@oneuptime/common 12.0.31 → 12.0.33

package/Tests/Server/Utils/Captcha.test.ts

@@ -0,0 +1,422 @@
+import { describe, expect, it, jest, beforeEach } from "@jest/globals";
+
+/*
+ * Captcha verification, which is a gate rather than a feature: everything it
+ * protects (signup, password reset, the public forms) is reachable by anyone on
+ * the internet, so the only behaviour that matters is what it does when
+ * something is wrong.
+ *
+ * Three ways it could fail open, none of them visible from the outside — the
+ * page looks identical whether the check ran or not:
+ *
+ *   1. Enabled with no secret key. There is nothing to verify against, and
+ *      "cannot verify" must mean "reject", not "allow".
+ *   2. The provider is unreachable, times out, or answers with something other
+ *      than success. An hCaptcha outage must not become an open door.
+ *   3. A blank or whitespace-only token passed off as a solved challenge.
+ *
+ * `CaptchaEnabled` and `CaptchaSecretKey` are read from the environment at
+ * module load, so each configuration below gets a freshly required copy of the
+ * module. axios is mocked throughout: these assertions are about the decision,
+ * and a test that reached hcaptcha.com would be neither hermetic nor honest.
+ */
+
+const SITEVERIFY_URL: string = "https://hcaptcha.com/siteverify";
+
+interface CaptchaModule {
+  default: {
+    isCaptchaEnabled: () => boolean;
+    verifyCaptcha: (options: {
+      token: string | null | undefined;
+      remoteIp?: string | null;
+    }) => Promise<void>;
+  };
+}
+
+interface PostCall {
+  url: string;
+  body: string;
+}
+
+interface LoadedCaptcha {
+  captcha: CaptchaModule["default"];
+  posts: Array<PostCall>;
+  setResponse: (response: unknown) => void;
+  setRejection: (error: Error | null) => void;
+}
+
+/*
+ * Load Captcha against one environment configuration, with axios stubbed. The
+ * real EnvironmentConfig is spread in first so only the two captcha values
+ * differ from production — mocking the module wholesale would quietly blank
+ * every other setting the import graph reads.
+ */
+function loadCaptcha(config: {
+  captchaEnabled: boolean;
+  captchaSecretKey: string;
+}): LoadedCaptcha {
+  const posts: Array<PostCall> = [];
+  let response: unknown = { data: { success: true } };
+  let rejection: Error | null = null;
+
+  let loaded: CaptchaModule["default"] | null = null;
+
+  jest.isolateModules((): void => {
+    jest.doMock("../../../Server/EnvironmentConfig", (): unknown => {
+      return {
+        ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+          string,
+          unknown
+        >),
+        CaptchaEnabled: config.captchaEnabled,
+        CaptchaSecretKey: config.captchaSecretKey,
+      };
+    });
+
+    jest.doMock("axios", (): unknown => {
+      const post: unknown = (url: string, body: string): Promise<unknown> => {
+        posts.push({ url, body });
+
+        if (rejection) {
+          return Promise.reject(rejection);
+        }
+
+        return Promise.resolve(response);
+      };
+
+      return {
+        __esModule: true,
+        default: {
+          post,
+          isAxiosError: (): boolean => {
+            return false;
+          },
+        },
+        post,
+        isAxiosError: (): boolean => {
+          return false;
+        },
+      };
+    });
+
+    /*
+     * requireActual, not require: it loads Captcha itself unmocked while its
+     * own imports - the two doMock calls above - still resolve through this
+     * isolated registry, which is exactly the split these tests need.
+     */
+    loaded = (
+      jest.requireActual("../../../Server/Utils/Captcha") as CaptchaModule
+    ).default;
+  });
+
+  return {
+    captcha: loaded!,
+    posts,
+    setResponse: (next: unknown): void => {
+      response = next;
+    },
+    setRejection: (next: Error | null): void => {
+      rejection = next;
+    },
+  };
+}
+
+beforeEach((): void => {
+  jest.resetModules();
+});
+
+/*
+ * Assert a rejection is a BadDataException carrying `message`.
+ *
+ * By constructor NAME, not identity. Each configuration above is loaded through
+ * jest.isolateModules, which gives the module under test its own registry — so
+ * the BadDataException it throws is a different class object from the one this
+ * file would import, and `toThrow(BadDataException)` fails on two constructors
+ * that print the same name. The name and the message are what the API surface
+ * actually depends on.
+ */
+async function expectBadDataRejection(
+  work: Promise<void>,
+  message: string | RegExp,
+): Promise<void> {
+  let thrown: unknown = null;
+
+  try {
+    await work;
+  } catch (err) {
+    thrown = err;
+  }
+
+  expect(thrown).toBeInstanceOf(Error);
+  expect((thrown as Error).constructor.name).toBe("BadDataException");
+
+  if (message instanceof RegExp) {
+    expect((thrown as Error).message).toMatch(message);
+  } else {
+    expect((thrown as Error).message).toBe(message);
+  }
+}
+
+const GENERIC_ERROR_MESSAGE: string =
+  "Captcha verification failed. Please try again.";
+
+describe("CaptchaUtil.isCaptchaEnabled", () => {
+  it("is on only when the feature flag and a secret key agree", () => {
+    expect(
+      loadCaptcha({
+        captchaEnabled: true,
+        captchaSecretKey: "a-secret",
+      }).captcha.isCaptchaEnabled(),
+    ).toBe(true);
+  });
+
+  it("is off when the flag is off", () => {
+    expect(
+      loadCaptcha({
+        captchaEnabled: false,
+        captchaSecretKey: "a-secret",
+      }).captcha.isCaptchaEnabled(),
+    ).toBe(false);
+  });
+
+  it("is off when the flag is on but no secret key is configured", () => {
+    /*
+     * A half-configured deployment must report itself as off, so the UI does
+     * not render a widget whose answer can never be checked.
+     */
+    expect(
+      loadCaptcha({
+        captchaEnabled: true,
+        captchaSecretKey: "",
+      }).captcha.isCaptchaEnabled(),
+    ).toBe(false);
+  });
+});
+
+describe("CaptchaUtil.verifyCaptcha when captcha is switched off", () => {
+  it("lets the request through without calling the provider", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: false,
+      captchaSecretKey: "a-secret",
+    });
+
+    await expect(
+      loaded.captcha.verifyCaptcha({ token: null }),
+    ).resolves.toBeUndefined();
+
+    // No outbound call at all — an off switch must not cost a round trip.
+    expect(loaded.posts).toHaveLength(0);
+  });
+});
+
+describe("CaptchaUtil.verifyCaptcha when captcha is on", () => {
+  it("resolves when the provider says the challenge was solved", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    await expect(
+      loaded.captcha.verifyCaptcha({ token: "solved-token" }),
+    ).resolves.toBeUndefined();
+
+    expect(loaded.posts).toHaveLength(1);
+    expect(loaded.posts[0]!.url).toBe(SITEVERIFY_URL);
+  });
+
+  it("sends the secret and the token the visitor supplied", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    await loaded.captcha.verifyCaptcha({ token: "solved-token" });
+
+    const body: URLSearchParams = new URLSearchParams(loaded.posts[0]!.body);
+
+    expect(body.get("secret")).toBe("a-secret");
+    expect(body.get("response")).toBe("solved-token");
+  });
+
+  it("forwards the caller's IP when one is known", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    await loaded.captcha.verifyCaptcha({
+      token: "solved-token",
+      remoteIp: "203.0.113.7",
+    });
+
+    expect(new URLSearchParams(loaded.posts[0]!.body).get("remoteip")).toBe(
+      "203.0.113.7",
+    );
+  });
+
+  it("omits remoteip rather than sending an empty one", async () => {
+    /*
+     * hCaptcha scores a blank remoteip differently from an absent one, so a
+     * request with no known client IP must leave the field off entirely.
+     */
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    await loaded.captcha.verifyCaptcha({ token: "solved-token", remoteIp: "" });
+
+    expect(new URLSearchParams(loaded.posts[0]!.body).has("remoteip")).toBe(
+      false,
+    );
+  });
+
+  it("trims the token before sending it", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    await loaded.captcha.verifyCaptcha({ token: "  solved-token  " });
+
+    expect(new URLSearchParams(loaded.posts[0]!.body).get("response")).toBe(
+      "solved-token",
+    );
+  });
+});
+
+describe("CaptchaUtil.verifyCaptcha fails closed", () => {
+  it("rejects when enabled with no secret key, and never calls the provider", async () => {
+    /*
+     * The misconfiguration that would otherwise fail OPEN: no key means no
+     * verification is possible, and "cannot verify" has to mean "reject".
+     */
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "",
+    });
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "solved-token" }),
+      GENERIC_ERROR_MESSAGE,
+    );
+
+    expect(loaded.posts).toHaveLength(0);
+  });
+
+  it.each([
+    ["null", null],
+    ["undefined", undefined],
+    ["empty", ""],
+    ["whitespace only", "   "],
+  ])(
+    "rejects a %s token without calling the provider",
+    async (_label: string, token: string | null | undefined) => {
+      const loaded: LoadedCaptcha = loadCaptcha({
+        captchaEnabled: true,
+        captchaSecretKey: "a-secret",
+      });
+
+      await expectBadDataRejection(
+        loaded.captcha.verifyCaptcha({ token }),
+        /complete the verification challenge/i,
+      );
+
+      expect(loaded.posts).toHaveLength(0);
+    },
+  );
+
+  it("names the missing challenge, since that one is the visitor's to fix", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "" }),
+      /complete the verification challenge/i,
+    );
+  });
+
+  it("rejects when the provider answers success: false", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    loaded.setResponse({
+      data: { success: false, "error-codes": ["invalid-input-response"] },
+    });
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "forged-token" }),
+      GENERIC_ERROR_MESSAGE,
+    );
+  });
+
+  it("rejects when the provider answers with no success field at all", async () => {
+    // A shape change at the provider must not read as a pass.
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    loaded.setResponse({ data: {} });
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "some-token" }),
+      GENERIC_ERROR_MESSAGE,
+    );
+  });
+
+  it("rejects when the provider answers with no body", async () => {
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    loaded.setResponse({ data: null });
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "some-token" }),
+      GENERIC_ERROR_MESSAGE,
+    );
+  });
+
+  it("rejects when the provider is unreachable", async () => {
+    /*
+     * An hCaptcha outage is the moment a fail-open bug would be exploited, and
+     * the moment nobody is watching for one.
+     */
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    loaded.setRejection(new Error("connect ETIMEDOUT"));
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "some-token" }),
+      GENERIC_ERROR_MESSAGE,
+    );
+  });
+
+  it("does not leak the provider's error text to the visitor", async () => {
+    /*
+     * The message reaches an anonymous caller, so it says only that
+     * verification failed — not which secret, provider or error code was
+     * involved.
+     */
+    const loaded: LoadedCaptcha = loadCaptcha({
+      captchaEnabled: true,
+      captchaSecretKey: "a-secret",
+    });
+
+    loaded.setRejection(new Error("secret a-secret rejected by upstream"));
+
+    await expectBadDataRejection(
+      loaded.captcha.verifyCaptcha({ token: "some-token" }),
+      GENERIC_ERROR_MESSAGE,
+    );
+  });
+});

package/Tests/Server/Utils/DataSource/HttpFetch.test.ts

@@ -9,6 +9,7 @@ import DataSourceHttpFetch, {
   DataSourceHttpRequest,
   DataSourceHttpResponse,
 } from "../../../../Server/Utils/DataSource/HttpFetch";
+import OutboundUserAgent from "../../../../Server/Utils/OutboundUserAgent";
 import { DataSourceConnectionSettings } from "../../../../Server/Utils/DataSource/Types";
 import {
   DATA_SOURCE_MAX_RESPONSE_SIZE_IN_BYTES,
@@ -367,14 +368,17 @@ describe("DataSourceHttpFetch.fetch - egress guard runs before axios", () => {
 });
 
 describe("DataSourceHttpFetch.fetch - headers and body encoding", () => {
-  test("passes request headers through to axios untouched", async () => {
+  test("passes request headers through to axios untouched, plus our User-Agent", async () => {
     const headers: Dictionary<string> = {
       "X-Api-Key": "secret-key",
       Authorization: "Bearer token-123",
     };
     await DataSourceHttpFetch.fetch(makeRequest({ headers: headers }));
     const config: AxiosRequestConfig = getAxiosConfig();
-    expect(config.headers).toEqual(headers);
+    expect(config.headers).toEqual({
+      ...headers,
+      "User-Agent": OutboundUserAgent.get(),
+    });
   });
 
   test("GET requests never send a body, even when one is provided", async () => {
@@ -439,6 +443,96 @@ describe("DataSourceHttpFetch.fetch - headers and body encoding", () => {
   });
 });
 
+/*
+ * Regression cover for issue #3555: a bare `axios/<version>` User-Agent got
+ * every outbound request 403'd by the target's WAF before it reached the
+ * API. The transport now names the product on every request unless the
+ * caller deliberately set its own UA.
+ */
+describe("DataSourceHttpFetch.fetch - outbound User-Agent", () => {
+  function getSentHeaders(callIndex: number = 0): Dictionary<string> {
+    return getAxiosConfig(callIndex).headers as Dictionary<string>;
+  }
+
+  test("sends a descriptive User-Agent when the caller set none", async () => {
+    await DataSourceHttpFetch.fetch(makeRequest());
+    expect(getSentHeaders()["User-Agent"]).toBe(OutboundUserAgent.get());
+  });
+
+  test("the User-Agent names OneUptime and is never axios' default", async () => {
+    await DataSourceHttpFetch.fetch(makeRequest());
+    const userAgent: string = getSentHeaders()["User-Agent"] as string;
+
+    expect(userAgent.startsWith("OneUptime")).toBe(true);
+    expect(userAgent).toContain("https://oneuptime.com");
+    expect(userAgent.toLowerCase()).not.toContain("axios");
+  });
+
+  test("axios is never left to pick the User-Agent itself — the header is always set", async () => {
+    await DataSourceHttpFetch.fetch(makeRequest({ headers: {} }));
+    await DataSourceHttpFetch.fetch(
+      makeRequest({ method: "POST", body: { q: "up" } }),
+    );
+
+    for (const callIndex of [0, 1]) {
+      const userAgent: string | undefined =
+        getSentHeaders(callIndex)["User-Agent"];
+      expect(typeof userAgent).toBe("string");
+      expect((userAgent as string).trim()).not.toBe("");
+    }
+  });
+
+  test("a caller's explicit User-Agent wins — a data source may demand its own", async () => {
+    await DataSourceHttpFetch.fetch(
+      makeRequest({
+        headers: { "User-Agent": "AcmeSOC/3.1 (soc@acme.example)" },
+      }),
+    );
+    expect(getSentHeaders()["User-Agent"]).toBe(
+      "AcmeSOC/3.1 (soc@acme.example)",
+    );
+  });
+
+  test("a caller's lowercase user-agent wins without a second casing being sent", async () => {
+    await DataSourceHttpFetch.fetch(
+      makeRequest({ headers: { "user-agent": "AcmeSOC/3.1" } }),
+    );
+    const headers: Dictionary<string> = getSentHeaders();
+
+    expect(headers["user-agent"]).toBe("AcmeSOC/3.1");
+    expect(headers["User-Agent"]).toBeUndefined();
+  });
+
+  test("a blank User-Agent is replaced rather than sent as-is", async () => {
+    await DataSourceHttpFetch.fetch(
+      makeRequest({ headers: { "User-Agent": "   " } }),
+    );
+    expect(getSentHeaders()["User-Agent"]).toBe(OutboundUserAgent.get());
+  });
+
+  test("it rides alongside auth headers rather than displacing them", async () => {
+    const headers: Dictionary<string> = DataSourceHttpFetch.buildAuthHeaders({
+      dataSourceType: DataSourceType.RestApi,
+      url: "https://api.example.com",
+      apiToken: "tok-abc",
+    });
+
+    await DataSourceHttpFetch.fetch(makeRequest({ headers: headers }));
+    const sent: Dictionary<string> = getSentHeaders();
+
+    expect(sent["Authorization"]).toBe("Bearer tok-abc");
+    expect(sent["User-Agent"]).toBe(OutboundUserAgent.get());
+  });
+
+  test("the caller's header dictionary is not mutated — pagination reuses it", async () => {
+    const headers: Dictionary<string> = { Accept: "application/json" };
+
+    await DataSourceHttpFetch.fetch(makeRequest({ headers: headers }));
+
+    expect(headers).toEqual({ Accept: "application/json" });
+  });
+});
+
 describe("DataSourceHttpFetch.buildAuthHeaders", () => {
   function makeSettings(
     overrides?: Partial<DataSourceConnectionSettings>,