@etcsec-com/etc-collector 1.4.0

package/tests/unit/providers/ldap/ldap-retry.test.ts

@@ -0,0 +1,377 @@
+import {
+  retryWithBackoff,
+  retryable,
+  isRetryableError,
+  LDAP_RETRY_OPTIONS,
+} from '../../../../src/providers/ldap/ldap-retry';
+
+/**
+ * Unit Tests for LDAP Retry Logic
+ * Task 8: Write Unit Tests for LDAP Provider (Story 1.5)
+ */
+
+// Mock logger to avoid console output during tests
+jest.mock('../../../../src/utils/logger', () => ({
+  logger: {
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    debug: jest.fn(),
+  },
+}));
+
+describe('LDAP Retry Logic', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  describe('isRetryableError', () => {
+    it('should identify ECONNREFUSED as retryable', () => {
+      const error = new Error('Connection refused') as Error & { code: string };
+      error.code = 'ECONNREFUSED';
+
+      expect(isRetryableError(error)).toBe(true);
+    });
+
+    it('should identify ECONNRESET as retryable', () => {
+      const error = new Error('Connection reset') as Error & { code: string };
+      error.code = 'ECONNRESET';
+
+      expect(isRetryableError(error)).toBe(true);
+    });
+
+    it('should identify ETIMEDOUT as retryable', () => {
+      const error = new Error('Timeout') as Error & { code: string };
+      error.code = 'ETIMEDOUT';
+
+      expect(isRetryableError(error)).toBe(true);
+    });
+
+    it('should identify timeout message as retryable', () => {
+      const error = new Error('Operation timed out');
+
+      expect(isRetryableError(error)).toBe(true);
+    });
+
+    it('should identify connection errors as retryable', () => {
+      const error = new Error('Connection error occurred');
+
+      expect(isRetryableError(error)).toBe(true);
+    });
+
+    it('should identify network errors as retryable', () => {
+      const error = new Error('Network is unavailable');
+
+      expect(isRetryableError(error)).toBe(true);
+    });
+
+    it('should NOT identify authentication errors as retryable', () => {
+      const error = new Error('Invalid credentials');
+
+      expect(isRetryableError(error)).toBe(false);
+    });
+
+    it('should NOT identify bind failures as retryable', () => {
+      const error = new Error('Bind failed: invalid DN');
+
+      expect(isRetryableError(error)).toBe(false);
+    });
+
+    it('should NOT identify authentication failed as retryable', () => {
+      const error = new Error('Authentication failed');
+
+      expect(isRetryableError(error)).toBe(false);
+    });
+  });
+
+  describe('retryWithBackoff', () => {
+    it('should succeed on first attempt', async () => {
+      const operation = jest.fn().mockResolvedValue('success');
+
+      const result = await retryWithBackoff(operation, { maxAttempts: 3 });
+
+      expect(result).toBe('success');
+      expect(operation).toHaveBeenCalledTimes(1);
+    });
+
+    it('should retry on failure and eventually succeed', async () => {
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new Error('Temporary failure'))
+        .mockRejectedValueOnce(new Error('Another failure'))
+        .mockResolvedValue('success');
+
+      const result = await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 10,
+      });
+
+      expect(result).toBe('success');
+      expect(operation).toHaveBeenCalledTimes(3);
+    });
+
+    it('should throw error after max attempts', async () => {
+      const operation = jest.fn().mockRejectedValue(new Error('Persistent failure'));
+
+      await expect(
+        retryWithBackoff(operation, {
+          maxAttempts: 3,
+          initialDelay: 10,
+        })
+      ).rejects.toThrow('Persistent failure');
+
+      expect(operation).toHaveBeenCalledTimes(3);
+    });
+
+    it('should not retry if shouldRetry returns false', async () => {
+      const operation = jest.fn().mockRejectedValue(new Error('Auth failure'));
+
+      await expect(
+        retryWithBackoff(operation, {
+          maxAttempts: 3,
+          initialDelay: 10,
+          shouldRetry: () => false,
+        })
+      ).rejects.toThrow('Auth failure');
+
+      expect(operation).toHaveBeenCalledTimes(1);
+    });
+
+    it('should call onRetry callback before each retry', async () => {
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new Error('Failure 1'))
+        .mockResolvedValue('success');
+
+      const onRetry = jest.fn();
+
+      await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 10,
+        onRetry,
+      });
+
+      expect(onRetry).toHaveBeenCalledTimes(1);
+      expect(onRetry).toHaveBeenCalledWith(
+        expect.objectContaining({ message: 'Failure 1' }),
+        0,
+        expect.any(Number)
+      );
+    });
+
+    it('should apply exponential backoff', async () => {
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new Error('Failure 1'))
+        .mockRejectedValueOnce(new Error('Failure 2'))
+        .mockResolvedValue('success');
+
+      const delays: number[] = [];
+      const onRetry = jest.fn((_error, _attempt, delay) => {
+        delays.push(delay);
+      });
+
+      const startTime = Date.now();
+
+      await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 100,
+        backoffMultiplier: 2,
+        jitterFactor: 0,
+        onRetry,
+      });
+
+      const elapsedTime = Date.now() - startTime;
+
+      // First delay should be ~100ms, second should be ~200ms
+      // Total should be at least 300ms
+      expect(elapsedTime).toBeGreaterThanOrEqual(250);
+      expect(delays[0]).toBeGreaterThanOrEqual(90);
+      expect(delays[1]).toBeGreaterThanOrEqual(180);
+    });
+
+    it(
+      'should respect maxDelay cap',
+      async () => {
+        const operation = jest.fn().mockRejectedValue(new Error('Failure'));
+
+        const delays: number[] = [];
+        const onRetry = jest.fn((_error, _attempt, delay) => {
+          delays.push(delay);
+        });
+
+        try {
+          await retryWithBackoff(operation, {
+            maxAttempts: 5,
+            initialDelay: 1000,
+            maxDelay: 2000,
+            backoffMultiplier: 3,
+            jitterFactor: 0,
+            onRetry,
+          });
+        } catch (error) {
+          // Expected to fail
+        }
+
+        // All delays should be capped at maxDelay
+        delays.forEach((delay) => {
+          expect(delay).toBeLessThanOrEqual(2000);
+        });
+      },
+      10000
+    ); // 10 second timeout
+
+    it('should add jitter to delays', async () => {
+      const operation = jest
+        .fn()
+        .mockRejectedValueOnce(new Error('Failure 1'))
+        .mockRejectedValueOnce(new Error('Failure 2'))
+        .mockResolvedValue('success');
+
+      const delays: number[] = [];
+      const onRetry = jest.fn((_error, _attempt, delay) => {
+        delays.push(delay);
+      });
+
+      await retryWithBackoff(operation, {
+        maxAttempts: 3,
+        initialDelay: 1000,
+        backoffMultiplier: 1,
+        jitterFactor: 0.5, // 50% jitter
+        onRetry,
+      });
+
+      // With jitter, delays should vary around 1000ms
+      // Could be between 500ms and 1500ms
+      delays.forEach((delay) => {
+        expect(delay).toBeGreaterThanOrEqual(400);
+        expect(delay).toBeLessThanOrEqual(1600);
+      });
+    });
+
+    it('should handle non-Error objects', async () => {
+      const operation = jest.fn().mockRejectedValue('String error');
+
+      await expect(
+        retryWithBackoff(operation, {
+          maxAttempts: 2,
+          initialDelay: 10,
+        })
+      ).rejects.toThrow('String error');
+
+      expect(operation).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  describe('retryable', () => {
+    it('should create retryable function that succeeds', async () => {
+      const originalFn = jest.fn((x: number) => Promise.resolve(x * 2));
+      const retryableFn = retryable(originalFn, { maxAttempts: 3 });
+
+      const result = await retryableFn(5);
+
+      expect(result).toBe(10);
+      expect(originalFn).toHaveBeenCalledWith(5);
+      expect(originalFn).toHaveBeenCalledTimes(1);
+    });
+
+    it('should create retryable function that retries on failure', async () => {
+      const originalFn = jest
+        .fn()
+        .mockRejectedValueOnce(new Error('Failure'))
+        .mockResolvedValue('success');
+
+      const retryableFn = retryable(originalFn, {
+        maxAttempts: 3,
+        initialDelay: 10,
+      });
+
+      const result = await retryableFn();
+
+      expect(result).toBe('success');
+      expect(originalFn).toHaveBeenCalledTimes(2);
+    });
+
+    it('should pass arguments to retried function', async () => {
+      const originalFn = jest.fn((a: number, b: string) =>
+        Promise.resolve(`${a}-${b}`)
+      );
+
+      const retryableFn = retryable(originalFn);
+
+      const result = await retryableFn(42, 'test');
+
+      expect(result).toBe('42-test');
+      expect(originalFn).toHaveBeenCalledWith(42, 'test');
+    });
+  });
+
+  describe('LDAP_RETRY_OPTIONS', () => {
+    it('should have correct default values', () => {
+      expect(LDAP_RETRY_OPTIONS.maxAttempts).toBe(3);
+      expect(LDAP_RETRY_OPTIONS.initialDelay).toBe(1000);
+      expect(LDAP_RETRY_OPTIONS.maxDelay).toBe(10000);
+      expect(LDAP_RETRY_OPTIONS.backoffMultiplier).toBe(2);
+      expect(LDAP_RETRY_OPTIONS.jitterFactor).toBe(0.1);
+    });
+
+    it('should use isRetryableError as shouldRetry', () => {
+      const retryableErr = new Error('timeout') as Error;
+      const nonRetryableErr = new Error('invalid credentials');
+
+      expect(LDAP_RETRY_OPTIONS.shouldRetry!(retryableErr, 0)).toBe(true);
+      expect(LDAP_RETRY_OPTIONS.shouldRetry!(nonRetryableErr, 0)).toBe(false);
+    });
+
+    it('should have onRetry callback', () => {
+      expect(LDAP_RETRY_OPTIONS.onRetry).toBeDefined();
+      expect(typeof LDAP_RETRY_OPTIONS.onRetry).toBe('function');
+    });
+  });
+
+  describe('Integration test with realistic scenario', () => {
+    it('should handle transient network failure followed by success', async () => {
+      // Simulate a flaky network connection
+      let attemptCount = 0;
+      const flakyOperation = async () => {
+        attemptCount++;
+        if (attemptCount < 3) {
+          const error = new Error('Network timeout') as Error & { code: string };
+          error.code = 'ETIMEDOUT';
+          throw error;
+        }
+        return 'Connected successfully';
+      };
+
+      const result = await retryWithBackoff(flakyOperation, {
+        maxAttempts: 3,
+        initialDelay: 10,
+        shouldRetry: isRetryableError,
+      });
+
+      expect(result).toBe('Connected successfully');
+      expect(attemptCount).toBe(3);
+    });
+
+    it('should immediately fail on authentication error', async () => {
+      const operation = async () => {
+        throw new Error('Invalid credentials');
+      };
+
+      const startTime = Date.now();
+
+      await expect(
+        retryWithBackoff(operation, {
+          maxAttempts: 5,
+          initialDelay: 100,
+          shouldRetry: isRetryableError,
+        })
+      ).rejects.toThrow('Invalid credentials');
+
+      const elapsedTime = Date.now() - startTime;
+
+      // Should fail immediately without retries (< 50ms)
+      expect(elapsedTime).toBeLessThan(50);
+    });
+  });
+});

package/tests/unit/providers/ldap/ldap-sanitizer.test.ts

@@ -0,0 +1,301 @@
+import { LDAPSanitizer } from '../../../../src/providers/ldap/ldap-sanitizer';
+
+/**
+ * Unit Tests for LDAP Sanitizer
+ * Task 8: Write Unit Tests for LDAP Provider (Story 1.5)
+ */
+
+describe('LDAPSanitizer', () => {
+  describe('sanitizeFilter', () => {
+    it('should escape backslash characters', () => {
+      const input = 'user\\name';
+      const result = LDAPSanitizer.sanitizeFilter(input);
+      expect(result).toBe('user\\5cname');
+    });
+
+    it('should escape asterisk characters', () => {
+      const input = 'user*';
+      const result = LDAPSanitizer.sanitizeFilter(input);
+      expect(result).toBe('user\\2a');
+    });
+
+    it('should escape parentheses', () => {
+      const input = 'user(name)';
+      const result = LDAPSanitizer.sanitizeFilter(input);
+      expect(result).toBe('user\\28name\\29');
+    });
+
+    it('should escape NUL character', () => {
+      const input = 'user\0name';
+      const result = LDAPSanitizer.sanitizeFilter(input);
+      expect(result).toBe('user\\00name');
+    });
+
+    it('should prevent LDAP injection with multiple special chars', () => {
+      const maliciousInput = '*)(objectClass=*)';
+      const result = LDAPSanitizer.sanitizeFilter(maliciousInput);
+      expect(result).toBe('\\2a\\29\\28objectClass=\\2a\\29');
+    });
+
+    it('should handle empty string', () => {
+      const result = LDAPSanitizer.sanitizeFilter('');
+      expect(result).toBe('');
+    });
+
+    it('should handle string with no special characters', () => {
+      const input = 'john.doe';
+      const result = LDAPSanitizer.sanitizeFilter(input);
+      expect(result).toBe('john.doe');
+    });
+
+    it('should escape backslash before other special chars to prevent double-escaping', () => {
+      const input = '\\*';
+      const result = LDAPSanitizer.sanitizeFilter(input);
+      expect(result).toBe('\\5c\\2a');
+    });
+  });
+
+  describe('sanitizeDN', () => {
+    it('should escape comma in DN value', () => {
+      const input = 'John, Doe';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('John\\, Doe');
+    });
+
+    it('should escape equals sign in value', () => {
+      const input = 'user=name';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('user\\=name');
+    });
+
+    it('should escape plus sign in value', () => {
+      const input = 'test+value';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('test\\+value');
+    });
+
+    it('should escape leading space', () => {
+      const input = ' leading';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('\\ leading');
+    });
+
+    it('should escape trailing space', () => {
+      const input = 'trailing ';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('trailing\\ ');
+    });
+
+    it('should escape leading hash', () => {
+      const input = '#hash';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('\\#hash');
+    });
+
+    it('should escape backslash in value', () => {
+      const input = 'test\\value';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('test\\\\value');
+    });
+
+    it('should handle empty string', () => {
+      const result = LDAPSanitizer.sanitizeDN('');
+      expect(result).toBe('');
+    });
+
+    it('should handle simple value with no special characters', () => {
+      const input = 'JohnDoe';
+      const result = LDAPSanitizer.sanitizeDN(input);
+      expect(result).toBe('JohnDoe');
+    });
+  });
+
+  describe('isValidFilter', () => {
+    it('should validate simple filter', () => {
+      const result = LDAPSanitizer.isValidFilter('(uid=john)');
+      expect(result).toBe(true);
+    });
+
+    it('should validate AND filter', () => {
+      const result = LDAPSanitizer.isValidFilter('(&(uid=john)(objectClass=person))');
+      expect(result).toBe(true);
+    });
+
+    it('should validate OR filter', () => {
+      const result = LDAPSanitizer.isValidFilter('(|(uid=john)(uid=jane))');
+      expect(result).toBe(true);
+    });
+
+    it('should validate NOT filter', () => {
+      const result = LDAPSanitizer.isValidFilter('(!(uid=admin))');
+      expect(result).toBe(true);
+    });
+
+    it('should reject filter without parentheses', () => {
+      const result = LDAPSanitizer.isValidFilter('uid=john');
+      expect(result).toBe(false);
+    });
+
+    it('should reject filter with unbalanced parentheses', () => {
+      const result = LDAPSanitizer.isValidFilter('(uid=john');
+      expect(result).toBe(false);
+    });
+
+    it('should reject filter with extra closing parenthesis', () => {
+      const result = LDAPSanitizer.isValidFilter('(uid=john))');
+      expect(result).toBe(false);
+    });
+
+    it('should reject empty string', () => {
+      const result = LDAPSanitizer.isValidFilter('');
+      expect(result).toBe(false);
+    });
+
+    it('should reject empty parentheses', () => {
+      const result = LDAPSanitizer.isValidFilter('()');
+      expect(result).toBe(false);
+    });
+
+    it('should validate complex nested filter', () => {
+      const result = LDAPSanitizer.isValidFilter(
+        '(&(objectClass=user)(|(uid=john)(mail=john@example.com)))'
+      );
+      expect(result).toBe(true);
+    });
+  });
+
+  describe('isValidDN', () => {
+    it('should validate simple DN', () => {
+      const result = LDAPSanitizer.isValidDN('cn=John Doe');
+      expect(result).toBe(true);
+    });
+
+    it('should validate full DN', () => {
+      const result = LDAPSanitizer.isValidDN('cn=John Doe,ou=Users,dc=example,dc=com');
+      expect(result).toBe(true);
+    });
+
+    it('should validate DN with spaces', () => {
+      const result = LDAPSanitizer.isValidDN('cn=John Doe, ou=Users, dc=example, dc=com');
+      expect(result).toBe(true);
+    });
+
+    it('should reject invalid DN format', () => {
+      const result = LDAPSanitizer.isValidDN('invalid-dn');
+      expect(result).toBe(false);
+    });
+
+    it('should reject empty string', () => {
+      const result = LDAPSanitizer.isValidDN('');
+      expect(result).toBe(false);
+    });
+
+    it('should reject DN with invalid attribute name', () => {
+      const result = LDAPSanitizer.isValidDN('123invalid=value');
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('sanitizeAttribute', () => {
+    it('should allow valid attribute names', () => {
+      const result = LDAPSanitizer.sanitizeAttribute('sAMAccountName');
+      expect(result).toBe('sAMAccountName');
+    });
+
+    it('should allow attributes with hyphens', () => {
+      const result = LDAPSanitizer.sanitizeAttribute('user-name');
+      expect(result).toBe('user-name');
+    });
+
+    it('should allow attributes with dots', () => {
+      const result = LDAPSanitizer.sanitizeAttribute('user.name');
+      expect(result).toBe('user.name');
+    });
+
+    it('should remove special characters', () => {
+      const result = LDAPSanitizer.sanitizeAttribute('user@name!');
+      expect(result).toBe('username');
+    });
+
+    it('should handle empty string', () => {
+      const result = LDAPSanitizer.sanitizeAttribute('');
+      expect(result).toBe('');
+    });
+  });
+
+  describe('buildFilter', () => {
+    it('should build simple equality filter', () => {
+      const result = LDAPSanitizer.buildFilter('uid', '=', 'john');
+      expect(result).toBe('(uid=john)');
+    });
+
+    it('should sanitize filter value', () => {
+      const result = LDAPSanitizer.buildFilter('uid', '=', 'john*');
+      expect(result).toBe('(uid=john\\2a)');
+    });
+
+    it('should build greater-than filter', () => {
+      const result = LDAPSanitizer.buildFilter('age', '>=', '18');
+      expect(result).toBe('(age>=18)');
+    });
+
+    it('should build less-than filter', () => {
+      const result = LDAPSanitizer.buildFilter('age', '<=', '65');
+      expect(result).toBe('(age<=65)');
+    });
+
+    it('should build approximate filter', () => {
+      const result = LDAPSanitizer.buildFilter('name', '~=', 'john');
+      expect(result).toBe('(name~=john)');
+    });
+
+    it('should allow wildcards with =* operator', () => {
+      const result = LDAPSanitizer.buildFilter('uid', '=*', '*john*');
+      expect(result).toBe('(uid=**john*)');
+    });
+
+    it('should sanitize attribute name', () => {
+      const result = LDAPSanitizer.buildFilter('user@name', '=', 'john');
+      expect(result).toBe('(username=john)');
+    });
+  });
+
+  describe('buildLogicalFilter', () => {
+    it('should build AND filter', () => {
+      const result = LDAPSanitizer.buildLogicalFilter('&', [
+        '(uid=john)',
+        '(objectClass=person)',
+      ]);
+      expect(result).toBe('(&(uid=john)(objectClass=person))');
+    });
+
+    it('should build OR filter', () => {
+      const result = LDAPSanitizer.buildLogicalFilter('|', ['(uid=john)', '(uid=jane)']);
+      expect(result).toBe('(|(uid=john)(uid=jane))');
+    });
+
+    it('should build NOT filter', () => {
+      const result = LDAPSanitizer.buildLogicalFilter('!', ['(uid=admin)']);
+      expect(result).toBe('(!(uid=admin))');
+    });
+
+    it('should handle empty array', () => {
+      const result = LDAPSanitizer.buildLogicalFilter('&', []);
+      expect(result).toBe('');
+    });
+
+    it('should throw error for NOT with multiple filters', () => {
+      expect(() => {
+        LDAPSanitizer.buildLogicalFilter('!', ['(uid=john)', '(uid=jane)']);
+      }).toThrow('NOT operator requires exactly one filter');
+    });
+
+    it('should handle nested filters', () => {
+      const result = LDAPSanitizer.buildLogicalFilter('&', [
+        '(objectClass=user)',
+        '(|(uid=john)(mail=john@example.com))',
+      ]);
+      expect(result).toBe('(&(objectClass=user)(|(uid=john)(mail=john@example.com)))');
+    });
+  });
+});

package/tests/unit/sample.test.ts

@@ -0,0 +1,19 @@
+/**
+ * Sample Test - Infrastructure Validation
+ * This test verifies that Jest and TypeScript are configured correctly
+ */
+
+describe('Infrastructure Setup', () => {
+  it('should run Jest tests successfully', () => {
+    expect(1 + 1).toBe(2);
+  });
+
+  it('should support TypeScript', () => {
+    const sum = (a: number, b: number): number => a + b;
+    expect(sum(2, 3)).toBe(5);
+  });
+
+  it('should have test environment configured', () => {
+    expect(process.env['NODE_ENV']).toBe('test');
+  });
+});