File size: 2,127 Bytes
46252cd
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
import { makeOnWebhookSubscribe } from './webhook-subscribe.util';

describe('onWebhookSubscribe hardening', () => {
  const declaredRoutes = new Set(['chatwoot']);

  it('registers a declared route once and dedups repeats', () => {
    const subscribed = new Set<string>();
    const on = makeOnWebhookSubscribe({
      pluginId: 'p',
      declaredRoutes,
      hasPermission: true,
      subscribed,
      maxRoutes: 8,
      warn: jest.fn(),
    });

    on('chatwoot');
    on('chatwoot');

    expect([...subscribed]).toEqual(['chatwoot']);
  });

  it('silently drops a route the manifest never declared', () => {
    const subscribed = new Set<string>();
    makeOnWebhookSubscribe({
      pluginId: 'p',
      declaredRoutes,
      hasPermission: true,
      subscribed,
      maxRoutes: 8,
      warn: jest.fn(),
    })('unknown');

    expect(subscribed.size).toBe(0);
  });

  it('warns at most once about undeclared routes so a flood is not a log-flood vector', () => {
    const subscribed = new Set<string>();
    const warn = jest.fn();
    const on = makeOnWebhookSubscribe({
      pluginId: 'p',
      declaredRoutes,
      hasPermission: true,
      subscribed,
      maxRoutes: 8,
      warn,
    });

    on('x');
    on('y');
    on('z');

    expect(warn).toHaveBeenCalledTimes(1);
  });

  it('silently drops all routes when the manifest lacks webhook:ingress', () => {
    const subscribed = new Set<string>();
    const warn = jest.fn();
    makeOnWebhookSubscribe({
      pluginId: 'p',
      declaredRoutes,
      hasPermission: false,
      subscribed,
      maxRoutes: 8,
      warn,
    })('chatwoot');

    expect(subscribed.size).toBe(0);
    expect(warn).not.toHaveBeenCalled();
  });

  it('size-caps the subscribed set', () => {
    const subscribed = new Set<string>();
    const routes = new Set(['a', 'b', 'c']);
    const on = makeOnWebhookSubscribe({
      pluginId: 'p',
      declaredRoutes: routes,
      hasPermission: true,
      subscribed,
      maxRoutes: 2,
      warn: jest.fn(),
    });

    on('a');
    on('b');
    on('c');

    expect(subscribed.size).toBe(2);
  });
});