feat: Add comprehensive Jest test suite (209 tests)

- Add Jest configuration for TypeScript testing - Add security utilities tests (44 tests) - Add Zod validation tests (34 tests) - Add cursor pagination tests (25 tests) - Add query builder tests (38 tests) - Add tools structure validation (68 tests) - All 164 tools validated for correct structure - Version bump to 1.3.4 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 17:33:19 +00:00
parent 56f37892c0
commit 15c6c5a24f
10 changed files with 1935 additions and 9 deletions
--- a/src/tools/tests/tools-structure.test.ts
+++ b/src/tools/tests/tools-structure.test.ts
@@ -0,0 +1,610 @@
+/**
+ * Tools Structure Tests
+ * Validates that all tools have correct structure without DB connection
+ * @author Descomplicar® | @link descomplicar.pt | @copyright 2026
+ */
+
+import { documentsTools } from '../documents';
+import { collectionsTools } from '../collections';
+import { usersTools } from '../users';
+import { groupsTools } from '../groups';
+import { commentsTools } from '../comments';
+import { sharesTools } from '../shares';
+import { revisionsTools } from '../revisions';
+import { eventsTools } from '../events';
+import { attachmentsTools } from '../attachments';
+import { fileOperationsTools } from '../file-operations';
+import { oauthTools } from '../oauth';
+import { authTools } from '../auth';
+import { starsTools } from '../stars';
+import { pinsTools } from '../pins';
+import { viewsTools } from '../views';
+import { reactionsTools } from '../reactions';
+import { apiKeysTools } from '../api-keys';
+import { webhooksTools } from '../webhooks';
+import { backlinksTools } from '../backlinks';
+import { searchQueriesTools } from '../search-queries';
+import { teamsTools } from '../teams';
+import { integrationsTools } from '../integrations';
+import { notificationsTools } from '../notifications';
+import { subscriptionsTools } from '../subscriptions';
+import { templatesTools } from '../templates';
+import { importsTools } from '../imports-tools';
+import { emojisTools } from '../emojis';
+import { userPermissionsTools } from '../user-permissions';
+import { bulkOperationsTools } from '../bulk-operations';
+import { advancedSearchTools } from '../advanced-search';
+import { analyticsTools } from '../analytics';
+import { exportImportTools } from '../export-import';
+import { deskSyncTools } from '../desk-sync';
+import { BaseTool } from '../../types/tools';
+
+// Helper to validate tool structure
+function validateTool(tool: BaseTool): void {
+  // Name should be snake_case (tools use names like list_documents, not outline_list_documents)
+  expect(tool.name).toMatch(/^[a-z][a-z0-9_]*$/);
+
+  // Description should exist and be non-empty
+  expect(tool.description).toBeDefined();
+  expect(tool.description.length).toBeGreaterThan(10);
+
+  // Input schema should have correct structure
+  expect(tool.inputSchema).toBeDefined();
+  expect(tool.inputSchema.type).toBe('object');
+  expect(tool.inputSchema.properties).toBeDefined();
+  expect(typeof tool.inputSchema.properties).toBe('object');
+
+  // Handler should be a function
+  expect(typeof tool.handler).toBe('function');
+}
+
+// Helper to validate required properties in schema
+function validateRequiredProps(tool: BaseTool): void {
+  if (tool.inputSchema.required) {
+    expect(Array.isArray(tool.inputSchema.required)).toBe(true);
+    // All required fields should exist in properties
+    for (const req of tool.inputSchema.required) {
+      expect(tool.inputSchema.properties).toHaveProperty(req);
+    }
+  }
+}
+
+describe('Tools Structure Validation', () => {
+  describe('Documents Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(documentsTools.length).toBeGreaterThanOrEqual(15);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of documentsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+
+    it('should include core document operations', () => {
+      const names = documentsTools.map(t => t.name);
+      expect(names).toContain('list_documents');
+      expect(names).toContain('get_document');
+      expect(names).toContain('create_document');
+      expect(names).toContain('update_document');
+      expect(names).toContain('delete_document');
+      expect(names).toContain('search_documents');
+    });
+  });
+
+  describe('Collections Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(collectionsTools.length).toBeGreaterThanOrEqual(10);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of collectionsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+
+    it('should include core collection operations', () => {
+      const names = collectionsTools.map(t => t.name);
+      expect(names).toContain('list_collections');
+      expect(names).toContain('get_collection');
+      expect(names).toContain('create_collection');
+      expect(names).toContain('update_collection');
+      expect(names).toContain('delete_collection');
+    });
+  });
+
+  describe('Users Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(usersTools.length).toBeGreaterThanOrEqual(5);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of usersTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+
+    it('should include core user operations', () => {
+      const names = usersTools.map(t => t.name);
+      expect(names).toContain('outline_list_users');
+      expect(names).toContain('outline_get_user');
+    });
+  });
+
+  describe('Groups Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(groupsTools.length).toBeGreaterThanOrEqual(5);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of groupsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Comments Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(commentsTools.length).toBeGreaterThanOrEqual(4);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of commentsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Shares Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(sharesTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of sharesTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Revisions Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(revisionsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of revisionsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Events Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(eventsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of eventsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Attachments Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(attachmentsTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of attachmentsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('File Operations Tools', () => {
+    it('should export tools', () => {
+      expect(fileOperationsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of fileOperationsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('OAuth Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(oauthTools.length).toBeGreaterThanOrEqual(4);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of oauthTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Auth Tools', () => {
+    it('should export tools', () => {
+      expect(authTools.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of authTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Stars Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(starsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of starsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Pins Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(pinsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of pinsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Views Tools', () => {
+    it('should export tools', () => {
+      expect(viewsTools.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of viewsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Reactions Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(reactionsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of reactionsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('API Keys Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(apiKeysTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of apiKeysTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Webhooks Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(webhooksTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of webhooksTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Backlinks Tools', () => {
+    it('should export tools', () => {
+      expect(backlinksTools.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of backlinksTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Search Queries Tools', () => {
+    it('should export tools', () => {
+      expect(searchQueriesTools.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of searchQueriesTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Teams Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(teamsTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of teamsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Integrations Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(integrationsTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of integrationsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Notifications Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(notificationsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of notificationsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Subscriptions Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(subscriptionsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of subscriptionsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Templates Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(templatesTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of templatesTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Imports Tools', () => {
+    it('should export tools', () => {
+      expect(importsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of importsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Emojis Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(emojisTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of emojisTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('User Permissions Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(userPermissionsTools.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of userPermissionsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Bulk Operations Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(bulkOperationsTools.length).toBeGreaterThanOrEqual(4);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of bulkOperationsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Advanced Search Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(advancedSearchTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of advancedSearchTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Analytics Tools', () => {
+    it('should export correct number of tools', () => {
+      expect(analyticsTools.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of analyticsTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Export/Import Tools', () => {
+    it('should export tools', () => {
+      expect(exportImportTools.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of exportImportTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Desk Sync Tools', () => {
+    it('should export tools', () => {
+      expect(deskSyncTools.length).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should have valid structure for all tools', () => {
+      for (const tool of deskSyncTools) {
+        validateTool(tool);
+        validateRequiredProps(tool);
+      }
+    });
+  });
+
+  describe('Total Tools Count', () => {
+    it('should have at least 164 tools total', () => {
+      const allTools = [
+        ...documentsTools,
+        ...collectionsTools,
+        ...usersTools,
+        ...groupsTools,
+        ...commentsTools,
+        ...sharesTools,
+        ...revisionsTools,
+        ...eventsTools,
+        ...attachmentsTools,
+        ...fileOperationsTools,
+        ...oauthTools,
+        ...authTools,
+        ...starsTools,
+        ...pinsTools,
+        ...viewsTools,
+        ...reactionsTools,
+        ...apiKeysTools,
+        ...webhooksTools,
+        ...backlinksTools,
+        ...searchQueriesTools,
+        ...teamsTools,
+        ...integrationsTools,
+        ...notificationsTools,
+        ...subscriptionsTools,
+        ...templatesTools,
+        ...importsTools,
+        ...emojisTools,
+        ...userPermissionsTools,
+        ...bulkOperationsTools,
+        ...advancedSearchTools,
+        ...analyticsTools,
+        ...exportImportTools,
+        ...deskSyncTools
+      ];
+
+      expect(allTools.length).toBeGreaterThanOrEqual(164);
+    });
+
+    it('should have unique tool names', () => {
+      const allTools = [
+        ...documentsTools,
+        ...collectionsTools,
+        ...usersTools,
+        ...groupsTools,
+        ...commentsTools,
+        ...sharesTools,
+        ...revisionsTools,
+        ...eventsTools,
+        ...attachmentsTools,
+        ...fileOperationsTools,
+        ...oauthTools,
+        ...authTools,
+        ...starsTools,
+        ...pinsTools,
+        ...viewsTools,
+        ...reactionsTools,
+        ...apiKeysTools,
+        ...webhooksTools,
+        ...backlinksTools,
+        ...searchQueriesTools,
+        ...teamsTools,
+        ...integrationsTools,
+        ...notificationsTools,
+        ...subscriptionsTools,
+        ...templatesTools,
+        ...importsTools,
+        ...emojisTools,
+        ...userPermissionsTools,
+        ...bulkOperationsTools,
+        ...advancedSearchTools,
+        ...analyticsTools,
+        ...exportImportTools,
+        ...deskSyncTools
+      ];
+
+      const names = allTools.map(t => t.name);
+      const uniqueNames = [...new Set(names)];
+      expect(names.length).toBe(uniqueNames.length);
+    });
+  });
+});
--- a/src/utils/tests/pagination.test.ts
+++ b/src/utils/tests/pagination.test.ts
@@ -0,0 +1,204 @@
+/**
+ * Pagination Utilities Tests
+ * @author Descomplicar® | @link descomplicar.pt | @copyright 2026
+ */
+
+import {
+  encodeCursor,
+  decodeCursor,
+  buildCursorQuery,
+  processCursorResults,
+  offsetToCursorResult,
+  validatePaginationArgs
+} from '../pagination';
+
+describe('Pagination Utilities', () => {
+  describe('encodeCursor / decodeCursor', () => {
+    it('should encode and decode cursor data', () => {
+      const data = { v: '2024-01-15T10:00:00Z', d: 'desc' as const, s: 'abc123' };
+      const encoded = encodeCursor(data);
+      const decoded = decodeCursor(encoded);
+      expect(decoded).toEqual(data);
+    });
+
+    it('should handle numeric values', () => {
+      const data = { v: 12345, d: 'asc' as const };
+      const encoded = encodeCursor(data);
+      const decoded = decodeCursor(encoded);
+      expect(decoded).toEqual(data);
+    });
+
+    it('should return null for invalid cursor', () => {
+      expect(decodeCursor('invalid-base64!')).toBeNull();
+      expect(decodeCursor('')).toBeNull();
+    });
+
+    it('should use base64url encoding (URL safe)', () => {
+      const data = { v: 'some+value/with=chars', d: 'desc' as const };
+      const encoded = encodeCursor(data);
+      expect(encoded).not.toContain('+');
+      expect(encoded).not.toContain('/');
+    });
+  });
+
+  describe('buildCursorQuery', () => {
+    it('should return defaults when no args provided', () => {
+      const result = buildCursorQuery({});
+      expect(result.cursorCondition).toBe('');
+      expect(result.orderBy).toContain('DESC');
+      expect(result.limit).toBe(26); // 25 + 1 for hasMore detection
+      expect(result.params).toEqual([]);
+    });
+
+    it('should respect custom limit', () => {
+      const result = buildCursorQuery({ limit: 50 });
+      expect(result.limit).toBe(51); // 50 + 1
+    });
+
+    it('should cap limit at max', () => {
+      const result = buildCursorQuery({ limit: 200 });
+      expect(result.limit).toBe(101); // 100 + 1
+    });
+
+    it('should build cursor condition when cursor provided', () => {
+      const cursor = encodeCursor({ v: '2024-01-15T10:00:00Z', d: 'desc', s: 'abc123' });
+      const result = buildCursorQuery({ cursor, direction: 'desc' });
+      expect(result.cursorCondition).toContain('<');
+      expect(result.params.length).toBe(2);
+    });
+
+    it('should use correct operator for asc direction', () => {
+      const cursor = encodeCursor({ v: '2024-01-15T10:00:00Z', d: 'asc' });
+      const result = buildCursorQuery({ cursor, direction: 'asc' });
+      expect(result.cursorCondition).toContain('>');
+    });
+
+    it('should validate cursor field names to prevent SQL injection', () => {
+      expect(() => buildCursorQuery({}, { cursorField: 'DROP TABLE users; --' })).toThrow();
+      expect(() => buildCursorQuery({}, { cursorField: 'valid_field' })).not.toThrow();
+    });
+  });
+
+  describe('processCursorResults', () => {
+    it('should detect hasMore when extra row exists', () => {
+      const rows = [
+        { id: '1', createdAt: '2024-01-03' },
+        { id: '2', createdAt: '2024-01-02' },
+        { id: '3', createdAt: '2024-01-01' }
+      ];
+      const result = processCursorResults(rows, 2);
+      expect(result.hasMore).toBe(true);
+      expect(result.items.length).toBe(2);
+      expect(result.nextCursor).not.toBeNull();
+    });
+
+    it('should not have hasMore when no extra row', () => {
+      const rows = [
+        { id: '1', createdAt: '2024-01-02' },
+        { id: '2', createdAt: '2024-01-01' }
+      ];
+      const result = processCursorResults(rows, 2);
+      expect(result.hasMore).toBe(false);
+      expect(result.items.length).toBe(2);
+      expect(result.nextCursor).toBeNull();
+    });
+
+    it('should generate prevCursor for non-empty results', () => {
+      const rows = [{ id: '1', createdAt: '2024-01-01' }];
+      const result = processCursorResults(rows, 10);
+      expect(result.prevCursor).not.toBeNull();
+    });
+
+    it('should handle empty results', () => {
+      const result = processCursorResults([], 10);
+      expect(result.items.length).toBe(0);
+      expect(result.hasMore).toBe(false);
+      expect(result.nextCursor).toBeNull();
+      expect(result.prevCursor).toBeNull();
+    });
+
+    it('should use custom cursor fields', () => {
+      const rows = [
+        { uuid: 'a', timestamp: '2024-01-01' },
+        { uuid: 'b', timestamp: '2024-01-02' }
+      ];
+      const result = processCursorResults(rows, 1, 'timestamp', 'uuid');
+      expect(result.hasMore).toBe(true);
+      expect(result.nextCursor).not.toBeNull();
+
+      // Verify cursor contains the correct field values
+      const decoded = decodeCursor(result.nextCursor!);
+      expect(decoded?.v).toBe('2024-01-01');
+      expect(decoded?.s).toBe('a');
+    });
+  });
+
+  describe('offsetToCursorResult', () => {
+    it('should convert offset pagination to cursor format', () => {
+      const items = [{ id: '1' }, { id: '2' }];
+      const result = offsetToCursorResult(items, 0, 2, 5);
+      expect(result.items).toEqual(items);
+      expect(result.hasMore).toBe(true);
+      expect(result.totalCount).toBe(5);
+      expect(result.nextCursor).not.toBeNull();
+    });
+
+    it('should set hasMore false when at end', () => {
+      const items = [{ id: '5' }];
+      const result = offsetToCursorResult(items, 4, 10, 5);
+      expect(result.hasMore).toBe(false);
+    });
+
+    it('should set prevCursor null for first page', () => {
+      const items = [{ id: '1' }];
+      const result = offsetToCursorResult(items, 0, 10);
+      expect(result.prevCursor).toBeNull();
+    });
+
+    it('should set prevCursor for non-first pages', () => {
+      const items = [{ id: '11' }];
+      const result = offsetToCursorResult(items, 10, 10);
+      expect(result.prevCursor).not.toBeNull();
+    });
+  });
+
+  describe('validatePaginationArgs', () => {
+    it('should return defaults when no args provided', () => {
+      const result = validatePaginationArgs({});
+      expect(result.limit).toBe(25);
+      expect(result.cursor).toBeNull();
+      expect(result.direction).toBe('desc');
+    });
+
+    it('should respect provided values', () => {
+      const result = validatePaginationArgs({
+        limit: 50,
+        cursor: 'abc123',
+        direction: 'asc'
+      });
+      expect(result.limit).toBe(50);
+      expect(result.cursor).toBe('abc123');
+      expect(result.direction).toBe('asc');
+    });
+
+    it('should clamp limit to min 1', () => {
+      const result = validatePaginationArgs({ limit: 0 });
+      expect(result.limit).toBe(1);
+    });
+
+    it('should clamp limit to max', () => {
+      const result = validatePaginationArgs({ limit: 200 });
+      expect(result.limit).toBe(100);
+    });
+
+    it('should use custom max limit', () => {
+      const result = validatePaginationArgs({ limit: 50 }, { maxLimit: 25 });
+      expect(result.limit).toBe(25);
+    });
+
+    it('should use custom default limit', () => {
+      const result = validatePaginationArgs({}, { defaultLimit: 10 });
+      expect(result.limit).toBe(10);
+    });
+  });
+});
--- a/src/utils/tests/query-builder.test.ts
+++ b/src/utils/tests/query-builder.test.ts
@@ -0,0 +1,297 @@
+/**
+ * Query Builder Tests
+ * @author Descomplicar® | @link descomplicar.pt | @copyright 2026
+ */
+
+import {
+  SafeQueryBuilder,
+  createQueryBuilder,
+  buildSelectQuery,
+  buildCountQuery
+} from '../query-builder';
+
+describe('Query Builder', () => {
+  describe('SafeQueryBuilder', () => {
+    let builder: SafeQueryBuilder;
+
+    beforeEach(() => {
+      builder = new SafeQueryBuilder();
+    });
+
+    describe('addParam', () => {
+      it('should add params and return placeholders', () => {
+        expect(builder.addParam('value1')).toBe('$1');
+        expect(builder.addParam('value2')).toBe('$2');
+        expect(builder.addParam('value3')).toBe('$3');
+        expect(builder.getParams()).toEqual(['value1', 'value2', 'value3']);
+      });
+
+      it('should handle different types', () => {
+        builder.addParam('string');
+        builder.addParam(123);
+        builder.addParam(true);
+        builder.addParam(null);
+        expect(builder.getParams()).toEqual(['string', 123, true, null]);
+      });
+    });
+
+    describe('getNextIndex', () => {
+      it('should return the next parameter index', () => {
+        expect(builder.getNextIndex()).toBe(1);
+        builder.addParam('value');
+        expect(builder.getNextIndex()).toBe(2);
+      });
+    });
+
+    describe('buildILike', () => {
+      it('should build ILIKE condition with wildcards', () => {
+        const condition = builder.buildILike('"name"', 'test');
+        expect(condition).toBe('"name" ILIKE $1');
+        expect(builder.getParams()).toEqual(['%test%']);
+      });
+
+      it('should sanitize input', () => {
+        const condition = builder.buildILike('"name"', '  test\0value  ');
+        expect(builder.getParams()).toEqual(['%testvalue%']);
+      });
+    });
+
+    describe('buildILikeExact', () => {
+      it('should build ILIKE condition without wildcards', () => {
+        const condition = builder.buildILikeExact('"email"', 'test@example.com');
+        expect(condition).toBe('"email" ILIKE $1');
+        expect(builder.getParams()).toEqual(['test@example.com']);
+      });
+    });
+
+    describe('buildILikePrefix', () => {
+      it('should build ILIKE condition with trailing wildcard', () => {
+        const condition = builder.buildILikePrefix('"title"', 'intro');
+        expect(condition).toBe('"title" ILIKE $1');
+        expect(builder.getParams()).toEqual(['intro%']);
+      });
+    });
+
+    describe('buildIn', () => {
+      it('should build IN clause using ANY', () => {
+        const condition = builder.buildIn('"status"', ['active', 'pending']);
+        expect(condition).toBe('"status" = ANY($1)');
+        expect(builder.getParams()).toEqual([['active', 'pending']]);
+      });
+
+      it('should return FALSE for empty array', () => {
+        const condition = builder.buildIn('"status"', []);
+        expect(condition).toBe('FALSE');
+        expect(builder.getParams()).toEqual([]);
+      });
+    });
+
+    describe('buildNotIn', () => {
+      it('should build NOT IN clause using ALL', () => {
+        const condition = builder.buildNotIn('"status"', ['deleted', 'archived']);
+        expect(condition).toBe('"status" != ALL($1)');
+      });
+
+      it('should return TRUE for empty array', () => {
+        const condition = builder.buildNotIn('"status"', []);
+        expect(condition).toBe('TRUE');
+      });
+    });
+
+    describe('comparison operators', () => {
+      it('should build equals condition', () => {
+        expect(builder.buildEquals('"id"', 1)).toBe('"id" = $1');
+      });
+
+      it('should build not equals condition', () => {
+        expect(builder.buildNotEquals('"id"', 1)).toBe('"id" != $1');
+      });
+
+      it('should build greater than condition', () => {
+        expect(builder.buildGreaterThan('"count"', 10)).toBe('"count" > $1');
+      });
+
+      it('should build greater than or equals condition', () => {
+        expect(builder.buildGreaterThanOrEquals('"count"', 10)).toBe('"count" >= $1');
+      });
+
+      it('should build less than condition', () => {
+        expect(builder.buildLessThan('"count"', 10)).toBe('"count" < $1');
+      });
+
+      it('should build less than or equals condition', () => {
+        expect(builder.buildLessThanOrEquals('"count"', 10)).toBe('"count" <= $1');
+      });
+    });
+
+    describe('buildBetween', () => {
+      it('should build BETWEEN condition', () => {
+        const condition = builder.buildBetween('"date"', '2024-01-01', '2024-12-31');
+        expect(condition).toBe('"date" BETWEEN $1 AND $2');
+        expect(builder.getParams()).toEqual(['2024-01-01', '2024-12-31']);
+      });
+    });
+
+    describe('buildIsNull / buildIsNotNull', () => {
+      it('should build IS NULL condition', () => {
+        expect(builder.buildIsNull('"deletedAt"')).toBe('"deletedAt" IS NULL');
+      });
+
+      it('should build IS NOT NULL condition', () => {
+        expect(builder.buildIsNotNull('"publishedAt"')).toBe('"publishedAt" IS NOT NULL');
+      });
+    });
+
+    describe('buildUUIDEquals', () => {
+      it('should accept valid UUIDs', () => {
+        const uuid = '550e8400-e29b-41d4-a716-446655440000';
+        const condition = builder.buildUUIDEquals('"userId"', uuid);
+        expect(condition).toBe('"userId" = $1');
+        expect(builder.getParams()).toEqual([uuid]);
+      });
+
+      it('should throw for invalid UUIDs', () => {
+        expect(() => builder.buildUUIDEquals('"userId"', 'invalid')).toThrow('Invalid UUID');
+      });
+    });
+
+    describe('buildUUIDIn', () => {
+      it('should accept array of valid UUIDs', () => {
+        const uuids = [
+          '550e8400-e29b-41d4-a716-446655440000',
+          '6ba7b810-9dad-11d1-80b4-00c04fd430c8'
+        ];
+        const condition = builder.buildUUIDIn('"id"', uuids);
+        expect(condition).toBe('"id" = ANY($1)');
+      });
+
+      it('should throw if any UUID is invalid', () => {
+        const uuids = ['550e8400-e29b-41d4-a716-446655440000', 'invalid'];
+        expect(() => builder.buildUUIDIn('"id"', uuids)).toThrow('Invalid UUID');
+      });
+    });
+
+    describe('conditions management', () => {
+      it('should add and build WHERE clause', () => {
+        builder.addCondition(builder.buildEquals('"status"', 'active'));
+        builder.addCondition(builder.buildIsNull('"deletedAt"'));
+        const where = builder.buildWhereClause();
+        expect(where).toBe('WHERE "status" = $1 AND "deletedAt" IS NULL');
+      });
+
+      it('should support custom separator', () => {
+        builder.addCondition('"a" = 1');
+        builder.addCondition('"b" = 2');
+        const where = builder.buildWhereClause(' OR ');
+        expect(where).toBe('WHERE "a" = 1 OR "b" = 2');
+      });
+
+      it('should return empty string for no conditions', () => {
+        expect(builder.buildWhereClause()).toBe('');
+      });
+
+      it('should add condition only if value is truthy', () => {
+        builder.addConditionIf('"a" = 1', 'value');
+        builder.addConditionIf('"b" = 2', undefined);
+        builder.addConditionIf('"c" = 3', null);
+        builder.addConditionIf('"d" = 4', '');
+        expect(builder.getConditions()).toEqual(['"a" = 1']);
+      });
+    });
+
+    describe('reset', () => {
+      it('should clear all state', () => {
+        builder.addParam('value');
+        builder.addCondition('"a" = 1');
+        builder.reset();
+        expect(builder.getParams()).toEqual([]);
+        expect(builder.getConditions()).toEqual([]);
+        expect(builder.getNextIndex()).toBe(1);
+      });
+    });
+
+    describe('clone', () => {
+      it('should create independent copy', () => {
+        builder.addParam('value1');
+        builder.addCondition('"a" = 1');
+
+        const clone = builder.clone();
+        clone.addParam('value2');
+        clone.addCondition('"b" = 2');
+
+        expect(builder.getParams()).toEqual(['value1']);
+        expect(builder.getConditions()).toEqual(['"a" = 1']);
+        expect(clone.getParams()).toEqual(['value1', 'value2']);
+        expect(clone.getConditions()).toEqual(['"a" = 1', '"b" = 2']);
+      });
+    });
+  });
+
+  describe('createQueryBuilder', () => {
+    it('should create new builder instance', () => {
+      const builder = createQueryBuilder();
+      expect(builder).toBeInstanceOf(SafeQueryBuilder);
+    });
+  });
+
+  describe('buildSelectQuery', () => {
+    it('should build basic SELECT query', () => {
+      const builder = createQueryBuilder();
+      builder.addCondition(builder.buildIsNull('"deletedAt"'));
+
+      const { query, params } = buildSelectQuery(
+        'documents',
+        ['id', 'title', 'content'],
+        builder
+      );
+
+      expect(query).toBe('SELECT id, title, content FROM documents WHERE "deletedAt" IS NULL');
+      expect(params).toEqual([]);
+    });
+
+    it('should add ORDER BY', () => {
+      const builder = createQueryBuilder();
+      const { query } = buildSelectQuery(
+        'documents',
+        ['*'],
+        builder,
+        { orderBy: '"createdAt"', orderDirection: 'DESC' }
+      );
+
+      expect(query).toContain('ORDER BY "createdAt" DESC');
+    });
+
+    it('should add LIMIT and OFFSET', () => {
+      const builder = createQueryBuilder();
+      const { query, params } = buildSelectQuery(
+        'documents',
+        ['*'],
+        builder,
+        { limit: 10, offset: 20 }
+      );
+
+      expect(query).toContain('LIMIT $1');
+      expect(query).toContain('OFFSET $2');
+      expect(params).toEqual([10, 20]);
+    });
+  });
+
+  describe('buildCountQuery', () => {
+    it('should build COUNT query', () => {
+      const builder = createQueryBuilder();
+      builder.addCondition(builder.buildEquals('"status"', 'active'));
+
+      const { query, params } = buildCountQuery('documents', builder);
+
+      expect(query).toBe('SELECT COUNT(*) as count FROM documents WHERE "status" = $1');
+      expect(params).toEqual(['active']);
+    });
+
+    it('should handle no conditions', () => {
+      const builder = createQueryBuilder();
+      const { query } = buildCountQuery('documents', builder);
+
+      expect(query).toBe('SELECT COUNT(*) as count FROM documents ');
+    });
+  });
+});
--- a/src/utils/tests/security.test.ts
+++ b/src/utils/tests/security.test.ts
@@ -0,0 +1,324 @@
+/**
+ * Security Utilities Tests
+ * @author Descomplicar® | @link descomplicar.pt | @copyright 2026
+ */
+
+import {
+  checkRateLimit,
+  sanitizeInput,
+  isValidUUID,
+  isValidUrlId,
+  isValidEmail,
+  isValidHttpUrl,
+  escapeHtml,
+  validatePagination,
+  validateSortDirection,
+  validateSortField,
+  validateDaysInterval,
+  isValidISODate,
+  validatePeriod,
+  clearRateLimitStore,
+  startRateLimitCleanup,
+  stopRateLimitCleanup
+} from '../security';
+
+describe('Security Utilities', () => {
+  describe('isValidUUID', () => {
+    it('should accept valid v4 UUIDs', () => {
+      expect(isValidUUID('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+      expect(isValidUUID('6ba7b810-9dad-11d1-80b4-00c04fd430c8')).toBe(true);
+    });
+
+    it('should reject invalid UUIDs', () => {
+      expect(isValidUUID('')).toBe(false);
+      expect(isValidUUID('not-a-uuid')).toBe(false);
+      expect(isValidUUID('550e8400-e29b-41d4-a716')).toBe(false);
+      expect(isValidUUID('550e8400e29b41d4a716446655440000')).toBe(false);
+      expect(isValidUUID('550e8400-e29b-41d4-a716-44665544000g')).toBe(false);
+    });
+
+    it('should be case insensitive', () => {
+      expect(isValidUUID('550E8400-E29B-41D4-A716-446655440000')).toBe(true);
+      expect(isValidUUID('550e8400-E29B-41d4-A716-446655440000')).toBe(true);
+    });
+  });
+
+  describe('isValidUrlId', () => {
+    it('should accept valid URL IDs', () => {
+      expect(isValidUrlId('abc123')).toBe(true);
+      expect(isValidUrlId('my-document')).toBe(true);
+      expect(isValidUrlId('my_document')).toBe(true);
+      expect(isValidUrlId('MyDocument123')).toBe(true);
+    });
+
+    it('should reject invalid URL IDs', () => {
+      expect(isValidUrlId('')).toBe(false);
+      expect(isValidUrlId('my document')).toBe(false);
+      expect(isValidUrlId('my/document')).toBe(false);
+      expect(isValidUrlId('my.document')).toBe(false);
+      expect(isValidUrlId('my@document')).toBe(false);
+    });
+  });
+
+  describe('isValidEmail', () => {
+    it('should accept valid emails', () => {
+      expect(isValidEmail('test@example.com')).toBe(true);
+      expect(isValidEmail('user.name@domain.org')).toBe(true);
+      expect(isValidEmail('user+tag@example.co.uk')).toBe(true);
+    });
+
+    it('should reject invalid emails', () => {
+      expect(isValidEmail('')).toBe(false);
+      expect(isValidEmail('notanemail')).toBe(false);
+      expect(isValidEmail('@nodomain.com')).toBe(false);
+      expect(isValidEmail('no@domain')).toBe(false);
+      expect(isValidEmail('spaces in@email.com')).toBe(false);
+    });
+  });
+
+  describe('isValidHttpUrl', () => {
+    it('should accept valid HTTP(S) URLs', () => {
+      expect(isValidHttpUrl('http://example.com')).toBe(true);
+      expect(isValidHttpUrl('https://example.com')).toBe(true);
+      expect(isValidHttpUrl('https://example.com/path?query=1')).toBe(true);
+      expect(isValidHttpUrl('http://localhost:3000')).toBe(true);
+    });
+
+    it('should reject dangerous protocols', () => {
+      expect(isValidHttpUrl('javascript:alert(1)')).toBe(false);
+      expect(isValidHttpUrl('data:text/html,<script>alert(1)</script>')).toBe(false);
+      expect(isValidHttpUrl('file:///etc/passwd')).toBe(false);
+      expect(isValidHttpUrl('ftp://example.com')).toBe(false);
+    });
+
+    it('should reject invalid URLs', () => {
+      expect(isValidHttpUrl('')).toBe(false);
+      expect(isValidHttpUrl('not-a-url')).toBe(false);
+      expect(isValidHttpUrl('//example.com')).toBe(false);
+    });
+  });
+
+  describe('sanitizeInput', () => {
+    it('should remove null bytes', () => {
+      expect(sanitizeInput('hello\0world')).toBe('helloworld');
+      expect(sanitizeInput('\0test\0')).toBe('test');
+    });
+
+    it('should trim whitespace', () => {
+      expect(sanitizeInput('  hello  ')).toBe('hello');
+      expect(sanitizeInput('\n\thello\t\n')).toBe('hello');
+    });
+
+    it('should handle empty strings', () => {
+      expect(sanitizeInput('')).toBe('');
+      expect(sanitizeInput('   ')).toBe('');
+    });
+
+    it('should preserve normal strings', () => {
+      expect(sanitizeInput('normal text')).toBe('normal text');
+    });
+  });
+
+  describe('escapeHtml', () => {
+    it('should escape HTML entities', () => {
+      expect(escapeHtml('<script>')).toBe('&lt;script&gt;');
+      expect(escapeHtml('"quoted"')).toBe('&quot;quoted&quot;');
+      expect(escapeHtml("'single'")); // Just ensure no error
+      expect(escapeHtml('a & b')).toBe('a &amp; b');
+    });
+
+    it('should escape all dangerous characters', () => {
+      const input = '<div class="test" onclick=\'alert(1)\'>Content & More</div>';
+      const escaped = escapeHtml(input);
+      expect(escaped).not.toContain('<');
+      expect(escaped).not.toContain('>');
+      expect(escaped).toContain('&lt;');
+      expect(escaped).toContain('&gt;');
+    });
+
+    it('should preserve safe content', () => {
+      expect(escapeHtml('Hello World')).toBe('Hello World');
+      expect(escapeHtml('123')).toBe('123');
+    });
+  });
+
+  describe('validatePagination', () => {
+    it('should use defaults when no values provided', () => {
+      const result = validatePagination();
+      expect(result.limit).toBe(25);
+      expect(result.offset).toBe(0);
+    });
+
+    it('should respect provided values within limits', () => {
+      expect(validatePagination(50, 10)).toEqual({ limit: 50, offset: 10 });
+    });
+
+    it('should cap limit at maximum', () => {
+      expect(validatePagination(200, 0).limit).toBe(100);
+      expect(validatePagination(1000, 0).limit).toBe(100);
+    });
+
+    it('should ensure minimum values', () => {
+      // Note: 0 is falsy so defaults are used
+      expect(validatePagination(0, 0).limit).toBe(25); // Default used for 0
+      expect(validatePagination(-1, -1)).toEqual({ limit: 1, offset: 0 });
+    });
+  });
+
+  describe('validateSortDirection', () => {
+    it('should accept valid directions', () => {
+      expect(validateSortDirection('ASC')).toBe('ASC');
+      expect(validateSortDirection('DESC')).toBe('DESC');
+    });
+
+    it('should be case insensitive', () => {
+      expect(validateSortDirection('asc')).toBe('ASC');
+      expect(validateSortDirection('desc')).toBe('DESC');
+    });
+
+    it('should default to DESC', () => {
+      expect(validateSortDirection()).toBe('DESC');
+      expect(validateSortDirection('')).toBe('DESC');
+      expect(validateSortDirection('invalid')).toBe('DESC');
+    });
+  });
+
+  describe('validateSortField', () => {
+    const allowedFields = ['name', 'createdAt', 'updatedAt'];
+
+    it('should accept allowed fields', () => {
+      expect(validateSortField('name', allowedFields, 'createdAt')).toBe('name');
+      expect(validateSortField('updatedAt', allowedFields, 'createdAt')).toBe('updatedAt');
+    });
+
+    it('should use default for invalid fields', () => {
+      expect(validateSortField('invalid', allowedFields, 'createdAt')).toBe('createdAt');
+      expect(validateSortField('', allowedFields, 'createdAt')).toBe('createdAt');
+    });
+
+    it('should use default when undefined', () => {
+      expect(validateSortField(undefined, allowedFields, 'createdAt')).toBe('createdAt');
+    });
+  });
+
+  describe('validateDaysInterval', () => {
+    it('should accept valid integers', () => {
+      expect(validateDaysInterval(30)).toBe(30);
+      expect(validateDaysInterval('60')).toBe(60);
+      expect(validateDaysInterval(1)).toBe(1);
+    });
+
+    it('should use default for invalid values', () => {
+      expect(validateDaysInterval(null)).toBe(30);
+      expect(validateDaysInterval(undefined)).toBe(30);
+      expect(validateDaysInterval('invalid')).toBe(30);
+      expect(validateDaysInterval(0)).toBe(30);
+      expect(validateDaysInterval(-1)).toBe(30);
+    });
+
+    it('should cap at maximum', () => {
+      expect(validateDaysInterval(500)).toBe(365);
+      expect(validateDaysInterval(1000)).toBe(365);
+    });
+
+    it('should allow custom defaults and maximums', () => {
+      expect(validateDaysInterval(null, 7, 30)).toBe(7);
+      expect(validateDaysInterval(50, 7, 30)).toBe(30);
+    });
+  });
+
+  describe('isValidISODate', () => {
+    it('should accept valid ISO dates', () => {
+      expect(isValidISODate('2024-01-15')).toBe(true);
+      expect(isValidISODate('2024-12-31')).toBe(true);
+    });
+
+    it('should accept valid ISO datetime', () => {
+      expect(isValidISODate('2024-01-15T10:30:00')).toBe(true);
+      expect(isValidISODate('2024-01-15T10:30:00Z')).toBe(true);
+      expect(isValidISODate('2024-01-15T10:30:00.123')).toBe(true);
+      expect(isValidISODate('2024-01-15T10:30:00.123Z')).toBe(true);
+    });
+
+    it('should reject invalid formats', () => {
+      expect(isValidISODate('')).toBe(false);
+      expect(isValidISODate('15-01-2024')).toBe(false);
+      expect(isValidISODate('2024/01/15')).toBe(false);
+      expect(isValidISODate('January 15, 2024')).toBe(false);
+    });
+
+    it('should reject invalid date formats', () => {
+      // Note: JavaScript Date auto-corrects invalid dates (2024-13-01 → 2025-01-01)
+      // The regex validation catches obvious format issues
+      expect(isValidISODate('2024-13-01')).toBe(false); // Month 13 doesn't exist
+      // Note: 2024-02-30 is accepted by JS Date (auto-corrects to 2024-03-01)
+      // This is a known limitation - full calendar validation would require more complex logic
+    });
+  });
+
+  describe('validatePeriod', () => {
+    const allowedPeriods = ['day', 'week', 'month', 'year'];
+
+    it('should accept allowed periods', () => {
+      expect(validatePeriod('day', allowedPeriods, 'week')).toBe('day');
+      expect(validatePeriod('month', allowedPeriods, 'week')).toBe('month');
+    });
+
+    it('should use default for invalid periods', () => {
+      expect(validatePeriod('hour', allowedPeriods, 'week')).toBe('week');
+      expect(validatePeriod('', allowedPeriods, 'week')).toBe('week');
+    });
+
+    it('should use default when undefined', () => {
+      expect(validatePeriod(undefined, allowedPeriods, 'week')).toBe('week');
+    });
+  });
+
+  describe('Rate Limiting', () => {
+    beforeEach(() => {
+      clearRateLimitStore();
+    });
+
+    afterAll(() => {
+      stopRateLimitCleanup();
+    });
+
+    it('should allow requests within limit', () => {
+      for (let i = 0; i < 50; i++) {
+        expect(checkRateLimit('test', 'client1')).toBe(true);
+      }
+    });
+
+    it('should block requests over limit', () => {
+      // Fill up the limit (default 100)
+      for (let i = 0; i < 100; i++) {
+        checkRateLimit('test', 'client2');
+      }
+      // Next request should be blocked
+      expect(checkRateLimit('test', 'client2')).toBe(false);
+    });
+
+    it('should track different clients separately', () => {
+      for (let i = 0; i < 100; i++) {
+        checkRateLimit('test', 'client3');
+      }
+      // client4 should still be allowed
+      expect(checkRateLimit('test', 'client4')).toBe(true);
+    });
+
+    it('should track different types separately', () => {
+      for (let i = 0; i < 100; i++) {
+        checkRateLimit('type1', 'client5');
+      }
+      // Same client, different type should still be allowed
+      expect(checkRateLimit('type2', 'client5')).toBe(true);
+    });
+
+    it('should start and stop cleanup without errors', () => {
+      expect(() => startRateLimitCleanup()).not.toThrow();
+      expect(() => startRateLimitCleanup()).not.toThrow(); // Double start
+      expect(() => stopRateLimitCleanup()).not.toThrow();
+      expect(() => stopRateLimitCleanup()).not.toThrow(); // Double stop
+    });
+  });
+});
--- a/src/utils/tests/validation.test.ts
+++ b/src/utils/tests/validation.test.ts
@@ -0,0 +1,266 @@
+/**
+ * Validation Utilities Tests
+ * @author Descomplicar® | @link descomplicar.pt | @copyright 2026
+ */
+
+import { z } from 'zod';
+import {
+  schemas,
+  validateInput,
+  safeValidateInput,
+  formatZodError,
+  toolSchemas,
+  validateUUIDs,
+  validateEnum,
+  validateStringLength,
+  validateNumberRange
+} from '../validation';
+
+describe('Validation Utilities', () => {
+  describe('schemas', () => {
+    describe('uuid', () => {
+      it('should accept valid UUIDs', () => {
+        expect(schemas.uuid.safeParse('550e8400-e29b-41d4-a716-446655440000').success).toBe(true);
+      });
+
+      it('should reject invalid UUIDs', () => {
+        expect(schemas.uuid.safeParse('not-a-uuid').success).toBe(false);
+        expect(schemas.uuid.safeParse('').success).toBe(false);
+      });
+    });
+
+    describe('email', () => {
+      it('should accept valid emails', () => {
+        expect(schemas.email.safeParse('test@example.com').success).toBe(true);
+      });
+
+      it('should reject invalid emails', () => {
+        expect(schemas.email.safeParse('notanemail').success).toBe(false);
+      });
+    });
+
+    describe('pagination', () => {
+      it('should use defaults', () => {
+        const result = schemas.pagination.parse({});
+        expect(result.limit).toBe(25);
+        expect(result.offset).toBe(0);
+      });
+
+      it('should accept valid values', () => {
+        const result = schemas.pagination.parse({ limit: 50, offset: 10 });
+        expect(result.limit).toBe(50);
+        expect(result.offset).toBe(10);
+      });
+
+      it('should reject out of range values', () => {
+        expect(schemas.pagination.safeParse({ limit: 0 }).success).toBe(false);
+        expect(schemas.pagination.safeParse({ limit: 101 }).success).toBe(false);
+        expect(schemas.pagination.safeParse({ offset: -1 }).success).toBe(false);
+      });
+    });
+
+    describe('permission', () => {
+      it('should accept valid permissions', () => {
+        expect(schemas.permission.safeParse('read').success).toBe(true);
+        expect(schemas.permission.safeParse('read_write').success).toBe(true);
+        expect(schemas.permission.safeParse('admin').success).toBe(true);
+      });
+
+      it('should reject invalid permissions', () => {
+        expect(schemas.permission.safeParse('invalid').success).toBe(false);
+        expect(schemas.permission.safeParse('ADMIN').success).toBe(false);
+      });
+    });
+
+    describe('userRole', () => {
+      it('should accept valid roles', () => {
+        expect(schemas.userRole.safeParse('admin').success).toBe(true);
+        expect(schemas.userRole.safeParse('member').success).toBe(true);
+        expect(schemas.userRole.safeParse('viewer').success).toBe(true);
+        expect(schemas.userRole.safeParse('guest').success).toBe(true);
+      });
+
+      it('should reject invalid roles', () => {
+        expect(schemas.userRole.safeParse('superadmin').success).toBe(false);
+      });
+    });
+
+    describe('booleanString', () => {
+      it('should accept boolean values', () => {
+        expect(schemas.booleanString.parse(true)).toBe(true);
+        expect(schemas.booleanString.parse(false)).toBe(false);
+      });
+
+      it('should transform string values', () => {
+        expect(schemas.booleanString.parse('true')).toBe(true);
+        expect(schemas.booleanString.parse('1')).toBe(true);
+        expect(schemas.booleanString.parse('false')).toBe(false);
+        expect(schemas.booleanString.parse('0')).toBe(false);
+      });
+    });
+  });
+
+  describe('validateInput', () => {
+    const testSchema = z.object({
+      name: z.string().min(1),
+      age: z.number().int().positive()
+    });
+
+    it('should return validated data for valid input', () => {
+      const result = validateInput(testSchema, { name: 'John', age: 30 });
+      expect(result).toEqual({ name: 'John', age: 30 });
+    });
+
+    it('should throw ZodError for invalid input', () => {
+      expect(() => validateInput(testSchema, { name: '', age: -1 })).toThrow();
+    });
+  });
+
+  describe('safeValidateInput', () => {
+    const testSchema = z.object({
+      id: z.string().uuid()
+    });
+
+    it('should return success for valid input', () => {
+      const result = safeValidateInput(testSchema, { id: '550e8400-e29b-41d4-a716-446655440000' });
+      expect(result.success).toBe(true);
+      if (result.success) {
+        expect(result.data.id).toBe('550e8400-e29b-41d4-a716-446655440000');
+      }
+    });
+
+    it('should return error for invalid input', () => {
+      const result = safeValidateInput(testSchema, { id: 'invalid' });
+      expect(result.success).toBe(false);
+      if (!result.success) {
+        expect(result.error).toBeInstanceOf(z.ZodError);
+      }
+    });
+  });
+
+  describe('formatZodError', () => {
+    it('should format errors with path', () => {
+      const schema = z.object({
+        user: z.object({
+          email: z.string().email()
+        })
+      });
+
+      const result = schema.safeParse({ user: { email: 'invalid' } });
+      if (!result.success) {
+        const formatted = formatZodError(result.error);
+        expect(formatted).toContain('user.email');
+      }
+    });
+
+    it('should format errors without path', () => {
+      const schema = z.string().min(5);
+      const result = schema.safeParse('abc');
+      if (!result.success) {
+        const formatted = formatZodError(result.error);
+        expect(formatted).not.toContain('.');
+      }
+    });
+  });
+
+  describe('toolSchemas', () => {
+    describe('listArgs', () => {
+      it('should accept valid pagination', () => {
+        expect(toolSchemas.listArgs.safeParse({ limit: 50, offset: 10 }).success).toBe(true);
+        expect(toolSchemas.listArgs.safeParse({}).success).toBe(true);
+      });
+    });
+
+    describe('getByIdArgs', () => {
+      it('should require valid UUID id', () => {
+        expect(toolSchemas.getByIdArgs.safeParse({ id: '550e8400-e29b-41d4-a716-446655440000' }).success).toBe(true);
+        expect(toolSchemas.getByIdArgs.safeParse({ id: 'invalid' }).success).toBe(false);
+        expect(toolSchemas.getByIdArgs.safeParse({}).success).toBe(false);
+      });
+    });
+
+    describe('bulkDocumentArgs', () => {
+      it('should require at least one document_id', () => {
+        expect(toolSchemas.bulkDocumentArgs.safeParse({ document_ids: [] }).success).toBe(false);
+        expect(toolSchemas.bulkDocumentArgs.safeParse({
+          document_ids: ['550e8400-e29b-41d4-a716-446655440000']
+        }).success).toBe(true);
+      });
+
+      it('should validate all UUIDs', () => {
+        expect(toolSchemas.bulkDocumentArgs.safeParse({
+          document_ids: ['550e8400-e29b-41d4-a716-446655440000', 'invalid']
+        }).success).toBe(false);
+      });
+
+      it('should limit to 100 documents', () => {
+        const tooMany = Array(101).fill('550e8400-e29b-41d4-a716-446655440000');
+        expect(toolSchemas.bulkDocumentArgs.safeParse({ document_ids: tooMany }).success).toBe(false);
+      });
+    });
+
+    describe('searchArgs', () => {
+      it('should require non-empty query', () => {
+        expect(toolSchemas.searchArgs.safeParse({ query: '' }).success).toBe(false);
+        expect(toolSchemas.searchArgs.safeParse({ query: 'test' }).success).toBe(true);
+      });
+    });
+  });
+
+  describe('validateUUIDs', () => {
+    it('should accept valid UUID arrays', () => {
+      expect(() => validateUUIDs([
+        '550e8400-e29b-41d4-a716-446655440000',
+        '6ba7b810-9dad-11d1-80b4-00c04fd430c8'
+      ])).not.toThrow();
+    });
+
+    it('should throw for invalid UUIDs', () => {
+      expect(() => validateUUIDs(['invalid'])).toThrow();
+    });
+
+    it('should include field name in error', () => {
+      expect(() => validateUUIDs(['invalid'], 'document_ids')).toThrow('document_ids');
+    });
+  });
+
+  describe('validateEnum', () => {
+    const allowed = ['a', 'b', 'c'] as const;
+
+    it('should accept valid values', () => {
+      expect(validateEnum('a', allowed, 'test')).toBe('a');
+      expect(validateEnum('b', allowed, 'test')).toBe('b');
+    });
+
+    it('should throw for invalid values', () => {
+      expect(() => validateEnum('d', allowed, 'test')).toThrow('Invalid test');
+      expect(() => validateEnum('d', allowed, 'test')).toThrow('Allowed values');
+    });
+  });
+
+  describe('validateStringLength', () => {
+    it('should accept strings within range', () => {
+      expect(() => validateStringLength('hello', 1, 10, 'name')).not.toThrow();
+      expect(() => validateStringLength('a', 1, 10, 'name')).not.toThrow();
+      expect(() => validateStringLength('1234567890', 1, 10, 'name')).not.toThrow();
+    });
+
+    it('should throw for strings outside range', () => {
+      expect(() => validateStringLength('', 1, 10, 'name')).toThrow();
+      expect(() => validateStringLength('12345678901', 1, 10, 'name')).toThrow();
+    });
+  });
+
+  describe('validateNumberRange', () => {
+    it('should accept numbers within range', () => {
+      expect(() => validateNumberRange(5, 1, 10, 'age')).not.toThrow();
+      expect(() => validateNumberRange(1, 1, 10, 'age')).not.toThrow();
+      expect(() => validateNumberRange(10, 1, 10, 'age')).not.toThrow();
+    });
+
+    it('should throw for numbers outside range', () => {
+      expect(() => validateNumberRange(0, 1, 10, 'age')).toThrow();
+      expect(() => validateNumberRange(11, 1, 10, 'age')).toThrow();
+    });
+  });
+});