@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Utils/APIInstanceDispatch.test.ts

@@ -0,0 +1,311 @@
+// Must stay the first import: the client's URLs are built from HOST on load.
+import { DASHBOARD_ORIGIN } from "../UI/Utils/API/DashboardHost";
+import FakeAxiosServer, {
+  FakeTransport,
+  SentRequest,
+} from "../UI/Utils/API/FakeAxiosServer";
+import BaseAPI from "../../UI/Utils/API/API";
+import { IDENTITY_URL } from "../../UI/Config";
+import Navigation from "../../UI/Utils/Navigation";
+import User from "../../UI/Utils/User";
+import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
+import HTTPMethod from "../../Types/API/HTTPMethod";
+import HTTPResponse from "../../Types/API/HTTPResponse";
+import Headers from "../../Types/API/Headers";
+import Hostname from "../../Types/API/Hostname";
+import Protocol from "../../Types/API/Protocol";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import APIException from "../../Types/Exception/ApiException";
+import { JSONObject } from "../../Types/JSON";
+import API, { APIRequestOptions, AuthRetryContext } from "../../Utils/API";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+import axios from "axios";
+
+jest.mock("axios", () => {
+  // Keep the real helpers (axios.isAxiosError, AxiosError) and fake only the call.
+  return Object.assign(jest.fn(), jest.requireActual("axios"));
+});
+
+/*
+ * AN API INSTANCE IS ITS CLASS.
+ *
+ * `new BaseAPI(protocol, hostname).get(...)` used to forward to `API.get` - the
+ * base class, by name - so a request made through an INSTANCE silently lost
+ * everything its class adds: BaseAPI's refresh-and-replay on a 401, its error
+ * handling, its headers. A lapsed session on such a call surfaced as a bare 401
+ * where the same request made through `BaseAPI.get` recovered on its own.
+ *
+ * The instance methods now dispatch through `this.constructor`. These tests make
+ * the class of the instance observable - which refresh ran, which headers went
+ * out, which error handler saw the failure - for every instance method.
+ */
+
+const mockedAxios: FakeTransport = axios as unknown as FakeTransport;
+
+const REFRESH_URL: string = URL.fromString(IDENTITY_URL.toString())
+  .addRoute("/refresh-token")
+  .toString();
+
+const RESOURCE_URL: string = `${DASHBOARD_ORIGIN}/api/monitor/abc`;
+
+let server: FakeAxiosServer;
+
+let logoutSpy: jest.SpiedFunction<typeof User.logout>;
+
+let navigateSpy: jest.SpiedFunction<typeof Navigation.navigate>;
+
+type InstanceMethod = "get" | "delete" | "head" | "put" | "patch";
+
+const INSTANCE_METHODS: Array<[InstanceMethod, HTTPMethod]> = [
+  ["get", HTTPMethod.GET],
+  ["delete", HTTPMethod.DELETE],
+  ["head", HTTPMethod.HEAD],
+  ["put", HTTPMethod.PUT],
+  ["patch", HTTPMethod.PATCH],
+];
+
+type CallInstanceFunction = (
+  api: API,
+  method: InstanceMethod,
+  options: APIRequestOptions,
+) => Promise<HTTPResponse<JSONObject> | HTTPErrorResponse>;
+
+const callInstance: CallInstanceFunction = async (
+  api: API,
+  method: InstanceMethod,
+  options: APIRequestOptions,
+): Promise<HTTPResponse<JSONObject> | HTTPErrorResponse> => {
+  switch (method) {
+    case "get":
+      return await api.get<JSONObject>(options);
+    case "delete":
+      return await api.delete<JSONObject>(options);
+    case "head":
+      return await api.head<JSONObject>(options);
+    case "put":
+      return await api.put<JSONObject>(options);
+    case "patch":
+      return await api.patch<JSONObject>(options);
+  }
+};
+
+beforeEach(() => {
+  localStorage.clear();
+
+  server = new FakeAxiosServer(mockedAxios);
+
+  logoutSpy = jest.spyOn(User, "logout").mockImplementation((): void => {});
+
+  navigateSpy = jest
+    .spyOn(Navigation, "navigate")
+    .mockImplementation((): void => {});
+
+  jest
+    .spyOn(Navigation, "getCurrentRoute")
+    .mockReturnValue(new Route("/dashboard/home"));
+});
+
+afterEach(() => {
+  mockedAxios.mockReset();
+  jest.restoreAllMocks();
+  localStorage.clear();
+});
+
+describe("A BaseAPI instance refreshes a lapsed session like BaseAPI does", () => {
+  test.each(INSTANCE_METHODS)(
+    "instance %s: a 401 is refreshed and replayed",
+    async (method: InstanceMethod, httpMethod: HTTPMethod) => {
+      server
+        .on(httpMethod, RESOURCE_URL, [
+          { status: 401 },
+          { status: 200, data: { replayed: true } },
+        ])
+        .on(HTTPMethod.POST, REFRESH_URL, [{ status: 200 }]);
+
+      const api: BaseAPI = new BaseAPI(
+        Protocol.HTTPS,
+        new Hostname("oneuptime.example.com"),
+      );
+
+      const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+        await callInstance(api, method, {
+          url: URL.fromString(RESOURCE_URL),
+          data: { name: "db" },
+        });
+
+      expect(response.statusCode).toBe(200);
+      expect(response.data).toEqual({ replayed: true });
+      expect(server.requestsTo(HTTPMethod.POST, REFRESH_URL)).toHaveLength(1);
+      expect(server.requestsTo(httpMethod, RESOURCE_URL)).toHaveLength(2);
+      expect(logoutSpy).not.toHaveBeenCalled();
+    },
+  );
+
+  test("an instance made with BaseAPI.fromURL is a BaseAPI, and refreshes too", async () => {
+    server
+      .on(HTTPMethod.GET, RESOURCE_URL, [{ status: 401 }, { status: 200 }])
+      .on(HTTPMethod.POST, REFRESH_URL, [{ status: 200 }]);
+
+    const api: BaseAPI = BaseAPI.fromURL(
+      URL.fromString(`${DASHBOARD_ORIGIN}/api`),
+    );
+
+    expect(api).toBeInstanceOf(BaseAPI);
+
+    const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+      await api.get<JSONObject>({ url: URL.fromString(RESOURCE_URL) });
+
+    expect(response.statusCode).toBe(200);
+    expect(server.requestsTo(HTTPMethod.POST, REFRESH_URL)).toHaveLength(1);
+  });
+
+  test("a refused refresh through an instance ends in BaseAPI's logout, not a silent 401", async () => {
+    server
+      .on(HTTPMethod.GET, RESOURCE_URL, [{ status: 401 }])
+      .on(HTTPMethod.POST, REFRESH_URL, [{ status: 401 }]);
+
+    const api: BaseAPI = new BaseAPI(
+      Protocol.HTTPS,
+      new Hostname("oneuptime.example.com"),
+    );
+
+    const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+      await api.get<JSONObject>({ url: URL.fromString(RESOURCE_URL) });
+
+    expect(response.statusCode).toBe(401);
+    expect(logoutSpy).toHaveBeenCalled();
+    expect(navigateSpy).toHaveBeenCalledWith(new Route("/accounts/login"), {
+      forceNavigate: true,
+    });
+  });
+
+  test("BaseAPI's own headers go out on instance requests", async () => {
+    localStorage.setItem("project-permissions-hash", "hash-123");
+
+    server.on(HTTPMethod.GET, RESOURCE_URL, [{ status: 200 }]);
+
+    await new BaseAPI(
+      Protocol.HTTPS,
+      new Hostname("oneuptime.example.com"),
+    ).get({ url: URL.fromString(RESOURCE_URL) });
+
+    expect(server.sent[0]!.headers["project-permissions-hash"]).toBe(
+      "hash-123",
+    );
+  });
+});
+
+describe("The most-derived class is the one that answers", () => {
+  const STATUS_PAGE_REFRESH_URL: string =
+    "https://status.example.com/status-page-identity-api/refresh-token/abc";
+
+  class StatusPageLikeAPI extends BaseAPI {
+    protected static override getRefreshSessionUrl(): URL | null {
+      return URL.fromString(STATUS_PAGE_REFRESH_URL);
+    }
+
+    protected static override getSessionName(): string {
+      return "status-page-abc";
+    }
+  }
+
+  test("an instance of a BaseAPI subclass refreshes at the subclass's URL", async () => {
+    server
+      .on(HTTPMethod.PUT, RESOURCE_URL, [{ status: 401 }, { status: 200 }])
+      .on(HTTPMethod.POST, STATUS_PAGE_REFRESH_URL, [{ status: 200 }]);
+
+    const api: StatusPageLikeAPI = new StatusPageLikeAPI(
+      Protocol.HTTPS,
+      new Hostname("status.example.com"),
+    );
+
+    const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+      await api.put<JSONObject>({ url: URL.fromString(RESOURCE_URL) });
+
+    expect(response.statusCode).toBe(200);
+    expect(
+      server.requestsTo(HTTPMethod.POST, STATUS_PAGE_REFRESH_URL),
+    ).toHaveLength(1);
+    expect(server.requestsTo(HTTPMethod.POST, REFRESH_URL)).toHaveLength(0);
+  });
+
+  test("an instance of a plain API subclass uses that subclass's headers, refresh and error handler", async () => {
+    const handled: Array<number> = [];
+    const refreshedFor: Array<string> = [];
+
+    class CustomAPI extends API {
+      public static override getDefaultHeaders(): Headers {
+        return { "x-client": "custom" };
+      }
+
+      public static override handleError(
+        error: HTTPErrorResponse | APIException,
+      ): HTTPErrorResponse | APIException {
+        if (error instanceof HTTPErrorResponse) {
+          handled.push(error.statusCode);
+        }
+
+        return error;
+      }
+
+      protected static override async tryRefreshAuth(
+        context: AuthRetryContext,
+      ): Promise<boolean> {
+        refreshedFor.push(context.request.url.toString());
+        return true;
+      }
+    }
+
+    server.on(HTTPMethod.PATCH, RESOURCE_URL, [
+      { status: 401 },
+      { status: 500 },
+    ]);
+
+    const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+      await new CustomAPI(
+        Protocol.HTTPS,
+        new Hostname("oneuptime.example.com"),
+      ).patch<JSONObject>({ url: URL.fromString(RESOURCE_URL) });
+
+    expect(response.statusCode).toBe(500);
+    expect(refreshedFor).toEqual([RESOURCE_URL]);
+    expect(handled).toEqual([500]);
+
+    for (const request of server.sent) {
+      expect(request.headers["x-client"]).toBe("custom");
+    }
+  });
+});
+
+describe("A plain API instance is still the plain client", () => {
+  /*
+   * The bare client has no session to refresh and no login page to go to.
+   * Server-side callers and deliberately-bare browser calls (a status page's
+   * logout) depend on a 401 coming straight back.
+   */
+  test.each(INSTANCE_METHODS)(
+    "instance %s: a 401 comes straight back, with no refresh and no logout",
+    async (method: InstanceMethod, httpMethod: HTTPMethod) => {
+      server.on(httpMethod, RESOURCE_URL, [{ status: 401 }]);
+
+      const api: API = new API(
+        Protocol.HTTPS,
+        new Hostname("oneuptime.example.com"),
+      );
+
+      const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
+        await callInstance(api, method, { url: URL.fromString(RESOURCE_URL) });
+
+      expect(response).toBeInstanceOf(HTTPErrorResponse);
+      expect(response.statusCode).toBe(401);
+      expect(
+        server.sent.map((request: SentRequest): string => {
+          return request.url;
+        }),
+      ).toEqual([RESOURCE_URL]);
+      expect(logoutSpy).not.toHaveBeenCalled();
+      expect(navigateSpy).not.toHaveBeenCalled();
+    },
+  );
+});

package/Tests/Utils/HostAddressUtil.test.ts

@@ -0,0 +1,138 @@
+import HostAddressUtil from "../../Utils/HostAddressUtil";
+import { describe, expect, test } from "@jest/globals";
+import net from "net";
+
+/*
+ * The two IPv6 text problems that kept being got wrong one call site at a
+ * time: brackets are URL syntax rather than part of the address, and
+ * "host:port" is ambiguous for IPv6 in a way that does not look wrong.
+ */
+
+const CUSTOMER_ADDRESS: string = "2001:518:2800:9::2";
+
+describe("HostAddressUtil.isIPv6", () => {
+  test.each([
+    CUSTOMER_ADDRESS,
+    `[${CUSTOMER_ADDRESS}]`,
+    "::1",
+    "[::1]",
+    "::",
+    "2001:db8::",
+    "::ffff:192.0.2.1",
+    "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
+  ])("%s is IPv6", (value: string) => {
+    expect(HostAddressUtil.isIPv6(value)).toBe(true);
+  });
+
+  test.each([
+    "192.0.2.1",
+    "example.com",
+    "localhost",
+    "",
+    "   ",
+    "[not-an-address]",
+    "2001:db8::1:8443:extra",
+    "example.com:8443",
+  ])("%s is not IPv6", (value: string) => {
+    expect(HostAddressUtil.isIPv6(value)).toBe(false);
+  });
+});
+
+describe("HostAddressUtil.stripBrackets", () => {
+  test("removes the URL brackets from an IPv6 literal", () => {
+    expect(HostAddressUtil.stripBrackets(`[${CUSTOMER_ADDRESS}]`)).toBe(
+      CUSTOMER_ADDRESS,
+    );
+  });
+
+  test("the result is something a socket will accept, which the bracketed form is not", () => {
+    /*
+     * The point of the whole helper. Node does not strip these itself:
+     * net.connect({host: "[::1]"}) goes to the resolver and fails ENOTFOUND.
+     */
+    expect(net.isIP(`[${CUSTOMER_ADDRESS}]`)).toBe(0);
+    expect(
+      net.isIP(HostAddressUtil.stripBrackets(`[${CUSTOMER_ADDRESS}]`)),
+    ).toBe(6);
+  });
+
+  test("leaves a bare address, an IPv4 address and a DNS name alone", () => {
+    expect(HostAddressUtil.stripBrackets(CUSTOMER_ADDRESS)).toBe(
+      CUSTOMER_ADDRESS,
+    );
+    expect(HostAddressUtil.stripBrackets("192.0.2.1")).toBe("192.0.2.1");
+    expect(HostAddressUtil.stripBrackets("example.com")).toBe("example.com");
+  });
+
+  test("trims, because a pasted address usually arrives with whitespace", () => {
+    expect(HostAddressUtil.stripBrackets(`  ${CUSTOMER_ADDRESS}\n`)).toBe(
+      CUSTOMER_ADDRESS,
+    );
+  });
+
+  test("does NOT launder a bracketed non-address into a bare hostname", () => {
+    expect(HostAddressUtil.stripBrackets("[not-an-address]")).toBe(
+      "[not-an-address]",
+    );
+    expect(HostAddressUtil.stripBrackets("[192.0.2.1]")).toBe("[192.0.2.1]");
+  });
+
+  test("handles empty input", () => {
+    expect(HostAddressUtil.stripBrackets("")).toBe("");
+  });
+});
+
+describe("HostAddressUtil.formatHostAndPort", () => {
+  test("brackets an IPv6 host so the port separator cannot be read as the address", () => {
+    expect(
+      HostAddressUtil.formatHostAndPort({ host: CUSTOMER_ADDRESS, port: 179 }),
+    ).toBe(`[${CUSTOMER_ADDRESS}]:179`);
+  });
+
+  test("the unbracketed form really is a DIFFERENT valid address, which is why this matters", () => {
+    /*
+     * Not a cosmetic issue: "2001:518:2800:9::2" + ":179" parses as a real
+     * IPv6 address, so an alert naming it sends somebody to the wrong host
+     * rather than to something obviously malformed.
+     */
+    expect(net.isIP(`${CUSTOMER_ADDRESS}:179`)).toBe(6);
+    expect(`${CUSTOMER_ADDRESS}:179`).not.toBe(CUSTOMER_ADDRESS);
+
+    expect(
+      HostAddressUtil.formatHostAndPort({ host: CUSTOMER_ADDRESS, port: 179 }),
+    ).not.toBe(`${CUSTOMER_ADDRESS}:179`);
+  });
+
+  test("IPv4 and DNS hosts keep the conventional spelling", () => {
+    expect(
+      HostAddressUtil.formatHostAndPort({ host: "192.0.2.1", port: 179 }),
+    ).toBe("192.0.2.1:179");
+    expect(
+      HostAddressUtil.formatHostAndPort({ host: "example.com", port: "8443" }),
+    ).toBe("example.com:8443");
+  });
+
+  test("does not bracket twice", () => {
+    expect(
+      HostAddressUtil.formatHostAndPort({
+        host: `[${CUSTOMER_ADDRESS}]`,
+        port: 179,
+      }),
+    ).toBe(`[${CUSTOMER_ADDRESS}]:179`);
+  });
+
+  test("no port means the bare host, so a stored destination is not rewritten", () => {
+    expect(HostAddressUtil.formatHostAndPort({ host: CUSTOMER_ADDRESS })).toBe(
+      CUSTOMER_ADDRESS,
+    );
+    expect(
+      HostAddressUtil.formatHostAndPort({ host: CUSTOMER_ADDRESS, port: "" }),
+    ).toBe(CUSTOMER_ADDRESS);
+    expect(
+      HostAddressUtil.formatHostAndPort({
+        host: `[${CUSTOMER_ADDRESS}]`,
+        port: undefined,
+      }),
+    ).toBe(CUSTOMER_ADDRESS);
+  });
+});