@drip-apex/sdk 0.1.0 → 0.3.0

package/src/redirect.test.ts

@@ -0,0 +1,541 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  buildRedirectDestination,
+  finalizeRedirectAssignmentCarryHandover,
+  filterUnsafeRedirectAssignments,
+  hasGeneratedRedirectAssignmentCarry,
+  isRedirectLoop,
+  importRedirectAssignmentCarry,
+  readRedirectAssignmentCarry,
+  redirectForAssignment,
+  stripRedirectAssignmentCarry,
+  validateRedirectAssignmentCarry,
+} from "./redirect";
+import type { Assignment, Experiment } from "./types";
+
+function decodeTestHandover(token: string): Record<string, unknown> {
+  const payload = token.split(".")[0];
+  const normalized = payload.replace(/-/g, "+").replace(/_/g, "/");
+  return JSON.parse(atob(normalized + "=".repeat((4 - normalized.length % 4) % 4)));
+}
+
+function verifyTestHandover(token: string): Promise<unknown> {
+  return Promise.resolve({ ...decodeTestHandover(token), shop: "shop_123" });
+}
+
+const experiment: Experiment = { id: "exp_redirect", experimentType: "redirect", variations: [
+  { id: "control", weight: 0.5, mutations: [], isControl: true },
+  { id: "landing", weight: 0.5, mutations: [], redirectUrl: "https://landing.example.net/sale?theme=long" },
+] };
+const assignment: Assignment = { experimentId: experiment.id, variationId: "landing", pageActive: true, index: 1, mutations: [], isControl: false,
+  hashValue: "visitor", redirectUrl: "https://landing.example.net/sale?theme=long" };
+
+describe("redirect experiments", () => {
+  it("always strips malformed redirect carry parameters", () => {
+    const replaceState = vi.fn();
+    vi.stubGlobal("history", { state: undefined, replaceState });
+    stripRedirectAssignmentCarry("https://landing.test/sale?_apex_assignment=malformed&keep=1");
+    expect(replaceState).toHaveBeenCalledWith(undefined, "", "https://landing.test/sale?keep=1");
+  });
+  it("does not redirect without an explicit source URL rule", () => {
+    expect(redirectForAssignment([experiment], [assignment], "https://shop.example.com/cart")).toBeNull();
+  });
+  it("does not redirect with an exclusion-only source rule set", () => {
+    const exclusionOnly = {
+      ...experiment,
+      targeting: {
+        url: [
+          {
+            type: "simple" as const,
+            pattern: "/checkout/*",
+            include: false,
+          },
+        ],
+      },
+    };
+
+    expect(
+      redirectForAssignment(
+        [exclusionOnly],
+        [assignment],
+        "https://shop.example.com/products/a",
+      ),
+    ).toBeNull();
+    expect(
+      filterUnsafeRedirectAssignments(
+        [exclusionOnly],
+        [assignment],
+        "https://shop.example.com/products/a",
+      ),
+    ).toEqual([]);
+  });
+  it("preserves attribution query/hash and lets target params win", () => {
+    const result = buildRedirectDestination(
+      "https://shop.example.com/a?utm_source=ad&tag=a&tag=b&theme=short&theme=ignored#details",
+      "https://landing.example.net/sale?theme=long&theme=wide",
+      assignment,
+    )!;
+    expect(result.searchParams.get("utm_source")).toBe("ad");
+    expect(result.searchParams.getAll("tag")).toEqual(["a", "b"]);
+    expect(result.searchParams.getAll("theme")).toEqual(["long", "wide"]);
+    expect(result.searchParams.get("_apex_assignment")).toContain("exp_redirect");
+    expect(result.hash).toBe("#details");
+  });
+  it("preserves a merchant-authored reserved parameter and emits a collision signal", () => {
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => undefined);
+    const result = buildRedirectDestination(
+      "https://shop.example.com/a?utm_source=ad",
+      "https://landing.example.net/sale?_apex_assignment=merchant-value",
+      assignment,
+      "visitor_source",
+    )!;
+
+    expect(result.searchParams.get("_apex_assignment")).toBe("merchant-value");
+    expect(warn).toHaveBeenCalledWith(expect.stringContaining("preserving the merchant-authored value"));
+    warn.mockRestore();
+  });
+  it("recognizes a generated redirect carry after its destination URL is cloned", () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/a",
+      assignment.redirectUrl!,
+      assignment,
+      "visitor_source",
+    )!;
+    const clonedDestination = new URL(destination.href);
+
+    expect(hasGeneratedRedirectAssignmentCarry(clonedDestination)).toBe(true);
+    finalizeRedirectAssignmentCarryHandover(clonedDestination, "verified-token");
+    expect(JSON.parse(
+      clonedDestination.searchParams.get("_apex_assignment")!,
+    ).handover).toBe("verified-token");
+  });
+  it("does not redirect when the assigned destination is already current (negative loop guard)", () => {
+    const same = { ...assignment, redirectUrl: "https://shop.example.com/sale?utm_source=ad#offer" };
+    expect(redirectForAssignment([experiment], [same], "https://shop.example.com/sale?utm_source=ad#offer")).toBeNull();
+  });
+  it("does not redirect into the experiment's own source targeting", () => {
+    const targeted = { ...experiment, targeting: { url: [{ type: "simple" as const, pattern: "/products/*", include: true }] } };
+    const sameTarget = { ...assignment, redirectUrl: "https://shop.example.com/products/destination" };
+    expect(redirectForAssignment([targeted], [sameTarget], "https://shop.example.com/products/source")).toBeNull();
+    expect(
+      filterUnsafeRedirectAssignments(
+        [targeted],
+        [sameTarget],
+        "https://shop.example.com/products/source",
+      ),
+    ).toEqual([]);
+  });
+  it("redirects cross-origin when the destination only shares a path-only source rule", () => {
+    const targeted = { ...experiment, targeting: { url: [{ type: "simple" as const, pattern: "/products/*", include: true }] } };
+    const crossOriginSamePath = {
+      ...assignment,
+      redirectUrl: "https://landing.example.com/products/destination",
+    };
+
+    expect(
+      redirectForAssignment(
+        [targeted],
+        [crossOriginSamePath],
+        "https://shop.example.com/products/source",
+      )?.origin,
+    ).toBe("https://landing.example.com");
+    expect(
+      filterUnsafeRedirectAssignments(
+        [targeted],
+        [crossOriginSamePath],
+        "https://shop.example.com/products/source",
+      ),
+    ).toEqual([crossOriginSamePath]);
+  });
+  it("still blocks a same-origin destination that shares a path-only source rule", () => {
+    const targeted = { ...experiment, targeting: { url: [{ type: "simple" as const, pattern: "/products/*", include: true }] } };
+    const sameOriginSamePath = {
+      ...assignment,
+      redirectUrl: "https://shop.example.com/products/destination",
+    };
+
+    expect(
+      redirectForAssignment(
+        [targeted],
+        [sameOriginSamePath],
+        "https://shop.example.com/products/source",
+      ),
+    ).toBeNull();
+  });
+  it.each([
+    "https://landing.example.com/products/*",
+    "landing.example.com/products/*",
+  ])("blocks a cross-origin destination when a source rule specifies its host: %s", (hostPattern) => {
+    const targeted = {
+      ...experiment,
+      targeting: {
+        url: [
+          {
+            type: "simple" as const,
+            pattern: "/products/*",
+            include: true,
+          },
+          {
+            type: "simple" as const,
+            pattern: hostPattern,
+            include: true,
+          },
+        ],
+      },
+    };
+    const crossOriginSamePath = {
+      ...assignment,
+      redirectUrl: "https://landing.example.com/products/destination",
+    };
+
+    expect(
+      redirectForAssignment(
+        [targeted],
+        [crossOriginSamePath],
+        "https://shop.example.com/products/source",
+      ),
+    ).toBeNull();
+  });
+  it("allows a cross-origin destination excluded by a host-agnostic rule", () => {
+    const targeted = {
+      ...experiment,
+      targeting: {
+        url: [
+          {
+            type: "simple" as const,
+            pattern: "https://shop.example.com/products/*",
+            include: true,
+          },
+          {
+            type: "simple" as const,
+            pattern: "https://landing.example.com/products/*",
+            include: true,
+          },
+          {
+            type: "simple" as const,
+            pattern: "/products/excluded",
+            include: false,
+          },
+        ],
+      },
+    };
+    const excludedDestination = {
+      ...assignment,
+      redirectUrl: "https://landing.example.com/products/excluded",
+    };
+
+    expect(
+      redirectForAssignment(
+        [targeted],
+        [excludedDestination],
+        "https://shop.example.com/products/source",
+      )?.href,
+    ).toContain("https://landing.example.com/products/excluded");
+    expect(
+      filterUnsafeRedirectAssignments(
+        [targeted],
+        [excludedDestination],
+        "https://shop.example.com/products/source",
+      ),
+    ).toEqual([excludedDestination]);
+  });
+  it("does not redirect a sticky treatment from a page outside source targeting", () => {
+    const targeted = { ...experiment, targeting: { url: [{ type: "simple" as const, pattern: "/products/*", include: true }] } };
+    expect(redirectForAssignment([targeted], [assignment], "https://shop.example.com/cart")).toBeNull();
+  });
+  it("redirects when destination differs", () => {
+    const destination = buildRedirectDestination("https://shop.example.com/a", assignment.redirectUrl!, assignment)!;
+    expect(isRedirectLoop("https://shop.example.com/a", destination)).toBe(false);
+  });
+
+  it.each([
+    [
+      "a protocol change",
+      "https://shop.example.com/products/a",
+      "http://shop.example.com/sale",
+    ],
+    [
+      "a port change",
+      "https://shop.example.com:8443/products/a",
+      "https://shop.example.com:9443/sale",
+    ],
+  ])("carries assignment identity across %s on the same hostname", (
+    _label,
+    currentHref,
+    redirectUrl,
+  ) => {
+    const destination = buildRedirectDestination(
+      currentHref,
+      redirectUrl,
+      assignment,
+      "visitor_source",
+    )!;
+
+    expect(destination.searchParams.get("_apex_assignment")).toContain(
+      "exp_redirect",
+    );
+  });
+
+  it("adopts a Worker-verified carried visitor identity only inside the handover window", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      { ...assignment, assignmentEpoch: 0 },
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    await expect(readRedirectAssignmentCarry(
+      [{ ...experiment, assignmentEpoch: -2 }],
+      destination.href,
+      "shop_123",
+      verifyTestHandover,
+    )).resolves.toMatchObject({
+        variationId: "landing",
+        visitorId: "visitor_source",
+      });
+  });
+
+  it("imports carry on the configured destination entry path but not another path on the host", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      destination.href,
+      "shop_123",
+      verifyTestHandover,
+    )).resolves.toMatchObject({ variationId: "landing" });
+
+    const unrelated = new URL(destination.href);
+    unrelated.pathname = "/account";
+    const verify = vi.fn(verifyTestHandover);
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      unrelated.href,
+      "shop_123",
+      verify,
+    )).resolves.toBeNull();
+    expect(verify).not.toHaveBeenCalled();
+  });
+
+  it("rejects a valid handover when destinationPath is tampered to match a non-destination page", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    const rawCarry = JSON.parse(destination.searchParams.get("_apex_assignment")!);
+    rawCarry.destinationPath = "/account";
+    destination.searchParams.set("_apex_assignment", JSON.stringify(rawCarry));
+    destination.pathname = "/account";
+
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      destination.href,
+      "shop_123",
+      verifyTestHandover,
+    )).resolves.toBeNull();
+  });
+
+  it.each([
+    ["relative", "/sale", "https://landing.example.net/sale?merchant=kept"],
+    ["relative trailing slash", "/sale/", "https://landing.example.net/sale?merchant=kept"],
+    ["absolute", "https://landing.example.net/sale", "https://landing.example.net/sale?merchant=kept"],
+    ["absolute trailing slash", "https://landing.example.net/sale/", "https://landing.example.net/sale?merchant=kept"],
+  ])("imports a carry at its %s configured destination", async (_label, redirectUrl, arrivalHref) => {
+    const configuredExperiment: Experiment = {
+      ...experiment,
+      variations: experiment.variations.map((variation) => variation.id === "landing"
+        ? { ...variation, redirectUrl }
+        : variation),
+    };
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      arrivalHref,
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+
+    await expect(readRedirectAssignmentCarry(
+      [configuredExperiment],
+      destination.href,
+      "shop_123",
+      verifyTestHandover,
+    )).resolves.toMatchObject({ variationId: "landing" });
+  });
+
+  it("rejects an absolute configured destination on a different host", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    destination.hostname = "other.example.net";
+
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      destination.href,
+      "shop_123",
+      verifyTestHandover,
+    )).resolves.toBeNull();
+  });
+
+  it("treats trailing slashes as equivalent on a scoped destination entry path", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      "https://landing.example.net/sale/",
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    destination.pathname = "/sale";
+
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      destination.href,
+      "shop_123",
+      verifyTestHandover,
+    )).resolves.toMatchObject({ variationId: "landing" });
+  });
+
+  it("preserves href-less validation for legacy redirect carries without destinationPath", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    const rawCarry = JSON.parse(destination.searchParams.get("_apex_assignment")!);
+    delete rawCarry.destinationPath;
+    destination.searchParams.set("_apex_assignment", JSON.stringify(rawCarry));
+    const verifiedCarry = {
+      experimentId: rawCarry.e,
+      variationId: rawCarry.v,
+      assignmentEpoch: rawCarry.epoch,
+      handoverToken: rawCarry.handover,
+      expiresAt: Date.now() + 120_000,
+      exposureSent: false,
+      visitorId: "visitor_source",
+    };
+
+    expect(validateRedirectAssignmentCarry([experiment], verifiedCarry)).toMatchObject({
+      variationId: "landing",
+    });
+  });
+
+  it("rejects a forged carried visitor identity when Worker verification fails", async () => {
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      assignment,
+      "attacker_chosen_visitor",
+      { handoverTtlSeconds: 120 },
+    )!;
+    const verify = vi.fn(async () => null);
+
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      destination.href,
+      "shop_123",
+      verify,
+    )).resolves.toBeNull();
+    expect(verify).toHaveBeenCalledTimes(1);
+  });
+
+  it("imports edge-carried attribution only on the signed destination entry URL", () => {
+    const cookieDocument = { cookie: "" };
+    vi.stubGlobal("document", cookieDocument);
+    const carriedExperiment = { ...experiment, assignmentEpoch: 1 };
+    const carry = {
+      experiment: carriedExperiment,
+      variationId: "landing",
+      visitorId: "visitor_edge",
+      exposureSent: true,
+      attributionToken: "signed-attribution",
+      attributionDestinationUrl: "https://landing.example.net/sale?campaign=edge",
+      attributionIssuedAt: Date.now(),
+    };
+
+    importRedirectAssignmentCarry(carry, "https://landing.example.net/other?campaign=edge");
+    expect(cookieDocument.cookie).not.toContain("drip_ra=");
+
+    importRedirectAssignmentCarry(
+      carry,
+      "https://landing.example.net/sale?campaign=edge&_apex_assignment=carry",
+    );
+    expect(cookieDocument.cookie).toContain("drip_ra=signed-attribution");
+    expect(cookieDocument.cookie).toContain("SameSite=Lax");
+    vi.unstubAllGlobals();
+  });
+
+  it("does not persist landing attribution after the edge runtime already adopted the carry", () => {
+    const cookieDocument = { cookie: "" };
+    vi.stubGlobal("document", cookieDocument);
+
+    importRedirectAssignmentCarry({
+      experiment: { ...experiment, assignmentEpoch: 1 },
+      variationId: "landing",
+      visitorId: "visitor_edge",
+      exposureSent: true,
+      attributionToken: "signed-attribution",
+      attributionDestinationUrl: "https://landing.example.net/sale",
+      attributionIssuedAt: Date.now(),
+    }, "https://landing.example.net/sale?_apex_assignment=carry", false);
+
+    expect(cookieDocument.cookie).not.toContain("drip_ra=");
+    vi.unstubAllGlobals();
+  });
+
+  it("imports edge-carried attribution when slash, hash, query order, and encoding differ", () => {
+    const cookieDocument = { cookie: "" };
+    vi.stubGlobal("document", cookieDocument);
+
+    importRedirectAssignmentCarry(
+      {
+        experiment: { ...experiment, assignmentEpoch: 1 },
+        variationId: "landing",
+        visitorId: "visitor_edge",
+        exposureSent: true,
+        attributionToken: "signed-attribution",
+        attributionDestinationUrl: "https://landing.example.net/sale/?campaign=spring%20sale&tag=one&tag=two&B=upper&a=lower#signed",
+        attributionIssuedAt: Date.now(),
+      },
+      "https://landing.example.net/sale?tag=two&a=lower&_apex_assignment=carry&tag=one&B=upper&campaign=spring+sale#received",
+    );
+
+    expect(cookieDocument.cookie).toContain("drip_ra=signed-attribution");
+    vi.unstubAllGlobals();
+  });
+
+  it("ignores a stale carried visitor identity before verification", async () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-07-26T12:00:00Z"));
+    const destination = buildRedirectDestination(
+      "https://shop.example.com/products/a",
+      assignment.redirectUrl!,
+      assignment,
+      "visitor_source",
+      { handoverTtlSeconds: 120 },
+    )!;
+    vi.setSystemTime(new Date("2026-07-26T12:02:01Z"));
+    const verify = vi.fn(verifyTestHandover);
+    await expect(readRedirectAssignmentCarry(
+      [experiment],
+      destination.href,
+      "shop_123",
+      verify,
+    )).resolves.toBeNull();
+    expect(verify).not.toHaveBeenCalled();
+    vi.useRealTimers();
+  });
+});