haveapi-go-client 0.27.3 → 0.28.0

data/spec/integration/generator_spec.rb

@@ -7,6 +7,63 @@ RSpec.describe HaveAPI::GoClient::Generator do
   let(:root) { File.expand_path('../../../..', __dir__) }
   let(:cwd) { File.join(root, 'clients', 'go') }
 
+  def oauth2_action_description(method:, path:, output_params:)
+    {
+      aliases: [],
+      input: nil,
+      output: {
+        layout: 'object',
+        namespace: 'action_state',
+        parameters: output_params
+      },
+      method:,
+      path:,
+      meta: {},
+      blocking: false
+    }
+  end
+
+  def oauth2_revoke_description(revoke_url: '/revoke')
+    {
+      authentication: {
+        oauth2: {
+          http_header: 'X-HaveAPI-OAuth2-Token',
+          revoke_url:
+        }
+      },
+      meta: { namespace: '_meta' },
+      resources: {
+        action_state: {
+          resources: {},
+          actions: {
+            show: oauth2_action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}',
+              output_params: { id: { type: 'Integer' } }
+            ),
+            poll: oauth2_action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}/poll',
+              output_params: { finished: { type: 'Boolean' } }
+            )
+          }
+        }
+      }
+    }
+  end
+
+  def action_description(method:, path:, aliases: [], input: nil, output: nil, meta: {}, blocking: false)
+    {
+      aliases:,
+      input:,
+      output:,
+      method:,
+      path:,
+      meta:,
+      blocking:
+    }
+  end
+
   it 'generates a client that compiles and can call the API' do
     Dir.mktmpdir('haveapi-go-client-') do |dir|
       cmd = [
@@ -24,7 +81,11 @@ RSpec.describe HaveAPI::GoClient::Generator do
       File.write(File.join(dir, 'client', 'client_integration_test.go'), <<~GO)
         package client
 
-        import "testing"
+        import (
+          "net/http"
+          "testing"
+          "time"
+        )
 
         func TestProjectList(t *testing.T) {
           c := New("#{base_url}")
@@ -43,6 +104,28 @@ RSpec.describe HaveAPI::GoClient::Generator do
             t.Fatalf("expected at least 2 projects, got %d", len(resp.Output))
           }
         }
+
+        func TestClientTimeout(t *testing.T) {
+          c := New("#{base_url}")
+          c.SetBasicAuthentication("user", "pass")
+          c.SetTimeout(10 * time.Millisecond)
+
+          _, err := c.Test.Slow.Prepare().Call()
+          if err == nil {
+            t.Fatalf("expected timeout error, got nil")
+          }
+        }
+
+        func TestClientHTTPClient(t *testing.T) {
+          c := New("#{base_url}")
+          c.SetBasicAuthentication("user", "pass")
+          c.SetHTTPClient(&http.Client{Timeout: 10 * time.Millisecond})
+
+          _, err := c.Test.Slow.Prepare().Call()
+          if err == nil {
+            t.Fatalf("expected timeout error, got nil")
+          }
+        }
       GO
 
       File.write(File.join(dir, 'client', 'client_validation_test.go'), <<~GO)
@@ -226,7 +309,576 @@ RSpec.describe HaveAPI::GoClient::Generator do
         }
       GO
 
-      go_out, go_err, go_status = Open3.capture3('go', 'test', './...', chdir: dir)
+      go_out, go_err, go_status = Open3.capture3(
+        { 'CGO_ENABLED' => '0' },
+        'go',
+        'test',
+        './...',
+        chdir: dir
+      )
+      expect(go_status).to be_success, "go test failed: #{go_out}\n#{go_err}"
+    end
+  end
+
+  it 'generates an OAuth2 client that sends the revoke token as form data' do
+    Dir.mktmpdir('haveapi-go-client-oauth2-') do |dir|
+      communicator = instance_double(
+        HaveAPI::Client::Communicator,
+        describe_api: oauth2_revoke_description
+      )
+      allow(HaveAPI::Client::Communicator).to receive(:new).and_return(communicator)
+
+      generator = described_class.new(
+        'http://unused.example',
+        dir,
+        module: 'example.com/haveapi-oauth2-revoke',
+        package: 'client'
+      )
+      generator.generate
+      generator.go_fmt
+
+      File.write(File.join(dir, 'client', 'oauth2_revoke_test.go'), <<~GO)
+        package client
+
+        import (
+          "io"
+          "net/http"
+          "net/url"
+          "strings"
+          "testing"
+        )
+
+        type captureTransport struct {
+          req  *http.Request
+          body string
+        }
+
+        func (transport *captureTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+          if req.Body != nil {
+            body, err := io.ReadAll(req.Body)
+            if err != nil {
+              return nil, err
+            }
+
+            if err := req.Body.Close(); err != nil {
+              return nil, err
+            }
+
+            transport.body = string(body)
+          }
+
+          transport.req = req
+
+          return &http.Response{
+            StatusCode: 200,
+            Status:     "200 OK",
+            Body:       io.NopCloser(strings.NewReader("ok")),
+            Header:     make(http.Header),
+            Request:    req,
+          }, nil
+        }
+
+        func TestOAuth2RevokeSendsTokenFormBody(t *testing.T) {
+          transport := &captureTransport{}
+          token := "secret-token"
+
+          c := New("http://unused.example")
+          c.SetHTTPClient(&http.Client{Transport: transport})
+          c.SetExistingOAuth2Auth(token)
+
+          if err := c.RevokeAccessToken(); err != nil {
+            t.Fatalf("revoke failed: %v", err)
+          }
+
+          if transport.req == nil {
+            t.Fatalf("expected revoke request")
+          }
+
+          if got := transport.req.Method; got != "POST" {
+            t.Fatalf("expected POST revoke, got %s", got)
+          }
+
+          if got := transport.req.URL.String(); got != "http://unused.example/revoke" {
+            t.Fatalf("unexpected revoke URL: %s", got)
+          }
+
+          if got := transport.req.Header.Get("X-HaveAPI-OAuth2-Token"); got != token {
+            t.Fatalf("expected OAuth2 header %q, got %q", token, got)
+          }
+
+          if got := transport.req.Header.Get("Content-Type"); got != "application/x-www-form-urlencoded" {
+            t.Fatalf("expected form content type, got %q", got)
+          }
+
+          form, err := url.ParseQuery(transport.body)
+          if err != nil {
+            t.Fatalf("invalid form body %q: %v", transport.body, err)
+          }
+
+          if got := form.Get("token"); got != token {
+            t.Fatalf("expected revoke token %q, got %q in body %q", token, got, transport.body)
+          }
+
+          if c.Authentication != nil {
+            t.Fatalf("expected authentication to be cleared after revoke")
+          }
+        }
+      GO
+
+      go_out, go_err, go_status = Open3.capture3(
+        { 'CGO_ENABLED' => '0' },
+        'go',
+        'test',
+        './...',
+        chdir: dir
+      )
+      expect(go_status).to be_success, "go test failed: #{go_out}\n#{go_err}"
+    end
+  end
+
+  it 'rejects generated action paths that can switch request authority' do
+    malicious_description = {
+      authentication: {
+        basic: {}
+      },
+      meta: { namespace: '_meta' },
+      resources: {
+        action_state: {
+          resources: {},
+          actions: {
+            show: oauth2_action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}',
+              output_params: { id: { type: 'Integer' } }
+            ),
+            poll: oauth2_action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}/poll',
+              output_params: { finished: { type: 'Boolean' } }
+            )
+          }
+        },
+        victim: {
+          resources: {},
+          actions: {
+            list: action_description(method: 'GET', path: '@attacker.example/capture')
+          }
+        }
+      }
+    }
+
+    Dir.mktmpdir('haveapi-go-client-action-authority-') do |dir|
+      communicator = instance_double(
+        HaveAPI::Client::Communicator,
+        describe_api: malicious_description
+      )
+      allow(HaveAPI::Client::Communicator).to receive(:new).and_return(communicator)
+
+      generator = described_class.new(
+        'http://api.example',
+        dir,
+        module: 'example.com/haveapi-action-authority',
+        package: 'client'
+      )
+      generator.generate
+      generator.go_fmt
+
+      File.write(File.join(dir, 'client', 'action_authority_test.go'), <<~GO)
+        package client
+
+        import (
+          "errors"
+          "net/http"
+          "testing"
+        )
+
+        type unexpectedActionTransport struct {
+          req *http.Request
+        }
+
+        func (transport *unexpectedActionTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+          transport.req = req
+          return nil, errors.New("unexpected request")
+        }
+
+        func TestActionPathAuthoritySwitchIsRejectedBeforeAuth(t *testing.T) {
+          transport := &unexpectedActionTransport{}
+
+          c := New("http://api.example")
+          c.SetHTTPClient(&http.Client{Transport: transport})
+          c.SetBasicAuthentication("user", "pass")
+
+          if _, err := c.Victim.List.Call(); err == nil {
+            t.Fatalf("expected unsafe action path error")
+          }
+
+          if transport.req != nil {
+            t.Fatalf(
+              "unexpected request to %s with authorization %q",
+              transport.req.URL.String(),
+              transport.req.Header.Get("Authorization"),
+            )
+          }
+        }
+      GO
+
+      go_out, go_err, go_status = Open3.capture3(
+        { 'CGO_ENABLED' => '0' },
+        'go',
+        'test',
+        './...',
+        chdir: dir
+      )
+      expect(go_status).to be_success, "go test failed: #{go_out}\n#{go_err}"
+    end
+  end
+
+  it 'escapes generated action path parameters as single path segments' do
+    description = {
+      authentication: {
+        basic: {}
+      },
+      meta: { namespace: '_meta' },
+      resources: {
+        action_state: {
+          resources: {},
+          actions: {
+            show: oauth2_action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}',
+              output_params: { id: { type: 'Integer' } }
+            ),
+            poll: oauth2_action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}/poll',
+              output_params: { finished: { type: 'Boolean' } }
+            )
+          }
+        },
+        user: {
+          resources: {},
+          actions: {
+            show: action_description(
+              method: 'GET',
+              path: '/users/{user_id}',
+              output: {
+                layout: 'object',
+                namespace: 'user',
+                parameters: { id: { type: 'Integer' } }
+              }
+            )
+          }
+        }
+      }
+    }
+
+    Dir.mktmpdir('haveapi-go-client-path-param-') do |dir|
+      communicator = instance_double(
+        HaveAPI::Client::Communicator,
+        describe_api: description
+      )
+      allow(HaveAPI::Client::Communicator).to receive(:new).and_return(communicator)
+
+      generator = described_class.new(
+        'http://api.example',
+        dir,
+        module: 'example.com/haveapi-path-param',
+        package: 'client'
+      )
+      generator.generate
+      generator.go_fmt
+
+      File.write(File.join(dir, 'client', 'path_param_escape_test.go'), <<~GO)
+        package client
+
+        import (
+          "io"
+          "net/http"
+          "net/url"
+          "strings"
+          "testing"
+        )
+
+        type pathParamEscapeTransport struct {
+          req *http.Request
+        }
+
+        func (transport *pathParamEscapeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+          transport.req = req
+
+          return &http.Response{
+            StatusCode: 200,
+            Status:     "200 OK",
+            Body:       io.NopCloser(strings.NewReader(`{"status":true,"response":{"user":{"id":42}}}`)),
+            Header:     make(http.Header),
+            Request:    req,
+          }, nil
+        }
+
+        func TestPathParamIsEscapedAsSingleSegment(t *testing.T) {
+          transport := &pathParamEscapeTransport{}
+          pathArg := "42?user[name]=alice&_meta[includes]=group__secret/section#frag%2Fencoded=1"
+
+          c := New("http://api.example")
+          c.SetHTTPClient(&http.Client{Transport: transport})
+
+          resp, err := c.User.Show.Prepare().SetPathParamString("user_id", pathArg).Call()
+          if err != nil {
+            t.Fatalf("request failed: %v", err)
+          }
+
+          if !resp.Status {
+            t.Fatalf("request failed: %s", resp.Message)
+          }
+
+          if transport.req == nil {
+            t.Fatalf("expected request")
+          }
+
+          if got := transport.req.URL.RawQuery; got != "" {
+            t.Fatalf("path parameter injected query string %q", got)
+          }
+
+          if got := transport.req.URL.Fragment; got != "" {
+            t.Fatalf("path parameter injected fragment %q", got)
+          }
+
+          expectedPath := "/users/" + url.PathEscape(pathArg)
+          if got := transport.req.URL.EscapedPath(); got != expectedPath {
+            t.Fatalf("expected escaped path %q, got %q", expectedPath, got)
+          }
+
+          if got := transport.req.URL.Query().Get("user[name]"); got != "" {
+            t.Fatalf("unexpected injected user[name] query value %q", got)
+          }
+
+          if got := transport.req.URL.Query().Get("_meta[includes]"); got != "" {
+            t.Fatalf("unexpected injected _meta[includes] query value %q", got)
+          }
+
+          if !strings.Contains(transport.req.URL.EscapedPath(), "%252Fencoded") {
+            t.Fatalf("expected percent-encoded input to remain data, got %q", transport.req.URL.EscapedPath())
+          }
+        }
+      GO
+
+      go_out, go_err, go_status = Open3.capture3(
+        { 'CGO_ENABLED' => '0' },
+        'go',
+        'test',
+        './...',
+        chdir: dir
+      )
+      expect(go_status).to be_success, "go test failed: #{go_out}\n#{go_err}"
+    end
+  end
+
+  it 'rejects OAuth2 revoke URLs outside the client origin before sending the token' do
+    Dir.mktmpdir('haveapi-go-client-oauth2-revoke-origin-') do |dir|
+      communicator = instance_double(
+        HaveAPI::Client::Communicator,
+        describe_api: oauth2_revoke_description(
+          revoke_url: 'http://attacker.example/collect-token'
+        )
+      )
+      allow(HaveAPI::Client::Communicator).to receive(:new).and_return(communicator)
+
+      generator = described_class.new(
+        'http://api.example',
+        dir,
+        module: 'example.com/haveapi-oauth2-revoke-origin',
+        package: 'client'
+      )
+      generator.generate
+      generator.go_fmt
+
+      File.write(File.join(dir, 'client', 'oauth2_revoke_origin_test.go'), <<~GO)
+        package client
+
+        import (
+          "errors"
+          "net/http"
+          "testing"
+        )
+
+        type unexpectedRevokeTransport struct {
+          req *http.Request
+        }
+
+        func (transport *unexpectedRevokeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+          transport.req = req
+          return nil, errors.New("unexpected request")
+        }
+
+        func TestOAuth2RevokeCrossOriginURLIsRejectedBeforeAuth(t *testing.T) {
+          transport := &unexpectedRevokeTransport{}
+
+          c := New("http://api.example")
+          c.SetHTTPClient(&http.Client{Transport: transport})
+          c.SetExistingOAuth2Auth("secret-token")
+
+          if err := c.RevokeAccessToken(); err == nil {
+            t.Fatalf("expected unsafe revoke URL error")
+          }
+
+          if transport.req != nil {
+            t.Fatalf(
+              "unexpected request to %s with token header %q",
+              transport.req.URL.String(),
+              transport.req.Header.Get("X-HaveAPI-OAuth2-Token"),
+            )
+          }
+
+          if c.Authentication == nil {
+            t.Fatalf("authentication should remain configured after failed revoke")
+          }
+        }
+      GO
+
+      go_out, go_err, go_status = Open3.capture3(
+        { 'CGO_ENABLED' => '0' },
+        'go',
+        'test',
+        './...',
+        chdir: dir
+      )
+      expect(go_status).to be_success, "go test failed: #{go_out}\n#{go_err}"
+    end
+  end
+
+  it 'escapes untrusted API descriptions when generating Go source' do
+    injected_path = <<~PATH.chomp
+      /safe",
+      \t}
+      }
+
+      func init() {
+      \tpanic("generated code executed from API description")
+      }
+
+      func (action *ActionVictimList) unused() *ActionVictimListInvocation {
+      \treturn &ActionVictimListInvocation{
+      \t\tAction: action,
+      \t\tPath: "/safe
+    PATH
+
+    injected_name = "bad\"\nfunc init() { panic(\"name\") }\n"
+    injected_method = "POST\"\nfunc init() { panic(\"method\") }\n"
+    injected_auth = "X-Token\"\nfunc init() { panic(\"auth\") }\n"
+
+    malicious_description = {
+      authentication: {
+        oauth2: {
+          http_header: injected_auth,
+          revoke_url: "https://auth.example/revoke\"\nfunc init() { panic(\"revoke\") }\n"
+        }
+      },
+      meta: { namespace: "_meta#{injected_name}" },
+      resources: {
+        action_state: {
+          resources: {},
+          actions: {
+            show: action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}',
+              output: {
+                layout: 'object',
+                namespace: 'action_state',
+                parameters: { id: { type: 'Integer' } }
+              }
+            ),
+            poll: action_description(
+              method: 'GET',
+              path: '/action_states/{action_state_id}/poll',
+              output: {
+                layout: 'object',
+                namespace: 'action_state',
+                parameters: { finished: { type: 'Boolean' } }
+              }
+            )
+          }
+        },
+        victim: {
+          resources: {},
+          actions: {
+            list: action_description(method: 'GET', path: injected_path)
+          }
+        },
+        injected_name => {
+          resources: {},
+          actions: {
+            injected_name => action_description(
+              method: injected_method,
+              path: "/#{injected_name}",
+              aliases: [injected_name],
+              input: {
+                layout: 'object',
+                namespace: "input#{injected_name}",
+                parameters: {
+                  injected_name => { type: 'String', nullable: true }
+                }
+              },
+              output: {
+                layout: 'object',
+                namespace: "output#{injected_name}",
+                parameters: {
+                  injected_name => { type: 'String' }
+                }
+              },
+              meta: {
+                global: {
+                  input: {
+                    layout: 'object',
+                    namespace: "meta#{injected_name}",
+                    parameters: {
+                      "meta#{injected_name}" => { type: 'String' }
+                    }
+                  }
+                }
+              }
+            )
+          }
+        }
+      }
+    }
+
+    Dir.mktmpdir('haveapi-go-client-injection-') do |dir|
+      communicator = instance_double(
+        HaveAPI::Client::Communicator,
+        describe_api: malicious_description
+      )
+      allow(HaveAPI::Client::Communicator).to receive(:new).and_return(communicator)
+
+      generator = described_class.new(
+        'http://unused.example',
+        dir,
+        module: 'example.com/haveapi-injection',
+        package: 'client'
+      )
+      generator.generate
+      generator.go_fmt
+
+      generated_sources = Dir[File.join(dir, 'client', '*.go')].map do |path|
+        File.read(path)
+      end.join("\n")
+
+      expect(generated_sources).not_to match(/^\s*func init\(\)/)
+
+      File.write(File.join(dir, 'client', 'package_load_test.go'), <<~GO)
+        package client
+
+        import "testing"
+
+        func TestGeneratedPackageLoads(t *testing.T) {}
+      GO
+
+      go_out, go_err, go_status = Open3.capture3(
+        { 'CGO_ENABLED' => '0' },
+        'go',
+        'test',
+        './...',
+        chdir: dir
+      )
       expect(go_status).to be_success, "go test failed: #{go_out}\n#{go_err}"
     end
   end