@antasphere/chassis-server 1.1.0 → 1.2.0

package/test/unit/secret-box.test.ts

@@ -0,0 +1,124 @@
+import { describe, expect, it } from 'vitest';
+import { createSecretBox, SecretBoxError } from '../../src/secret-box.js';
+
+/**
+ * The readable-secret box: AES-256-GCM under an HKDF key per (auth secret,
+ * info). Every refusal is a SecretBoxError, a malformed string included, and
+ * nothing that was changed ever opens to garbage.
+ */
+
+const AUTH_SECRET = 'unit-test-secret-0123456789abcdef0123456789abcdef';
+const INFO = 'webhooks:signing-secret';
+const PLAIN = 'whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw';
+
+const box = createSecretBox(AUTH_SECRET, INFO);
+
+/** Flip one bit of the decoded bytes of part `index` (1 = iv, 2 = tag, 3 = ciphertext). */
+function flipByte(sealed: string, index: 1 | 2 | 3): string {
+  const parts = sealed.split('.');
+  const bytes = Buffer.from(parts[index]!, 'base64url');
+  bytes[0] = bytes[0]! ^ 0x01;
+  parts[index] = bytes.toString('base64url');
+  return parts.join('.');
+}
+
+function expectRefused(open: () => string): void {
+  let thrown: unknown;
+  try {
+    open();
+  } catch (error) {
+    thrown = error;
+  }
+  expect(thrown).toBeInstanceOf(SecretBoxError);
+}
+
+describe('createSecretBox', () => {
+  it('round-trips a value', () => {
+    expect(box.open(box.seal(PLAIN))).toBe(PLAIN);
+  });
+
+  it('round-trips the empty string', () => {
+    expect(box.open(box.seal(''))).toBe('');
+  });
+
+  it('spells v1.<iv>.<tag>.<ciphertext> in base64url without the plaintext', () => {
+    const sealed = box.seal(PLAIN);
+    const parts = sealed.split('.');
+    expect(parts).toHaveLength(4);
+    expect(parts[0]).toBe('v1');
+    expect(Buffer.from(parts[1]!, 'base64url')).toHaveLength(12);
+    expect(Buffer.from(parts[2]!, 'base64url')).toHaveLength(16);
+    for (const part of parts.slice(1)) expect(part).toMatch(/^[A-Za-z0-9_-]+$/);
+    expect(sealed).not.toContain('MfKQ9r8');
+  });
+
+  it('seals one value twice to two different strings, both of which open', () => {
+    const first = box.seal(PLAIN);
+    const second = box.seal(PLAIN);
+    expect(first).not.toBe(second);
+    expect(first.split('.')[1]).not.toBe(second.split('.')[1]);
+    expect(box.open(first)).toBe(PLAIN);
+    expect(box.open(second)).toBe(PLAIN);
+  });
+
+  it.each([
+    ['the iv', 1],
+    ['the tag', 2],
+    ['the ciphertext', 3]
+  ] as const)('refuses a flipped byte in %s', (_name, index) => {
+    const sealed = box.seal(PLAIN);
+    expectRefused(() => box.open(flipByte(sealed, index)));
+  });
+
+  it('refuses a value sealed under another info', () => {
+    const other = createSecretBox(AUTH_SECRET, 'webhooks:other-purpose');
+    expectRefused(() => other.open(box.seal(PLAIN)));
+    expectRefused(() => box.open(other.seal(PLAIN)));
+  });
+
+  it('refuses a value sealed under another auth secret', () => {
+    const other = createSecretBox('another-auth-secret-0123456789abcdef0123456789', INFO);
+    expectRefused(() => other.open(box.seal(PLAIN)));
+  });
+
+  it('opens a value sealed by another box of the same auth secret and info', () => {
+    const twin = createSecretBox(AUTH_SECRET, INFO);
+    expect(twin.open(box.seal(PLAIN))).toBe(PLAIN);
+  });
+
+  it('keeps unicode plaintext intact', () => {
+    const unicode = 'clé secrète: 🔐 — 秘密 — Ωμέγα\u0000end';
+    expect(box.open(box.seal(unicode))).toBe(unicode);
+  });
+
+  describe('a malformed string is a SecretBoxError and nothing else', () => {
+    const sealed = box.seal(PLAIN);
+    const [, iv, tag, ciphertext] = sealed.split('.') as [string, string, string, string];
+    const cases: Array<[string, unknown]> = [
+      ['the empty string', ''],
+      ['no separators', 'garbage'],
+      ['three parts', `v1.${iv}.${tag}`],
+      ['five parts', `${sealed}.extra`],
+      ['an unknown version', `v2.${iv}.${tag}.${ciphertext}`],
+      ['an empty version', `.${iv}.${tag}.${ciphertext}`],
+      ['a short iv', `v1.${iv.slice(0, 8)}.${tag}.${ciphertext}`],
+      ['a long iv', `v1.${iv}AAAA.${tag}.${ciphertext}`],
+      ['an empty iv', `v1..${tag}.${ciphertext}`],
+      ['a short tag', `v1.${iv}.${tag.slice(0, 10)}.${ciphertext}`],
+      ['an empty tag', `v1.${iv}..${ciphertext}`],
+      ['an empty ciphertext', `v1.${iv}.${tag}.`],
+      ['a character outside base64url', `v1.${iv}.${tag}.${ciphertext}*`],
+      ['standard base64 characters', `v1.${iv}.${tag}.+/${ciphertext}`],
+      ['a non-string', null],
+      ['a number', 42]
+    ];
+    it.each(cases)('refuses %s', (_name, input) => {
+      expectRefused(() => box.open(input as string));
+    });
+  });
+
+  it('refuses an empty auth secret or an empty info', () => {
+    expect(() => createSecretBox('', INFO)).toThrow(SecretBoxError);
+    expect(() => createSecretBox(AUTH_SECRET, '')).toThrow(SecretBoxError);
+  });
+});

package/test/unit/tx-send.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from 'vitest';
+import pg from 'pg';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { connectionOf } from '../../src/webhooks/tx-send.js';
+
+/**
+ * The transactional send reaches the connection behind a drizzle handle
+ * through the driver binding's session (`session.client`): this pins the
+ * shape against the installed drizzle, so a bump that moves it fails here
+ * and not in a delivery.
+ */
+describe('tx-send: the connection behind a drizzle handle', () => {
+  it('a plain handle exposes its pool, with query', () => {
+    const pool = new pg.Pool({ connectionString: 'postgres://nobody@127.0.0.1:1/none' });
+    const db = drizzle(pool);
+    expect(connectionOf(db)).toBe(pool);
+    expect(typeof connectionOf(db).query).toBe('function');
+  });
+
+  it('something that is not a drizzle handle is refused, naming the shape', () => {
+    expect(() => connectionOf({} as never)).toThrow(/session\.client/);
+  });
+});

package/test/unit/webhook-catalog.test.ts

@@ -0,0 +1,151 @@
+import { describe, expect, it } from 'vitest';
+import { z } from 'zod';
+import {
+  buildWebhookCatalog,
+  catalogToWire,
+  CHASSIS_WEBHOOK_EVENTS,
+  type WebhookCatalogDeclaration,
+  type WebhookEventDeclaration
+} from '../../src/webhooks/catalog.js';
+
+/**
+ * The boot check of the webhooks catalog (PRDCT-3482, verifier round 1, G7):
+ * the chassis's events merged with the tool's, every fault named at boot, and
+ * the wire form `GET /webhooks/events` answers.
+ */
+
+const thingCreated: WebhookEventDeclaration = {
+  type: 'thing.created',
+  description: 'A thing was created.',
+  subjects: ['thing', 'project'],
+  data: z.object({ thingId: z.string(), name: z.string() })
+};
+
+const tool = (over: Partial<WebhookCatalogDeclaration> = {}): WebhookCatalogDeclaration => ({
+  subjects: { thing: { field: 'thingId', description: 'A thing, by id' } },
+  events: [thingCreated],
+  ...over
+});
+
+describe('buildWebhookCatalog', () => {
+  it('merges the chassis events with the tool events', () => {
+    const catalog = buildWebhookCatalog(tool());
+    for (const e of CHASSIS_WEBHOOK_EVENTS) expect(catalog.events.has(e.type), e.type).toBe(true);
+    expect(catalog.events.get('thing.created')).toBe(thingCreated);
+    expect(Object.keys(catalog.subjects).sort()).toEqual(['project', 'thing']);
+  });
+
+  it('a tool with no webhooks slot gets the chassis catalog alone', () => {
+    const catalog = buildWebhookCatalog(undefined);
+    expect([...catalog.events.keys()].sort()).toEqual(CHASSIS_WEBHOOK_EVENTS.map((e) => e.type).sort());
+    expect(catalog.subjects.project).toMatchObject({ field: 'projectId' });
+  });
+
+  it('refuses a type declared twice', () => {
+    expect(() => buildWebhookCatalog(tool({ events: [thingCreated, { ...thingCreated }] }))).toThrow(
+      /"thing\.created" is declared twice/
+    );
+  });
+
+  it('refuses a tool re-declaring a chassis type', () => {
+    expect(() =>
+      buildWebhookCatalog(tool({ events: [{ ...thingCreated, type: 'project.created' }] }))
+    ).toThrow(/"project\.created" is declared twice/);
+  });
+
+  it('refuses an event carrying a subject nobody declared', () => {
+    expect(() =>
+      buildWebhookCatalog(tool({ events: [{ ...thingCreated, subjects: ['thing', 'widget'] }] }))
+    ).toThrow(/carries the subject "widget", which webhooks\.subjects does not declare/);
+  });
+
+  it.each(['Thing.created', 'thing', 'thing.created.now', 'thing-x.created', '1thing.created', 'thing.'])(
+    'refuses the malformed type %s',
+    (type) => {
+      expect(() => buildWebhookCatalog(tool({ events: [{ ...thingCreated, type }] }))).toThrow(
+        /must be family\.verb/
+      );
+    }
+  );
+
+  it.each(['*', 'thing.*'])('refuses the pattern %s as a type', (type) => {
+    expect(() => buildWebhookCatalog(tool({ events: [{ ...thingCreated, type }] }))).toThrow(
+      new RegExp(`"${type.replace(/[.*]/g, '\\$&')}"`)
+    );
+  });
+
+  it('refuses an event without a description', () => {
+    expect(() => buildWebhookCatalog(tool({ events: [{ ...thingCreated, description: '' }] }))).toThrow(
+      /"thing\.created" needs a description/
+    );
+  });
+
+  it('refuses a malformed subject key and a subject without a field', () => {
+    expect(() =>
+      buildWebhookCatalog(tool({ subjects: { 'Bad-Key': { field: 'x', description: 'x' } } }))
+    ).toThrow(/webhooks\.subjects key "Bad-Key"/);
+    expect(() => buildWebhookCatalog(tool({ subjects: { thing: { field: '', description: 'x' } } }))).toThrow(
+      /webhooks\.subjects\.thing\.field is required/
+    );
+  });
+
+  it('accepts a tool renaming the project subject’s field (a list under projectIds)', () => {
+    const catalog = buildWebhookCatalog(
+      tool({
+        subjects: {
+          thing: { field: 'thingId', description: 'A thing, by id' },
+          project: { field: 'projectIds', description: 'The projects of a thing', list: true }
+        }
+      })
+    );
+    expect(catalog.subjects.project).toEqual({
+      field: 'projectIds',
+      description: 'The projects of a thing',
+      list: true
+    });
+    // The chassis's own project events now carry the tool's declaration.
+    expect(catalog.events.get('project.created')?.subjects).toEqual(['project']);
+  });
+});
+
+describe('catalogToWire', () => {
+  it('carries list: true for a list subject and false otherwise, and the JSON Schema of every event', () => {
+    const wire = catalogToWire(
+      buildWebhookCatalog(
+        tool({
+          subjects: {
+            thing: { field: 'thingId', description: 'A thing, by id' },
+            project: { field: 'projectIds', description: 'The projects of a thing', list: true }
+          }
+        })
+      )
+    );
+    expect(wire.subjects).toEqual(
+      expect.arrayContaining([
+        { key: 'thing', field: 'thingId', description: 'A thing, by id', list: false },
+        { key: 'project', field: 'projectIds', description: 'The projects of a thing', list: true }
+      ])
+    );
+    expect(wire.subjects).toHaveLength(2);
+    const created = wire.events.find((e) => e.type === 'thing.created');
+    expect(created).toMatchObject({
+      description: 'A thing was created.',
+      subjects: ['thing', 'project'],
+      schema: {
+        type: 'object',
+        properties: { thingId: { type: 'string' }, name: { type: 'string' } },
+        required: ['thingId', 'name']
+      }
+    });
+    expect(wire.events.map((e) => e.type)).toEqual(
+      expect.arrayContaining(['webhook.ping', 'project.created', 'thing.created'])
+    );
+  });
+
+  it('the chassis’s own project subject reads list: false', () => {
+    const wire = catalogToWire(buildWebhookCatalog(undefined));
+    expect(wire.subjects).toEqual([
+      { key: 'project', field: 'projectId', description: expect.any(String), list: false }
+    ]);
+  });
+});

package/test/unit/webhook-env.test.ts

@@ -0,0 +1,60 @@
+import { describe, expect, it } from 'vitest';
+import { buildEnvSchema } from '../../src/env.js';
+
+/**
+ * The webhooks' environment (PRDCT-3482, verifier round 1, G8): the switch
+ * that opens private networks is refused on the cloud edition, by name, and
+ * the delivery log's retention defaults to thirty days.
+ */
+
+const schema = buildEnvSchema({ version: '0.0.0-test' });
+const BASE = { DATABASE_URL: 'postgres://u:p@localhost:5432/db' };
+const CLOUD = {
+  ...BASE,
+  EDITION: 'cloud',
+  HUB_ISSUER_URL: 'https://account.example.com',
+  HUB_CLIENT_ID: 'tool-client',
+  HUB_CLIENT_SECRET: 'a-hub-client-secret-of-length'
+};
+
+const issuesOf = (source: Record<string, string>) => {
+  const result = schema.safeParse(source);
+  return result.success
+    ? []
+    : result.error.issues.map((i) => ({ key: i.path.join('.'), message: i.message }));
+};
+
+describe('WEBHOOKS_ALLOW_PRIVATE_NETWORKS', () => {
+  it('is refused on EDITION=cloud, naming the key', () => {
+    const issues = issuesOf({ ...CLOUD, WEBHOOKS_ALLOW_PRIVATE_NETWORKS: 'true' });
+    expect(issues).toEqual([
+      { key: 'WEBHOOKS_ALLOW_PRIVATE_NETWORKS', message: expect.stringMatching(/never on EDITION=cloud/) }
+    ]);
+  });
+
+  it('a cloud env without it parses (the refusal is the switch, not the edition)', () => {
+    expect(issuesOf(CLOUD)).toEqual([]);
+    expect(
+      schema.parse({ ...CLOUD, WEBHOOKS_ALLOW_PRIVATE_NETWORKS: 'false' }).WEBHOOKS_ALLOW_PRIVATE_NETWORKS
+    ).toBe(false);
+  });
+
+  it('parses true on oss, and defaults to false', () => {
+    expect(
+      schema.parse({ ...BASE, WEBHOOKS_ALLOW_PRIVATE_NETWORKS: 'true' }).WEBHOOKS_ALLOW_PRIVATE_NETWORKS
+    ).toBe(true);
+    expect(schema.parse(BASE).WEBHOOKS_ALLOW_PRIVATE_NETWORKS).toBe(false);
+  });
+});
+
+describe('WEBHOOK_DELIVERY_RETENTION_DAYS', () => {
+  it('defaults to 30, takes 0 (keep forever), refuses a negative', () => {
+    expect(schema.parse(BASE).WEBHOOK_DELIVERY_RETENTION_DAYS).toBe(30);
+    expect(
+      schema.parse({ ...BASE, WEBHOOK_DELIVERY_RETENTION_DAYS: '0' }).WEBHOOK_DELIVERY_RETENTION_DAYS
+    ).toBe(0);
+    expect(issuesOf({ ...BASE, WEBHOOK_DELIVERY_RETENTION_DAYS: '-1' }).map((i) => i.key)).toEqual([
+      'WEBHOOK_DELIVERY_RETENTION_DAYS'
+    ]);
+  });
+});

package/test/unit/webhook-jobs.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { Logger } from '../../src/logger.js';
+import { webhookJobs } from '../../src/webhooks/jobs.js';
+import {
+  MAX_IN_FLIGHT_PER_ENDPOINT,
+  WEBHOOK_DELIVERIES_HELD_QUEUE,
+  WEBHOOK_DELIVERIES_QUEUE,
+  WEBHOOK_EVENTS_QUEUE,
+  WEBHOOK_PURGE_QUEUE,
+  WebhookDeliveryDeferred,
+  WebhookDeliveryFailed,
+  type WebhookService
+} from '../../src/webhooks/service.js';
+
+/**
+ * The webhooks' queue declarations (verifier round 2, MJ-R2-1): the two
+ * queues that must drain a burst poll every half second, the delivery queue
+ * runs eight pollers, and an attempt the per-endpoint bound defers goes back
+ * in the queue with its retry budget untouched (the job completes), while a
+ * failed attempt still throws so pg-boss retries it.
+ */
+
+const logger = { debug: vi.fn(), info: vi.fn(), warn: vi.fn(), error: vi.fn() } as unknown as Logger;
+
+function fakeService(attempt: (id: string) => Promise<unknown>) {
+  const requeue = vi.fn(async (_id: string, _inSeconds: number) => undefined);
+  const service = {
+    dials: { retryLimit: 2, retryDelaySeconds: 1 },
+    attempt: vi.fn(async (id: string) => attempt(id)),
+    requeue,
+    fanOut: vi.fn(async () => 0),
+    hold: vi.fn(async () => undefined),
+    purge: vi.fn(async () => 0)
+  } as unknown as WebhookService;
+  return { service, requeue };
+}
+
+const jobOf = (service: WebhookService, queue: string) => {
+  const job = webhookJobs(service, logger, 30).find((j) => j.queue === queue);
+  expect(job, `no declaration for ${queue}`).toBeDefined();
+  return job!;
+};
+
+const META = { id: 'job-1', queue: WEBHOOK_DELIVERIES_QUEUE, key: null };
+
+describe('webhookJobs', () => {
+  it('the fan-out and the delivery queues poll every half second; the held queue and the purge keep the default', () => {
+    const { service } = fakeService(async () => null);
+    const byQueue = new Map(webhookJobs(service, logger, 30).map((j) => [j.queue, j]));
+    expect(byQueue.get(WEBHOOK_EVENTS_QUEUE)).toMatchObject({ concurrency: 2, pollingIntervalSeconds: 0.5 });
+    expect(byQueue.get(WEBHOOK_DELIVERIES_QUEUE)).toMatchObject({
+      concurrency: 8,
+      pollingIntervalSeconds: 0.5
+    });
+    expect(byQueue.get(WEBHOOK_DELIVERIES_HELD_QUEUE)?.pollingIntervalSeconds).toBeUndefined();
+    expect(byQueue.get(WEBHOOK_PURGE_QUEUE)?.pollingIntervalSeconds).toBeUndefined();
+  });
+
+  it('the bound leaves room for other endpoints: two per endpoint of the eight pollers', () => {
+    expect(MAX_IN_FLIGHT_PER_ENDPOINT).toBe(2);
+    const { service } = fakeService(async () => null);
+    expect(jobOf(service, WEBHOOK_DELIVERIES_QUEUE).concurrency).toBeGreaterThan(MAX_IN_FLIGHT_PER_ENDPOINT);
+  });
+
+  it('a deferred attempt is put back in the queue two seconds later and the job completes', async () => {
+    const { service, requeue } = fakeService(async (id) => {
+      throw new WebhookDeliveryDeferred(id);
+    });
+    const job = jobOf(service, WEBHOOK_DELIVERIES_QUEUE);
+    vi.mocked(logger.warn).mockClear();
+    await expect(job.handler({ deliveryId: 'd-1' }, META)).resolves.toBeUndefined();
+    expect(requeue).toHaveBeenCalledTimes(1);
+    expect(requeue).toHaveBeenCalledWith('d-1', 2);
+    expect(logger.warn).not.toHaveBeenCalled();
+  });
+
+  it('a failed attempt throws so pg-boss retries it, and is never requeued by hand', async () => {
+    const { service, requeue } = fakeService(async (id) => {
+      throw new WebhookDeliveryFailed(id, 'HTTP 500');
+    });
+    const job = jobOf(service, WEBHOOK_DELIVERIES_QUEUE);
+    await expect(job.handler({ deliveryId: 'd-2' }, META)).rejects.toBeInstanceOf(WebhookDeliveryFailed);
+    expect(requeue).not.toHaveBeenCalled();
+  });
+
+  it('a delivered attempt neither throws nor requeues', async () => {
+    const { service, requeue } = fakeService(async () => ({ status: 'delivered' }));
+    const job = jobOf(service, WEBHOOK_DELIVERIES_QUEUE);
+    await expect(job.handler({ deliveryId: 'd-3' }, META)).resolves.toBeUndefined();
+    expect(requeue).not.toHaveBeenCalled();
+  });
+});

package/test/unit/webhook-match.test.ts

@@ -0,0 +1,81 @@
+import { describe, expect, it } from 'vitest';
+import { endpointWants, matchesEventType, matchesFilters } from '../../src/webhooks/match.js';
+
+/**
+ * The subscription rule (PRDCT-3482, verifier round 1, G7): an endpoint's
+ * event patterns against a type, its filters against the event's subjects.
+ */
+
+describe('matchesEventType', () => {
+  it('`*` matches every type', () => {
+    expect(matchesEventType(['*'], 'thing.created')).toBe(true);
+    expect(matchesEventType(['*'], 'webhook.ping')).toBe(true);
+  });
+
+  it('a family matches its own types only', () => {
+    expect(matchesEventType(['thing.*'], 'thing.created')).toBe(true);
+    expect(matchesEventType(['thing.*'], 'thing.deleted')).toBe(true);
+    expect(matchesEventType(['thing.*'], 'project.created')).toBe(false);
+    // A family is the whole segment before the dot, never a prefix of it.
+    expect(matchesEventType(['thing.*'], 'things.created')).toBe(false);
+    expect(matchesEventType(['thin.*'], 'thing.created')).toBe(false);
+  });
+
+  it('an exact type matches itself only', () => {
+    expect(matchesEventType(['thing.created'], 'thing.created')).toBe(true);
+    expect(matchesEventType(['thing.created'], 'thing.deleted')).toBe(false);
+  });
+
+  it('any of several patterns; none is no match', () => {
+    expect(matchesEventType(['project.created', 'thing.deleted'], 'thing.deleted')).toBe(true);
+    expect(matchesEventType(['project.created', 'thing.deleted'], 'thing.created')).toBe(false);
+    expect(matchesEventType([], 'thing.created')).toBe(false);
+  });
+});
+
+describe('matchesFilters', () => {
+  it('an empty filter matches everything, an event with no subject included', () => {
+    expect(matchesFilters({}, {})).toBe(true);
+    expect(matchesFilters({}, { thing: 't1' })).toBe(true);
+  });
+
+  it('a key with no ids is no constraint', () => {
+    expect(matchesFilters({ project: [] }, { thing: 't1' })).toBe(true);
+  });
+
+  it('OR within one key: any id matches, on a scalar or a list', () => {
+    expect(matchesFilters({ thing: ['t1', 't2'] }, { thing: 't2' })).toBe(true);
+    expect(matchesFilters({ thing: ['t1', 't2'] }, { thing: 't3' })).toBe(false);
+    expect(matchesFilters({ project: ['p9'] }, { project: ['p1', 'p9'] })).toBe(true);
+    expect(matchesFilters({ project: ['p9'] }, { project: ['p1', 'p2'] })).toBe(false);
+  });
+
+  it('AND across keys: every filtered key must match', () => {
+    const filters = { thing: ['t-a'], project: ['p-a'] };
+    expect(matchesFilters(filters, { thing: 't-a', project: ['p-a'] })).toBe(true);
+    expect(matchesFilters(filters, { thing: 't-a', project: ['p-b'] })).toBe(false);
+    expect(matchesFilters(filters, { thing: 't-b', project: ['p-a'] })).toBe(false);
+  });
+
+  it('an event missing a filtered subject does not match', () => {
+    expect(matchesFilters({ project: ['p1'] }, { thing: 't1' })).toBe(false);
+    expect(matchesFilters({ thing: ['t1'], project: ['p1'] }, { thing: 't1' })).toBe(false);
+  });
+});
+
+describe('endpointWants', () => {
+  const endpoint = { enabled: true, events: ['thing.*'], filters: { thing: ['t1'] } };
+
+  it('enabled, the type subscribed and the filters satisfied', () => {
+    expect(endpointWants(endpoint, 'thing.created', { thing: 't1' })).toBe(true);
+  });
+
+  it('a disabled endpoint wants nothing', () => {
+    expect(endpointWants({ ...endpoint, enabled: false }, 'thing.created', { thing: 't1' })).toBe(false);
+  });
+
+  it('the type unsubscribed, or the filters unmet, is no', () => {
+    expect(endpointWants(endpoint, 'project.created', { thing: 't1' })).toBe(false);
+    expect(endpointWants(endpoint, 'thing.created', { thing: 't2' })).toBe(false);
+  });
+});