@abyss-project/main 16.0.0 → 18.0.0

package/dist/server/tests/safe-url.util.spec.js

@@ -0,0 +1,848 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const axios_1 = __importStar(require("axios"));
+const http = __importStar(require("http"));
+const safe_url_util_1 = require("../safe-url.util");
+const test_env_util_1 = require("./utils/test-env.util");
+const FORM_SIGNATURE_HEADER = 'abyss-form-webhook-signature';
+const MONITOR_SIGNATURE_HEADER = 'abyss-monitor-webhook-signature';
+const resolverReturning = (...addresses) => jest.fn(async () => addresses.map((address) => ({ address })));
+const hangingResolver = () => jest.fn(() => new Promise(() => undefined));
+const redirectError = (location, status = 302) => new axios_1.AxiosError('redirect', 'ERR_BAD_RESPONSE', undefined, undefined, {
+    status,
+    headers: { location },
+});
+const okResponse = (data = 'ok') => ({ status: 200, data });
+const captureError = async (pending) => {
+    try {
+        await pending;
+    }
+    catch (error) {
+        return error;
+    }
+    throw new Error('the call was expected to fail');
+};
+const lookupThrough = (lookup, hostname) => new Promise((resolve, reject) => lookup(hostname, { all: true }, (error, addresses) => error ? reject(error) : resolve(addresses)));
+describe('safe-url.util', () => {
+    beforeEach(() => {
+        (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, undefined);
+        (0, test_env_util_1.setTestEnv)('NODE_ENV', 'test');
+    });
+    afterEach(() => {
+        jest.restoreAllMocks();
+    });
+    describe('isBlockedIp', () => {
+        it.each([
+            ['0.0.0.0/8', '0.1.2.3'],
+            ['10.0.0.0/8', '10.20.30.40'],
+            ['100.64.0.0/10', '100.127.255.254'],
+            ['127.0.0.0/8', '127.5.5.5'],
+            ['169.254.0.0/16 (cloud metadata)', '169.254.169.254'],
+            ['172.16.0.0/12', '172.31.255.255'],
+            ['192.0.0.0/24', '192.0.0.8'],
+            ['192.168.0.0/16', '192.168.1.1'],
+            ['198.18.0.0/15', '198.19.0.1'],
+            ['224.0.0.0/4 (multicast)', '239.255.255.250'],
+            ['240.0.0.0/4 (reserved, broadcast included)', '255.255.255.255'],
+            ['192.0.2.0/24 (TEST-NET-1)', '192.0.2.1'],
+            ['198.51.100.0/24 (TEST-NET-2)', '198.51.100.1'],
+            ['203.0.113.0/24 (TEST-NET-3)', '203.0.113.1'],
+        ])('blocks IPv4 %s (%s)', (_family, ip) => {
+            expect((0, safe_url_util_1.isBlockedIp)(ip)).toBe(true);
+        });
+        it.each([
+            ['unspecified', '::'],
+            ['loopback', '::1'],
+            ['IPv4-mapped loopback', '::ffff:127.0.0.1'],
+            ['IPv4-mapped metadata', '::ffff:169.254.169.254'],
+            ['IPv4-compatible loopback', '::127.0.0.1'],
+            ['link-local fe80::/10', 'fe80::'],
+            ['unique-local fc00::/7 (fc)', 'fc00::'],
+            ['unique-local fc00::/7 (fd)', 'fd00::'],
+            ['multicast ff00::/8', 'ff02::'],
+            ['NAT64 of loopback', '64:ff9b::127.0.0.1'],
+            ['NAT64 of metadata', '64:ff9b::a9fe:a9fe'],
+            ['NAT64 local-use 64:ff9b:1::/48', '64:ff9b:1::8.8.8.8'],
+            ['6to4 of a private network', '2002:a00:1::'],
+            ['6to4 of metadata', '2002:a9fe:a9fe::1'],
+        ])('blocks IPv6 %s (%s)', (_family, ip) => {
+            expect((0, safe_url_util_1.isBlockedIp)(ip)).toBe(true);
+        });
+        it.each([
+            '8.8.8.8',
+            '93.184.216.34',
+            '100.128.0.1',
+            '172.32.0.1',
+            '192.0.1.1',
+            '198.20.0.1',
+            '223.255.255.255',
+            '2606:4700:4700::1111',
+            '::ffff:8.8.8.8',
+            '64:ff9b::8.8.8.8',
+            '2002:808:808::1',
+        ])('accepts the public address %s', (ip) => {
+            expect((0, safe_url_util_1.isBlockedIp)(ip)).toBe(false);
+        });
+        it.each(['not-an-ip', '', '999.1.1.1'])('treats %p as blocked', (value) => {
+            expect((0, safe_url_util_1.isBlockedIp)(value)).toBe(true);
+        });
+    });
+    describe('assertSafeHost', () => {
+        it('returns every address of a host that resolves only to public addresses', async () => {
+            await expect((0, safe_url_util_1.assertSafeHost)('monitored.example', resolverReturning('93.184.216.34', '2606:4700:4700::1111'))).resolves.toEqual([
+                { address: '93.184.216.34', family: 4 },
+                { address: '2606:4700:4700::1111', family: 6 },
+            ]);
+        });
+        it('returns a public literal IP without resolving', async () => {
+            const resolver = resolverReturning('10.0.0.1');
+            await expect((0, safe_url_util_1.assertSafeHost)('[2606:4700:4700::1111]', resolver)).resolves.toEqual([
+                { address: '2606:4700:4700::1111', family: 6 },
+            ]);
+            expect(resolver).not.toHaveBeenCalled();
+        });
+        it('refuses a host when ONE of its resolved addresses is private', async () => {
+            const error = await captureError((0, safe_url_util_1.assertSafeHost)('rebind.example', resolverReturning('93.184.216.34', '10.0.0.5')));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+        });
+        it('refuses a host that resolves to no address at all', async () => {
+            const error = await captureError((0, safe_url_util_1.assertSafeHost)('empty.example', resolverReturning()));
+            expect(error).toBeInstanceOf(safe_url_util_1.HostResolutionError);
+            expect(error.resolverCode).toBeNull();
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.UNRESOLVABLE_HOST);
+        });
+        it('refuses an empty bracketed host as an invalid URL', async () => {
+            const error = await captureError((0, safe_url_util_1.assertSafeHost)('[]'));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.INVALID_URL);
+        });
+    });
+    describe('assertSafeRequestUrl', () => {
+        it('accepts a public hostname and returns its validated addresses', async () => {
+            const target = await (0, safe_url_util_1.assertSafeRequestUrl)('https://cdn.example.com/avatar.png', resolverReturning('93.184.216.34'));
+            expect(target.url.hostname).toBe('cdn.example.com');
+            expect(target.addresses).toEqual([{ address: '93.184.216.34', family: 4 }]);
+        });
+        it('accepts a raw public IP host without resolving', async () => {
+            const resolver = resolverReturning();
+            const target = await (0, safe_url_util_1.assertSafeRequestUrl)('https://8.8.8.8/x', resolver);
+            expect(target.addresses).toEqual([{ address: '8.8.8.8', family: 4 }]);
+            expect(resolver).not.toHaveBeenCalled();
+        });
+        it.each(['ftp://example.com/x', 'file:///etc/passwd', 'gopher://127.0.0.1:11211/_stats'])('refuses the scheme of %s as unsupported_scheme', async (url) => {
+            const resolver = resolverReturning('8.8.8.8');
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)(url, resolver));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.UNSUPPORTED_SCHEME);
+            expect(resolver).not.toHaveBeenCalled();
+        });
+        it('refuses an unparseable URL as invalid_url', async () => {
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)('not a url'));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.INVALID_URL);
+        });
+        it.each(['http://127.0.0.1/x', 'http://169.254.169.254/latest/meta-data/', 'http://[::1]/x'])('refuses the raw private host of %s without resolving', async (url) => {
+            const resolver = resolverReturning('8.8.8.8');
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)(url, resolver));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+            expect(resolver).not.toHaveBeenCalled();
+        });
+        it('refuses a hostname when ONE of its resolved addresses is private (private_address)', async () => {
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)('https://evil.example.com/x', resolverReturning('8.8.8.8', '169.254.169.254')));
+            expect(error).toBeInstanceOf(safe_url_util_1.UnsafeDestinationError);
+            expect(error).not.toBeInstanceOf(safe_url_util_1.HostResolutionError);
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+            expect(error.hostname).toBe('evil.example.com');
+        });
+        it.each(['EAI_AGAIN', 'ENOTFOUND', 'ESERVFAIL'])('turns a DNS failure (%s) into a HostResolutionError carrying the resolver code', async (code) => {
+            const resolver = jest.fn(async () => {
+                throw Object.assign(new Error(`getaddrinfo ${code} nope.example.com`), { code });
+            });
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)('https://nope.example.com/x', resolver));
+            expect(error).toBeInstanceOf(safe_url_util_1.HostResolutionError);
+            expect(error.resolverCode).toBe(code);
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.UNRESOLVABLE_HOST);
+            expect(error.message).toBe(`Could not resolve host nope.example.com (${code})`);
+        });
+        it('keeps a null resolverCode when the resolver gives none', async () => {
+            const resolver = jest.fn(async () => {
+                throw new Error('resolution failed');
+            });
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)('https://nope.example.com/x', resolver));
+            expect(error.resolverCode).toBeNull();
+            expect(error.message).toBe('Could not resolve host nope.example.com');
+        });
+        it('refuses a hostname that resolves to an empty list with a HostResolutionError', async () => {
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)('https://empty.example.com/x', resolverReturning()));
+            expect(error).toBeInstanceOf(safe_url_util_1.HostResolutionError);
+        });
+        it('never puts the path or the query of the URL in its messages', async () => {
+            const messages = await Promise.all([
+                captureError((0, safe_url_util_1.assertSafeRequestUrl)('https://evil.example.com/hook/s3cr3t?token=s3cr3t', resolverReturning('10.0.0.1'))),
+                captureError((0, safe_url_util_1.assertSafeRequestUrl)('ftp://example.com/s3cr3t?token=s3cr3t')),
+                captureError((0, safe_url_util_1.assertSafeRequestUrl)('https://nope.example.com/s3cr3t?token=s3cr3t', async () => {
+                    throw new Error('down');
+                })),
+            ]);
+            for (const error of messages) {
+                expect(error.message).not.toContain('s3cr3t');
+            }
+        });
+    });
+    describe('development exception', () => {
+        it('validates nothing and returns addresses: null when set to true outside production', async () => {
+            (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            (0, test_env_util_1.setTestEnv)('NODE_ENV', 'development');
+            const target = await (0, safe_url_util_1.assertSafeRequestUrl)('http://127.0.0.1:3000/hook');
+            expect(target.addresses).toBeNull();
+        });
+        it('is ignored when NODE_ENV is PRODUCTION', async () => {
+            (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            (0, test_env_util_1.setTestEnv)('NODE_ENV', 'PRODUCTION');
+            const error = await captureError((0, safe_url_util_1.assertSafeRequestUrl)('http://127.0.0.1:3000/hook'));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+        });
+        it('is ignored when NODE_ENV is production', async () => {
+            (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            (0, test_env_util_1.setTestEnv)('NODE_ENV', 'production');
+            const error = await captureError((0, safe_url_util_1.assertSafeHost)('127.0.0.1'));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+        });
+        it("is ignored when its value is not exactly 'true'", async () => {
+            (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, '1');
+            const error = await captureError((0, safe_url_util_1.assertSafeHost)('127.0.0.1'));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+        });
+        it('sets no pin: pinnedLookupConfig is empty for an unvalidated target', () => {
+            expect((0, safe_url_util_1.pinnedLookupConfig)({ url: new URL('http://127.0.0.1/'), addresses: null })).toEqual({});
+        });
+    });
+    describe('assertOutboundGuardEnvironment', () => {
+        it.each(['production', 'PRODUCTION'])('throws when the exception is set and NODE_ENV is %s', (nodeEnv) => {
+            expect(() => (0, safe_url_util_1.assertOutboundGuardEnvironment)({
+                NODE_ENV: nodeEnv,
+                [safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV]: 'true',
+            })).toThrow(`${safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV}=true`);
+        });
+        it.each([
+            ['production without the exception', { NODE_ENV: 'production' }],
+            [
+                'development with the exception',
+                { NODE_ENV: 'development', [safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV]: 'true' },
+            ],
+            [
+                "production with a value other than 'true'",
+                { NODE_ENV: 'production', [safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV]: 'false' },
+            ],
+        ])('does not throw for %s', (_case, env) => {
+            expect(() => (0, safe_url_util_1.assertOutboundGuardEnvironment)(env)).not.toThrow();
+        });
+        it('reads process.env by default', () => {
+            (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            (0, test_env_util_1.setTestEnv)('NODE_ENV', 'production');
+            expect(() => (0, safe_url_util_1.assertOutboundGuardEnvironment)()).toThrow();
+        });
+    });
+    describe('isUnsafeDestinationError', () => {
+        it('is true for an UnsafeDestinationError', () => {
+            expect((0, safe_url_util_1.isUnsafeDestinationError)(new safe_url_util_1.UnsafeDestinationError(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS, 'h', 'refused'))).toBe(true);
+        });
+        it('is true for a HostResolutionError', () => {
+            expect((0, safe_url_util_1.isUnsafeDestinationError)(new safe_url_util_1.HostResolutionError('h', 'ENOTFOUND'))).toBe(true);
+        });
+        it('is false for a plain Error', () => {
+            expect((0, safe_url_util_1.isUnsafeDestinationError)(new Error('boom'))).toBe(false);
+        });
+        it('is false for an Error borrowing the name without a known reason', () => {
+            const impostor = Object.assign(new Error('x'), {
+                name: 'UnsafeDestinationError',
+                reason: 'other',
+            });
+            expect((0, safe_url_util_1.isUnsafeDestinationError)(impostor)).toBe(false);
+        });
+        it('recognises an error from another copy of the class by its name and reason', () => {
+            const foreign = Object.assign(new Error('x'), {
+                name: 'UnsafeDestinationError',
+                reason: safe_url_util_1.UnsafeDestinationReason.TOO_MANY_REDIRECTS,
+            });
+            expect((0, safe_url_util_1.isUnsafeDestinationError)(foreign)).toBe(true);
+        });
+    });
+    describe('safeAxiosRequest (transport stubbed)', () => {
+        it('sends nothing when the URL is refused', async () => {
+            const request = jest.spyOn(axios_1.default, 'request');
+            await expect((0, safe_url_util_1.safeAxiosRequest)({ url: 'http://169.254.169.254/latest/meta-data/', method: 'GET' }, { resolver: resolverReturning('8.8.8.8') })).rejects.toBeInstanceOf(safe_url_util_1.UnsafeDestinationError);
+            expect(request).not.toHaveBeenCalled();
+        });
+        it('sends a public URL once, with maxRedirects 0, a pinned lookup and no proxy', async () => {
+            const request = jest.spyOn(axios_1.default, 'request').mockResolvedValueOnce(okResponse());
+            const response = await (0, safe_url_util_1.safeAxiosRequest)({ url: 'https://cdn.example.com/avatar.png', method: 'GET' }, { resolver: resolverReturning('93.184.216.34') });
+            expect(response.status).toBe(200);
+            expect(request).toHaveBeenCalledTimes(1);
+            expect(request.mock.calls[0][0]).toMatchObject({ maxRedirects: 0, proxy: false });
+            expect(typeof request.mock.calls[0][0].lookup).toBe('function');
+        });
+        it('safeAxiosGet sends a GET whatever method the config carries', async () => {
+            const request = jest.spyOn(axios_1.default, 'request').mockResolvedValueOnce(okResponse());
+            await (0, safe_url_util_1.safeAxiosGet)('https://cdn.example.com/x', { method: 'POST' }, { resolver: resolverReturning('93.184.216.34') });
+            expect(request.mock.calls[0][0]).toMatchObject({
+                method: 'GET',
+                url: 'https://cdn.example.com/x',
+            });
+        });
+        it('refuses a redirect to a private address without calling the second host', async () => {
+            const request = jest
+                .spyOn(axios_1.default, 'request')
+                .mockRejectedValueOnce(redirectError('http://169.254.169.254/latest/'));
+            const error = await captureError((0, safe_url_util_1.safeAxiosGet)('https://cdn.example.com/x', {}, { resolver: resolverReturning('93.184.216.34') }));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+            expect(request).toHaveBeenCalledTimes(1);
+        });
+        it('refuses a redirect to a name resolving to a private address without calling it', async () => {
+            const resolver = jest.fn(async (hostname) => hostname === 'cdn.example.com' ? [{ address: '93.184.216.34' }] : [{ address: '10.0.0.7' }]);
+            const request = jest
+                .spyOn(axios_1.default, 'request')
+                .mockRejectedValueOnce(redirectError('https://internal.example.com/admin'));
+            const error = await captureError((0, safe_url_util_1.safeAxiosGet)('https://cdn.example.com/x', {}, { resolver }));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+            expect(resolver).toHaveBeenCalledWith('internal.example.com');
+            expect(request).toHaveBeenCalledTimes(1);
+        });
+        it('follows a redirect to another public URL after re-validating it', async () => {
+            const request = jest
+                .spyOn(axios_1.default, 'request')
+                .mockRejectedValueOnce(redirectError('https://other.example.com/final'))
+                .mockResolvedValueOnce(okResponse('final'));
+            const response = await (0, safe_url_util_1.safeAxiosRequest)({ url: 'https://cdn.example.com/x', method: 'GET' }, { resolver: resolverReturning('93.184.216.34') });
+            expect(response.data).toBe('final');
+            expect(request).toHaveBeenCalledTimes(2);
+            expect(request.mock.calls[1][0]).toMatchObject({ url: 'https://other.example.com/final' });
+        });
+        it('stops after 5 redirects with too_many_redirects', async () => {
+            const request = jest.spyOn(axios_1.default, 'request').mockImplementation(async () => {
+                throw redirectError('https://cdn.example.com/again');
+            });
+            const onSettled = jest.fn();
+            const error = await captureError((0, safe_url_util_1.safeAxiosGet)('https://cdn.example.com/x', {}, { resolver: resolverReturning('93.184.216.34'), onSettled }));
+            expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.TOO_MANY_REDIRECTS);
+            expect(error.message).toBe('Too many redirects (more than 5)');
+            expect(request).toHaveBeenCalledTimes(6);
+            expect(onSettled).toHaveBeenCalledWith({ hops: 5, durationMs: expect.any(Number) });
+        });
+        it('rethrows a non-redirect HTTP error as is', async () => {
+            const failure = new axios_1.AxiosError('boom', 'ERR_BAD_RESPONSE', undefined, undefined, {
+                status: 500,
+                headers: {},
+            });
+            jest.spyOn(axios_1.default, 'request').mockRejectedValueOnce(failure);
+            const error = await captureError((0, safe_url_util_1.safeAxiosGet)('https://cdn.example.com/x', {}, { resolver: resolverReturning('93.184.216.34') }));
+            expect(error).toBe(failure);
+        });
+    });
+    describe('safeAxiosInstanceRequest', () => {
+        it('drives the provided instance, never the global axios', async () => {
+            const globalRequest = jest.spyOn(axios_1.default, 'request');
+            const instanceRequest = jest.fn().mockResolvedValue(okResponse());
+            const instance = { request: instanceRequest };
+            const response = await (0, safe_url_util_1.safeAxiosInstanceRequest)(instance, { url: 'https://cdn.example.com/hook', method: 'POST', data: { a: 1 } }, { resolver: resolverReturning('93.184.216.34') });
+            expect(response.status).toBe(200);
+            expect(instanceRequest).toHaveBeenCalledTimes(1);
+            expect(instanceRequest.mock.calls[0][0]).toMatchObject({
+                url: 'https://cdn.example.com/hook',
+                method: 'POST',
+                data: { a: 1 },
+                maxRedirects: 0,
+                proxy: false,
+            });
+            expect(globalRequest).not.toHaveBeenCalled();
+        });
+        it('does not call the instance when the URL is refused', async () => {
+            const instanceRequest = jest.fn();
+            const instance = { request: instanceRequest };
+            await expect((0, safe_url_util_1.safeAxiosInstanceRequest)(instance, { url: 'http://169.254.169.254/latest/', method: 'POST' }, { resolver: resolverReturning('8.8.8.8') })).rejects.toBeInstanceOf(safe_url_util_1.UnsafeDestinationError);
+            expect(instanceRequest).not.toHaveBeenCalled();
+        });
+        it('follows redirects through the instance too', async () => {
+            const instanceRequest = jest
+                .fn()
+                .mockRejectedValueOnce(redirectError('https://other.example.com/final'))
+                .mockResolvedValueOnce(okResponse('final'));
+            const instance = { request: instanceRequest };
+            const response = await (0, safe_url_util_1.safeAxiosInstanceRequest)(instance, { url: 'https://cdn.example.com/x' }, { resolver: resolverReturning('93.184.216.34') });
+            expect(response.data).toBe('final');
+            expect(instanceRequest).toHaveBeenCalledTimes(2);
+        });
+    });
+    describe('one resolution, one pinned address (ADR-0168)', () => {
+        const connectThroughLookup = (resolver) => {
+            const connectedTo = [];
+            jest.spyOn(axios_1.default, 'request').mockImplementation((async (config) => {
+                const hostname = new URL(config.url).hostname;
+                const addresses = config.lookup
+                    ? await lookupThrough(config.lookup, hostname)
+                    : await resolver(hostname);
+                connectedTo.push(addresses[0].address);
+                return okResponse();
+            }));
+            return connectedTo;
+        };
+        it('resolves the name once per attempt', async () => {
+            const resolver = resolverReturning('93.184.216.34');
+            const connectedTo = connectThroughLookup(resolver);
+            await (0, safe_url_util_1.safeAxiosRequest)({ url: 'https://cdn.example.com/hook', method: 'POST' }, { resolver });
+            expect(resolver).toHaveBeenCalledTimes(1);
+            expect(connectedTo).toEqual(['93.184.216.34']);
+        });
+        it('connects to the validated address even if the name then rebinds to a private one', async () => {
+            const resolver = jest
+                .fn()
+                .mockResolvedValueOnce([{ address: '93.184.216.34' }])
+                .mockResolvedValue([{ address: '10.0.0.7' }]);
+            const connectedTo = connectThroughLookup(resolver);
+            await (0, safe_url_util_1.safeAxiosRequest)({ url: 'https://rebind.example/hook', method: 'POST' }, { resolver });
+            expect(connectedTo).toEqual(['93.184.216.34']);
+        });
+        it('pins each hop to the addresses validated for that hop', async () => {
+            const resolver = jest.fn(async (hostname) => hostname === 'cdn.example.com' ? [{ address: '93.184.216.34' }] : [{ address: '1.1.1.1' }]);
+            const lookups = [];
+            jest.spyOn(axios_1.default, 'request').mockImplementation((async (config) => {
+                const hostname = new URL(config.url).hostname;
+                lookups.push({ hostname, addresses: await lookupThrough(config.lookup, hostname) });
+                if (hostname === 'cdn.example.com') {
+                    throw redirectError('https://other.example.com/final');
+                }
+                return okResponse('final');
+            }));
+            await (0, safe_url_util_1.safeAxiosRequest)({ url: 'https://cdn.example.com/x', method: 'GET' }, { resolver });
+            expect(resolver).toHaveBeenCalledTimes(2);
+            expect(lookups).toEqual([
+                { hostname: 'cdn.example.com', addresses: [{ address: '93.184.216.34', family: 4 }] },
+                { hostname: 'other.example.com', addresses: [{ address: '1.1.1.1', family: 4 }] },
+            ]);
+        });
+        it("does not let a caller's lookup replace the guard's pin", async () => {
+            const resolver = resolverReturning('93.184.216.34');
+            const connectedTo = connectThroughLookup(resolver);
+            const callerLookup = jest.fn((_hostname, _options, cb) => cb(null, [{ address: '10.0.0.7' }]));
+            await (0, safe_url_util_1.safeAxiosRequest)({
+                url: 'https://cdn.example.com/hook',
+                method: 'POST',
+                lookup: callerLookup,
+            }, { resolver });
+            expect(callerLookup).not.toHaveBeenCalled();
+            expect(connectedTo).toEqual(['93.184.216.34']);
+        });
+        it('disables any proxy along with the pin, even one passed by the caller', async () => {
+            const resolver = resolverReturning('93.184.216.34');
+            connectThroughLookup(resolver);
+            await (0, safe_url_util_1.safeAxiosRequest)({
+                url: 'https://cdn.example.com/hook',
+                method: 'POST',
+                proxy: { protocol: 'http', host: 'proxy.internal', port: 3128 },
+            }, { resolver });
+            expect(axios_1.default.request.mock.calls[0][0].proxy).toBe(false);
+        });
+        it('sets no pin under the development exception, which validates nothing', async () => {
+            (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            const request = jest.spyOn(axios_1.default, 'request').mockResolvedValueOnce(okResponse());
+            await (0, safe_url_util_1.safeAxiosRequest)({ url: 'http://127.0.0.1:3000/hook' });
+            expect(request.mock.calls[0][0].lookup).toBeUndefined();
+            expect(request.mock.calls[0][0].proxy).toBeUndefined();
+        });
+    });
+    describe('pinnedLookup', () => {
+        it('answers with the validated addresses for their host', async () => {
+            const lookup = (0, safe_url_util_1.pinnedLookup)('cdn.example.com', [{ address: '93.184.216.34', family: 4 }]);
+            await expect(lookupThrough(lookup, 'cdn.example.com')).resolves.toEqual([
+                { address: '93.184.216.34', family: 4 },
+            ]);
+        });
+        it('refuses to resolve any other name', async () => {
+            const lookup = (0, safe_url_util_1.pinnedLookup)('cdn.example.com', [{ address: '93.184.216.34', family: 4 }]);
+            await expect(lookupThrough(lookup, 'internal.example')).rejects.toThrow('Refusing to resolve internal.example: only cdn.example.com was validated');
+        });
+        it('pinnedLookupConfig strips the brackets of an IPv6 host', async () => {
+            const config = (0, safe_url_util_1.pinnedLookupConfig)({
+                url: new URL('https://[2606:4700:4700::1111]/x'),
+                addresses: [{ address: '2606:4700:4700::1111', family: 6 }],
+            });
+            expect(config.proxy).toBe(false);
+            await expect(lookupThrough(config.lookup, '2606:4700:4700::1111')).resolves.toEqual([{ address: '2606:4700:4700::1111', family: 6 }]);
+        });
+    });
+    describe('redirect policy', () => {
+        const SIGNATURE = 'hmac-of-the-body';
+        const CUSTOM_SIGNATURE_HEADER = 'X-Customer-Signature';
+        const CLIENT_HOST_HEADER = 'internal.client.example';
+        const DELIVERY_TAG = 'delivery-4b7e';
+        const callerHeaders = () => ({
+            'Content-Type': 'application/json',
+            'Content-Length': '42',
+            Authorization: 'Bearer recipient-secret',
+            Cookie: 'session=recipient',
+            [FORM_SIGNATURE_HEADER]: SIGNATURE,
+            [MONITOR_SIGNATURE_HEADER]: SIGNATURE,
+            [CUSTOM_SIGNATURE_HEADER]: SIGNATURE,
+            Host: CLIENT_HOST_HEADER,
+            'X-Delivery-Tag': DELIVERY_TAG,
+        });
+        const sentConfig = (index) => axios_1.default.request.mock.calls[index][0];
+        const deliverThroughRedirect = async (location, status = 302, method = 'POST', options = {}) => {
+            jest
+                .spyOn(axios_1.default, 'request')
+                .mockRejectedValueOnce(redirectError(location, status))
+                .mockResolvedValueOnce(okResponse('delivered'));
+            await (0, safe_url_util_1.safeAxiosRequest)({
+                url: 'https://client.example/hook',
+                method,
+                data: { deliveryId: 'delivery-id' },
+                headers: callerHeaders(),
+            }, {
+                resolver: resolverReturning('93.184.216.34'),
+                confidentialHeaders: [CUSTOM_SIGNATURE_HEADER.toLowerCase()],
+                ...options,
+            });
+        };
+        it('sends the first request with the caller headers untouched', async () => {
+            await deliverThroughRedirect('https://attacker.example/collect', 307);
+            expect(sentConfig(0).headers).toEqual(callerHeaders());
+        });
+        it('drops Authorization, Cookie, every signature and the caller confidential header on a hop to another host', async () => {
+            await deliverThroughRedirect('https://attacker.example/collect', 307);
+            const headers = sentConfig(1).headers;
+            expect(headers.Authorization).toBeUndefined();
+            expect(headers.Cookie).toBeUndefined();
+            expect(headers[FORM_SIGNATURE_HEADER]).toBeUndefined();
+            expect(headers[MONITOR_SIGNATURE_HEADER]).toBeUndefined();
+            expect(headers[CUSTOM_SIGNATURE_HEADER]).toBeUndefined();
+            expect(headers.Host).toBeUndefined();
+            expect(headers['X-Delivery-Tag']).toBe(DELIVERY_TAG);
+        });
+        it('keeps the confidential headers on a hop to a subdomain, but still drops Host', async () => {
+            await deliverThroughRedirect('https://api.client.example/hook', 307);
+            const headers = sentConfig(1).headers;
+            expect(headers.Authorization).toBe('Bearer recipient-secret');
+            expect(headers.Cookie).toBe('session=recipient');
+            expect(headers[FORM_SIGNATURE_HEADER]).toBe(SIGNATURE);
+            expect(headers[CUSTOM_SIGNATURE_HEADER]).toBe(SIGNATURE);
+            expect(headers.Host).toBeUndefined();
+        });
+        it('drops Host on a hop to the same host and keeps the signature', async () => {
+            await deliverThroughRedirect('/hook-v2', 307);
+            expect(sentConfig(1).headers.Host).toBeUndefined();
+            expect(sentConfig(1).headers[FORM_SIGNATURE_HEADER]).toBe(SIGNATURE);
+        });
+        it('drops the confidential headers on a protocol downgrade to the same host', async () => {
+            await deliverThroughRedirect('http://client.example/hook', 307);
+            expect(sentConfig(1).headers.Authorization).toBeUndefined();
+            expect(sentConfig(1).headers[FORM_SIGNATURE_HEADER]).toBeUndefined();
+        });
+        it('does not treat a lookalike suffix as a subdomain', async () => {
+            await deliverThroughRedirect('https://evilclient.example/hook', 307);
+            expect(sentConfig(1).headers[FORM_SIGNATURE_HEADER]).toBeUndefined();
+        });
+        it.each([303, 302])('turns a POST into a GET without body nor content-* on a %s', async (status) => {
+            await deliverThroughRedirect('/hook-v2', status);
+            expect(sentConfig(0).method).toBe('POST');
+            expect(sentConfig(0).data).toEqual({ deliveryId: 'delivery-id' });
+            const next = sentConfig(1);
+            expect(next.method).toBe('GET');
+            expect(next.data).toBeUndefined();
+            expect(next.headers['Content-Type']).toBeUndefined();
+            expect(next.headers['Content-Length']).toBeUndefined();
+            expect(next.headers['X-Delivery-Tag']).toBe(DELIVERY_TAG);
+        });
+        it('keeps the method, the body and its Content-Type on a 307', async () => {
+            await deliverThroughRedirect('/hook-v2', 307);
+            const next = sentConfig(1);
+            expect(next.method).toBe('POST');
+            expect(next.data).toEqual({ deliveryId: 'delivery-id' });
+            expect(next.headers['Content-Type']).toBe('application/json');
+        });
+        it('never brings a dropped body back at a later hop', async () => {
+            jest
+                .spyOn(axios_1.default, 'request')
+                .mockRejectedValueOnce(redirectError('/second', 303))
+                .mockRejectedValueOnce(redirectError('/third', 307))
+                .mockResolvedValueOnce(okResponse());
+            await (0, safe_url_util_1.safeAxiosRequest)({ url: 'https://client.example/hook', method: 'POST', data: { a: 1 } }, { resolver: resolverReturning('93.184.216.34') });
+            expect(sentConfig(2).method).toBe('GET');
+            expect(sentConfig(2).data).toBeUndefined();
+        });
+        describe('requestForRedirect', () => {
+            const from = new URL('https://client.example/hook');
+            it('turns a POST into a GET on a 301', () => {
+                expect((0, safe_url_util_1.requestForRedirect)({ headers: {}, method: 'POST' }, from, from, 301)).toEqual({
+                    headers: {},
+                    method: 'GET',
+                    sendsBody: false,
+                });
+            });
+            it('keeps a PUT on a 302, which only normalises a POST', () => {
+                expect((0, safe_url_util_1.requestForRedirect)({ headers: {}, method: 'PUT' }, from, from, 302).method).toBe('PUT');
+            });
+            it('turns a PUT into a GET on a 303', () => {
+                expect((0, safe_url_util_1.requestForRedirect)({ headers: {}, method: 'PUT' }, from, from, 303).method).toBe('GET');
+            });
+            it('matches the caller confidential headers case-insensitively', () => {
+                const next = (0, safe_url_util_1.requestForRedirect)({ headers: { 'x-customer-signature': 's', Accept: 'json' }, method: 'GET' }, from, new URL('https://attacker.example/'), 307, ['X-Customer-Signature']);
+                expect(next.headers).toEqual({ Accept: 'json' });
+            });
+        });
+    });
+    describe('isOutboundDeadlineError', () => {
+        it.each(['ECONNABORTED', 'ETIMEDOUT', 'ERR_CANCELED'])('is true for an axios error %s without response', (code) => {
+            expect((0, safe_url_util_1.isOutboundDeadlineError)(new axios_1.AxiosError('x', code))).toBe(true);
+        });
+        it('is false with a response, another code, or a non-axios error', () => {
+            const answered = new axios_1.AxiosError('x', 'ETIMEDOUT', undefined, undefined, {
+                status: 504,
+                headers: {},
+            });
+            expect((0, safe_url_util_1.isOutboundDeadlineError)(answered)).toBe(false);
+            expect((0, safe_url_util_1.isOutboundDeadlineError)(new axios_1.AxiosError('x', 'ECONNREFUSED'))).toBe(false);
+            expect((0, safe_url_util_1.isOutboundDeadlineError)(new Error('ETIMEDOUT'))).toBe(false);
+        });
+    });
+    describe('real HTTP', () => {
+        let server;
+        let port;
+        let baseUrl;
+        let handler;
+        beforeAll(async () => {
+            server = http.createServer((req, res) => handler(req, res));
+            await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+            port = server.address().port;
+            baseUrl = `http://127.0.0.1:${port}`;
+        });
+        afterAll(async () => {
+            server.closeAllConnections();
+            await new Promise((resolve) => server.close(() => resolve()));
+        });
+        describe('address pinning with the exception disarmed', () => {
+            it('connects to the pinned address while Host keeps the name', async () => {
+                let receivedHost;
+                handler = (req, res) => {
+                    receivedHost = req.headers.host;
+                    res.writeHead(200, { 'content-type': 'text/plain' }).end('pinned');
+                };
+                const response = await axios_1.default.get(`http://pinned.invalid:${port}/ok`, {
+                    lookup: (0, safe_url_util_1.pinnedLookup)('pinned.invalid', [{ address: '127.0.0.1', family: 4 }]),
+                    proxy: false,
+                });
+                expect(response.data).toBe('pinned');
+                expect(receivedHost).toBe(`pinned.invalid:${port}`);
+            });
+            it('refuses a connection to a name the pin did not validate', async () => {
+                let reached = false;
+                handler = (_req, res) => {
+                    reached = true;
+                    res.writeHead(200).end();
+                };
+                await expect(axios_1.default.get(`http://other.invalid:${port}/ok`, {
+                    lookup: (0, safe_url_util_1.pinnedLookup)('pinned.invalid', [{ address: '127.0.0.1', family: 4 }]),
+                    proxy: false,
+                })).rejects.toThrow('Refusing to resolve other.invalid: only pinned.invalid was validated');
+                expect(reached).toBe(false);
+            });
+            it('refuses the local server itself through the guard', async () => {
+                let reached = false;
+                handler = (_req, res) => {
+                    reached = true;
+                    res.writeHead(200).end();
+                };
+                const error = await captureError((0, safe_url_util_1.safeAxiosGet)(`${baseUrl}/ok`));
+                expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.PRIVATE_ADDRESS);
+                expect(reached).toBe(false);
+            });
+        });
+        const redirectChain = (delayMs, last) => {
+            handler = (req, res) => {
+                const n = Number((req.url ?? '').split('/')[2]);
+                setTimeout(() => {
+                    if (n >= last) {
+                        res.writeHead(200, { 'content-type': 'text/plain' }).end('final');
+                        return;
+                    }
+                    res.writeHead(302, { location: `/hop/${n + 1}` }).end();
+                }, delayMs);
+            };
+        };
+        const variants = [
+            ['safeAxiosRequest', (config, options) => (0, safe_url_util_1.safeAxiosRequest)(config, options)],
+            [
+                'safeAxiosInstanceRequest',
+                (config, options) => (0, safe_url_util_1.safeAxiosInstanceRequest)(axios_1.default.create(), config, options),
+            ],
+        ];
+        describe.each(variants)('total deadline through %s', (_name, send) => {
+            beforeEach(() => {
+                (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            });
+            it('fails a slow redirect chain at the attempt deadline with ETIMEDOUT', async () => {
+                redirectChain(150, 5);
+                const onSettled = jest.fn();
+                const startedAt = Date.now();
+                const error = (await captureError(send({ url: `${baseUrl}/hop/0`, timeout: 400 }, { onSettled })));
+                expect(error.code).toBe('ETIMEDOUT');
+                expect(error.response).toBeUndefined();
+                expect(error.message).toBe('Outbound deadline of 400ms exceeded');
+                expect((0, safe_url_util_1.isOutboundDeadlineError)(error)).toBe(true);
+                expect(Date.now() - startedAt).toBeLessThan(400 + 300);
+                expect(onSettled).toHaveBeenCalledTimes(1);
+                expect(onSettled.mock.calls[0][0].hops).toBeGreaterThanOrEqual(1);
+            });
+            it('cuts a drip-fed response at the deadline', async () => {
+                handler = (_req, res) => {
+                    res.writeHead(200, { 'content-type': 'text/plain' });
+                    const drip = setInterval(() => res.write('.'), 50);
+                    res.on('close', () => clearInterval(drip));
+                };
+                const startedAt = Date.now();
+                const error = (await captureError(send({ url: `${baseUrl}/drip`, timeout: 300 })));
+                expect(error.code).toBe('ETIMEDOUT');
+                expect(Date.now() - startedAt).toBeLessThan(300 + 300);
+            });
+            it('cuts a DNS resolution that never answers at the deadline', async () => {
+                (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, undefined);
+                const resolver = hangingResolver();
+                const onSettled = jest.fn();
+                const startedAt = Date.now();
+                const error = (await captureError(send({ url: 'https://silent-dns.example/cron', timeout: 200 }, { resolver, onSettled })));
+                expect(resolver).toHaveBeenCalledWith('silent-dns.example');
+                expect(error.code).toBe('ETIMEDOUT');
+                expect(error.message).toBe('Outbound deadline of 200ms exceeded');
+                expect(Date.now() - startedAt).toBeLessThan(200 + 300);
+                expect(onSettled).toHaveBeenCalledWith({ hops: 0, durationMs: expect.any(Number) });
+            });
+            it('succeeds in one healthy hop', async () => {
+                handler = (_req, res) => res.writeHead(200, { 'content-type': 'text/plain' }).end('ok');
+                const onSettled = jest.fn();
+                const response = await send({ url: `${baseUrl}/ok` }, { onSettled });
+                expect(response.data).toBe('ok');
+                expect(onSettled).toHaveBeenCalledWith({ hops: 0, durationMs: expect.any(Number) });
+            });
+            it('succeeds through redirects under the deadline and counts its hops', async () => {
+                redirectChain(20, 2);
+                const onSettled = jest.fn();
+                const response = await send({ url: `${baseUrl}/hop/0`, timeout: 2000 }, { onSettled });
+                expect(response.data).toBe('final');
+                expect(onSettled.mock.calls[0][0].hops).toBe(2);
+            });
+            it('refuses beyond 5 real redirects', async () => {
+                handler = (req, res) => res.writeHead(302, { location: `${req.url}/x` }).end();
+                const error = await captureError(send({ url: `${baseUrl}/loop`, timeout: 2000 }));
+                expect(error.reason).toBe(safe_url_util_1.UnsafeDestinationReason.TOO_MANY_REDIRECTS);
+            });
+            it('keeps a cancellation by the caller signal an ERR_CANCELED', async () => {
+                handler = () => undefined;
+                const controller = new AbortController();
+                setTimeout(() => controller.abort(), 50);
+                const error = (await captureError(send({ url: `${baseUrl}/pending`, timeout: 2000, signal: controller.signal })));
+                expect(error.code).toBe('ERR_CANCELED');
+                expect(error.message).not.toMatch(/Outbound deadline/);
+            });
+            it('lets the caller signal interrupt a DNS resolution that never answers', async () => {
+                (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, undefined);
+                const controller = new AbortController();
+                setTimeout(() => controller.abort(), 50);
+                const startedAt = Date.now();
+                const error = (await captureError(send({ url: 'https://silent-dns.example/cron', timeout: 2000, signal: controller.signal }, { resolver: hangingResolver() })));
+                expect(error.code).toBe('ERR_CANCELED');
+                expect(Date.now() - startedAt).toBeLessThan(50 + 300);
+            });
+            it('removes its listener from the caller signal once the attempt is over', async () => {
+                handler = (_req, res) => res.writeHead(200, { 'content-type': 'text/plain' }).end('ok');
+                const controller = new AbortController();
+                const add = jest.spyOn(controller.signal, 'addEventListener');
+                const remove = jest.spyOn(controller.signal, 'removeEventListener');
+                await send({ url: `${baseUrl}/ok`, signal: controller.signal });
+                expect(add).toHaveBeenCalledTimes(1);
+                expect(remove).toHaveBeenCalledWith('abort', add.mock.calls[0][1]);
+            });
+        });
+        describe('deadline details', () => {
+            beforeEach(() => {
+                (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, 'true');
+            });
+            it('does not cut a stream after its headers: the deadline stops at the response', async () => {
+                handler = (_req, res) => {
+                    res.writeHead(200, { 'content-type': 'application/octet-stream' });
+                    let sent = 0;
+                    const chunks = setInterval(() => {
+                        sent += 1;
+                        res.write(`chunk${sent};`);
+                        if (sent === 8) {
+                            clearInterval(chunks);
+                            res.end();
+                        }
+                    }, 100);
+                    res.on('close', () => clearInterval(chunks));
+                };
+                const response = await (0, safe_url_util_1.safeAxiosRequest)({
+                    url: `${baseUrl}/stream`,
+                    responseType: 'stream',
+                    timeout: 300,
+                });
+                let body = '';
+                for await (const chunk of response.data) {
+                    body += chunk.toString();
+                }
+                expect(body).toBe(Array.from({ length: 8 }, (_, index) => `chunk${index + 1};`).join(''));
+            });
+            it.each(['ECONNABORTED', 'ETIMEDOUT'])('turns a hop inactivity timeout (%s, no response) into the deadline error, without the headers', async (code) => {
+                jest
+                    .spyOn(axios_1.default, 'request')
+                    .mockRejectedValueOnce(new axios_1.AxiosError('timeout of 2000ms exceeded', code));
+                const error = (await captureError((0, safe_url_util_1.safeAxiosRequest)({
+                    url: `${baseUrl}/idle`,
+                    timeout: 2000,
+                    headers: { Authorization: 'Bearer secret' },
+                })));
+                expect(error.code).toBe('ETIMEDOUT');
+                expect(error.message).toBe('Outbound deadline of 2000ms exceeded');
+                expect(error.config?.url).toBe(`${baseUrl}/idle`);
+                expect(error.config?.headers.Authorization).toBeUndefined();
+            });
+            it('honours the deadline passed by the caller', async () => {
+                (0, test_env_util_1.setTestEnv)(safe_url_util_1.ALLOW_PRIVATE_OUTBOUND_TARGETS_ENV, undefined);
+                const startedAt = Date.now();
+                const error = (await captureError((0, safe_url_util_1.safeAxiosRequest)({ url: 'https://silent-dns.example/cron', timeout: 1000 }, { resolver: hangingResolver() })));
+                expect(error.message).toBe('Outbound deadline of 1000ms exceeded');
+                expect(Date.now() - startedAt).toBeGreaterThanOrEqual(950);
+                expect(Date.now() - startedAt).toBeLessThan(1000 + 500);
+            });
+        });
+    });
+});
+//# sourceMappingURL=safe-url.util.spec.js.map