@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/webhook.test.js

@@ -786,6 +786,257 @@ function testVerifyLoadableWithoutHttpClient() {
         code === 0);
 }
 
+// A signature's authenticated timestamp is `t=<seconds>` — the canonical
+// decimal integer the signer emits (Math.floor(now/1000) String'd). The
+// verifier re-composes the signed string from Number(parsed.t), so validating
+// only the post-coercion value (isNonNegativeFiniteInt) let every
+// Number()-equivalent encoding through — a trailing ".0", scientific
+// ("1.7e9"), hex ("0x..."), a leading "0"/"+"/whitespace — each of which
+// re-canonicalizes into the signed string and RE-VERIFIES, making the
+// authenticated t= field malleable (one captured header mutates into many
+// distinct-but-valid headers, desyncing any dedup/audit layer keyed on the
+// raw header or raw t value from the verifier's parsed timestamp). Every
+// non-canonical form must be refused BAD_TIMESTAMP; the canonical form must
+// still verify (guards against over-strict rejection breaking the round-trip).
+async function testTimestampNonCanonicalRejected() {
+  var s = b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "s" } });
+  var v = b.webhook.verifier({ algo: "hmac-sha3-512", keys: { v1: "s" } });
+  var signed = s.sign("body");
+  var tsCanon = String(signed.timestamp);
+  var id = signed.id, sig = signed.signature;
+
+  function hdr(tStr) { return "t=" + tStr + ",id=" + id + ",v1=" + sig; }
+  async function codeFor(tStr) {
+    try {
+      await v.verify({ body: "body", headers: { "Webhook-Signature": hdr(tStr) } });
+      return "ACCEPTED";
+    } catch (e) { return e && e.code; }
+  }
+
+  var okInfo = await v.verify({ body: "body", headers: { "Webhook-Signature": hdr(tsCanon) } });
+  check("canonical t= still verifies", okInfo && okInfo.kid === "v1");
+
+  // Non-whitespace Number()-coercion forms only. Whitespace AROUND the
+  // comma-delimited segment is legitimately normalized by the header parser
+  // (RFC-style list whitespace tolerance), so it is a header-framing concern,
+  // not authenticated-field malleability.
+  var forms = [
+    ["trailing .0",   tsCanon + ".0"],
+    ["decimal zeros", tsCanon + ".00000"],
+    ["scientific",    Number(tsCanon).toExponential()],
+    ["hex 0x",        "0x" + Number(tsCanon).toString(16)],
+    ["leading zero",  "0" + tsCanon],
+    ["leading plus",  "+" + tsCanon],
+  ];
+  for (var i = 0; i < forms.length; i++) {
+    var code = await codeFor(forms[i][1]);
+    check("non-canonical t (" + forms[i][0] + ") -> BAD_TIMESTAMP (got " + code + ")",
+          code === "BAD_TIMESTAMP");
+  }
+}
+
+// pqcAlgorithm pin is a config-time guard that a key rotation didn't
+// silently swap the underlying PQC algorithm. A matching pin constructs; a
+// mismatched pin, an out-of-catalog value, or a pin paired with a non-pqc
+// algo are all refused BAD_OPT. Covers _assertPqcAlgorithmMatches (both
+// sides) + the algo-guard branch.
+async function testPqcAlgorithmPin() {
+  var pair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  function expectThrow(label, fn) {
+    var threw = null; try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === "BAD_OPT");
+  }
+  var sOk = b.webhook.signer({ algo: "pqc-pem",
+    keys: { v1: { privateKey: pair.privateKey, publicKey: pair.publicKey } }, pqcAlgorithm: "ml-dsa-87" });
+  check("signer: matching pqcAlgorithm pin constructs", typeof sOk.sign === "function");
+  var vOk = b.webhook.verifier({ algo: "pqc-pem", keys: { v1: pair.publicKey }, pqcAlgorithm: "ml-dsa-87" });
+  check("verifier: matching pqcAlgorithm pin constructs", typeof vOk.verify === "function");
+
+  expectThrow("signer: pqcAlgorithm mismatch -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "pqc-pem",
+      keys: { v1: { privateKey: pair.privateKey, publicKey: pair.publicKey } }, pqcAlgorithm: "ml-dsa-65" }); });
+  expectThrow("verifier: pqcAlgorithm mismatch -> BAD_OPT",
+    function () { b.webhook.verifier({ algo: "pqc-pem", keys: { v1: pair.publicKey }, pqcAlgorithm: "ml-dsa-65" }); });
+  expectThrow("verifier: out-of-catalog pqcAlgorithm -> BAD_OPT",
+    function () { b.webhook.verifier({ algo: "pqc-pem", keys: { v1: pair.publicKey }, pqcAlgorithm: "rsa-2048" }); });
+  expectThrow("hmac algo + pqcAlgorithm -> BAD_OPT",
+    function () { b.webhook.verifier({ algo: "hmac-sha3-512", keys: { v1: "s" }, pqcAlgorithm: "ml-dsa-87" }); });
+}
+
+// Key-shape validation across both algos: PQC verifier key must be a PEM
+// string/Buffer (not a number); PQC signer key must be { privateKey,
+// publicKey } (not a partial object, not an array); HMAC key must be a
+// non-empty Buffer/string. All refuse BAD_OPT.
+function testKeyShapeErrors() {
+  var pair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  function expectThrow(label, fn) {
+    var threw = null; try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === "BAD_OPT");
+  }
+  expectThrow("PQC verifier key as number -> BAD_OPT",
+    function () { b.webhook.verifier({ algo: "pqc-pem", keys: { v1: 123 } }); });
+  expectThrow("PQC signer key missing publicKey -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "pqc-pem", keys: { v1: { privateKey: pair.privateKey } } }); });
+  expectThrow("PQC signer key as array -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "pqc-pem", keys: { v1: [pair.privateKey, pair.publicKey] } }); });
+  expectThrow("HMAC empty-string key -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "" } }); });
+  expectThrow("HMAC key as number -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: 123 } }); });
+}
+
+// Signer call-site guards: signing with an unknown per-call kid, or an
+// idGenerator that returns a header-unsafe / empty / non-string id, all
+// refuse BAD_OPT (a comma/equals/whitespace id would corrupt the header
+// grammar, so it fails closed).
+function testSignerCallSiteErrors() {
+  function expectThrow(label, fn) {
+    var threw = null; try { fn(); } catch (e) { threw = e; }
+    check(label, threw && threw.code === "BAD_OPT");
+  }
+  var s = b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "s" } });
+  expectThrow("sign unknown per-call kid -> BAD_OPT", function () { s.sign("body", { kid: "ghost" }); });
+  expectThrow("idGenerator returns comma id -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "s" }, idGenerator: function () { return "bad,id"; } }).sign("x"); });
+  expectThrow("idGenerator returns empty id -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "s" }, idGenerator: function () { return ""; } }).sign("x"); });
+  expectThrow("idGenerator returns non-string -> BAD_OPT",
+    function () { b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "s" }, idGenerator: function () { return 42; } }).sign("x"); });
+}
+
+// verify() defensive input-shape guards (before any crypto): non-object
+// input, non-object headers, missing headers, and a non-string/Buffer body
+// each throw the typed refusal.
+async function testVerifyInputShapes() {
+  var v = b.webhook.verifier({ algo: "hmac-sha3-512", keys: { v1: "s" } });
+  async function expectCode(label, input, code) {
+    var t = null; try { await v.verify(input); } catch (e) { t = e; }
+    check(label, t && t.code === code);
+  }
+  await expectCode("verify(null) -> BAD_OPT", null, "BAD_OPT");
+  await expectCode("verify(non-object) -> BAD_OPT", "nope", "BAD_OPT");
+  await expectCode("verify headers not object -> BAD_OPT", { body: "b", headers: "x" }, "BAD_OPT");
+  await expectCode("verify missing headers -> BAD_OPT", { body: "b" }, "BAD_OPT");
+  await expectCode("verify object body -> BAD_BODY",
+    { body: { a: 1 }, headers: { "Webhook-Signature": "t=1,id=2,v1=ff" } }, "BAD_BODY");
+}
+
+// Advertised: the PQC verifier accepts EITHER base64url (current) OR hex
+// (legacy) signature encodings for a transition window. New signatures emit
+// base64url; an old hex-encoded signature must still verify.
+async function testPqcHexTransitionWindow() {
+  var pair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  var s = b.webhook.signer({ algo: "pqc-pem",
+    keys: { v1: { privateKey: pair.privateKey, publicKey: pair.publicKey } } });
+  var v = b.webhook.verifier({ algo: "pqc-pem", keys: { v1: pair.publicKey } });
+  var signed = s.sign("payload");
+  var m = /v1=([^,]+)$/.exec(signed.headers["Webhook-Signature"]);
+  var hexSig = Buffer.from(m[1], "base64url").toString("hex");
+  var hexHeader = "t=" + signed.timestamp + ",id=" + signed.id + ",v1=" + hexSig;
+  var info = await v.verify({ body: "payload", headers: { "Webhook-Signature": hexHeader } });
+  check("PQC hex-encoded signature still verifies (transition window)", info && info.kid === "v1");
+}
+
+// b.webhook.verify (Stripe) rejects malformed opts before the MAC compare:
+// non-object input, tolerance below the 30s floor, a non-string/Buffer or
+// empty secret, a non-string/Buffer body, an empty header, and a header past
+// the 4096-byte anti-DoS cap.
+async function testStripeVerifyBadInputs() {
+  var ts = Math.floor(Date.now() / 1000);
+  var sig64 = "a".repeat(64);
+  async function expectCode(label, input, code) {
+    var t = null; try { await b.webhook.verify(input); } catch (e) { t = e; }
+    check(label, t && t.code === code);
+  }
+  await expectCode("stripe verify(null) -> bad-opts", null, "webhook/bad-opts");
+  await expectCode("stripe verify below-min tolerance -> bad-tolerance",
+    { alg: "hmac-sha256-stripe", secret: "whsec_x", header: "t=" + ts + ",v1=" + sig64, body: "{}", toleranceMs: 1000 },
+    "webhook/bad-tolerance");
+  await expectCode("stripe verify non-string/Buffer secret -> bad-secret",
+    { alg: "hmac-sha256-stripe", secret: 123, header: "t=" + ts + ",v1=" + sig64, body: "{}" }, "webhook/bad-secret");
+  await expectCode("stripe verify empty secret -> bad-secret",
+    { alg: "hmac-sha256-stripe", secret: "", header: "t=" + ts + ",v1=" + sig64, body: "{}" }, "webhook/bad-secret");
+  await expectCode("stripe verify object body -> bad-body",
+    { alg: "hmac-sha256-stripe", secret: "whsec_x", header: "t=" + ts + ",v1=" + sig64, body: { a: 1 } }, "webhook/bad-body");
+  await expectCode("stripe verify empty header -> bad-stripe-header",
+    { alg: "hmac-sha256-stripe", secret: "whsec_x", header: "", body: "{}" }, "webhook/bad-stripe-header");
+  await expectCode("stripe verify header > 4096 -> bad-stripe-header",
+    { alg: "hmac-sha256-stripe", secret: "whsec_x", header: "t=" + ts + ",v1=" + sig64 + "," + "z=1,".repeat(1100), body: "{}" },
+    "webhook/bad-stripe-header");
+}
+
+// b.webhook.sign (Stripe) mirrors verify's opt guards: non-object input,
+// wrong alg, non-string/empty secret, non-string/Buffer body, negative
+// timestamp all throw their typed codes.
+function testStripeSignBadInputs() {
+  function expectCode(label, fn, code) {
+    var t = null; try { fn(); } catch (e) { t = e; }
+    check(label, t && t.code === code);
+  }
+  expectCode("stripe sign(null) -> bad-opts", function () { b.webhook.sign(null); }, "webhook/bad-opts");
+  expectCode("stripe sign bad alg -> bad-alg", function () { b.webhook.sign({ alg: "x", secret: "s", body: "{}" }); }, "webhook/bad-alg");
+  expectCode("stripe sign non-string secret -> bad-secret",
+    function () { b.webhook.sign({ alg: "hmac-sha256-stripe", secret: 1, body: "{}" }); }, "webhook/bad-secret");
+  expectCode("stripe sign empty secret -> bad-secret",
+    function () { b.webhook.sign({ alg: "hmac-sha256-stripe", secret: "", body: "{}" }); }, "webhook/bad-secret");
+  expectCode("stripe sign object body -> bad-body",
+    function () { b.webhook.sign({ alg: "hmac-sha256-stripe", secret: "s", body: {} }); }, "webhook/bad-body");
+  expectCode("stripe sign negative timestamp -> bad-timestamp",
+    function () { b.webhook.sign({ alg: "hmac-sha256-stripe", secret: "s", body: "{}", timestamp: -5 }); }, "webhook/bad-timestamp");
+}
+
+// A non-WebhookError thrown DURING verify (here: the nonce store faults after
+// a valid MAC) must surface as HTTP 500 VERIFY_ERROR from the middleware —
+// distinct from the 401 WebhookError path, and it must never call next().
+async function testMiddlewareVerifyError() {
+  var ns = { checkAndInsert: function () { throw new Error("store fault"); } };
+  var s = b.webhook.signer({ algo: "hmac-sha3-512", keys: { v1: "s" } });
+  var v = b.webhook.verifier({ algo: "hmac-sha3-512", keys: { v1: "s" }, nonceStore: ns });
+  var mw = v.middleware();
+  var body = "hello";
+  var signed = s.sign(body);
+  var req = { bodyRaw: Buffer.from(body, "utf8"), headers: signed.headers };
+  var res = _bodyRes();
+  var nextCalled = false;
+  await new Promise(function (resolve) {
+    mw(req, res, function () { nextCalled = true; resolve(); });
+    helpers.passiveObserve(100, "webhook verify-error: middleware 500 window").then(resolve);
+  });
+  check("middleware: 500 on non-WebhookError verify fault", res._endedStatus === 500);
+  check("middleware: VERIFY_ERROR in body", /VERIFY_ERROR/.test(res._captured || ""));
+  check("middleware: next() not called on fault", nextCalled === false);
+}
+
+// A resolved non-2xx delivery emits a FAILURE audit event (auditFailures
+// default ON) and resolves with the response — the send() success-path
+// failure-audit branch (distinct from the transport-error catch). The
+// transport resolves rather than throws on the 500 via responseMode
+// "always-resolve", so withRetry returns it without retrying.
+async function testSendFailureAudit() {
+  var events = [];
+  var audit = { safeEmit: function (e) { events.push(e); } };
+  var server = http.createServer(function (req, res) {
+    var chunks = [];
+    req.on("data", function (c) { chunks.push(c); });
+    req.on("end", function () { res.statusCode = 500; res.end("nope"); });
+  });
+  await new Promise(function (r) { server.listen(0, "127.0.0.1", r); });
+  var port = server.address().port;
+  try {
+    var signer = b.webhook.signer({
+      algo: "hmac-sha3-512", keys: { v1: "s" }, audit: audit,
+      http: { allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true, responseMode: "always-resolve" },
+      retry: { maxAttempts: 1 },
+    });
+    var res = await signer.send({ url: "http://127.0.0.1:" + port + "/hook", body: "{}" });
+    check("send: resolves with non-2xx status", (res.status || res.statusCode) === 500);
+    var failed = events.some(function (e) { return e.action === "webhook.send" && e.outcome === "failure"; });
+    check("send: non-2xx emits failure audit", failed);
+  } finally {
+    await new Promise(function (r) { server.close(r); });
+  }
+}
+
 // signer.send dispatches through the shared httpClient keep-alive transport
 // pool; a cached client socket finalizes its destroy on a later event-loop
 // turn, past the forked worker's grace window. Reset the pool, then poll until
@@ -835,6 +1086,15 @@ async function _runTests() {
   await testSendEndToEnd();
   testRejectsBadOpts();
   await testSendBadUrl();
+  // Authenticated-timestamp canonicalization + verify/signer config guards.
+  await testTimestampNonCanonicalRejected();
+  await testPqcAlgorithmPin();
+  testKeyShapeErrors();
+  testSignerCallSiteErrors();
+  await testVerifyInputShapes();
+  await testPqcHexTransitionWindow();
+  await testMiddlewareVerifyError();
+  await testSendFailureAudit();
   // v0.11.25 — Stripe HMAC-SHA-256 inbound verifier.
   await testStripeHappyPath();
   await testStripeWrongSecret();
@@ -851,6 +1111,8 @@ async function _runTests() {
   await testStripeNonceStoreFromPrimitive();
   await testStripeNonceStoreBadShapeRefused();
   await testStripeNonceStoreConcurrentAtomic();
+  testStripeSignBadInputs();
+  await testStripeVerifyBadInputs();
   // #378 — verify path must stay free of the Node networking chain.
   testVerifyLoadableWithoutHttpClient();
 }