@blamejs/blamejs-shop 0.5.12 → 0.5.14

package/lib/vendor/blamejs/test/layer-0-primitives/webhook-dispatcher.test.js

@@ -145,12 +145,33 @@ async function _runAll() {
   await testEventTypeAndWildcardMatching();
   await testTransientFailureBacksOff();
   await testThrownTransportErrorBacksOff();
+  await testTransientDnsRevalidationRetries();
+  await testPermanentDnsRevalidationDeadLetters();
+  await testDeliveryTimeSsrfRebindDeadLetters();
   await testMysqlSchemaNoPartialIndex();
   await testInlineDeliveryNotDoubleClaimed();
   await testPostgresClaimUsesSkipLockedDisjoint();
   await testMaxAttemptsDeadLetters();
   await testDlqReplay();
   await testDeliveriesRetry();
+  // ---- error / edge / adversarial branch coverage ----
+  await testDispatcherOptsValidation();
+  await testBadTableNameRejected();
+  await testRegisterEventTypesValidation();
+  await testDispatchInputValidation();
+  await testDispatchNoSubscribers();
+  await testDispatchStringAndBufferPayload();
+  await testRemoveEndpoint();
+  await testRetryUnknownDeliveryId();
+  await testDeliveryEndpointRemovedDeadLetters();
+  await testGetUnknownDeliveryReturnsNull();
+  await testDefaultOptionsConstructAndDeliver();
+  await testBackoffCappedAtMax();
+  await testDisabledEndpointSkipped();
+  await testCustomSignatureHeader();
+  await testDeclareSchemaPostgresExplicitXdb();
+  await testReapStaleInflight();
+  await testListDeliveriesFilters();
 }
 
 function _newDispatcher(xdb, transport, extra) {
@@ -304,6 +325,80 @@ async function testThrownTransportErrorBacksOff() {
   check("thrown transport error not dead-lettered", res.deliveries[0].dead !== true);
 }
 
+async function testTransientDnsRevalidationRetries() {
+  // The delivery-time SSRF re-validation resolves the destination host. A
+  // TRANSIENT resolver fault (EAI_AGAIN) during that lookup must be treated as
+  // transient — rescheduled — NOT dead-lettered. Regression: the re-validation
+  // catch marked EVERY throw permanent, so a DNS blip dead-lettered a delivery.
+  var xdb = _sqliteExternalDb();
+  var HOST_URL = "https://hook.example.test/hooks";
+  var calls = 0;
+  var dnsLookup = function (host) {
+    calls += 1;
+    if (calls === 1) return Promise.resolve([{ address: "93.184.216.34", family: 4 }]); // register: public
+    var e = new Error("getaddrinfo EAI_AGAIN " + host); e.code = "EAI_AGAIN";              // deliver: transient
+    return Promise.reject(e);
+  };
+  var wd = _newDispatcher(xdb, _stubTransport(), { dnsLookup: dnsLookup });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "td", url: HOST_URL, eventTypes: ["e"], secret: "s" });
+  var res = await wd.dispatch("e", { n: 1 });
+  check("transient DNS in SSRF re-validation not delivered", res.delivered === 0 && res.failed === 1);
+  check("transient DNS not dead-lettered", res.deliveries[0].dead !== true);
+  var rows = await wd.deliveries.list({ endpointId: "td" });
+  check("transient DNS delivery stays pending for retry", rows.length === 1 && rows[0].status === "pending");
+  check("transient DNS resolver error recorded", /EAI_AGAIN/.test(rows[0].lastError || ""));
+}
+
+async function testPermanentDnsRevalidationDeadLetters() {
+  // A PERMANENT resolver failure at the SSRF re-check — a host with no
+  // addresses / a removed DNS record — carries the framework DnsError verdict
+  // err.permanent === true. It must dead-letter immediately, NOT burn every
+  // retry attempt on a name that will never resolve. (Distinct from a transient
+  // DNS blip, which retries.)
+  var xdb = _sqliteExternalDb();
+  var HOST_URL = "https://gone.example.test/hooks";
+  var calls = 0;
+  var dnsLookup = function (host) {
+    calls += 1;
+    if (calls === 1) return Promise.resolve([{ address: "93.184.216.34", family: 4 }]); // register: public
+    var e = new Error("dns lookup of '" + host + "' returned no addresses");             // deliver: permanent
+    e.code = "dns/no-result"; e.permanent = true;
+    return Promise.reject(e);
+  };
+  var wd = _newDispatcher(xdb, _stubTransport(), { dnsLookup: dnsLookup });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "gone", url: HOST_URL, eventTypes: ["e"], secret: "s" });
+  var res = await wd.dispatch("e", { n: 1 });
+  check("permanent DNS failure not delivered", res.delivered === 0 && res.failed === 1);
+  check("permanent DNS failure is dead-lettered (not retried)", res.deliveries[0].dead === true);
+  var rows = await wd.deliveries.list({ endpointId: "gone" });
+  check("permanent DNS delivery status is dead", rows.length === 1 && rows[0].status === "dead");
+}
+
+async function testDeliveryTimeSsrfRebindDeadLetters() {
+  // The control: a destination that was public at registration but REBINDS to a
+  // loopback IP by delivery time is a genuine SSRF refusal — PERMANENT — and is
+  // dead-lettered immediately (a WebhookDispatcherError, not a raw resolver fault).
+  var xdb = _sqliteExternalDb();
+  var HOST_URL = "https://hook.example.test/hooks";
+  var calls = 0;
+  var dnsLookup = function () {
+    calls += 1;
+    if (calls === 1) return Promise.resolve([{ address: "93.184.216.34", family: 4 }]); // register: public
+    return Promise.resolve([{ address: "127.0.0.1", family: 4 }]);                        // deliver: rebound internal
+  };
+  var wd = _newDispatcher(xdb, _stubTransport(), { dnsLookup: dnsLookup });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "rb", url: HOST_URL, eventTypes: ["e"], secret: "s" });
+  var res = await wd.dispatch("e", { n: 1 });
+  check("SSRF-rebind at delivery not delivered", res.delivered === 0 && res.failed === 1);
+  check("SSRF-rebind at delivery is dead-lettered (permanent)", res.deliveries[0].dead === true);
+  var rows = await wd.deliveries.list({ endpointId: "rb" });
+  check("SSRF-rebind delivery status is dead", rows.length === 1 && rows[0].status === "dead");
+  check("SSRF-refused error recorded", /ssrf-refused|resolves to/.test(rows[0].lastError || ""));
+}
+
 async function testMysqlSchemaNoPartialIndex() {
   // MySQL has no partial indexes; sql.createIndex refuses `where` on mysql, so
   // declareSchema must emit a NON-partial index there or it throws on boot.
@@ -441,6 +536,299 @@ async function testDeliveriesRetry() {
   check("retried delivery now delivered",     after.status === "delivered");
 }
 
+// ---- opts / construction validation (the validateOpts.shape + table-name gate) ----
+async function testDispatcherOptsValidation() {
+  var xdb = _sqliteExternalDb();
+  var missingDb = false, badMax = false, infMax = false, unknownOpt = false;
+  try { b.webhook.dispatcher({}); }
+  catch (e) { missingDb = e.code === "webhook-dispatcher/bad-opts"; }
+  try { b.webhook.dispatcher({ externalDb: xdb, httpRequest: _stubTransport(), maxAttempts: -5 }); }
+  catch (e) { badMax = e.code === "webhook-dispatcher/bad-opts"; }
+  try { b.webhook.dispatcher({ externalDb: xdb, httpRequest: _stubTransport(), maxAttempts: Infinity }); }
+  catch (e) { infMax = e.code === "webhook-dispatcher/bad-opts"; }
+  try { b.webhook.dispatcher({ externalDb: xdb, httpRequest: _stubTransport(), bogusOpt: 1 }); }
+  catch (e) { unknownOpt = e.code === "webhook-dispatcher/bad-opts"; }
+  check("dispatcher throws on missing externalDb",        missingDb);
+  check("dispatcher throws on negative maxAttempts",      badMax);
+  check("dispatcher throws on non-finite maxAttempts",    infMax);
+  check("dispatcher throws on an unknown opt (exhaustive shape)", unknownOpt);
+}
+
+async function testBadTableNameRejected() {
+  var xdb = _sqliteExternalDb();
+  // An injection-bearing table name is refused at construction by
+  // safeSql.quoteIdentifier (parity with b.db.from()).
+  var endpointsThrew = false, deliveriesThrew = false;
+  try { _newDispatcher(xdb, _stubTransport(), { endpointsTable: "bad name; DROP TABLE x" }); }
+  catch (_e) { endpointsThrew = true; }
+  try { _newDispatcher(xdb, _stubTransport(), { deliveriesTable: "evil\"; --" }); }
+  catch (_e) { deliveriesThrew = true; }
+  check("bad endpointsTable name rejected at construction",  endpointsThrew);
+  check("bad deliveriesTable name rejected at construction", deliveriesThrew);
+}
+
+async function testRegisterEventTypesValidation() {
+  var xdb = _sqliteExternalDb();
+  var wd = _newDispatcher(xdb, _stubTransport());
+  await wd.declareSchema();
+  var emptyThrew = false, missingThrew = false;
+  try { await wd.registerEndpoint({ endpointId: "e1", url: PUBLIC_URL, eventTypes: [], secret: "s" }); }
+  catch (e) { emptyThrew = e.code === "webhook-dispatcher/bad-opts"; }
+  try { await wd.registerEndpoint({ endpointId: "e2", url: PUBLIC_URL, secret: "s" }); }
+  catch (e) { missingThrew = e.code === "webhook-dispatcher/bad-opts"; }
+  check("registerEndpoint refuses empty eventTypes array", emptyThrew);
+  check("registerEndpoint refuses missing eventTypes",     missingThrew);
+  // Neither bad call should have written a row.
+  var eps = await wd.listEndpoints();
+  check("no endpoint persisted after eventTypes rejection", eps.length === 0);
+}
+
+async function testDispatchInputValidation() {
+  var xdb = _sqliteExternalDb();
+  var wd = _newDispatcher(xdb, _stubTransport());
+  await wd.declareSchema();
+  var emptyEventThrew = false, nullPayloadThrew = false, undefPayloadThrew = false;
+  try { await wd.dispatch("", { n: 1 }); }
+  catch (e) { emptyEventThrew = e.code === "webhook-dispatcher/bad-opts"; }
+  try { await wd.dispatch("e", null); }
+  catch (e) { nullPayloadThrew = e.code === "webhook-dispatcher/bad-opts"; }
+  try { await wd.dispatch("e", undefined); }
+  catch (e) { undefPayloadThrew = e.code === "webhook-dispatcher/bad-opts"; }
+  check("dispatch refuses empty eventType",   emptyEventThrew);
+  check("dispatch refuses null payload",       nullPayloadThrew);
+  check("dispatch refuses undefined payload",  undefPayloadThrew);
+}
+
+async function testDispatchNoSubscribers() {
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport);
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "sub", url: PUBLIC_URL, eventTypes: ["subscribed.only"], secret: "s" });
+  var res = await wd.dispatch("nobody.listening", { n: 1 });
+  check("dispatch with no subscribers delivers nothing", res.delivered === 0 && res.failed === 0);
+  check("dispatch with no subscribers has an empty deliveries list", res.deliveries.length === 0);
+  check("no delivery row written for an unsubscribed event", transport.calls.length === 0);
+}
+
+async function testDispatchStringAndBufferPayload() {
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport);
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "raw", url: PUBLIC_URL, eventTypes: ["s", "b"], secret: "s" });
+  await wd.dispatch("s", "already-a-string-body");
+  check("string payload passed through verbatim (not re-serialized)",
+    transport.calls.length === 1 && transport.calls[0].body === "already-a-string-body");
+  await wd.dispatch("b", Buffer.from("buffer-bytes-body", "utf8"));
+  check("Buffer payload coerced to its utf8 string",
+    transport.calls.length === 2 && transport.calls[1].body === "buffer-bytes-body");
+}
+
+async function testRemoveEndpoint() {
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport);
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "keep",   url: PUBLIC_URL,  eventTypes: ["e"], secret: "s" });
+  await wd.registerEndpoint({ endpointId: "remove", url: PUBLIC_URL2, eventTypes: ["e"], secret: "s" });
+  var rm = await wd.removeEndpoint("remove");
+  check("removeEndpoint reports removed", rm && rm.removed === true && rm.endpointId === "remove");
+  var eps = await wd.listEndpoints();
+  check("removed endpoint no longer listed",
+    eps.length === 1 && eps[0].endpointId === "keep");
+  var res = await wd.dispatch("e", { n: 1 });
+  check("removed endpoint no longer receives dispatch", res.delivered === 1);
+  // Validation: empty endpointId is refused.
+  var idThrew = false;
+  try { await wd.removeEndpoint(""); }
+  catch (e) { idThrew = e.code === "webhook-dispatcher/bad-opts"; }
+  check("removeEndpoint refuses empty endpointId", idThrew);
+}
+
+async function testRetryUnknownDeliveryId() {
+  var xdb = _sqliteExternalDb();
+  var wd = _newDispatcher(xdb, _stubTransport());
+  await wd.declareSchema();
+  var res = await wd.deliveries.retry("deadbeefdeadbeefdeadbeefdeadbeef");
+  check("retry of an unknown delivery id fails softly (row not found)",
+    res && res.ok === false && res.error === "delivery row not found");
+  // Empty id is a hard validation throw.
+  var threw = false;
+  try { await wd.deliveries.retry(""); }
+  catch (e) { threw = e.code === "webhook-dispatcher/bad-opts"; }
+  check("retry refuses empty delivery id", threw);
+}
+
+async function testDeliveryEndpointRemovedDeadLetters() {
+  // A delivery whose endpoint was removed between dispatch and re-attempt can
+  // never sign (no secret) — it is dead-lettered as "endpoint no longer
+  // registered", not retried forever.
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport);
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "gone2", url: PUBLIC_URL, eventTypes: ["e"], secret: "s" });
+  var res = await wd.dispatch("e", { n: 1 });
+  var deliveryId = res.deliveries[0].deliveryId;
+  await wd.removeEndpoint("gone2");
+  var retryRes = await wd.deliveries.retry(deliveryId);
+  check("delivery whose endpoint was removed is dead-lettered", retryRes.dead === true);
+  var row = await wd.deliveries.get(deliveryId);
+  check("removed-endpoint delivery status is dead", row && row.status === "dead");
+  check("removed-endpoint delivery records the reason",
+    /endpoint no longer registered/.test(row.lastError || ""));
+}
+
+async function testGetUnknownDeliveryReturnsNull() {
+  var xdb = _sqliteExternalDb();
+  var wd = _newDispatcher(xdb, _stubTransport());
+  await wd.declareSchema();
+  var got = await wd.deliveries.get("00000000000000000000000000000000");
+  check("deliveries.get returns null for an unknown id", got === null);
+}
+
+async function testDefaultOptionsConstructAndDeliver() {
+  // Construct with ONLY the required externalDb + an injected transport — every
+  // other opt (maxAttempts / batchSize / claimReclaimMs / retryBackoff /
+  // signatureHeader / allowedProtocols / now) falls to its default.
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = b.webhook.dispatcher({ externalDb: xdb, httpRequest: transport });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "def", url: PUBLIC_URL, eventTypes: ["e"], secret: "s" });
+  var res = await wd.dispatch("e", { n: 1 });
+  check("dispatcher built with all-default opts delivers", res.delivered === 1);
+  var sigHeader = transport.calls[0].headers["Webhook-Signature"];
+  check("default signatureHeader is the framework default (Webhook-Signature)",
+    typeof sigHeader === "string" && sigHeader.length > 0);
+}
+
+async function testBackoffCappedAtMax() {
+  // initialMs (10s) exceeds maxMs (5s), so the very first reschedule must clamp
+  // the backoff to maxMs — exercising the `ms > backoffMax` cap branch.
+  var now = 1700000000000;
+  var clock = function () { return now; };
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  transport.setStatus(503);
+  var wd = b.webhook.dispatcher({
+    externalDb: xdb, httpRequest: transport, maxAttempts: 5,
+    retryBackoff: { initialMs: 10000, maxMs: 5000, factor: 2 }, now: clock,
+  });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "cap", url: PUBLIC_URL, eventTypes: ["e"], secret: "s" });
+  await wd.dispatch("e", { n: 1 });
+  var rows = await wd.deliveries.list({ endpointId: "cap" });
+  var expected = new Date(now + 5000).toISOString();
+  check("backoff is clamped to maxMs, not initialMs*factor^n",
+    rows.length === 1 && rows[0].nextAttemptAt === expected);
+}
+
+async function testDisabledEndpointSkipped() {
+  // A disabled endpoint (disabled=1) is filtered out of the fan-out AND
+  // surfaced as disabled:true by listEndpoints (_isTruthy on the integer flag).
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport);
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "dis", url: PUBLIC_URL, eventTypes: ["e"], secret: "s" });
+  xdb._raw.prepare("UPDATE " + tableName("webhook_endpoints") +
+    " SET disabled = 1 WHERE endpoint_id = ?").run("dis");
+  var eps = await wd.listEndpoints();
+  check("listEndpoints reports the endpoint as disabled",
+    eps.length === 1 && eps[0].disabled === true);
+  var res = await wd.dispatch("e", { n: 1 });
+  check("a disabled endpoint receives no delivery",
+    res.delivered === 0 && res.failed === 0 && transport.calls.length === 0);
+}
+
+async function testCustomSignatureHeader() {
+  // A custom signatureHeader opt is forwarded to b.webhook.signer, so the POSTed
+  // request carries the operator's header name instead of the default.
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport, { signatureHeader: "X-Partner-Signature" });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "csh", url: PUBLIC_URL, eventTypes: ["e"], secret: "s" });
+  await wd.dispatch("e", { n: 1 });
+  var h = transport.calls[0].headers;
+  check("custom signatureHeader name is emitted", typeof h["X-Partner-Signature"] === "string");
+  check("default Webhook-Signature header absent under a custom header",
+    h["Webhook-Signature"] === undefined);
+}
+
+async function testDeclareSchemaPostgresExplicitXdb() {
+  // declareSchema(xdb) with an explicit Postgres target: exercises the
+  // `xdb || externalDb` xdb branch AND the postgres TIMESTAMPTZ + partial-index
+  // (WHERE status='pending') branches — the complement of the mysql schema test.
+  var xdb = _sqliteExternalDb();
+  var wd = _newDispatcher(xdb, _stubTransport());
+  var sqls = [];
+  var pgTarget = {
+    dialect: "postgres",
+    query: async function (s) { sqls.push(s); return { rows: [] }; },
+    transaction: async function (fn) { return fn(this); },
+  };
+  await wd.declareSchema(pgTarget);
+  var joined = sqls.join(" || ");
+  check("postgres schema uses TIMESTAMPTZ timestamps", /TIMESTAMPTZ/i.test(joined));
+  var idxSql = sqls.filter(function (s) { return /_pending_idx/i.test(s); }).join(" || ");
+  check("postgres pending index is partial (WHERE status = 'pending')",
+    /where\s+status\s*=\s*'pending'/i.test(idxSql));
+}
+
+async function testReapStaleInflight() {
+  // A worker that claimed a delivery (status 'in-flight') then crashed strands
+  // the row. processRetries()'s reaper flips it back to 'pending' once the lease
+  // (claimReclaimMs) expires; a FRESHLY-claimed in-flight row is NOT reaped.
+  var now = 1700000000000;
+  var clock = function () { return now; };
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  transport.setStatus(503);
+  var wd = b.webhook.dispatcher({
+    externalDb: xdb, httpRequest: transport, maxAttempts: 5,
+    retryBackoff: { initialMs: 1000, maxMs: 5000, factor: 2 }, now: clock,
+  });
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "reap", url: PUBLIC_URL, eventTypes: ["e"], secret: "s" });
+  var d1 = (await wd.dispatch("e", { n: 1 })).deliveries[0].deliveryId;   // → pending
+  var d2 = (await wd.dispatch("e", { n: 2 })).deliveries[0].deliveryId;   // → pending
+  var tenMinMs = 600000;   // well past the 5-min default claimReclaimMs lease
+  var staleIso = new Date(now - tenMinMs).toISOString();
+  var freshIso = new Date(now).toISOString();
+  var dueIso   = new Date(now - tenMinMs).toISOString();
+  var upd = "UPDATE " + tableName("webhook_deliveries") +
+    " SET status = 'in-flight', claimed_at = ?, next_attempt_at = ? WHERE delivery_id = ?";
+  xdb._raw.prepare(upd).run(staleIso, dueIso, d1);   // stranded past the lease
+  xdb._raw.prepare(upd).run(freshIso, dueIso, d2);   // just claimed — still owned
+  transport.setStatus(200);
+  var res = await wd.processRetries();
+  check("only the stale in-flight row is reaped + re-attempted", res.attempted === 1 && res.delivered === 1);
+  var r1 = await wd.deliveries.get(d1);
+  var r2 = await wd.deliveries.get(d2);
+  check("reaped delivery is now delivered", r1 && r1.status === "delivered");
+  check("freshly-claimed delivery is left in-flight (not reaped)", r2 && r2.status === "in-flight");
+}
+
+async function testListDeliveriesFilters() {
+  // Drive the endpointId + status + explicit limit filter branches of
+  // deliveries.list in one pass.
+  var xdb = _sqliteExternalDb();
+  var transport = _stubTransport();
+  var wd = _newDispatcher(xdb, transport);
+  await wd.declareSchema();
+  await wd.registerEndpoint({ endpointId: "f1", url: PUBLIC_URL,  eventTypes: ["e"], secret: "s" });
+  await wd.registerEndpoint({ endpointId: "f2", url: PUBLIC_URL2, eventTypes: ["e"], secret: "s" });
+  await wd.dispatch("e", { n: 1 });   // both delivered (200)
+  var f1 = await wd.deliveries.list({ endpointId: "f1", status: "delivered", limit: 10 });
+  check("list filters by endpointId + status + explicit limit",
+    f1.length === 1 && f1[0].endpointId === "f1" && f1[0].status === "delivered");
+  var all = await wd.deliveries.list();
+  check("list with no filter returns every delivery", all.length === 2);
+}
+
 module.exports = { run: run };
 
 if (require.main === module) {