feat(ai): add integration tests for MCP controller and improve JSON-R… (#14047)

…PC validation

- Introduced full integration test suite for MCP controller, testing
`POST /mcp` with valid and invalid payloads.
- Added `@IsDefined` validation to ensure the `method` field is required
in JSON-RPC requests.
- Applied `RestApiExceptionFilter` to MCP controller for consistent
error handling.
- Enhanced validation pipe in MCP controller to whitelist and reject
non-whitelisted properties.
- Consolidated exception filters in SSOAuthController.

packages/twenty-server/src/engine/core-modules/ai/controllers/mcp.controller.spec.ts

@@ -6,6 +6,7 @@ import { type Workspace } from 'src/engine/core-modules/workspace/workspace.enti
 import { MCP_SERVER_METADATA } from 'src/engine/core-modules/ai/constants/mcp.const';
 import { AccessTokenService } from 'src/engine/core-modules/auth/token/services/access-token.service';
 import { WorkspaceCacheStorageService } from 'src/engine/workspace-cache-storage/workspace-cache-storage.service';
+import { HttpExceptionHandlerService } from 'src/engine/core-modules/exception-handler/http-exception-handler.service';
 
 import { McpController } from './mcp.controller';
 
@@ -33,6 +34,12 @@ describe('McpController', () => {
           provide: WorkspaceCacheStorageService,
           useValue: jest.fn(),
         },
+        {
+          provide: HttpExceptionHandlerService,
+          useValue: {
+            handleError: jest.fn(),
+          },
+        },
       ],
     }).compile();
 

packages/twenty-server/src/engine/core-modules/ai/controllers/mcp.controller.ts

@@ -2,6 +2,7 @@ import {
   Body,
   Controller,
   Post,
+  UseFilters,
   UseGuards,
   UsePipes,
   ValidationPipe,
@@ -15,21 +16,29 @@ import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-worksp
 import { JsonRpc } from 'src/engine/core-modules/ai/dtos/json-rpc';
 import { McpService } from 'src/engine/core-modules/ai/services/mcp.service';
 import { JwtAuthGuard } from 'src/engine/guards/jwt-auth.guard';
+import { RestApiExceptionFilter } from 'src/engine/api/rest/rest-api-exception.filter';
 
 @Controller('mcp')
 @UseGuards(JwtAuthGuard, WorkspaceAuthGuard)
+@UseFilters(RestApiExceptionFilter)
 export class McpController {
   constructor(private readonly mcpService: McpService) {}
 
   @Post()
-  @UsePipes(new ValidationPipe({ transform: true }))
+  @UsePipes(
+    new ValidationPipe({
+      transform: true,
+      whitelist: true,
+      forbidNonWhitelisted: true,
+    }),
+  )
   async handleMcpCore(
     @Body() body: JsonRpc,
     @AuthWorkspace() workspace: Workspace,
     @AuthApiKey() apiKey: string | undefined,
     @AuthUserWorkspaceId() userWorkspaceId: string | undefined,
   ) {
-    return this.mcpService.handleMCPCoreQuery(body, {
+    return await this.mcpService.handleMCPCoreQuery(body, {
       workspace,
       userWorkspaceId,
       apiKey,

packages/twenty-server/src/engine/core-modules/ai/dtos/json-rpc.ts

@@ -1,4 +1,5 @@
 import {
+  IsDefined,
   IsNotEmpty,
   IsObject,
   IsOptional,
@@ -14,6 +15,7 @@ export class JsonRpc {
   @Matches(/^2\.0$/, { message: 'jsonrpc must be exactly "2.0"' })
   jsonrpc = '2.0';
 
+  @IsDefined({ message: 'method is required' })
   @IsString()
   @IsNotEmpty()
   method: string;

packages/twenty-server/src/engine/core-modules/auth/controllers/sso-auth.controller.ts

@@ -19,7 +19,6 @@ import {
   AuthException,
   AuthExceptionCode,
 } from 'src/engine/core-modules/auth/auth.exception';
-import { AuthOAuthExceptionFilter } from 'src/engine/core-modules/auth/filters/auth-oauth-exception.filter';
 import { AuthRestApiExceptionFilter } from 'src/engine/core-modules/auth/filters/auth-rest-api-exception.filter';
 import { EnterpriseFeaturesEnabledGuard } from 'src/engine/core-modules/auth/guards/enterprise-features-enabled.guard';
 import { OIDCAuthGuard } from 'src/engine/core-modules/auth/guards/oidc-auth.guard';
@@ -42,6 +41,7 @@ import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.
 import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
 
 @Controller('auth')
+@UseFilters(AuthRestApiExceptionFilter)
 export class SSOAuthController {
   constructor(
     private readonly loginTokenService: LoginTokenService,
@@ -58,7 +58,6 @@ export class SSOAuthController {
 
   @Get('saml/metadata/:identityProviderId')
   @UseGuards(EnterpriseFeaturesEnabledGuard, PublicEndpointGuard)
-  @UseFilters(AuthRestApiExceptionFilter)
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   async generateMetadata(@Req() req: any): Promise<string | void> {
     return generateServiceProviderMetadata({
@@ -76,7 +75,6 @@ export class SSOAuthController {
 
   @Get('oidc/login/:identityProviderId')
   @UseGuards(EnterpriseFeaturesEnabledGuard, OIDCAuthGuard, PublicEndpointGuard)
-  @UseFilters(AuthRestApiExceptionFilter)
   async oidcAuth() {
     // As this method is protected by OIDC Auth guard, it will trigger OIDC SSO flow
     return;
@@ -84,7 +82,6 @@ export class SSOAuthController {
 
   @Get('saml/login/:identityProviderId')
   @UseGuards(EnterpriseFeaturesEnabledGuard, SAMLAuthGuard, PublicEndpointGuard)
-  @UseFilters(AuthRestApiExceptionFilter)
   async samlAuth() {
     // As this method is protected by SAML Auth guard, it will trigger SAML SSO flow
     return;
@@ -92,14 +89,12 @@ export class SSOAuthController {
 
   @Get('oidc/callback')
   @UseGuards(EnterpriseFeaturesEnabledGuard, OIDCAuthGuard, PublicEndpointGuard)
-  @UseFilters(AuthOAuthExceptionFilter)
   async oidcAuthCallback(@Req() req: OIDCRequest, @Res() res: Response) {
     return await this.authCallback(req, res);
   }
 
   @Post('saml/callback/:identityProviderId')
   @UseGuards(EnterpriseFeaturesEnabledGuard, SAMLAuthGuard, PublicEndpointGuard)
-  @UseFilters(AuthOAuthExceptionFilter)
   async samlAuthCallback(@Req() req: SAMLRequest, @Res() res: Response) {
     try {
       return await this.authCallback(req, res);