@tellescope/sdk 1.255.18 → 1.256.0

package/lib/cjs/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.js

@@ -0,0 +1,443 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g;
+    return g = { next: verb(0), "throw": verb(1), "return": verb(2) }, typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhook_outbound_ssrf_tests = void 0;
+require('source-map-support').install();
+var http_1 = __importDefault(require("http"));
+var os_1 = __importDefault(require("os"));
+var sdk_1 = require("../../../sdk");
+var testing_1 = require("@tellescope/testing");
+var setup_1 = require("../../setup");
+var host = process.env.API_URL || 'http://localhost:8080';
+var LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1'];
+var TEST_SECRET = "f0015 outbound ssrf test secret";
+/**
+ * The sentinel — the destination that must NEVER be reached — is bound to this machine's own RFC1918
+ * address rather than to loopback, and that choice is load-bearing.
+ *
+ * Loopback is deliberately permitted outside prod/staging (see api/modules/outbound_url.ts), because
+ * several test suites bind their receivers with `listen(0, '127.0.0.1')` and an ephemeral port cannot be
+ * allowlisted ahead of time. A loopback sentinel would therefore be ALLOWED in exactly the environment
+ * where this test runs, and "the sentinel was not contacted" would pass by allowance while proving
+ * nothing.
+ *
+ * RFC1918 is refused in every environment, so binding there keeps the assertion meaningful AND keeps a
+ * real listener present — which is what lets us prove non-delivery by observation rather than by
+ * reading a log message.
+ */
+var first_private_ipv4 = function () {
+    for (var _i = 0, _a = Object.values(os_1.default.networkInterfaces()); _i < _a.length; _i++) {
+        var addresses = _a[_i];
+        for (var _b = 0, _c = addresses !== null && addresses !== void 0 ? addresses : []; _b < _c.length; _b++) {
+            var address = _c[_b];
+            if (address.family !== 'IPv4' || address.internal)
+                continue;
+            if (/^10\./.test(address.address))
+                return address.address;
+            if (/^192\.168\./.test(address.address))
+                return address.address;
+            if (/^172\.(1[6-9]|2\d|3[01])\./.test(address.address))
+                return address.address;
+        }
+    }
+    return undefined;
+};
+/**
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel would never be contacted, every assertion here would
+ * pass for the wrong reason, and we would be creating a real webhook in a live tenant. Fail loudly.
+ */
+var assert_local_api = function () {
+    var hostname = new URL(host).hostname;
+    if (!LOCAL_HOSTNAMES.includes(hostname)) {
+        throw new Error("F-0015 SSRF tests must run against a local API (got ".concat(host, "). ")
+            + "127.0.0.1 would resolve to the API server rather than this machine, and this test configures a webhook.");
+    }
+};
+var listen = function (server, address) { return new Promise(function (resolve, reject) {
+    server.once('error', reject);
+    server.listen(0, address, function () { return resolve(); }); // ephemeral port — nothing here needs a fixed one
+}); };
+var port_of = function (server) { return server.address().port; };
+/** Webhook delivery is fire-and-forget, so absence has to be established by waiting. */
+var settle = function (ms) { return new Promise(function (resolve) { return setTimeout(resolve, ms); }); };
+var wait_until = function (predicate, ms) { return __awaiter(void 0, void 0, void 0, function () {
+    var deadline;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                deadline = Date.now() + ms;
+                _a.label = 1;
+            case 1:
+                if (!(Date.now() < deadline)) return [3 /*break*/, 3];
+                if (predicate())
+                    return [2 /*return*/, true];
+                return [4 /*yield*/, settle(100)];
+            case 2:
+                _a.sent();
+                return [3 /*break*/, 1];
+            case 3: return [2 /*return*/, predicate()];
+        }
+    });
+}); };
+/**
+ * Regression tests for F-0015
+ * (security-audit/findings/F-0015-webhook-outbound-ssrf.md).
+ *
+ * Outbound webhooks request customer-configured URLs that are validated only for SYNTAX
+ * (urlValidator -> validator.isURL, which happily accepts http://10.0.0.1/). Four call sites are
+ * affected: api/modules/webhooks.ts:145, :214, :270, and the five-method block at api/v1/api.ts:9723.
+ *
+ * Two properties make this worse than a blind SSRF:
+ *  - A non-2xx response body is stored in log.response, and webhook_logs is surfaced to customers for
+ *    debugging — so an internal endpoint's error body is readable by the tenant that configured it.
+ *  - The automation send-webhook action builds its URL at runtime through five nested template
+ *    replacers over action.info.url, so patient-controlled field values can reach the destination.
+ *
+ * And critically: axios@0.30.2 follows redirects by default (maxRedirects: 5). A pre-flight check on
+ * the configured URL is therefore NOT sufficient — a receiver can simply 302 to an internal address
+ * after validation has already passed. T4 exists to prove exactly that, which is why the fix has to
+ * validate at connect time (a guarded agent) rather than as a string check.
+ *
+ * Each test below asserts ABSENCE ("the sentinel was never contacted"), which passes trivially if the
+ * request never happened at all — a missing allowlist entry, a webhook that never fired, a broken
+ * subscription. So each is paired with a positive control that proves the attempt really was made.
+ */
+var webhook_outbound_ssrf_tests = function (_a) {
+    var sdk = _a.sdk;
+    return __awaiter(void 0, void 0, void 0, function () {
+        var SENTINEL, privateIP, sentinelHits, okHits, redirectHits, sentinelURL, sentinel, allowed, enduserId, templateEnduserId, configuredWebhook, sentinelPort, okURL_1, redirectURL_1, enduser_1, send_automation_webhook_to_1, templateEnduser_1, webhooks, _i, _b, w, _c, _d, _e;
+        return __generator(this, function (_f) {
+            switch (_f.label) {
+                case 0:
+                    (0, testing_1.log_header)("F-0015: outbound webhook SSRF");
+                    assert_local_api();
+                    SENTINEL = "f0015-sentinel-".concat(Date.now(), "-").concat(Math.random().toString(36).slice(2));
+                    privateIP = first_private_ipv4();
+                    if (!privateIP) {
+                        // Degrade loudly rather than silently passing. Everything below needs a bindable address that the
+                        // guard refuses in every environment, and loopback does not qualify (see the note above).
+                        (0, testing_1.assert)(false, 'F-0015 SKIPPED: no non-loopback RFC1918 interface on this host, so the SSRF sentinel cannot be '
+                            + 'bound anywhere the guard refuses. Run on a host with a private network interface.', 'F-0015 outbound SSRF');
+                        return [2 /*return*/];
+                    }
+                    sentinelHits = 0 // must NEVER be reached once fixed
+                    ;
+                    okHits = 0 // permitted target: must stay reachable
+                    ;
+                    redirectHits = 0 // permitted hop 1 of the redirect chain
+                    ;
+                    sentinelURL = '';
+                    sentinel = http_1.default.createServer(function (_, res) {
+                        sentinelHits++;
+                        res.writeHead(200, { 'content-type': 'application/json' });
+                        res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }));
+                    });
+                    allowed = http_1.default.createServer(function (req, res) {
+                        if ((req.url || '').startsWith('/redirect-to-internal')) {
+                            redirectHits++;
+                            // Hop 1 is permitted and genuinely succeeds; hop 2 points somewhere that is not.
+                            res.writeHead(302, { location: sentinelURL });
+                            res.end();
+                            return;
+                        }
+                        okHits++;
+                        res.writeHead(200, { 'content-type': 'application/json' });
+                        res.end(JSON.stringify({ ok: true }));
+                    });
+                    configuredWebhook = false;
+                    _f.label = 1;
+                case 1:
+                    _f.trys.push([1, , 14, 31]);
+                    return [4 /*yield*/, listen(sentinel, privateIP)];
+                case 2:
+                    _f.sent();
+                    sentinelPort = port_of(sentinel);
+                    sentinelURL = "http://".concat(privateIP, ":").concat(sentinelPort, "/ssrf-sentinel");
+                    return [4 /*yield*/, listen(allowed, '127.0.0.1')];
+                case 3:
+                    _f.sent();
+                    okURL_1 = "http://127.0.0.1:".concat(port_of(allowed), "/webhook-ok");
+                    redirectURL_1 = "http://127.0.0.1:".concat(port_of(allowed), "/redirect-to-internal");
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0015-".concat(Date.now(), "@example.com"), fname: 'F0015', lname: 'Ssrf',
+                        })];
+                case 4:
+                    enduser_1 = _f.sent();
+                    enduserId = enduser_1.id;
+                    send_automation_webhook_to_1 = function (url, forEnduserId) {
+                        if (forEnduserId === void 0) { forEnduserId = enduser_1.id; }
+                        return __awaiter(void 0, void 0, void 0, function () {
+                            var outcome;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        sentinelHits = 0;
+                                        okHits = 0;
+                                        redirectHits = 0;
+                                        return [4 /*yield*/, sdk.api.webhooks.send_automation_webhook({
+                                                enduserId: forEnduserId,
+                                                action: { info: { url: url } },
+                                            }).then(function () { return 'resolved'; }).catch(function () { return 'rejected'; })
+                                            // The action awaits its own axios call, but give redirect chains a moment to land.
+                                        ];
+                                    case 1:
+                                        outcome = _a.sent();
+                                        // The action awaits its own axios call, but give redirect chains a moment to land.
+                                        return [4 /*yield*/, settle(750)];
+                                    case 2:
+                                        // The action awaits its own axios call, but give redirect chains a moment to land.
+                                        _a.sent();
+                                        return [2 /*return*/, { outcome: outcome, sentinelHits: sentinelHits, okHits: okHits, redirectHits: redirectHits }];
+                                }
+                            });
+                        });
+                    };
+                    // ---------------------------------------------------------------------------------------------
+                    // T6 first: the positive control for the whole file. If an allowlisted target does not receive the
+                    // webhook, every "sentinel not contacted" assertion below is meaningless.
+                    // ---------------------------------------------------------------------------------------------
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0015: automation webhook to a permitted target still delivers (regression baseline)', function () { return send_automation_webhook_to_1(okURL_1); }, { onResult: function (r) { return r.okHits === 1 && r.sentinelHits === 0; } })
+                        // T3 — direct non-allowlisted private destination.
+                    ];
+                case 5:
+                    // ---------------------------------------------------------------------------------------------
+                    // T6 first: the positive control for the whole file. If an allowlisted target does not receive the
+                    // webhook, every "sentinel not contacted" assertion below is meaningless.
+                    // ---------------------------------------------------------------------------------------------
+                    _f.sent();
+                    // T3 — direct non-allowlisted private destination.
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0015: automation webhook does not reach a private destination', function () { return send_automation_webhook_to_1(sentinelURL); }, { onResult: function (r) { return r.sentinelHits === 0; } })
+                        // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
+                    ];
+                case 6:
+                    // T3 — direct non-allowlisted private destination.
+                    _f.sent();
+                    // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0015: automation webhook does not follow a redirect from a permitted host into a private one', function () { return send_automation_webhook_to_1(redirectURL_1); }, {
+                            // redirectHits === 1 is the positive control: hop 1 was allowlisted and really was reached, so
+                            // sentinelHits === 0 can only mean hop 2 was refused — not that the request never happened.
+                            onResult: function (r) { return r.redirectHits === 1 && r.sentinelHits === 0; },
+                        })
+                        // T5 — the destination arrives via template interpolation, so validation must run AFTER the
+                        // replacers rather than against the stored config. {{enduser.<key>}} resolves from enduser.fields.
+                    ];
+                case 7:
+                    // T4 — the redirect bypass. THE test that justifies a connect-time guard over a pre-flight check.
+                    _f.sent();
+                    return [4 /*yield*/, sdk.api.endusers.createOne({
+                            email: "f0015-tpl-".concat(Date.now(), "@example.com"),
+                            fname: 'F0015', lname: 'Template',
+                            fields: { ssrfTarget: "".concat(privateIP, ":").concat(sentinelPort) },
+                        })];
+                case 8:
+                    templateEnduser_1 = _f.sent();
+                    templateEnduserId = templateEnduser_1.id;
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0015: automation webhook validates the URL after template interpolation, not before', function () { return send_automation_webhook_to_1('http://{{enduser.ssrfTarget}}/ssrf-sentinel', templateEnduser_1.id); }, { onResult: function (r) { return r.sentinelHits === 0; } })
+                        // ---------------------------------------------------------------------------------------------
+                        // The configured-webhook delivery path (api/modules/webhooks.ts:145), which is a different code
+                        // path from the automation action above. Paired: allowlisted target proves the subscription and
+                        // trigger plumbing works, then the same plumbing pointed at the sentinel must not reach it.
+                        // ---------------------------------------------------------------------------------------------
+                        // CUDSubscription is an object of booleans, not a list of verbs (see webhooks_tests.ts fullSubscription).
+                    ];
+                case 9:
+                    _f.sent();
+                    // ---------------------------------------------------------------------------------------------
+                    // The configured-webhook delivery path (api/modules/webhooks.ts:145), which is a different code
+                    // path from the automation action above. Paired: allowlisted target proves the subscription and
+                    // trigger plumbing works, then the same plumbing pointed at the sentinel must not reach it.
+                    // ---------------------------------------------------------------------------------------------
+                    // CUDSubscription is an object of booleans, not a list of verbs (see webhooks_tests.ts fullSubscription).
+                    return [4 /*yield*/, sdk.api.webhooks.configure({
+                            url: okURL_1, secret: TEST_SECRET, subscriptions: { endusers: { create: true } },
+                        })];
+                case 10:
+                    // ---------------------------------------------------------------------------------------------
+                    // The configured-webhook delivery path (api/modules/webhooks.ts:145), which is a different code
+                    // path from the automation action above. Paired: allowlisted target proves the subscription and
+                    // trigger plumbing works, then the same plumbing pointed at the sentinel must not reach it.
+                    // ---------------------------------------------------------------------------------------------
+                    // CUDSubscription is an object of booleans, not a list of verbs (see webhooks_tests.ts fullSubscription).
+                    _f.sent();
+                    configuredWebhook = true;
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0015: configured webhook to a permitted target still delivers (positive control)', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var e, delivered;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        sentinelHits = 0;
+                                        okHits = 0;
+                                        return [4 /*yield*/, sdk.api.endusers.createOne({ email: "f0015-ok-".concat(Date.now(), "@example.com") })];
+                                    case 1:
+                                        e = _a.sent();
+                                        return [4 /*yield*/, wait_until(function () { return okHits > 0; }, 8000)];
+                                    case 2:
+                                        delivered = _a.sent();
+                                        return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id).catch(function () { })];
+                                    case 3:
+                                        _a.sent();
+                                        return [2 /*return*/, { delivered: delivered, okHits: okHits, sentinelHits: sentinelHits }];
+                                }
+                            });
+                        }); }, { onResult: function (r) { return r.delivered === true && r.sentinelHits === 0; } })
+                        // Repoint the same configuration at the sentinel, keeping the subscription intact.
+                    ];
+                case 11:
+                    _f.sent();
+                    // Repoint the same configuration at the sentinel, keeping the subscription intact.
+                    return [4 /*yield*/, sdk.api.webhooks.update({ url: sentinelURL })];
+                case 12:
+                    // Repoint the same configuration at the sentinel, keeping the subscription intact.
+                    _f.sent();
+                    return [4 /*yield*/, (0, testing_1.async_test)('F-0015: configured webhook does not deliver to a private destination', function () { return __awaiter(void 0, void 0, void 0, function () {
+                            var e;
+                            return __generator(this, function (_a) {
+                                switch (_a.label) {
+                                    case 0:
+                                        sentinelHits = 0;
+                                        okHits = 0;
+                                        return [4 /*yield*/, sdk.api.endusers.createOne({ email: "f0015-blocked-".concat(Date.now(), "@example.com") })
+                                            // Wait out the window a real delivery would have landed in, then assert it did not.
+                                        ];
+                                    case 1:
+                                        e = _a.sent();
+                                        // Wait out the window a real delivery would have landed in, then assert it did not.
+                                        return [4 /*yield*/, settle(6000)];
+                                    case 2:
+                                        // Wait out the window a real delivery would have landed in, then assert it did not.
+                                        _a.sent();
+                                        return [4 /*yield*/, sdk.api.endusers.deleteOne(e.id).catch(function () { })];
+                                    case 3:
+                                        _a.sent();
+                                        return [2 /*return*/, { sentinelHits: sentinelHits }];
+                                }
+                            });
+                        }); }, { onResult: function (r) { return r.sentinelHits === 0; } })];
+                case 13:
+                    _f.sent();
+                    return [3 /*break*/, 31];
+                case 14:
+                    if (!configuredWebhook) return [3 /*break*/, 22];
+                    _f.label = 15;
+                case 15:
+                    _f.trys.push([15, 21, , 22]);
+                    return [4 /*yield*/, sdk.api.webhooks.getSome({})];
+                case 16:
+                    webhooks = (_f.sent()).webhooks;
+                    _i = 0, _b = (webhooks !== null && webhooks !== void 0 ? webhooks : []);
+                    _f.label = 17;
+                case 17:
+                    if (!(_i < _b.length)) return [3 /*break*/, 20];
+                    w = _b[_i];
+                    return [4 /*yield*/, sdk.api.webhooks.deleteOne(w.id).catch(function () { })];
+                case 18:
+                    _f.sent();
+                    _f.label = 19;
+                case 19:
+                    _i++;
+                    return [3 /*break*/, 17];
+                case 20: return [3 /*break*/, 22];
+                case 21:
+                    _c = _f.sent();
+                    return [3 /*break*/, 22];
+                case 22:
+                    if (!enduserId) return [3 /*break*/, 26];
+                    _f.label = 23;
+                case 23:
+                    _f.trys.push([23, 25, , 26]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+                case 24:
+                    _f.sent();
+                    return [3 /*break*/, 26];
+                case 25:
+                    _d = _f.sent();
+                    return [3 /*break*/, 26];
+                case 26:
+                    if (!templateEnduserId) return [3 /*break*/, 30];
+                    _f.label = 27;
+                case 27:
+                    _f.trys.push([27, 29, , 30]);
+                    return [4 /*yield*/, sdk.api.endusers.deleteOne(templateEnduserId)];
+                case 28:
+                    _f.sent();
+                    return [3 /*break*/, 30];
+                case 29:
+                    _e = _f.sent();
+                    return [3 /*break*/, 30];
+                case 30:
+                    sentinel.close();
+                    allowed.close();
+                    return [7 /*endfinally*/];
+                case 31: return [2 /*return*/];
+            }
+        });
+    });
+};
+exports.webhook_outbound_ssrf_tests = webhook_outbound_ssrf_tests;
+if (require.main === module) {
+    console.log("\uD83C\uDF10 Using API URL: ".concat(host));
+    var sdk_2 = new sdk_1.Session({ host: host });
+    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
+    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
+        return __generator(this, function (_a) {
+            switch (_a.label) {
+                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
+                case 1:
+                    _a.sent();
+                    return [4 /*yield*/, (0, exports.webhook_outbound_ssrf_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
+                case 2:
+                    _a.sent();
+                    return [2 /*return*/];
+            }
+        });
+    }); };
+    runTests()
+        .then(function () {
+        console.log("✅ F-0015 outbound webhook SSRF test suite completed successfully");
+        process.exit(0);
+    })
+        .catch(function (error) {
+        console.error("❌ F-0015 outbound webhook SSRF test suite failed:", error);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=F-0015-webhook-outbound-ssrf.test.js.map

package/lib/cjs/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0015-webhook-outbound-ssrf.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0015-webhook-outbound-ssrf.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,8CAAuB;AACvB,0CAAmB;AACnB,oCAAsC;AACtC,+CAI4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEzD,IAAM,WAAW,GAAG,iCAAiC,CAAA;AAErD;;;;;;;;;;;;;GAaG;AACH,IAAM,kBAAkB,GAAG;IACzB,KAAwB,UAAqC,EAArC,KAAA,MAAM,CAAC,MAAM,CAAC,YAAE,CAAC,iBAAiB,EAAE,CAAC,EAArC,cAAqC,EAArC,IAAqC,EAAE;QAA1D,IAAM,SAAS,SAAA;QAClB,KAAsB,UAAe,EAAf,KAAA,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,EAAE,EAAf,cAAe,EAAf,IAAe,EAAE;YAAlC,IAAM,OAAO,SAAA;YAChB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ;gBAAE,SAAQ;YAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;YACzD,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;YAC/D,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAA;SAC/E;KACF;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;GAIG;AACH,IAAM,gBAAgB,GAAG;IACvB,IAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAA;IACvC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACvC,MAAM,IAAI,KAAK,CACb,8DAAuD,IAAI,QAAK;cAC9D,yGAAyG,CAC5G,CAAA;KACF;AACH,CAAC,CAAA;AAED,IAAM,MAAM,GAAG,UAAC,MAAmB,EAAE,OAAe,IAAK,OAAA,IAAI,OAAO,CAAO,UAAC,OAAO,EAAE,MAAM;IACzF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,cAAM,OAAA,OAAO,EAAE,EAAT,CAAS,CAAC,CAAA,CAAC,kDAAkD;AAC/F,CAAC,CAAC,EAHuD,CAGvD,CAAA;AAEF,IAAM,OAAO,GAAG,UAAC,MAAmB,IAAK,OAAC,MAAM,CAAC,OAAO,EAAU,CAAC,IAAI,EAA9B,CAA8B,CAAA;AAEvE,wFAAwF;AACxF,IAAM,MAAM,GAAG,UAAC,EAAU,IAAK,OAAA,IAAI,OAAO,CAAO,UAAA,OAAO,IAAI,OAAA,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAvB,CAAuB,CAAC,EAArD,CAAqD,CAAA;AACpF,IAAM,UAAU,GAAG,UAAO,SAAwB,EAAE,EAAU;;;;;gBACtD,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAA;;;qBACzB,CAAA,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAA;gBAC1B,IAAI,SAAS,EAAE;oBAAE,sBAAO,IAAI,EAAA;gBAC5B,qBAAM,MAAM,CAAC,GAAG,CAAC,EAAA;;gBAAjB,SAAiB,CAAA;;oBAEnB,sBAAO,SAAS,EAAE,EAAA;;;KACnB,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACI,IAAM,2BAA2B,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBACrD,IAAA,oBAAU,EAAC,+BAA+B,CAAC,CAAA;oBAC3C,gBAAgB,EAAE,CAAA;oBAEZ,QAAQ,GAAG,yBAAkB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;oBAEhF,SAAS,GAAG,kBAAkB,EAAE,CAAA;oBACtC,IAAI,CAAC,SAAS,EAAE;wBACd,kGAAkG;wBAClG,0FAA0F;wBAC1F,IAAA,gBAAM,EACJ,KAAK,EACL,iGAAiG;8BAC/F,mFAAmF,EACrF,sBAAsB,CACvB,CAAA;wBACD,sBAAM;qBACP;oBAEG,YAAY,GAAG,CAAC,CAAG,mCAAmC;oBAAtC,CAAA;oBAChB,MAAM,GAAG,CAAC,CAAS,wCAAwC;oBAAjD,CAAA;oBACV,YAAY,GAAG,CAAC,CAAG,wCAAwC;oBAA3C,CAAA;oBAEhB,WAAW,GAAG,EAAE,CAAA;oBAId,QAAQ,GAAG,cAAI,CAAC,YAAY,CAAC,UAAC,CAAC,EAAE,GAAG;wBACxC,YAAY,EAAE,CAAA;wBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;oBAC/E,CAAC,CAAC,CAAA;oBAGI,OAAO,GAAG,cAAI,CAAC,YAAY,CAAC,UAAC,GAAG,EAAE,GAAG;wBACzC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE;4BACvD,YAAY,EAAE,CAAA;4BACd,iFAAiF;4BACjF,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;4BAC7C,GAAG,CAAC,GAAG,EAAE,CAAA;4BACT,OAAM;yBACP;wBACD,MAAM,EAAE,CAAA;wBACR,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;oBACvC,CAAC,CAAC,CAAA;oBAIE,iBAAiB,GAAG,KAAK,CAAA;;;;oBAG3B,qBAAM,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAA;;oBAAjC,SAAiC,CAAA;oBAC3B,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;oBACtC,WAAW,GAAG,iBAAU,SAAS,cAAI,YAAY,mBAAgB,CAAA;oBAEjE,qBAAM,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAA;;oBAAlC,SAAkC,CAAA;oBAC5B,UAAQ,2BAAoB,OAAO,CAAC,OAAO,CAAC,gBAAa,CAAA;oBACzD,gBAAc,2BAAoB,OAAO,CAAC,OAAO,CAAC,0BAAuB,CAAA;oBAE/D,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/C,KAAK,EAAE,gBAAS,IAAI,CAAC,GAAG,EAAE,iBAAc,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM;yBACxE,CAAC,EAAA;;oBAFI,YAAU,SAEd;oBACF,SAAS,GAAG,SAAO,CAAC,EAAE,CAAA;oBAEhB,+BAA6B,UAAO,GAAW,EAAE,YAAyB;wBAAzB,6BAAA,EAAA,eAAe,SAAO,CAAC,EAAE;;;;;;wCAC9E,YAAY,GAAG,CAAC,CAAC;wCAAC,MAAM,GAAG,CAAC,CAAC;wCAAC,YAAY,GAAG,CAAC,CAAA;wCAC9B,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,uBAAuB,CAAC;gDAC7D,SAAS,EAAE,YAAY;gDACvB,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,GAAG,KAAA,EAAE,EAAE;6CACnB,CAAC,CAAC,IAAI,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC,CAAC,KAAK,CAAC,cAAM,OAAA,UAAU,EAAV,CAAU,CAAC;4CACxD,mFAAmF;0CAD3B;;wCAHlD,OAAO,GAAG,SAGwC;wCACxD,mFAAmF;wCACnF,qBAAM,MAAM,CAAC,GAAG,CAAC,EAAA;;wCADjB,mFAAmF;wCACnF,SAAiB,CAAA;wCACjB,sBAAO,EAAE,OAAO,SAAA,EAAE,YAAY,cAAA,EAAE,MAAM,QAAA,EAAE,YAAY,cAAA,EAAE,EAAA;;;;qBACvD,CAAA;oBAED,gGAAgG;oBAChG,mGAAmG;oBACnG,0EAA0E;oBAC1E,gGAAgG;oBAChG,qBAAM,IAAA,oBAAU,EACd,uFAAuF,EACvF,cAAM,OAAA,4BAA0B,CAAC,OAAK,CAAC,EAAjC,CAAiC,EACvC,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAtC,CAAsC,EAAE,CACjE;wBAED,mDAAmD;sBAFlD;;oBARD,gGAAgG;oBAChG,mGAAmG;oBACnG,0EAA0E;oBAC1E,gGAAgG;oBAChG,SAIC,CAAA;oBAED,mDAAmD;oBACnD,qBAAM,IAAA,oBAAU,EACd,iEAAiE,EACjE,cAAM,OAAA,4BAA0B,CAAC,WAAW,CAAC,EAAvC,CAAuC,EAC7C,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,YAAY,KAAK,CAAC,EAApB,CAAoB,EAAE,CAC/C;wBAED,kGAAkG;sBAFjG;;oBALD,mDAAmD;oBACnD,SAIC,CAAA;oBAED,kGAAkG;oBAClG,qBAAM,IAAA,oBAAU,EACd,gGAAgG,EAChG,cAAM,OAAA,4BAA0B,CAAC,aAAW,CAAC,EAAvC,CAAuC,EAC7C;4BACE,+FAA+F;4BAC/F,4FAA4F;4BAC5F,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,YAAY,KAAK,CAAC,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAA5C,CAA4C;yBACnE,CACF;wBAED,4FAA4F;wBAC5F,mGAAmG;sBAHlG;;oBATD,kGAAkG;oBAClG,SAQC,CAAA;oBAIuB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BACvD,KAAK,EAAE,oBAAa,IAAI,CAAC,GAAG,EAAE,iBAAc;4BAC5C,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU;4BACjC,MAAM,EAAE,EAAE,UAAU,EAAE,UAAG,SAAS,cAAI,YAAY,CAAE,EAAE;yBACvD,CAAC,EAAA;;oBAJI,oBAAkB,SAItB;oBACF,iBAAiB,GAAG,iBAAe,CAAC,EAAE,CAAA;oBAEtC,qBAAM,IAAA,oBAAU,EACd,uFAAuF,EACvF,cAAM,OAAA,4BAA0B,CAAC,6CAA6C,EAAE,iBAAe,CAAC,EAAE,CAAC,EAA7F,CAA6F,EACnG,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,YAAY,KAAK,CAAC,EAApB,CAAoB,EAAE,CAC/C;wBAED,gGAAgG;wBAChG,gGAAgG;wBAChG,gGAAgG;wBAChG,4FAA4F;wBAC5F,gGAAgG;wBAChG,0GAA0G;sBAPzG;;oBAJD,SAIC,CAAA;oBAED,gGAAgG;oBAChG,gGAAgG;oBAChG,gGAAgG;oBAChG,4FAA4F;oBAC5F,gGAAgG;oBAChG,0GAA0G;oBAC1G,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;4BAC/B,GAAG,EAAE,OAAK,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;yBAC/E,CAAC,EAAA;;oBARF,gGAAgG;oBAChG,gGAAgG;oBAChG,gGAAgG;oBAChG,4FAA4F;oBAC5F,gGAAgG;oBAChG,0GAA0G;oBAC1G,SAEE,CAAA;oBACF,iBAAiB,GAAG,IAAI,CAAA;oBAExB,qBAAM,IAAA,oBAAU,EACd,oFAAoF,EACpF;;;;;wCACE,YAAY,GAAG,CAAC,CAAC;wCAAC,MAAM,GAAG,CAAC,CAAA;wCAClB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAY,IAAI,CAAC,GAAG,EAAE,iBAAc,EAAE,CAAC,EAAA;;wCAArF,CAAC,GAAG,SAAiF;wCACzE,qBAAM,UAAU,CAAC,cAAM,OAAA,MAAM,GAAG,CAAC,EAAV,CAAU,EAAE,IAAK,CAAC,EAAA;;wCAArD,SAAS,GAAG,SAAyC;wCAC3D,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;wCAAtD,SAAsD,CAAA;wCACtD,sBAAO,EAAE,SAAS,WAAA,EAAE,MAAM,QAAA,EAAE,YAAY,cAAA,EAAE,EAAA;;;6BAC3C,EACD,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAA5C,CAA4C,EAAE,CACvE;wBAED,mFAAmF;sBAFlF;;oBAVD,SAUC,CAAA;oBAED,mFAAmF;oBACnF,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,EAAA;;oBADnD,mFAAmF;oBACnF,SAAmD,CAAA;oBAEnD,qBAAM,IAAA,oBAAU,EACd,sEAAsE,EACtE;;;;;wCACE,YAAY,GAAG,CAAC,CAAC;wCAAC,MAAM,GAAG,CAAC,CAAA;wCAClB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,wBAAiB,IAAI,CAAC,GAAG,EAAE,iBAAc,EAAE,CAAC;4CAChG,oFAAoF;0CADY;;wCAA1F,CAAC,GAAG,SAAsF;wCAChG,oFAAoF;wCACpF,qBAAM,MAAM,CAAC,IAAK,CAAC,EAAA;;wCADnB,oFAAoF;wCACpF,SAAmB,CAAA;wCACnB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;wCAAtD,SAAsD,CAAA;wCACtD,sBAAO,EAAE,YAAY,cAAA,EAAE,EAAA;;;6BACxB,EACD,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,YAAY,KAAK,CAAC,EAApB,CAAoB,EAAE,CAC/C,EAAA;;oBAXD,SAWC,CAAA;;;yBAGG,iBAAiB,EAAjB,yBAAiB;;;;oBAEI,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAA/C,QAAQ,GAAK,CAAA,SAAyC,CAAA,SAA9C;0BACgB,EAAhB,MAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC;;;yBAAhB,CAAA,cAAgB,CAAA;oBAArB,CAAC;oBAAwB,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAO,CAAC,CAAC,EAAA;;oBAAtD,SAAsD,CAAA;;;oBAA1E,IAAgB,CAAA;;;;;;;yBAGhC,SAAS,EAAT,yBAAS;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;oBAA3C,SAA2C,CAAA;;;;;;yBAC9D,iBAAiB,EAAjB,yBAAiB;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAA;;oBAAnD,SAAmD,CAAA;;;;;;oBAClF,QAAQ,CAAC,KAAK,EAAE,CAAA;oBAChB,OAAO,CAAC,KAAK,EAAE,CAAA;;;;;;CAElB,CAAA;AA1KY,QAAA,2BAA2B,+BA0KvC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,mCAA2B,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAvD,SAAuD,CAAA;;;;SACxD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAA;QAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,mDAAmD,EAAE,KAAK,CAAC,CAAA;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.d.ts

@@ -0,0 +1,35 @@
+import { Session } from "../../../sdk";
+/**
+ * Regression tests for F-0025
+ * (security-audit/findings/F-0025-proxy-image-unauth-ssrf.md).
+ *
+ * GET /v1/proxy-image accepted an arbitrary ?url= and streamed the upstream response body straight
+ * back with Access-Control-Allow-Origin: *, with no authentication, no destination validation and no
+ * content-type restriction. That reaches http://169.254.169.254/ (EC2 instance credentials under
+ * IMDSv1), 127.0.0.1, and anything else inside the VPC.
+ *
+ * The endpoint's only legitimate job is to re-serve an image that ALREADY renders in the staff
+ * browser, with permissive CORS headers, so html2canvas can rasterize a form-response PDF without
+ * tainting the canvas (canvas.toDataURL() throws on a tainted canvas, and the form-response view sets
+ * crossOrigin="anonymous"). Anything reachable only from inside our network was therefore never a
+ * legitimate input — which is why refusing non-public destinations cannot regress the feature.
+ *
+ * Repro: stand up a local HTTP server that serves a JSON secret, point proxy-image at it with no
+ * credentials, and assert the secret does not come back.
+ *   - red  (unfixed): the sentinel body is streamed back to an unauthenticated caller
+ *   - green (fixed):  the request is refused and the sentinel server is never contacted
+ *
+ * Assertions are deliberately written as "4xx and nothing leaked" rather than pinning an exact status,
+ * because the fix both authenticates the endpoint and moves it to POST (the url moves into the body so
+ * presigned S3 URLs for patient attachments stop landing in access logs). Either 401 or 404/405 on the
+ * old GET shape is an acceptable outcome; streaming the body is not.
+ *
+ * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
+ * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
+ * the vulnerability proof.
+ */
+export declare const proxy_image_ssrf_tests: ({ sdk }: {
+    sdk: Session;
+    sdkNonAdmin: Session;
+}) => Promise<void>;
+//# sourceMappingURL=F-0025-proxy-image-unauth-ssrf.test.d.ts.map

package/lib/cjs/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"F-0025-proxy-image-unauth-ssrf.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/F-0025-proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AA0BtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,sBAAsB;SAA2B,OAAO;iBAAe,OAAO;mBAkG1F,CAAA"}