert!(params.scan_type.is_none());
+        assert!(params.limit.is_none());
+    }
+
+    #[test]
+    fn get_finding_params_deserialize() {
+        let json = serde_json::json!({ "id": "507f1f77bcf86cd799439011" });
+        let params: GetFindingParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.id, "507f1f77bcf86cd799439011");
+    }
+
+    #[test]
+    fn findings_summary_params_deserialize() {
+        let json = serde_json::json!({ "repo_id": "r1" });
+        let params: FindingsSummaryParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.repo_id.as_deref(), Some("r1"));
+
+        let json2 = serde_json::json!({});
+        let params2: FindingsSummaryParams = serde_json::from_value(json2).unwrap();
+        assert!(params2.repo_id.is_none());
+    }
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct ListFindingsParams {
     /// Filter by repository ID

compliance-mcp/src/tools/pentest.rs

@@ -12,6 +12,90 @@ fn cap_limit(limit: Option<i64>) -> i64 {
     limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cap_limit_default() {
+        assert_eq!(cap_limit(None), DEFAULT_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_high() {
+        assert_eq!(cap_limit(Some(1000)), MAX_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_low() {
+        assert_eq!(cap_limit(Some(-100)), 1);
+        assert_eq!(cap_limit(Some(0)), 1);
+    }
+
+    #[test]
+    fn cap_limit_normal() {
+        assert_eq!(cap_limit(Some(42)), 42);
+    }
+
+    #[test]
+    fn list_pentest_sessions_params_deserialize() {
+        let json = serde_json::json!({
+            "target_id": "tgt",
+            "status": "running",
+            "strategy": "aggressive",
+            "limit": 5
+        });
+        let params: ListPentestSessionsParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.target_id.as_deref(), Some("tgt"));
+        assert_eq!(params.status.as_deref(), Some("running"));
+        assert_eq!(params.strategy.as_deref(), Some("aggressive"));
+        assert_eq!(params.limit, Some(5));
+    }
+
+    #[test]
+    fn list_pentest_sessions_params_all_optional() {
+        let params: ListPentestSessionsParams =
+            serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params.target_id.is_none());
+        assert!(params.status.is_none());
+        assert!(params.strategy.is_none());
+        assert!(params.limit.is_none());
+    }
+
+    #[test]
+    fn get_pentest_session_params_deserialize() {
+        let params: GetPentestSessionParams =
+            serde_json::from_value(serde_json::json!({ "id": "abc123" })).unwrap();
+        assert_eq!(params.id, "abc123");
+    }
+
+    #[test]
+    fn get_attack_chain_params_deserialize() {
+        let params: GetAttackChainParams =
+            serde_json::from_value(serde_json::json!({ "session_id": "s1", "limit": 20 })).unwrap();
+        assert_eq!(params.session_id, "s1");
+        assert_eq!(params.limit, Some(20));
+    }
+
+    #[test]
+    fn get_pentest_messages_params_deserialize() {
+        let params: GetPentestMessagesParams =
+            serde_json::from_value(serde_json::json!({ "session_id": "s2" })).unwrap();
+        assert_eq!(params.session_id, "s2");
+        assert!(params.limit.is_none());
+    }
+
+    #[test]
+    fn pentest_stats_params_deserialize() {
+        let params: PentestStatsParams =
+            serde_json::from_value(serde_json::json!({ "target_id": "t1" })).unwrap();
+        assert_eq!(params.target_id.as_deref(), Some("t1"));
+
+        let params2: PentestStatsParams = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params2.target_id.is_none());
+    }
+}
+
 // ── List Pentest Sessions ──────────────────────────────────────
 
 #[derive(Debug, Deserialize, JsonSchema)]

compliance-mcp/src/tools/sbom.rs

@@ -12,6 +12,66 @@ fn cap_limit(limit: Option<i64>) -> i64 {
     limit.unwrap_or(DEFAULT_LIMIT).clamp(1, MAX_LIMIT)
 }
 
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cap_limit_default() {
+        assert_eq!(cap_limit(None), DEFAULT_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_high() {
+        assert_eq!(cap_limit(Some(999)), MAX_LIMIT);
+    }
+
+    #[test]
+    fn cap_limit_clamps_low() {
+        assert_eq!(cap_limit(Some(0)), 1);
+        assert_eq!(cap_limit(Some(-5)), 1);
+    }
+
+    #[test]
+    fn cap_limit_normal() {
+        assert_eq!(cap_limit(Some(75)), 75);
+    }
+
+    #[test]
+    fn list_sbom_params_deserialize() {
+        let json = serde_json::json!({
+            "repo_id": "repo1",
+            "has_vulns": true,
+            "package_manager": "npm",
+            "license": "MIT",
+            "limit": 30
+        });
+        let params: ListSbomPackagesParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.repo_id.as_deref(), Some("repo1"));
+        assert_eq!(params.has_vulns, Some(true));
+        assert_eq!(params.package_manager.as_deref(), Some("npm"));
+        assert_eq!(params.license.as_deref(), Some("MIT"));
+        assert_eq!(params.limit, Some(30));
+    }
+
+    #[test]
+    fn list_sbom_params_all_optional() {
+        let params: ListSbomPackagesParams = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(params.repo_id.is_none());
+        assert!(params.has_vulns.is_none());
+        assert!(params.package_manager.is_none());
+        assert!(params.license.is_none());
+        assert!(params.limit.is_none());
+    }
+
+    #[test]
+    fn sbom_vuln_report_params_deserialize() {
+        let json = serde_json::json!({ "repo_id": "my-repo" });
+        let params: SbomVulnReportParams = serde_json::from_value(json).unwrap();
+        assert_eq!(params.repo_id, "my-repo");
+    }
+}
+
 #[derive(Debug, Deserialize, JsonSchema)]
 pub struct ListSbomPackagesParams {
     /// Filter by repository ID