@channel.io/app-sdk-server 0.2.0 → 0.3.1

package/dist/__tests__/signature.test.js

@@ -0,0 +1,172 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { createHmac } from "crypto";
+import { UnauthorizedException } from "@nestjs/common";
+import { verifySignature, SignatureGuard, SIGNATURE_HEADER } from "../guards/signature.guard.js";
+/**
+ * Helper: compute HMAC-SHA256 signature the same way ch-app-store does.
+ * signingKey is hex-encoded, body is raw bytes, result is base64.
+ */
+function computeSignature(signingKey, body) {
+    const keyBuffer = Buffer.from(signingKey, "hex");
+    return createHmac("sha256", keyBuffer).update(body).digest("base64");
+}
+/** 64-char hex signing key for tests */
+const VALID_HEX_KEY = "ab".repeat(32);
+describe("verifySignature", () => {
+    it("should return true for a valid signature over raw body", () => {
+        const body = Buffer.from('{"method":"hello","params":{"name":"world"}}');
+        const sig = computeSignature(VALID_HEX_KEY, body);
+        expect(verifySignature(sig, VALID_HEX_KEY, body)).toBe(true);
+    });
+    it("should return false when body bytes differ (re-serialized JSON)", () => {
+        // ch-app-store signs the raw bytes with specific whitespace
+        const rawWithSpaces = Buffer.from('{ "method" : "hello" , "params" : { "name" : "world" } }');
+        const sig = computeSignature(VALID_HEX_KEY, rawWithSpaces);
+        const parsed = JSON.parse(rawWithSpaces.toString());
+        const reserialized = Buffer.from(JSON.stringify(parsed));
+        // The re-serialized body loses whitespace → signature mismatch
+        expect(verifySignature(sig, VALID_HEX_KEY, reserialized)).toBe(false);
+        // But raw body works
+        expect(verifySignature(sig, VALID_HEX_KEY, rawWithSpaces)).toBe(true);
+    });
+    it("should return false for an invalid signature", () => {
+        const body = Buffer.from('{"key":"value"}');
+        expect(verifySignature("invalid-signature", VALID_HEX_KEY, body)).toBe(false);
+    });
+    it("should return false for wrong signing key", () => {
+        const body = Buffer.from('{"key":"value"}');
+        const sig = computeSignature(VALID_HEX_KEY, body);
+        const wrongKey = "cd".repeat(32);
+        expect(verifySignature(sig, wrongKey, body)).toBe(false);
+    });
+    it("should return false for empty signature", () => {
+        const body = Buffer.from("{}");
+        expect(verifySignature("", VALID_HEX_KEY, body)).toBe(false);
+    });
+    it("should return false for malformed signing key", () => {
+        const body = Buffer.from("{}");
+        // "zz" is not valid hex, Buffer.from will produce empty/garbage
+        expect(verifySignature("anysig", "not-hex!", body)).toBe(false);
+    });
+});
+describe("SignatureGuard", () => {
+    let guard;
+    let options;
+    function createMockExecutionContext(overrides) {
+        const request = {
+            headers: overrides.headers ?? {},
+            rawBody: overrides.rawBody,
+        };
+        return {
+            switchToHttp: () => ({
+                getRequest: () => request,
+                getResponse: () => ({}),
+                getNext: () => vi.fn(),
+            }),
+            getClass: vi.fn(),
+            getHandler: vi.fn(),
+            getArgs: vi.fn(),
+            getArgByIndex: vi.fn(),
+            switchToRpc: vi.fn(),
+            switchToWs: vi.fn(),
+            getType: vi.fn(),
+        };
+    }
+    beforeEach(() => {
+        options = {
+            appId: "test-app",
+            appSecret: VALID_HEX_KEY,
+        };
+        // Construct guard with injected options
+        guard = new SignatureGuard(options);
+    });
+    it("should pass when signature is valid", () => {
+        const body = Buffer.from('{"method":"test","params":{}}');
+        const sig = computeSignature(VALID_HEX_KEY, body);
+        const ctx = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: sig },
+            rawBody: body,
+        });
+        expect(guard.canActivate(ctx)).toBe(true);
+    });
+    it("should throw when X-Signature header is missing", () => {
+        const ctx = createMockExecutionContext({
+            headers: {},
+            rawBody: Buffer.from("{}"),
+        });
+        expect(() => guard.canActivate(ctx)).toThrow(UnauthorizedException);
+    });
+    it("should throw when rawBody is not available", () => {
+        const ctx = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: "some-sig" },
+            rawBody: undefined,
+        });
+        expect(() => guard.canActivate(ctx)).toThrow("raw body not available");
+    });
+    it("should throw when signature is invalid", () => {
+        const body = Buffer.from('{"method":"test"}');
+        const ctx = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: "wrong-signature" },
+            rawBody: body,
+        });
+        expect(() => guard.canActivate(ctx)).toThrow("Invalid signature");
+    });
+    it("should skip verification when skipSignatureVerification is true", () => {
+        options.skipSignatureVerification = true;
+        guard = new SignatureGuard(options);
+        const ctx = createMockExecutionContext({
+            headers: {}, // no signature header
+            rawBody: undefined,
+        });
+        expect(guard.canActivate(ctx)).toBe(true);
+    });
+    it("should use signingKey over appSecret when both are provided", () => {
+        const dedicatedKey = "cd".repeat(32);
+        options.signingKey = dedicatedKey;
+        guard = new SignatureGuard(options);
+        const body = Buffer.from('{"data":"test"}');
+        const sig = computeSignature(dedicatedKey, body);
+        const ctx = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: sig },
+            rawBody: body,
+        });
+        expect(guard.canActivate(ctx)).toBe(true);
+        // Signature computed with appSecret should NOT pass
+        const wrongSig = computeSignature(VALID_HEX_KEY, body);
+        const ctx2 = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: wrongSig },
+            rawBody: body,
+        });
+        expect(() => guard.canActivate(ctx2)).toThrow("Invalid signature");
+    });
+    it("should throw when no signing key is configured", () => {
+        const noKeyOptions = {
+            appId: "test-app",
+            appSecret: undefined,
+        };
+        guard = new SignatureGuard(noKeyOptions);
+        const ctx = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: "some-sig" },
+            rawBody: Buffer.from("{}"),
+        });
+        expect(() => guard.canActivate(ctx)).toThrow("not configured");
+    });
+    it("should verify using raw body bytes, not re-serialized JSON", () => {
+        // This is the core bug scenario: ch-app-store sends JSON with specific formatting
+        // If SDK re-serializes with JSON.stringify, the signature won't match
+        const rawJson = '{ "method" :  "test" , "params" : {} }';
+        const rawBody = Buffer.from(rawJson);
+        const sig = computeSignature(VALID_HEX_KEY, rawBody);
+        // Guard uses rawBody directly → should pass
+        const ctx = createMockExecutionContext({
+            headers: { [SIGNATURE_HEADER]: sig },
+            rawBody: rawBody,
+        });
+        expect(guard.canActivate(ctx)).toBe(true);
+        // If we were to use JSON.stringify(JSON.parse(rawJson)), it would fail
+        const reserialized = Buffer.from(JSON.stringify(JSON.parse(rawJson)));
+        expect(reserialized.toString()).not.toBe(rawJson); // confirm they differ
+        expect(verifySignature(sig, VALID_HEX_KEY, reserialized)).toBe(false);
+    });
+});
+//# sourceMappingURL=signature.test.js.map

package/dist/__tests__/signature.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.test.js","sourceRoot":"","sources":["../../src/__tests__/signature.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAoB,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAGjG;;;GAGG;AACH,SAAS,gBAAgB,CAAC,UAAkB,EAAE,IAAY;IACxD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,wCAAwC;AACxC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAEtC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAElD,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,4DAA4D;QAC5D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;QAC9F,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;QAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAEzD,+DAA+D;QAC/D,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtE,qBAAqB;QACrB,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,CAAC,eAAe,CAAC,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,gEAAgE;QAChE,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,IAAI,KAAqB,CAAC;IAC1B,IAAI,OAAgC,CAAC;IAErC,SAAS,0BAA0B,CAAC,SAGnC;QACC,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,EAAE;YAChC,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC;QACF,OAAO;YACL,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnB,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO;gBACzB,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;gBACvB,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE;aACvB,CAAC;YACF,QAAQ,EAAE,EAAE,CAAC,EAAE,EAAE;YACjB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;YAChB,aAAa,EAAE,EAAE,CAAC,EAAE,EAAE;YACtB,WAAW,EAAE,EAAE,CAAC,EAAE,EAAE;YACpB,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;YACnB,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE;SACc,CAAC;IACnC,CAAC;IAED,UAAU,CAAC,GAAG,EAAE;QACd,OAAO,GAAG;YACR,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,aAAa;SACzB,CAAC;QACF,wCAAwC;QACxC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAElD,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE;YACpC,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE;YAC3C,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,EAAE;YAClD,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACzC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,sBAAsB;YACnC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,UAAU,GAAG,YAAY,CAAC;QAClC,KAAK,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE;YACpC,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1C,oDAAoD;QACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,0BAA0B,CAAC;YACtC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE;YACzC,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,YAAY,GAA4B;YAC5C,KAAK,EAAE,UAAU;YACjB,SAAS,EAAE,SAA8B;SAC1C,CAAC;QACF,KAAK,GAAG,IAAI,cAAc,CAAC,YAAY,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,UAAU,EAAE;YAC3C,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,kFAAkF;QAClF,sEAAsE;QACtE,MAAM,OAAO,GAAG,wCAAwC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QAErD,4CAA4C;QAC5C,MAAM,GAAG,GAAG,0BAA0B,CAAC;YACrC,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE;YACpC,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE1C,uEAAuE;QACvE,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,sBAAsB;QACzE,MAAM,CAAC,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/token-manager.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=token-manager.test.d.ts.map

package/dist/__tests__/token-manager.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-manager.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/token-manager.test.ts"],"names":[],"mappings":""}