@ftisindia/create-app 0.1.5 → 0.2.0

package/template/test/forms-webhooks.e2e-spec.ts

@@ -0,0 +1,403 @@
+import { createServer, Server } from 'node:http';
+import { createHmac } from 'node:crypto';
+import { AddressInfo } from 'node:net';
+import { INestApplication, ValidationPipe } from '@nestjs/common';
+import { Test } from '@nestjs/testing';
+import request from 'supertest';
+import { HttpExceptionFilter } from '../src/common/filters/http-exception.filter';
+import { PrismaService } from '../src/database/prisma/prisma.service';
+import { OutboxDispatcherService } from '../src/modules/forms/application/services/outbox-dispatcher.service';
+
+interface CapturedRequest {
+  url: string;
+  signature: string | undefined;
+  idempotencyKey: string | undefined;
+  body: string;
+}
+
+describe('Forms submission webhooks (e2e)', () => {
+  let app: INestApplication;
+  let prisma: PrismaService;
+  let dispatcher: OutboxDispatcherService;
+  let server: Server;
+  let port: number;
+  const received: CapturedRequest[] = [];
+
+  beforeAll(async () => {
+    process.env.DATABASE_URL = process.env.TEST_DATABASE_URL ?? process.env.DATABASE_URL;
+    process.env.JWT_SECRET ||= 'test-jwt-secret-at-least-16-chars';
+    process.env.AUTH_GOOGLE_ENABLED ||= 'false';
+    process.env.AUTH_EMAIL_PASSWORD_ENABLED ||= 'true';
+    process.env.NODE_ENV = 'test';
+    process.env.FORMS_OUTBOX_ENABLED = 'false';
+
+    server = createServer((req, res) => {
+      const chunks: Buffer[] = [];
+      req.on('data', (chunk: Buffer) => chunks.push(chunk));
+      req.on('end', () => {
+        received.push({
+          url: req.url ?? '',
+          signature: req.headers['x-forms-signature'] as string | undefined,
+          idempotencyKey: req.headers['x-forms-idempotency-key'] as string | undefined,
+          body: Buffer.concat(chunks).toString('utf8'),
+        });
+        if (req.url === '/redirect-metadata') {
+          res.statusCode = 302;
+          res.setHeader('location', 'http://169.254.169.254/latest/meta-data/');
+          res.end();
+          return;
+        }
+        res.statusCode = req.url === '/always-500' ? 500 : 200;
+        res.end();
+      });
+    });
+    await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
+    port = (server.address() as AddressInfo).port;
+
+    const { AppModule } = await import('../src/app.module');
+    const moduleRef = await Test.createTestingModule({
+      imports: [AppModule],
+    }).compile();
+
+    app = moduleRef.createNestApplication();
+    app.useGlobalFilters(new HttpExceptionFilter());
+    app.useGlobalPipes(
+      new ValidationPipe({
+        forbidNonWhitelisted: true,
+        transform: true,
+        whitelist: true,
+      }),
+    );
+    await app.init();
+    prisma = app.get(PrismaService);
+    dispatcher = app.get(OutboxDispatcherService);
+    await prisma.formOutboxJob.updateMany({
+      where: { status: { in: ['PENDING', 'PROCESSING'] } },
+      data: {
+        status: 'FAILED',
+        claimedBy: null,
+        lastError: 'parked by forms-webhooks e2e setup',
+      },
+    });
+  });
+
+  afterAll(async () => {
+    await app.close();
+    await new Promise<void>((resolve, reject) =>
+      server.close((error) => (error ? reject(error) : resolve())),
+    );
+  });
+
+  it('rejects webhook hosts that are not in the org allowlist (save-time lint)', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-allowlist');
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        definition: makeDefinition([{ url: 'https://hooks.example.com/x' }]),
+      })
+      .expect(422);
+
+    const codes = issueCodes(response.body);
+    expect(codes).toContain('WEBHOOK_HOST_NOT_ALLOWED');
+  });
+
+  it('rejects http urls on non-loopback hosts even when allowlisted', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-insecure');
+    await allowHosts(accessToken, orgId, ['hooks.example.com']);
+
+    const response = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        definition: makeDefinition([{ url: 'http://hooks.example.com/x' }]),
+      })
+      .expect(422);
+
+    expect(issueCodes(response.body)).toContain('WEBHOOK_URL_INSECURE');
+  });
+
+  it('delivers a signed, redacted webhook atomically with the submission', async () => {
+    const { accessToken, orgId, userId } = await createUserAndOrg('wh-deliver');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/hook`, secret: 'test-secret' }]),
+    );
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({
+        mode: 'submit',
+        data: { title: 'Hello', apiKey: 'super-secret-key' },
+      })
+      .expect(200);
+    const submissionId = submit.body.submissionId as string;
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${submissionId}:webhook:0` },
+    });
+    expect(job).not.toBeNull();
+    expect(job!.type).toBe('webhook');
+    expect(job!.status).toBe('PENDING');
+    expect(job!.orgId).toBe(orgId);
+    const payload = job!.payload as Record<string, unknown>;
+    expect(payload.secret).toBeUndefined();
+    expect(payload.signature).toEqual(expect.stringMatching(/^sha256=/));
+
+    const before = received.length;
+    await dispatcher.runOnce();
+
+    const hits = received.slice(before).filter((entry) => entry.url === '/hook');
+    expect(hits).toHaveLength(1);
+    const hit = hits[0]!;
+    const body = JSON.parse(hit.body) as Record<string, unknown>;
+    expect(body.event).toBe('submitted');
+    expect(body.formKey).toBe('webhook-form');
+    expect(body.submissionId).toBe(submissionId);
+    const data = body.data as Record<string, unknown>;
+    expect(data.title).toBe('Hello');
+    expect(data.apiKey).toBe('[REDACTED]');
+
+    const expectedSignature =
+      'sha256=' + createHmac('sha256', 'test-secret').update(hit.body).digest('hex');
+    expect(hit.signature).toBe(expectedSignature);
+    expect(hit.idempotencyKey).toBe(`${submissionId}:webhook:0`);
+
+    const delivered = await prisma.formOutboxJob.findFirst({
+      where: { id: job!.id },
+    });
+    expect(delivered!.status).toBe('DONE');
+
+    const audit = await prisma.auditLog.findFirst({
+      where: { orgId, action: 'forms.outbox.delivered', targetId: job!.id },
+    });
+    expect(audit).not.toBeNull();
+    expect(audit!.actorUserId).toBe(userId);
+  });
+
+  it('sanitizes legacy webhook payloads that still contain a secret', async () => {
+    const { orgId, userId } = await createUserAndOrg('wh-legacy-secret');
+    const body = { event: 'submitted', formKey: 'legacy-webhook' };
+    const job = await prisma.formOutboxJob.create({
+      data: {
+        type: 'webhook',
+        payload: {
+          url: `http://127.0.0.1:${port}/legacy`,
+          body,
+          secret: 'legacy-secret',
+        },
+        status: 'PENDING',
+        attempts: 0,
+        maxAttempts: 3,
+        orgId,
+        actorUserId: userId,
+      },
+    });
+
+    const before = received.length;
+    await dispatcher.runOnce();
+
+    const hits = received.slice(before).filter((entry) => entry.url === '/legacy');
+    expect(hits).toHaveLength(1);
+    const expectedSignature =
+      'sha256=' + createHmac('sha256', 'legacy-secret').update(hits[0]!.body).digest('hex');
+    expect(hits[0]!.signature).toBe(expectedSignature);
+
+    const delivered = await prisma.formOutboxJob.findUnique({ where: { id: job.id } });
+    expect(delivered?.status).toBe('DONE');
+    const sanitized = delivered!.payload as Record<string, unknown>;
+    expect(sanitized.secret).toBeUndefined();
+    expect(sanitized.body).toBeUndefined();
+    expect(sanitized.rawBody).toBe(JSON.stringify(body));
+    expect(sanitized.signature).toBe(expectedSignature);
+  });
+
+  it('retries failed webhook deliveries with backoff', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-retry');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/always-500` }]),
+    );
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'submit', data: { title: 'Retry me' } })
+      .expect(200);
+
+    await dispatcher.runOnce();
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${submit.body.submissionId}:webhook:0` },
+    });
+    expect(job!.status).toBe('PENDING');
+    expect(job!.attempts).toBe(1);
+    expect(job!.lastError).toContain('500');
+    expect(job!.runAfter!.getTime()).toBeGreaterThan(Date.now());
+  });
+
+  it('does not follow webhook redirects during delivery', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-redirect');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/redirect-metadata` }]),
+    );
+
+    const submit = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'submit', data: { title: 'Redirect me' } })
+      .expect(200);
+
+    const before = received.length;
+    await dispatcher.runOnce();
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${submit.body.submissionId}:webhook:0` },
+    });
+    expect(job!.status).toBe('PENDING');
+    expect(job!.attempts).toBe(1);
+    expect(job!.lastError).toContain('redirects are not allowed');
+    const redirectHits = received
+      .slice(before)
+      .filter((entry) => entry.url === '/redirect-metadata');
+    expect(redirectHits).toHaveLength(1);
+  });
+
+  it('rejects private and link-local webhook destinations at delivery in production', async () => {
+    const { orgId, userId } = await createUserAndOrg('wh-private-delivery');
+    const previousNodeEnv = process.env.NODE_ENV;
+    process.env.NODE_ENV = 'production';
+    try {
+      const job = await prisma.formOutboxJob.create({
+        data: {
+          type: 'webhook',
+          payload: {
+            url: 'https://169.254.169.254/latest/meta-data/',
+            body: { event: 'submitted' },
+          },
+          status: 'PENDING',
+          attempts: 0,
+          maxAttempts: 3,
+          orgId,
+          actorUserId: userId,
+        },
+      });
+
+      await dispatcher.runOnce();
+
+      const retried = await prisma.formOutboxJob.findUnique({
+        where: { id: job.id },
+      });
+      expect(retried!.status).toBe('PENDING');
+      expect(retried!.attempts).toBe(1);
+      expect(retried!.lastError).toContain('private or reserved address');
+    } finally {
+      process.env.NODE_ENV = previousNodeEnv;
+    }
+  });
+
+  it('does not enqueue webhooks for draft saves', async () => {
+    const { accessToken, orgId } = await createUserAndOrg('wh-draft');
+    await allowHosts(accessToken, orgId, ['127.0.0.1']);
+    await createAndPublish(
+      accessToken,
+      orgId,
+      makeDefinition([{ url: `http://127.0.0.1:${port}/hook` }]),
+    );
+
+    const draft = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms/webhook-form/submissions`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ mode: 'draft', data: { title: 'Draft only' } })
+      .expect(200);
+
+    const job = await prisma.formOutboxJob.findFirst({
+      where: { idempotencyKey: `${draft.body.submissionId}:webhook:0` },
+    });
+    expect(job).toBeNull();
+  });
+
+  function makeDefinition(webhooks: Array<Record<string, unknown>>) {
+    return {
+      key: 'webhook-form',
+      version: 1,
+      title: 'Webhook form',
+      fields: [
+        {
+          type: 'text',
+          name: 'title',
+          validators: { required: true, maxLength: 200 },
+        },
+        { type: 'password', name: 'apiKey' },
+      ],
+      actions: {
+        submit: ['validateAll', 'persist'],
+        saveDraft: ['persistDraft'],
+      },
+      settings: { webhooks },
+    };
+  }
+
+  function issueCodes(body: { error?: { details?: { issues?: Array<{ code: string }> } } }) {
+    return (body.error?.details?.issues ?? []).map((issue) => issue.code);
+  }
+
+  async function allowHosts(accessToken: string, orgId: string, hosts: string[]) {
+    await request(app.getHttpServer())
+      .patch(`/organisations/${orgId}/settings`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ key: 'forms.webhookAllowedHosts', value: hosts })
+      .expect(200);
+  }
+
+  async function createAndPublish(
+    accessToken: string,
+    orgId: string,
+    definition: Record<string, unknown>,
+  ) {
+    const created = await request(app.getHttpServer())
+      .post(`/organisations/${orgId}/forms`)
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ definition })
+      .expect(201);
+    await request(app.getHttpServer())
+      .post(
+        `/organisations/${orgId}/forms/${definition.key as string}/versions/${created.body.version}/publish`,
+      )
+      .set('Authorization', `Bearer ${accessToken}`)
+      .expect(200);
+    return created.body as { version: number };
+  }
+
+  async function createUserAndOrg(label: string) {
+    const suffix = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+    const signup = await request(app.getHttpServer())
+      .post('/auth/signup')
+      .send({
+        email: `${label}-${suffix}@example.com`,
+        password: 'test-password-123',
+        displayName: label,
+      })
+      .expect(201);
+    const accessToken = signup.body.accessToken as string;
+    const org = await request(app.getHttpServer())
+      .post('/organisations')
+      .set('Authorization', `Bearer ${accessToken}`)
+      .send({ name: `${label} ${suffix}`, slug: `${label}-${suffix}` })
+      .expect(201);
+
+    return {
+      accessToken,
+      userId: signup.body.user.id as string,
+      orgId: org.body.organisation.id as string,
+    };
+  }
+});

package/template/test/jest-e2e.json

@@ -3,6 +3,7 @@
   "rootDir": "..",
   "testEnvironment": "node",
   "testRegex": ".e2e-spec.ts$",
+  "testTimeout": 30000,
   "transform": {
     "^.+\\.(t|j)s$": "ts-jest"
   }