@reventlessdev/reventless-local 3.0.0-alpha.288 → 3.0.0-alpha.290

package/tests/components/inboundtranslationslice/InboundTranslationWebhookTest.res.mjs

@@ -0,0 +1,473 @@
+// Generated by ReScript, PLEASE EDIT WITH CARE
+
+import * as Sury from "sury";
+import * as Stdlib_Dict from "@rescript/runtime/lib/es6/Stdlib_Dict.js";
+import * as Nodecrypto from "node:crypto";
+import * as Stdlib_Result from "@rescript/runtime/lib/es6/Stdlib_Result.js";
+import * as Pulumi from "@pulumi/pulumi";
+import * as Stdlib_JsError from "@rescript/runtime/lib/es6/Stdlib_JsError.js";
+import * as Role$Reventless from "@reventlessdev/reventless-spec/src/types/Role.res.mjs";
+import * as DcbTag$Reventless from "@reventlessdev/reventless-spec/src/components/DcbTag.res.mjs";
+import * as Api$ReventlessInfra from "@reventlessdev/reventless-infra/src/components/Api.res.mjs";
+import * as TestRunner$ReventlessLocal from "../../../src/test/TestRunner.res.mjs";
+import * as LocalWebhookRegistry$ReventlessLocal from "../../../src/adapter/Webhook/LocalWebhookRegistry.res.mjs";
+import * as InboundTranslationSlice_Webhook$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Webhook.res.mjs";
+import * as InboundTranslationSlice_Callback$ReventlessCore from "@reventlessdev/reventless-core/src/components/InboundTranslationSlice/InboundTranslationSlice_Callback.res.mjs";
+
+TestRunner$ReventlessLocal.setup();
+
+let merchandiser = "Merchandiser";
+
+let moduleUrl = "signed-feed://spec";
+
+let externalInputSchema = Sury.$schema(s => ({
+  kind: s.m(Sury.string),
+  id: s.m(Sury.string)
+}));
+
+let commandSchema = Sury.union([
+  Sury.$schema(s => ({
+    TAG: "AddProduct",
+    productId: s.m(DcbTag$Reventless.string)
+  })),
+  Sury.$schema(s => ({
+    TAG: "AddCategory",
+    categoryId: s.m(DcbTag$Reventless.string)
+  }))
+]);
+
+function authorizationOf(name) {
+  if (name === "AddProduct") {
+    return {
+      TAG: "AllowRoles",
+      _0: [merchandiser]
+    };
+  } else {
+    return {
+      TAG: "AllowRoles",
+      _0: [Role$Reventless.admin]
+    };
+  }
+}
+
+let endpoint = {
+  path: "/feeds/signed/",
+  auth: {
+    TAG: "SignedBody",
+    _0: {
+      header: "X-Signature",
+      prefix: "sha256=",
+      timestampHeader: "X-Timestamp",
+      secret: "feed"
+    }
+  },
+  role: merchandiser
+};
+
+let traits = [];
+
+let FeedSpec = {
+  name: "SignedFeed",
+  moduleUrl: moduleUrl,
+  externalInputSchema: externalInputSchema,
+  commandSchema: commandSchema,
+  targetName: "AddProduct",
+  externalSystem: undefined,
+  authorizationOf: authorizationOf,
+  endpoint: endpoint,
+  traits: traits
+};
+
+function translateFeed(input) {
+  let kind = input.kind;
+  switch (kind) {
+    case "category" :
+      return {
+        TAG: "Ok",
+        _0: [[
+            input.id,
+            {
+              TAG: "AddCategory",
+              categoryId: input.id
+            }
+          ]]
+      };
+    case "product" :
+      return {
+        TAG: "Ok",
+        _0: [[
+            input.id,
+            {
+              TAG: "AddProduct",
+              productId: input.id
+            }
+          ]]
+      };
+    default:
+      return {
+        TAG: "Error",
+        _0: `unknown kind ` + kind
+      };
+  }
+}
+
+let FeedCallback = InboundTranslationSlice_Callback$ReventlessCore.Make(FeedSpec)({
+  translate: translateFeed,
+  moduleUrl: moduleUrl
+});
+
+let moduleUrl$1 = "open-feed://spec";
+
+let externalInputSchema$1 = Sury.$schema(s => ({
+  kind: s.m(Sury.string),
+  id: s.m(Sury.string)
+}));
+
+let commandSchema$1 = Sury.$schema(s => ({
+  TAG: "AddProduct",
+  productId: s.m(DcbTag$Reventless.string)
+}));
+
+function authorizationOf$1(param) {
+  return "AllowAuthenticated";
+}
+
+let traits$1 = [];
+
+let OpenSpec_endpoint = {
+  path: "open",
+  auth: "Open"
+};
+
+let OpenSpec = {
+  name: "OpenFeed",
+  moduleUrl: moduleUrl$1,
+  externalInputSchema: externalInputSchema$1,
+  commandSchema: commandSchema$1,
+  targetName: "AddProduct",
+  externalSystem: undefined,
+  authorizationOf: authorizationOf$1,
+  endpoint: OpenSpec_endpoint,
+  traits: traits$1
+};
+
+function translate(input) {
+  return {
+    TAG: "Ok",
+    _0: [[
+        input.id,
+        {
+          TAG: "AddProduct",
+          productId: input.id
+        }
+      ]]
+  };
+}
+
+let OpenCallback = InboundTranslationSlice_Callback$ReventlessCore.Make(OpenSpec)({
+  translate: translate,
+  moduleUrl: moduleUrl$1
+});
+
+let inputSchema = Sury.$schema(s => ({
+  id: s.m(Sury.string)
+}));
+
+let published = {
+  contents: []
+};
+
+async function publishJsons(cmds) {
+  published.contents = published.contents.concat(cmds);
+}
+
+function feedOps_receive(input, caller, door) {
+  return FeedCallback.receive(publishJsons, input, caller, door);
+}
+
+async function feedOps_refuse(body, errorCode, error) {
+  return FeedCallback.refuse(body, errorCode, error);
+}
+
+let feedOps = {
+  receive: feedOps_receive,
+  refuse: feedOps_refuse
+};
+
+function openOps_receive(input, caller, door) {
+  return OpenCallback.receive(publishJsons, input, caller, door);
+}
+
+async function openOps_refuse(body, errorCode, error) {
+  return OpenCallback.refuse(body, errorCode, error);
+}
+
+let openOps = {
+  receive: openOps_receive,
+  refuse: openOps_refuse
+};
+
+let viaWebhook = "Webhook";
+
+let viaMutation = "Mutation";
+
+let secret = "s3cret";
+
+function secretOf(name) {
+  if (name === "feed") {
+    return secret;
+  }
+}
+
+let signature = {
+  header: "X-Signature",
+  prefix: "sha256=",
+  timestampHeader: "X-Timestamp",
+  secret: "feed"
+};
+
+function hmac(secret, text) {
+  return Nodecrypto.createHmac("sha256", secret).update(text).digest("hex");
+}
+
+function signedHeaders(secretOpt, atOpt, body) {
+  let secret$1 = secretOpt !== undefined ? secretOpt : secret;
+  let at = atOpt !== undefined ? atOpt : 1700000000;
+  let at$1 = at.toString();
+  return Object.fromEntries([
+    [
+      "x-timestamp",
+      at$1
+    ],
+    [
+      "x-signature",
+      "sha256=" + hmac(secret$1, at$1 + `.` + body)
+    ]
+  ]);
+}
+
+function body(kindOpt, idOpt) {
+  let kind = kindOpt !== undefined ? kindOpt : "product";
+  let id = idOpt !== undefined ? idOpt : "p-1";
+  return `{"kind":"` + kind + `","id":"` + id + `"}`;
+}
+
+function post(pathOpt, method, headers, body) {
+  let path = pathOpt !== undefined ? pathOpt : "feeds/signed";
+  return LocalWebhookRegistry$ReventlessLocal.post(path, method, headers, secretOf, 1700000000, body);
+}
+
+function throws(run) {
+  try {
+    run();
+    return false;
+  } catch (exn) {
+    return true;
+  }
+}
+
+function rows(log) {
+  return Object.values(log);
+}
+
+function clear(log) {
+  Object.keys(log).forEach(key => Stdlib_Dict.$$delete(log, key));
+}
+
+globalThis.describe("webhook signature", () => {
+  let check = (secretsOpt, headers, text) => {
+    let secrets = secretsOpt !== undefined ? secretsOpt : [secret];
+    return InboundTranslationSlice_Webhook$ReventlessCore.verify(signature, secrets, headers, text, 1700000000);
+  };
+  globalThis.test("a signature by the shared secret passes", () => {
+    globalThis.expect(check(undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined))).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+  globalThis.test("a signature by another secret is refused", () => {
+    globalThis.expect(Stdlib_Result.isError(check(undefined, signedHeaders("other", undefined, body(undefined, undefined)), body(undefined, undefined)))).toBe(true);
+  });
+  globalThis.test("a body changed after signing is refused", () => {
+    globalThis.expect(Stdlib_Result.isError(check(undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, "p-2")))).toBe(true);
+  });
+  globalThis.test("a timestamp outside the window is refused, so a captured request cannot be replayed", () => {
+    globalThis.expect(Stdlib_Result.isError(check(undefined, signedHeaders(undefined, 1700000000 - 301, body(undefined, undefined)), body(undefined, undefined)))).toBe(true);
+  });
+  globalThis.test("a request without the signature header is refused", () => {
+    let headers = signedHeaders(undefined, undefined, body(undefined, undefined));
+    Stdlib_Dict.$$delete(headers, "x-signature");
+    globalThis.expect(Stdlib_Result.isError(check(undefined, headers, body(undefined, undefined)))).toBe(true);
+  });
+  globalThis.test("while a secret is rotated, either one passes", () => {
+    globalThis.expect(check(InboundTranslationSlice_Webhook$ReventlessCore.secretsOf("new, old"), signedHeaders("old", undefined, body(undefined, undefined)), body(undefined, undefined))).toEqual({
+      TAG: "Ok",
+      _0: undefined
+    });
+  });
+  globalThis.test("a secret is read from a variable named after it", () => {
+    globalThis.expect(InboundTranslationSlice_Webhook$ReventlessCore.secretEnvKey("supplier-feed")).toBe("REVENTLESS_WEBHOOK_SECRET_SUPPLIER_FEED");
+  });
+});
+
+globalThis.describe("webhook door", () => {
+  globalThis.beforeAll(() => {
+    LocalWebhookRegistry$ReventlessLocal.reset();
+    let match = FeedCallback.webhook;
+    let match$1 = OpenCallback.webhook;
+    if (match !== undefined && match$1 !== undefined) {
+      LocalWebhookRegistry$ReventlessLocal.register(match, Pulumi.output(feedOps));
+      return LocalWebhookRegistry$ReventlessLocal.register(match$1, Pulumi.output(openOps));
+    } else {
+      return Stdlib_JsError.throwWithMessage("fixture specs declare endpoints");
+    }
+  });
+  globalThis.afterAll(() => LocalWebhookRegistry$ReventlessLocal.reset());
+  globalThis.beforeEach(() => {
+    published.contents = [];
+    clear(FeedCallback.auditLog);
+    clear(OpenCallback.auditLog);
+  });
+  globalThis.test("a signed request publishes its commands as the endpoint's role", async () => {
+    let response = await post(undefined, undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect(response.status).toBe(200);
+    globalThis.expect(published.contents.map(c => c.id)).toEqual(["p-1"]);
+    globalThis.expect(Object.values(FeedCallback.auditLog).map(row => row.door)).toEqual([viaWebhook]);
+  });
+  globalThis.test("a command the endpoint's role may not send is refused", async () => {
+    let text = body("category", undefined);
+    let response = await post(undefined, undefined, signedHeaders(undefined, undefined, text), text);
+    globalThis.expect(response.status).toBe(403);
+    globalThis.expect(published.contents).toEqual([]);
+  });
+  globalThis.test("a bad signature is refused before the body is read, with an audit row", async () => {
+    let response = await post(undefined, undefined, signedHeaders("other", undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect(response.status).toBe(401);
+    globalThis.expect(published.contents).toEqual([]);
+    globalThis.expect(Object.values(FeedCallback.auditLog).map(row => [
+      row.status,
+      row.door,
+      row.input
+    ])).toEqual([[
+        "Failure",
+        viaWebhook,
+        body(undefined, undefined)
+      ]]);
+  });
+  globalThis.test("a signed body that is not JSON is refused", async () => {
+    let response = await post(undefined, undefined, signedHeaders(undefined, undefined, "not json"), "not json");
+    globalThis.expect(response.status).toBe(400);
+  });
+  globalThis.test("an unknown path and a wrong method are refused", async () => {
+    let unknown = await post("nowhere", undefined, undefined, body(undefined, undefined));
+    let wrongMethod = await post(undefined, "PUT", signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect([
+      unknown.status,
+      wrongMethod.status
+    ]).toEqual([
+      404,
+      405
+    ]);
+  });
+  globalThis.test("a secret the platform lacks fails closed, without an audit row", async () => {
+    let response = await LocalWebhookRegistry$ReventlessLocal.post("feeds/signed", undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), param => {}, 1700000000, body(undefined, undefined));
+    globalThis.expect(response.status).toBe(500);
+    globalThis.expect(published.contents).toEqual([]);
+    globalThis.expect(Object.values(FeedCallback.auditLog)).toEqual([]);
+  });
+  globalThis.test("an open URL identifies nobody, so a signed-in rule refuses it", async () => {
+    let response = await post("open", undefined, undefined, body(undefined, undefined));
+    globalThis.expect(response.status).toBe(403);
+  });
+  globalThis.test("both doors publish the same commands and are told apart in the audit", async () => {
+    let caller_groups = [merchandiser];
+    let caller = {
+      userId: "u-1",
+      username: "alice",
+      groups: caller_groups,
+      provider: "InMemory"
+    };
+    let mutationResult = await feedOps_receive(JSON.parse(body(undefined, undefined)), caller, undefined);
+    await post(undefined, undefined, signedHeaders(undefined, undefined, body(undefined, undefined)), body(undefined, undefined));
+    globalThis.expect(Stdlib_Result.isOk(mutationResult)).toBe(true);
+    let commands = published.contents.map(c => c.commandJson);
+    if (commands.length !== 2) {
+      globalThis.expect(commands.length).toBe(2);
+    } else {
+      let viaMutationCommand = commands[0];
+      let viaWebhookCommand = commands[1];
+      globalThis.expect(viaWebhookCommand).toEqual(viaMutationCommand);
+    }
+    globalThis.expect(Object.values(FeedCallback.auditLog).map(row => row.door)).toEqual([
+      viaMutation,
+      viaWebhook
+    ]);
+  });
+  globalThis.test("two slices may not share a path", () => {
+    let route = FeedCallback.webhook;
+    if (route !== undefined) {
+      globalThis.expect(throws(() => LocalWebhookRegistry$ReventlessLocal.register(route, Pulumi.output(feedOps)))).toBe(true);
+      return;
+    } else {
+      return Stdlib_JsError.throwWithMessage("fixture spec declares an endpoint");
+    }
+  });
+});
+
+globalThis.describe("which doors a slice has", () => {
+  globalThis.test("@noApi on externalInput withholds the mutation", () => {
+    globalThis.expect([
+      InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(Api$ReventlessInfra.markNoApi(inputSchema)),
+      InboundTranslationSlice_Callback$ReventlessCore.exposesMutation(inputSchema)
+    ]).toEqual([
+      false,
+      true
+    ]);
+  });
+  globalThis.test("a slice with neither door is refused", () => {
+    let check = webhook => throws(() => InboundTranslationSlice_Callback$ReventlessCore.checkReachable("P", "S", false, webhook));
+    globalThis.expect([
+      check(false),
+      check(true)
+    ]).toEqual([
+      true,
+      false
+    ]);
+  });
+});
+
+let Webhook;
+
+let Callback;
+
+let now = 1700000000;
+
+export {
+  Webhook,
+  Callback,
+  merchandiser,
+  FeedSpec,
+  translateFeed,
+  FeedCallback,
+  OpenSpec,
+  OpenCallback,
+  inputSchema,
+  published,
+  publishJsons,
+  feedOps,
+  openOps,
+  viaWebhook,
+  viaMutation,
+  secret,
+  now,
+  secretOf,
+  signature,
+  hmac,
+  signedHeaders,
+  body,
+  post,
+  throws,
+  rows,
+  clear,
+}
+/*  Not a pure module */

package/tests/components/outboundtranslationslice/OutboundTranslationSliceCallbackTest.res.mjs

@@ -44,7 +44,6 @@ let FireForgetCallback = OutboundTranslationSlice_Callback$ReventlessCore.Make({
   outboundItemSchema: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.outboundItemSchema,
   inboundCommandSchema: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.inboundCommandSchema,
   maxRetries: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.maxRetries,
-  heartbeatInterval: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.heartbeatInterval,
   targetName: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.targetName,
   sourceNames: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.sourceNames,
   externalSystem: OutboundTranslationSliceFixtures$ReventlessLocal.SendTrackingEmailSpec.externalSystem,
@@ -59,7 +58,6 @@ let CommandBackCallback = OutboundTranslationSlice_Callback$ReventlessCore.Make(
   outboundItemSchema: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.outboundItemSchema,
   inboundCommandSchema: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.inboundCommandSchema,
   maxRetries: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.maxRetries,
-  heartbeatInterval: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.heartbeatInterval,
   targetName: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.targetName,
   sourceNames: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.sourceNames,
   externalSystem: OutboundTranslationSliceFixtures$ReventlessLocal.ProcessPaymentSpec.externalSystem,

package/tests/components/outboundtranslationslice/OutboundTranslationSliceFixtures.res

@@ -38,7 +38,6 @@ module SendTrackingEmailSpec = {
   let onExhausted = (_id, _item, ~lastError as _) => None
 
   let maxRetries = 3
-  let heartbeatInterval = 60
   let targetName = None
   let sourceNames: array<string> = []
   let externalSystem = None
@@ -86,7 +85,6 @@ module ProcessPaymentSpec = {
   let onExhausted = (id, item, ~lastError) => onExhaustedFn.contents(id, item, lastError)
 
   let maxRetries = 2
-  let heartbeatInterval = 30
   let targetName = Some("ConfirmPayment")
   let sourceNames: array<string> = []
   let externalSystem = None

package/tests/components/outboundtranslationslice/OutboundTranslationSliceFixtures.res.mjs

@@ -76,7 +76,6 @@ let SendTrackingEmailSpec = {
   translate: translate,
   onExhausted: onExhausted,
   maxRetries: 3,
-  heartbeatInterval: 60,
   targetName: undefined,
   sourceNames: sourceNames,
   externalSystem: undefined,
@@ -158,7 +157,6 @@ let ProcessPaymentSpec = {
   onExhaustedFn: onExhaustedFn,
   onExhausted: onExhausted$1,
   maxRetries: 2,
-  heartbeatInterval: 30,
   targetName: ProcessPaymentSpec_targetName,
   sourceNames: sourceNames$1,
   externalSystem: undefined,

package/tests/components/outboundtranslationslice/OutboundTranslationSlicePlatformFixtures.res

@@ -78,7 +78,6 @@ module SendConfirmSpec = {
   type inboundCommand = unit
 
   let maxRetries = 3
-  let heartbeatInterval = 60
   let targetName = None
   let sourceNames: array<string> = []
   let externalSystem = Some("EmailService")

package/tests/components/outboundtranslationslice/OutboundTranslationSlicePlatformFixtures.res.mjs

@@ -121,7 +121,6 @@ let SendConfirmSpec = {
   outboundItemSchema: outboundItemSchema,
   inboundCommandSchema: inboundCommandSchema,
   maxRetries: 3,
-  heartbeatInterval: 60,
   targetName: undefined,
   sourceNames: sourceNames,
   externalSystem: SendConfirmSpec_externalSystem,