@hubspot/ui-extensions-dev-server 1.1.6 → 1.1.8

package/dist/lib/__tests__/app-functions/services/AppProxyService.spec.js

@@ -0,0 +1,667 @@
+import { describe, it, expect, vi, afterEach, beforeEach } from 'vitest';
+import { extractErrorData, mapToLocalUrl, AppProxyService, } from "../../../app-functions/services/AppProxyService.js";
+import { axiosErrorMappings, defaultServerError, validationError, } from "../../../app-functions/constants.js";
+import axios, { AxiosError, HttpStatusCode } from 'axios';
+import httpMocks from 'node-mocks-http';
+import { EventEmitter } from 'node:events';
+import * as signing from "../../../app-functions/signing.js";
+const callAppProxy = async ({ requestUri, method, requestTimeoutMillis, requestBody, requestHeaders, accountId, localDevUrlMapping = {}, logger, }) => {
+    const request = httpMocks.createRequest({
+        method: 'POST',
+        url: '/proxy',
+        body: {
+            requestUri,
+            method,
+            requestTimeoutMillis,
+            requestBody,
+            requestHeaders,
+        },
+    });
+    const response = httpMocks.createResponse({
+        req: request,
+        eventEmitter: EventEmitter,
+    });
+    const handler = AppProxyService({
+        localDevUrlMapping,
+        logger,
+        accountId,
+        allowedUrls: [],
+    });
+    // Hold response until the handler finishes writing to it. THis must
+    // be set up before calling the handler or it may miss the `end` event.
+    const responsePromised = new Promise((resolve) => {
+        response.on('end', () => {
+            resolve(response);
+        });
+    });
+    await handler(request, response);
+    return await responsePromised;
+};
+describe('AppProxyService', () => {
+    let logger;
+    beforeEach(() => {
+        logger = {
+            error: vi.fn(),
+            debug: vi.fn(),
+            info: vi.fn(),
+            warn: vi.fn(),
+        };
+    });
+    describe('mapToLocalUrl', () => {
+        const validUrl = 'https://valid.com';
+        const invalidUrl = 'this-is-not-a-url';
+        it('should throw an error if provided an invalid uri', () => {
+            expect(() => {
+                mapToLocalUrl({}, invalidUrl, [], logger);
+            }).toThrowError('Invalid URL');
+        });
+        it('should return the provided requestUri if no mapping is provided', () => {
+            expect(mapToLocalUrl({}, validUrl, [], logger)).toBe(validUrl);
+        });
+        it('should throw an error if the url in the mapping is invalid', () => {
+            expect(() => {
+                mapToLocalUrl({
+                    [validUrl]: invalidUrl,
+                }, validUrl, [], logger);
+            }).toThrowError('Invalid URL');
+        });
+        it('should update the url correctly', () => {
+            const newValidUrl = 'https://newvalidurl.com';
+            expect(mapToLocalUrl({
+                [validUrl]: newValidUrl,
+            }, validUrl, [], logger)).toBe(newValidUrl);
+        });
+        it('should update the url correctly when there is a base path', () => {
+            const basePath = '/some/base/path';
+            const validUrlWithBasePath = `${validUrl}${basePath}`;
+            const newValidUrl = 'https://newvalidurl.com';
+            expect(mapToLocalUrl({
+                [validUrl]: newValidUrl,
+            }, validUrlWithBasePath, [], logger)).toBe(`${newValidUrl}${basePath}`);
+        });
+        it('should honor urls with ports', () => {
+            const newValidUrl = 'https://localhost:5173';
+            expect(mapToLocalUrl({
+                [validUrl]: newValidUrl,
+            }, validUrl, [], logger)).toBe(newValidUrl);
+        });
+        it('should return a trailing slash if the user specifies it', () => {
+            const newValidUrl = 'https://localhost:5173/';
+            expect(mapToLocalUrl({
+                [validUrl]: newValidUrl,
+            }, validUrl, [], logger)).toBe(newValidUrl);
+        });
+        it('should allow trailing slashes in the mapping file', () => {
+            const newValidUrl = 'https://localhost:5173/';
+            expect(mapToLocalUrl({
+                [`${validUrl}/`]: newValidUrl,
+            }, validUrl, [], logger)).toBe(newValidUrl);
+        });
+        it('should log a warning if the url provided is not in the allowedUrls', () => {
+            mapToLocalUrl({}, validUrl, [], logger);
+            expect(logger.warn).toHaveBeenCalledTimes(1);
+            expect(logger.warn).toHaveBeenCalledWith(`'${validUrl}' is not in the 'allowedUrls' list in the application configuration file. Uploading the project in it's current state may result in request failures.`);
+        });
+        it('should NOT log a warning if the url provided is in the allowedUrls', () => {
+            const newValidUrl = 'https://localhost:5173/';
+            mapToLocalUrl({
+                [validUrl]: newValidUrl,
+            }, validUrl, [validUrl], logger);
+            expect(logger.warn).not.toHaveBeenCalled();
+        });
+    });
+    describe('extractErrorData', () => {
+        it('should return the default error if the provided error is not an AxiosError', () => {
+            expect(extractErrorData({})).toBe(defaultServerError);
+        });
+        it('should return the default error if the provided error is an unmapped AxiosError', () => {
+            expect(extractErrorData(new AxiosError())).toBe(defaultServerError);
+        });
+        it('should return the correct error data', () => {
+            expect(extractErrorData(new axios.AxiosError('YOOOOOO', AxiosError.ERR_FR_TOO_MANY_REDIRECTS))).toBe(axiosErrorMappings[AxiosError.ERR_FR_TOO_MANY_REDIRECTS]);
+        });
+        it('should return the status and data from the error.response if it exists', () => {
+            const error = new AxiosError('YOOOOOO', AxiosError.ERR_FR_TOO_MANY_REDIRECTS);
+            // @ts-expect-error excluding properties we don't care about
+            error.response = {
+                data: {
+                    message: 'RUH ROH',
+                },
+                status: HttpStatusCode.ImATeapot,
+            };
+            expect(extractErrorData(error)).toStrictEqual({
+                ...axiosErrorMappings[AxiosError.ERR_FR_TOO_MANY_REDIRECTS],
+                status: error.response.status,
+                data: error.response.data,
+            });
+        });
+    });
+    describe('Request handler', () => {
+        // Changing this secret will change all the signatures
+        const clientSecret = '12345678-aaaa-bbbb-cccc-ddddeeeeffff';
+        // Changing this timestamp will change all the signatures
+        const fakeTime = 1111111111111;
+        const expectedSignatureHeaders = (includeContentType) => ({
+            'X-HubSpot-Request-Timestamp': fakeTime,
+            'X-HubSpot-Signature': expect.any(String),
+            'X-HubSpot-Signature-Version': 'v2',
+            'X-HubSpot-Signature-v3': expect.any(String),
+            ...(includeContentType && { 'content-type': 'application/json' }),
+        });
+        let savedEnv;
+        beforeEach(() => {
+            savedEnv = JSON.stringify(process.env);
+            process.env.CLIENT_SECRET = clientSecret;
+            vi.spyOn(axios, 'request');
+        });
+        afterEach(() => {
+            process.env = JSON.parse(savedEnv);
+            vi.restoreAllMocks();
+        });
+        it('should call the third party endpoint correctly for GET requests without a body', async () => {
+            vi.spyOn(Date.prototype, 'getTime').mockReturnValue(fakeTime);
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const requestTimeoutMillis = 1000;
+            const accountId = 1;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.resolve({ data: {}, status: 200 }));
+            await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                accountId,
+                logger,
+            });
+            expect(axios.request).toBeCalledWith({
+                url: requestUri,
+                method,
+                timeout: requestTimeoutMillis,
+                headers: expectedSignatureHeaders(false),
+                maxRedirects: 0,
+            });
+        });
+        it('should call the third party endpoint correctly for POST requests with a body', async () => {
+            vi.spyOn(Date.prototype, 'getTime').mockReturnValue(fakeTime);
+            const method = 'POST';
+            const requestUri = 'http://localhost:1234';
+            const requestBody = { message: 'YOOOOOO' };
+            const requestTimeoutMillis = 1000;
+            const accountId = 1;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.resolve({ data: {}, status: 200 }));
+            await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                requestBody,
+                accountId,
+                logger,
+            });
+            expect(axios.request).toBeCalledWith({
+                url: requestUri,
+                method,
+                timeout: requestTimeoutMillis,
+                data: JSON.stringify(requestBody),
+                headers: expectedSignatureHeaders(true),
+                maxRedirects: 0,
+            });
+        });
+        it('should not include body for GET requests even if requestBody is provided', async () => {
+            vi.spyOn(Date.prototype, 'getTime').mockReturnValue(fakeTime);
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const requestBody = { message: 'YOOOOOO' };
+            const requestTimeoutMillis = 1000;
+            const accountId = 1;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.resolve({ data: {}, status: 200 }));
+            await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                requestBody,
+                accountId,
+                logger,
+            });
+            expect(axios.request).toBeCalledWith({
+                url: requestUri,
+                method,
+                timeout: requestTimeoutMillis,
+                headers: expectedSignatureHeaders(false),
+                maxRedirects: 0,
+            });
+        });
+        it('should call getSignatureHeaders without requestBody for GET requests', async () => {
+            vi.spyOn(Date.prototype, 'getTime').mockReturnValue(fakeTime);
+            const getSignatureHeadersSpy = vi.spyOn(signing, 'getSignatureHeaders');
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const requestBody = { message: 'YOOOOOO' };
+            const requestTimeoutMillis = 1000;
+            const accountId = 1;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.resolve({ data: {}, status: 200 }));
+            await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                requestBody,
+                accountId,
+                logger,
+            });
+            expect(getSignatureHeadersSpy).toBeCalledWith({
+                method,
+                url: requestUri,
+            });
+        });
+        it('should call getSignatureHeaders with requestBody for POST requests', async () => {
+            vi.spyOn(Date.prototype, 'getTime').mockReturnValue(fakeTime);
+            const getSignatureHeadersSpy = vi.spyOn(signing, 'getSignatureHeaders');
+            const method = 'POST';
+            const requestUri = 'http://localhost:1234';
+            const requestBody = { message: 'YOOOOOO' };
+            const requestTimeoutMillis = 1000;
+            const accountId = 1;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.resolve({ data: {}, status: 200 }));
+            await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                requestBody,
+                accountId,
+                logger,
+            });
+            expect(getSignatureHeadersSpy).toBeCalledWith({
+                method,
+                url: requestUri,
+                requestBody,
+            });
+        });
+        it('returns success responses if the proxy endpoint is reachable', async () => {
+            const responseBody = { message: 'Yooooooo' };
+            const statusCode = 200;
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const accountId = 123456;
+            const requestTimeoutMillis = 1000;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.resolve({ data: responseBody, status: statusCode }));
+            const res = await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                accountId,
+                logger,
+            });
+            expect(res.statusCode).toBe(200);
+            expect(res._getData()).toStrictEqual(expect.objectContaining({
+                status: 'success',
+                responseBody,
+                context: expect.objectContaining({
+                    httpMethod: [method],
+                    appServerStatusCode: [`${statusCode}`],
+                    portalId: [`${accountId}`],
+                    requestUri: [requestUri],
+                }),
+            }));
+        });
+        it('should not follow 3xx redirects, mimicking the backend proxy behavior', async () => {
+            const responseBody = { message: 'redirecting' };
+            const statusCode = 302;
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const accountId = 123456;
+            const requestTimeoutMillis = 1000;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.reject(new AxiosError("this message doesn't matter", 'THIS_ERROR_DOESNT_MATTER', 
+            // @ts-expect-error excluding properties we don't care about
+            {}, {}, { data: responseBody, status: statusCode })));
+            const res = await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                accountId,
+                logger,
+            });
+            expect(res.statusCode).toBe(200);
+            expect(res._getData()).toStrictEqual(expect.objectContaining({
+                category: 'BAD_GATEWAY',
+                message: 'Error returned from Request Uri',
+                status: 'error',
+                errors: [
+                    {
+                        message: `Unacceptable HTTP status ${statusCode} calling ${requestUri}`,
+                    },
+                ],
+                context: expect.objectContaining({
+                    correlationId: expect.any(Array),
+                    httpMethod: [method],
+                    appServerStatusCode: [`${statusCode}`],
+                    portalId: [`${accountId}`],
+                    requestUri: [requestUri],
+                }),
+            }));
+        });
+        it('returns success responses with error info in the body if the proxy returns 4xx, mimicking the backend proxy behavior', async () => {
+            const responseBody = { message: 'this is 404z' };
+            const statusCode = 404;
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const accountId = 494999;
+            const requestTimeoutMillis = 1000;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.reject(new AxiosError("this message doesn't matter", 'THIS_ERROR_DOESNT_MATTER', 
+            // @ts-expect-error excluding properties we don't care about
+            {}, {}, { data: responseBody, status: statusCode })));
+            const res = await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                accountId,
+                logger,
+            });
+            expect(res.statusCode).toBe(200);
+            expect(res._getData()).toStrictEqual(expect.objectContaining({
+                category: 'BAD_GATEWAY',
+                message: 'Error returned from Request Uri',
+                status: 'error',
+                errors: [
+                    {
+                        message: `Unacceptable HTTP status ${statusCode} calling ${requestUri}`,
+                    },
+                ],
+                context: expect.objectContaining({
+                    correlationId: expect.any(Array),
+                    httpMethod: [method],
+                    appServerStatusCode: [`${statusCode}`],
+                    portalId: [`${accountId}`],
+                    requestUri: [requestUri],
+                }),
+            }));
+        });
+        it('returns success responses with error info in the body if the proxy returns 5xx, mimicking the backend proxy behavior', async () => {
+            const responseBody = { message: 'there is 500' };
+            const statusCode = 500;
+            const method = 'GET';
+            const requestUri = 'http://localhost:1234';
+            const accountId = 334545;
+            const requestTimeoutMillis = 1000;
+            // @ts-expect-error Typescript doesn't know this is a spy
+            axios.request.mockImplementationOnce(() => Promise.reject(new AxiosError("this message doesn't matter", 'THIS_ERROR_DOESNT_MATTER', 
+            // @ts-expect-error excluding properties we don't care about
+            {}, {}, { data: responseBody, status: statusCode })));
+            const res = await callAppProxy({
+                requestUri,
+                method,
+                requestTimeoutMillis,
+                accountId,
+                logger,
+            });
+            expect(res.statusCode).toBe(200);
+            expect(res._getData()).toStrictEqual(expect.objectContaining({
+                category: 'BAD_GATEWAY',
+                message: 'Error returned from Request Uri',
+                status: 'error',
+                errors: [
+                    {
+                        message: `Unacceptable HTTP status ${statusCode} calling ${requestUri}`,
+                    },
+                ],
+                context: expect.objectContaining({
+                    correlationId: expect.any(Array),
+                    httpMethod: [method],
+                    appServerStatusCode: [`${statusCode}`],
+                    portalId: [`${accountId}`],
+                    requestUri: [requestUri],
+                }),
+            }));
+        });
+        describe('with local.json mapping', () => {
+            const mappedUrl = 'http://localhost:1234';
+            const requestUri = 'https://example.com';
+            const requestTimeoutMillis = 1000;
+            const accountId = 999888777;
+            const requestBody = { message: 'YOOOOOO' };
+            const localDevUrlMapping = {
+                [requestUri]: mappedUrl,
+            };
+            beforeEach(() => {
+                vi.spyOn(Date.prototype, 'getTime').mockReturnValue(fakeTime);
+                // @ts-expect-error TS doesn't know this is a spy
+                axios.request.mockImplementationOnce(() => Promise.resolve({ data: {}, status: 200 }));
+            });
+            it('should call axios with the mapped url for GET requests without body', async () => {
+                const method = 'GET';
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    headers: expectedSignatureHeaders(false),
+                    maxRedirects: 0,
+                });
+            });
+            it('should call axios with body for POST requests', async () => {
+                const method = 'POST';
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    data: JSON.stringify(requestBody),
+                    headers: expectedSignatureHeaders(true),
+                    maxRedirects: 0,
+                });
+            });
+            it('should pass the Authorization header, no matter the letter casing', async () => {
+                const method = 'POST';
+                const requestHeaders = {
+                    auTHoriZaTion: 'a very nice bearer token',
+                };
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    requestHeaders,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    data: JSON.stringify(requestBody),
+                    headers: {
+                        ...requestHeaders,
+                        ...expectedSignatureHeaders(true),
+                    },
+                    maxRedirects: 0,
+                });
+            });
+            it('should return error if more than one header is present in the request', async () => {
+                const method = 'POST';
+                const requestHeaders = {
+                    AUTHORIZAtion: 'a very nice bearer token',
+                    something: 'else',
+                };
+                const res = await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    requestHeaders,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(res.statusCode).toBe(validationError.status);
+                expect(res._getData()).toStrictEqual(expect.objectContaining({
+                    category: validationError.category,
+                    context: expect.objectContaining({
+                        httpMethod: [method],
+                        portalId: [`${accountId}`],
+                        requestUri: [requestUri],
+                    }),
+                    message: "Only 'Authorization' header is allowed",
+                    status: 'error',
+                }));
+                expect(axios.request).not.toBeCalled();
+            });
+            it('should return error if any header other than Authorization is present in the request', async () => {
+                const method = 'POST';
+                const requestHeaders = {
+                    something: 'else',
+                };
+                const res = await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    requestHeaders,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(res.statusCode).toBe(validationError.status);
+                expect(res._getData()).toStrictEqual(expect.objectContaining({
+                    category: validationError.category,
+                    context: expect.objectContaining({
+                        httpMethod: [method],
+                        portalId: [`${accountId}`],
+                        requestUri: [requestUri],
+                    }),
+                    message: "Invalid Request Headers provided. Only 'Authorization' header is allowed from hubspot.fetch()",
+                    status: 'error',
+                }));
+                expect(axios.request).not.toBeCalled();
+            });
+            it('should return error if headers is not object', async () => {
+                const method = 'POST';
+                const res = await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    // @ts-expect-error passing incorrect value on purpose
+                    requestHeaders: 'hello',
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(res.statusCode).toBe(validationError.status);
+                expect(res._getData()).toStrictEqual(expect.objectContaining({
+                    category: validationError.category,
+                    context: expect.objectContaining({
+                        httpMethod: [method],
+                        portalId: [`${accountId}`],
+                        requestUri: [requestUri],
+                    }),
+                    message: "Only 'Authorization' header is allowed",
+                    status: 'error',
+                }));
+                expect(axios.request).not.toBeCalled();
+            });
+            it('should work when the headers are missing for POST with body', async () => {
+                const method = 'POST';
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    data: JSON.stringify(requestBody),
+                    headers: expectedSignatureHeaders(true),
+                    maxRedirects: 0,
+                });
+            });
+            it('should work when the headers are undefined for POST with body', async () => {
+                const method = 'POST';
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    accountId,
+                    requestHeaders: undefined,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    data: JSON.stringify(requestBody),
+                    headers: expectedSignatureHeaders(true),
+                    maxRedirects: 0,
+                });
+            });
+            it('should work when the headers are null for POST with body', async () => {
+                const method = 'POST';
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    accountId,
+                    // @ts-expect-error passing incorrect value on purpose
+                    requestHeaders: null,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    data: JSON.stringify(requestBody),
+                    headers: expectedSignatureHeaders(true),
+                    maxRedirects: 0,
+                });
+            });
+            it('should not include body or content-type for GET requests even with requestBody provided', async () => {
+                const method = 'GET';
+                await callAppProxy({
+                    requestUri,
+                    method,
+                    requestTimeoutMillis,
+                    requestBody,
+                    accountId,
+                    localDevUrlMapping,
+                    logger,
+                });
+                expect(axios.request).toBeCalledWith({
+                    url: mappedUrl,
+                    method,
+                    timeout: requestTimeoutMillis,
+                    headers: expectedSignatureHeaders(false),
+                    maxRedirects: 0,
+                });
+            });
+        });
+    });
+});

package/dist/lib/__tests__/app-functions/services/PrivateAppUserTokenManager.spec.d.ts

@@ -0,0 +1 @@
+export {};