Merge pull request #22 from evolution-foundation/feat/EVO-1738-custom-tools-test-payload-endpoint

feat(EVO-1738): stateless POST /custom-tools/test (test-before-save)

Author: gomessguii

pkg/custom_tool/handler/custom_tool_handler.go

@@ -25,6 +25,7 @@ type CustomToolHandler interface {
 	Update(c *gin.Context)
 	Delete(c *gin.Context)
 	Test(c *gin.Context)
+	TestPayload(c *gin.Context)
 }
 
 // customToolHandler implements the CustomToolHandler interface.
@@ -75,6 +76,14 @@ func (h *customToolHandler) RegisterRoutesMiddleware(router gin.IRouter) {
 			permissionMiddleware.RequirePermission("ai_custom_tools", "delete"),
 			h.Delete)
 
+		// EVO-1738: stateless test-before-save (validates the payload typed in the wizard).
+		// Gated on "create", NOT "read": unlike GET /:id/test — which only replays a tool
+		// someone with create rights already authored — this takes method/endpoint/headers
+		// straight from the request body, so a read-only user would otherwise gain an
+		// arbitrary server-side HTTP fetcher (our egress, our IP, our network position).
+		customTools.POST("/test",
+			permissionMiddleware.RequirePermission("ai_custom_tools", "create"),
+			h.TestPayload)
 		// Test permissions
 		customTools.GET("/:id/test",
 			permissionMiddleware.RequirePermission("ai_custom_tools", "read"),
@@ -323,3 +332,21 @@ func (h *customToolHandler) Test(c *gin.Context) {
 
 	response.SuccessResponse(c, customTool, "Custom tool test completed successfully", http.StatusOK)
 }
+
+// TestPayload tests an UNSAVED tool payload (test-before-save). EVO-1738.
+func (h *customToolHandler) TestPayload(c *gin.Context) {
+	var req model.CustomToolTestPayloadRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.ValidationErrorResponse(c, err)
+		return
+	}
+
+	testResult, err := h.customToolService.TestPayload(c.Request.Context(), req)
+	if err != nil {
+		code, message, httpCode := errors.HandleError(err)
+		response.ErrorResponse(c, code, message, nil, httpCode)
+		return
+	}
+
+	response.SuccessResponse(c, gin.H{"test_result": testResult}, "Custom tool test completed successfully", http.StatusOK)
+}

pkg/custom_tool/handler/custom_tool_test_payload_handler_test.go

@@ -0,0 +1,116 @@
+package handler
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	apiErrors "evo-ai-core-service/internal/httpclient/errors"
+	"evo-ai-core-service/pkg/custom_tool/model"
+	"evo-ai-core-service/pkg/custom_tool/service"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+// stubService implements service.CustomToolService; only TestPayload is exercised.
+type stubService struct {
+	service.CustomToolService
+	gotReq model.CustomToolTestPayloadRequest
+	result *model.TestResult
+	err    error
+}
+
+func (s *stubService) TestPayload(_ context.Context, req model.CustomToolTestPayloadRequest) (*model.TestResult, error) {
+	s.gotReq = req
+	return s.result, s.err
+}
+
+func postTestPayload(t *testing.T, svc service.CustomToolService, body string) *httptest.ResponseRecorder {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	rec := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(rec)
+	c.Request = httptest.NewRequest(http.MethodPost, "/custom-tools/test", bytes.NewBufferString(body))
+	c.Request.Header.Set("Content-Type", "application/json")
+
+	NewCustomToolHandler(svc).TestPayload(c)
+	return rec
+}
+
+// R1 review (EVO-1738): the handler package had no tests at all, so the new
+// test-before-save endpoint's binding and response envelope were unverified.
+func TestTestPayloadHandler_ForwardsFullRequestAndWrapsResult(t *testing.T) {
+	svc := &stubService{result: &model.TestResult{Success: true, StatusCode: 200, Body: `{"ok":true}`}}
+
+	rec := postTestPayload(t, svc, `{
+		"method": "GET",
+		"endpoint": "https://api.example.com/users/{user_id}",
+		"headers": {"X-Token": "abc"},
+		"path_params": {"user_id": "42"},
+		"query_params": {"limit": 10},
+		"body_params": {"ignored": true}
+	}`)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("want 200, got %d: %s", rec.Code, rec.Body.String())
+	}
+
+	// path_params/query_params must survive the bind — dropping them is what made
+	// the wizard report "Request OK" for a request missing the user's config.
+	if svc.gotReq.PathParams["user_id"] != "42" {
+		t.Fatalf("path_params not bound: %#v", svc.gotReq.PathParams)
+	}
+	if svc.gotReq.QueryParams["limit"] != float64(10) {
+		t.Fatalf("query_params not bound: %#v", svc.gotReq.QueryParams)
+	}
+	if svc.gotReq.Headers["X-Token"] != "abc" {
+		t.Fatalf("headers not bound: %#v", svc.gotReq.Headers)
+	}
+
+	var envelope struct {
+		Success bool `json:"success"`
+		Data    struct {
+			TestResult model.TestResult `json:"test_result"`
+		} `json:"data"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &envelope); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	if !envelope.Success || !envelope.Data.TestResult.Success || envelope.Data.TestResult.StatusCode != 200 {
+		t.Fatalf("unexpected envelope: %s", rec.Body.String())
+	}
+}
+
+func TestTestPayloadHandler_RejectsMissingRequiredFields(t *testing.T) {
+	rec := postTestPayload(t, &stubService{}, `{"endpoint": "https://api.example.com"}`)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("want 400 when method is missing, got %d: %s", rec.Code, rec.Body.String())
+	}
+}
+
+// An unsupported method is caller input: it must surface as 400 with the real
+// reason, not a generic 500 the UI cannot explain.
+func TestTestPayloadHandler_MapsServiceApiErrorStatus(t *testing.T) {
+	svc := &stubService{err: apiErrors.New(apiErrors.InvalidInput, "unsupported method: TRACE", http.StatusBadRequest)}
+
+	rec := postTestPayload(t, svc, `{"method": "TRACE", "endpoint": "https://api.example.com"}`)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("want 400, got %d: %s", rec.Code, rec.Body.String())
+	}
+
+	var envelope struct {
+		Error struct {
+			Code    string `json:"code"`
+			Message string `json:"message"`
+		} `json:"error"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &envelope); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	// The frontend reads error.message — assert the reason actually lands there.
+	if envelope.Error.Message != "unsupported method: TRACE" {
+		t.Fatalf("reason not surfaced in error.message: %s", rec.Body.String())
+	}
+}

pkg/custom_tool/model/custom_tool.go

@@ -111,6 +111,18 @@ type CustomToolTestResponse struct {
 	TestResult *TestResult         `json:"test_result"`
 }
 
+// CustomToolTestPayloadRequest is an UNSAVED tool config to run once (EVO-1738,
+// test-before-save). Mirrors the request-shaping fields of CustomToolBase so the
+// wizard's test hits exactly the URL the saved tool would.
+type CustomToolTestPayloadRequest struct {
+	Method      string                 `json:"method" binding:"required"`
+	Endpoint    string                 `json:"endpoint" binding:"required"`
+	Headers     map[string]string      `json:"headers"`
+	PathParams  map[string]string      `json:"path_params"`
+	QueryParams map[string]interface{} `json:"query_params"`
+	BodyParams  map[string]interface{} `json:"body_params"`
+}
+
 type CustomToolListResponse struct {
 	Items      []CustomToolResponse `json:"-"`
 	Page       int                  `json:"-"`

pkg/custom_tool/service/custom_tool_service.go

@@ -4,11 +4,12 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
+	apiErrors "evo-ai-core-service/internal/httpclient/errors"
 	errorsPostgres "evo-ai-core-service/internal/infra/postgres"
 	"evo-ai-core-service/internal/utils/stringutils"
 	model "evo-ai-core-service/pkg/custom_tool/model"
 	repository "evo-ai-core-service/pkg/custom_tool/repository"
-	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -165,9 +166,59 @@ var testHTTPClient = &http.Client{
 	},
 }
 
+// toQueryValue renders a query-param value as a string. Scalars go verbatim;
+// objects/arrays are JSON-encoded so we never emit Go's map[k:v] syntax.
+func toQueryValue(v interface{}) string {
+	switch t := v.(type) {
+	case nil:
+		return ""
+	case string:
+		return t
+	case map[string]interface{}, []interface{}:
+		if buf, err := json.Marshal(t); err == nil {
+			return string(buf)
+		}
+		return fmt.Sprintf("%v", t)
+	default:
+		return fmt.Sprintf("%v", t)
+	}
+}
+
+// resolveToolURL applies the tool's path placeholders and query params to the raw
+// endpoint, yielding the URL the tool actually calls. Without this the test ran a
+// bare endpoint — `/users/{user_id}` was requested literally and query params were
+// dropped, so the result did not reflect the configured tool.
+//
+// Safe by construction: the result is fed to runToolTest, which runs
+// validateEndpoint on the FINAL url — so a placeholder that expands into an
+// internal host is still caught by the SSRF gate.
+func resolveToolURL(endpoint string, pathParams map[string]string, queryParams map[string]interface{}) string {
+	resolved := endpoint
+	for k, v := range pathParams {
+		resolved = strings.ReplaceAll(resolved, "{"+k+"}", url.PathEscape(v))
+	}
+
+	if len(queryParams) == 0 {
+		return resolved
+	}
+
+	u, err := url.Parse(strings.TrimSpace(resolved))
+	if err != nil {
+		// Let validateEndpoint produce the user-facing parse error.
+		return resolved
+	}
+	q := u.Query()
+	for k, v := range queryParams {
+		q.Set(k, toQueryValue(v))
+	}
+	u.RawQuery = q.Encode()
+	return u.String()
+}
+
 // runToolTest issues the HTTP request described by the tool and returns a
 // TestResult reflecting what actually happened: real status code, response
 // time, headers, body. Success = HTTP 2xx (not body parseability).
+// `endpoint` must already be resolved (see resolveToolURL).
 func runToolTest(
 	ctx context.Context,
 	method, endpoint string,
@@ -279,6 +330,9 @@ type CustomToolService interface {
 	Delete(ctx context.Context, id uuid.UUID) (bool, error)
 	ConvertToHTTPTool(tool model.CustomToolResponse) map[string]interface{}
 	Test(ctx context.Context, id uuid.UUID) (*model.CustomToolTestResponse, error)
+	// EVO-1738: stateless test of an UNSAVED tool payload (test-before-save in the
+	// wizard). Same SSRF-hardened runToolTest as Test, without requiring a saved tool.
+	TestPayload(ctx context.Context, req model.CustomToolTestPayloadRequest) (*model.TestResult, error)
 }
 
 type customToolService struct {
@@ -420,21 +474,52 @@ func (s *customToolService) Test(ctx context.Context, id uuid.UUID) (*model.Cust
 	}
 
 	response := customTool.ToResponse()
-	method := strings.ToUpper(customTool.Method)
 
-	switch method {
-	case http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch, http.MethodHead, http.MethodOptions:
-		// supported
-	default:
-		return nil, fmt.Errorf("unsupported method: %s", customTool.Method)
+	method, err := normalizeToolMethod(customTool.Method)
+	if err != nil {
+		return nil, err
 	}
 
 	headers := stringutils.JSONToStringMap(customTool.Headers)
 	bodyParams := stringutils.JSONToInterfaceMap(customTool.BodyParams)
-	testResult := runToolTest(ctx, method, customTool.Endpoint, headers, bodyParams)
+	endpoint := resolveToolURL(
+		customTool.Endpoint,
+		stringutils.JSONToStringMap(customTool.PathParams),
+		stringutils.JSONToInterfaceMap(customTool.QueryParams),
+	)
+	testResult := runToolTest(ctx, method, endpoint, headers, bodyParams)
 
 	return &model.CustomToolTestResponse{
 		Tool:       response,
 		TestResult: testResult,
 	}, nil
 }
+
+// normalizeToolMethod upper-cases the method and enforces the allowlist, shared by
+// the saved-tool test and the stateless payload test so the two cannot drift.
+// Returns a BadRequest ApiError — an unsupported method is caller input, not a 500.
+func normalizeToolMethod(method string) (string, error) {
+	upper := strings.ToUpper(strings.TrimSpace(method))
+	switch upper {
+	case http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch, http.MethodHead, http.MethodOptions:
+		return upper, nil
+	default:
+		return "", apiErrors.New(
+			apiErrors.InvalidInput,
+			fmt.Sprintf("unsupported method: %s", method),
+			http.StatusBadRequest,
+		)
+	}
+}
+
+// TestPayload runs the SSRF-hardened tool request against an UNSAVED payload —
+// powers the wizard's "test before save" (EVO-1738).
+func (s *customToolService) TestPayload(ctx context.Context, req model.CustomToolTestPayloadRequest) (*model.TestResult, error) {
+	method, err := normalizeToolMethod(req.Method)
+	if err != nil {
+		return nil, err
+	}
+
+	endpoint := resolveToolURL(req.Endpoint, req.PathParams, req.QueryParams)
+	return runToolTest(ctx, method, endpoint, req.Headers, req.BodyParams), nil
+}