@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/cjs/tests/api_tests/security/proxy-image-unauth-ssrf.test.js

@@ -39,27 +39,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.proxy_image_ssrf_tests = void 0;
+exports.ISOLATED_SUITE = exports.proxy_image_ssrf_tests = exports.proxy_image_ssrf_checks = void 0;
 require('source-map-support').install();
 var http_1 = __importDefault(require("http"));
 var axios_1 = __importDefault(require("axios"));
-var sdk_1 = require("../../../sdk");
-var testing_1 = require("@tellescope/testing");
-var setup_1 = require("../../setup");
+var setup_isolated_1 = require("../../setup_isolated");
 var host = process.env.API_URL || 'http://localhost:8080';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var LOCAL_HOSTNAMES = ['localhost', '127.0.0.1', '::1'];
-/**
- * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
- * prod it is the API server itself — the sentinel below would never be contacted, every assertion
- * here would pass for the wrong reason, and we would be probing a live environment. Fail loudly.
- */
-var assert_local_api = function () {
-    var hostname = new URL(host).hostname;
-    if (!LOCAL_HOSTNAMES.includes(hostname)) {
-        throw new Error("SSRF tests must run against a local API (got ".concat(host, "). ")
-            + "127.0.0.1 would resolve to the API server rather than this machine, so the tests would be meaningless.");
-    }
-};
 /**
  * Regression tests: `/v1/proxy-image` must refuse internal and non-image destinations.
  *
@@ -87,137 +74,202 @@ var assert_local_api = function () {
  * The authenticated happy-path test lives with the Phase 2 endpoint change — it cannot exist here
  * because the POST route does not yet exist, and a test that fails for "not implemented" would muddy
  * the vulnerability proof.
+ *
+ * 127.0.0.1 only means "the machine running this test" when the API is also local. Against staging or
+ * prod it is the API server itself — the sentinel below would never be contacted and every check here
+ * would pass for the wrong reason. So a non-local API_URL records ONE FAILING check and returns: this
+ * suite goes deliberately red rather than skipping, because a skipped SSRF proof rots silently. It
+ * must not throw: a throw propagates out of run_isolated_in_parallel and aborts every remaining batch.
  */
-var proxy_image_ssrf_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var SENTINEL, sentinelHits, sentinel, sentinelPort, sentinelURL_1, call_unauthenticated, call_authenticated_1;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    (0, testing_1.log_header)("proxy-image unauthenticated SSRF");
-                    assert_local_api();
-                    SENTINEL = "f0025-sentinel-".concat(Date.now(), "-").concat(Math.random().toString(36).slice(2));
-                    sentinelHits = 0;
-                    sentinel = http_1.default.createServer(function (_, res) {
-                        sentinelHits++;
-                        res.writeHead(200, { 'content-type': 'application/json' });
-                        res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }));
+var proxy_image_ssrf_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, hostname, SENTINEL, sentinelHits, sentinel, expect_result, tenant, sdk_1, sentinelPort, sentinelURL_1, call_unauthenticated, call_authenticated_1, e_1;
+    return __generator(this, function (_a) {
+        switch (_a.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                hostname = new URL(host).hostname;
+                if (!LOCAL_HOSTNAMES.includes(hostname)) {
+                    record('SSRF proof runs against a local API', false, "API_URL is ".concat(host, ", which is not local. 127.0.0.1 would resolve to the API server rather than ")
+                        + "this machine, so the sentinel could never be contacted and every check below would pass for "
+                        + "the wrong reason. Re-run against a local API; this suite is red, not skipped, on purpose.");
+                    return [2 /*return*/, checks];
+                }
+                SENTINEL = "f0025-sentinel-".concat(Date.now(), "-").concat(Math.random().toString(36).slice(2));
+                sentinelHits = 0;
+                sentinel = http_1.default.createServer(function (_, res) {
+                    sentinelHits++;
+                    res.writeHead(200, { 'content-type': 'application/json' });
+                    res.end(JSON.stringify({ sentinel: SENTINEL, credentials: 'internal-only' }));
+                });
+                expect_result = function (label, fn, onResult) { return __awaiter(void 0, void 0, void 0, function () {
+                    var result, stringified, e_2, message;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                _a.trys.push([0, 2, , 3]);
+                                return [4 /*yield*/, fn()
+                                    // The raw value decides the fallback, not JSON.stringify of it.
+                                ];
+                            case 1:
+                                result = _a.sent();
+                                stringified = JSON.stringify(result);
+                                record(label, onResult(result), "result=".concat(stringified === undefined ? String(result) : stringified));
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _a.sent();
+                                message = typeof (e_2 === null || e_2 === void 0 ? void 0 : e_2.message) === 'string' && e_2.message !== ''
+                                    ? e_2.message
+                                    : (e_2 === undefined || e_2 === null ? String(e_2) : JSON.stringify(e_2));
+                                record(label, false, "rejected instead of resolving: ".concat(message));
+                                return [3 /*break*/, 3];
+                            case 3: return [2 /*return*/];
+                        }
                     });
-                    _b.label = 1;
-                case 1:
-                    _b.trys.push([1, , 9, 10]);
-                    return [4 /*yield*/, new Promise(function (resolve) { return sentinel.listen(0, '127.0.0.1', function () { return resolve(); }); })];
-                case 2:
-                    _b.sent();
-                    sentinelPort = sentinel.address().port;
-                    sentinelURL_1 = "http://127.0.0.1:".concat(sentinelPort, "/latest/meta-data/iam/security-credentials/");
-                    call_unauthenticated = function () { return __awaiter(void 0, void 0, void 0, function () {
-                        var res, body;
-                        var _a;
-                        return __generator(this, function (_b) {
-                            switch (_b.label) {
-                                case 0:
-                                    sentinelHits = 0;
-                                    return [4 /*yield*/, axios_1.default.get("".concat(host, "/v1/proxy-image"), {
-                                            params: { url: sentinelURL_1 },
-                                            validateStatus: function () { return true; },
-                                            responseType: 'text',
-                                            transformResponse: [function (d) { return d; }],
-                                            timeout: 10000,
-                                        })];
-                                case 1:
-                                    res = _b.sent();
-                                    body = typeof res.data === 'string' ? res.data : JSON.stringify((_a = res.data) !== null && _a !== void 0 ? _a : '');
-                                    return [2 /*return*/, { status: res.status, leaked: body.includes(SENTINEL), sentinelHits: sentinelHits }];
-                            }
-                        });
-                    }); };
-                    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
-                    return [4 /*yield*/, (0, testing_1.async_test)('proxy-image does not stream an internal non-image resource to an unauthenticated caller', call_unauthenticated, {
-                            // Positive control: a numeric status proves we actually reached our API rather than failing to
-                            // connect (a connection error would make "nothing leaked" true for the wrong reason).
-                            onResult: function (r) { return (typeof r.status === 'number'
-                                && r.leaked === false
-                                && r.sentinelHits === 0); },
-                        })
-                        // T2 — the unauthenticated surface itself: the request must be refused outright, and the
-                        // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
-                    ];
-                case 3:
-                    // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
-                    _b.sent();
-                    // T2 — the unauthenticated surface itself: the request must be refused outright, and the
-                    // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
-                    return [4 /*yield*/, (0, testing_1.async_test)('proxy-image refuses an unauthenticated request without contacting the destination', call_unauthenticated, { onResult: function (r) { return r.status >= 400 && r.status < 500 && r.sentinelHits === 0; } })
-                        // Authenticating is not enough on its own — a staff session must not be able to reach an internal
-                        // address either. These use the real session, and are deterministic (no external network).
-                    ];
-                case 4:
+                }); };
+                _a.label = 1;
+            case 1:
+                _a.trys.push([1, , 10, 15]);
+                return [4 /*yield*/, (0, setup_isolated_1.setup_isolated_tenant)({
+                        name: "Proxy-image unauthenticated SSRF ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _a.sent();
+                sdk_1 = tenant.sdk;
+                return [4 /*yield*/, new Promise(function (resolve) { return sentinel.listen(0, '127.0.0.1', function () { return resolve(); }); })];
+            case 3:
+                _a.sent();
+                sentinelPort = sentinel.address().port;
+                sentinelURL_1 = "http://127.0.0.1:".concat(sentinelPort, "/latest/meta-data/iam/security-credentials/");
+                call_unauthenticated = function () { return __awaiter(void 0, void 0, void 0, function () {
+                    var res, body;
+                    var _a;
+                    return __generator(this, function (_b) {
+                        switch (_b.label) {
+                            case 0:
+                                sentinelHits = 0;
+                                return [4 /*yield*/, axios_1.default.get("".concat(host, "/v1/proxy-image"), {
+                                        params: { url: sentinelURL_1 },
+                                        validateStatus: function () { return true; },
+                                        responseType: 'text',
+                                        transformResponse: [function (d) { return d; }],
+                                        timeout: 10000,
+                                    })];
+                            case 1:
+                                res = _b.sent();
+                                body = typeof res.data === 'string' ? res.data : JSON.stringify((_a = res.data) !== null && _a !== void 0 ? _a : '');
+                                return [2 /*return*/, { status: res.status, leaked: body.includes(SENTINEL), sentinelHits: sentinelHits }];
+                        }
+                    });
+                }); };
+                // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+                return [4 /*yield*/, expect_result('proxy-image does not stream an internal non-image resource to an unauthenticated caller', call_unauthenticated, 
+                    // Positive control: a numeric status proves we actually reached our API rather than failing to
+                    // connect (a connection error would make "nothing leaked" true for the wrong reason).
+                    function (r) { return (typeof r.status === 'number'
+                        && r.leaked === false
+                        && r.sentinelHits === 0); })
                     // T2 — the unauthenticated surface itself: the request must be refused outright, and the
                     // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
-                    _b.sent();
-                    call_authenticated_1 = function (url) { return __awaiter(void 0, void 0, void 0, function () {
-                        var res;
-                        return __generator(this, function (_a) {
-                            switch (_a.label) {
-                                case 0:
-                                    sentinelHits = 0;
-                                    return [4 /*yield*/, axios_1.default.post("".concat(host, "/v1/proxy-image"), { url: url }, {
-                                            headers: { Authorization: "Bearer ".concat(sdk.authToken) },
-                                            validateStatus: function () { return true; },
-                                            timeout: 10000,
-                                        })];
-                                case 1:
-                                    res = _a.sent();
-                                    return [2 /*return*/, { status: res.status, sentinelHits: sentinelHits }];
-                            }
-                        });
-                    }); };
-                    return [4 /*yield*/, (0, testing_1.async_test)('proxy-image refuses a private destination even for an authenticated staff session', function () { return call_authenticated_1(sentinelURL_1); }, { onResult: function (r) { return r.status === 400 && r.sentinelHits === 0; } })];
-                case 5:
-                    _b.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)('proxy-image refuses cloud metadata for an authenticated staff session', function () { return call_authenticated_1('https://169.254.169.254/latest/meta-data/'); }, { onResult: function (r) { return r.status === 400; } })
-                        // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
-                    ];
-                case 6:
-                    _b.sent();
-                    // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
-                    return [4 /*yield*/, (0, testing_1.async_test)('proxy-image refuses a plain http destination', function () { return call_authenticated_1('http://example.com/logo.png'); }, { onResult: function (r) { return r.status === 400; } })];
-                case 7:
+                ];
+            case 4:
+                // T1 — the core SSRF: an unauthenticated caller must not be able to read an internal resource.
+                _a.sent();
+                // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                return [4 /*yield*/, expect_result('proxy-image refuses an unauthenticated request without contacting the destination', call_unauthenticated, 
+                    // 429 is excluded explicitly: this suite now runs inside the 8-wide isolated pool, where a
+                    // shared per-IP throttle could return one and satisfy "some 4xx" without the auth gate ever
+                    // having fired. Any other 4xx (401 on the authenticated shape, 404/405 on the retired GET)
+                    // is still accepted, as the comment above describes.
+                    function (r) { return r.status >= 400 && r.status < 500 && r.status !== 429 && r.sentinelHits === 0; })
+                    // Authenticating is not enough on its own — a staff session must not be able to reach an internal
+                    // address either. These use the real session, and are deterministic (no external network).
+                ];
+            case 5:
+                // T2 — the unauthenticated surface itself: the request must be refused outright, and the
+                // destination must never be contacted (no SSRF-as-a-side-effect even when the body is withheld).
+                _a.sent();
+                call_authenticated_1 = function (url) { return __awaiter(void 0, void 0, void 0, function () {
+                    var res;
+                    return __generator(this, function (_a) {
+                        switch (_a.label) {
+                            case 0:
+                                sentinelHits = 0;
+                                return [4 /*yield*/, axios_1.default.post("".concat(host, "/v1/proxy-image"), { url: url }, {
+                                        headers: { Authorization: "Bearer ".concat(sdk_1.authToken) },
+                                        validateStatus: function () { return true; },
+                                        timeout: 10000,
+                                    })];
+                            case 1:
+                                res = _a.sent();
+                                return [2 /*return*/, { status: res.status, sentinelHits: sentinelHits }];
+                        }
+                    });
+                }); };
+                return [4 /*yield*/, expect_result('proxy-image refuses a private destination even for an authenticated staff session', function () { return call_authenticated_1(sentinelURL_1); }, function (r) { return r.status === 400 && r.sentinelHits === 0; })];
+            case 6:
+                _a.sent();
+                return [4 /*yield*/, expect_result('proxy-image refuses cloud metadata for an authenticated staff session', function () { return call_authenticated_1('https://169.254.169.254/latest/meta-data/'); }, function (r) { return r.status === 400; })
                     // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
-                    _b.sent();
-                    return [4 /*yield*/, (0, testing_1.async_test)('proxy-image refuses a non-443 port', function () { return call_authenticated_1('https://example.com:8443/logo.png'); }, { onResult: function (r) { return r.status === 400; } })];
-                case 8:
-                    _b.sent();
-                    return [3 /*break*/, 10];
-                case 9:
-                    sentinel.close();
-                    return [7 /*endfinally*/];
-                case 10: return [2 /*return*/];
-            }
-        });
+                ];
+            case 7:
+                _a.sent();
+                // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                return [4 /*yield*/, expect_result('proxy-image refuses a plain http destination', function () { return call_authenticated_1('http://example.com/logo.png'); }, function (r) { return r.status === 400; })];
+            case 8:
+                // Scheme and port are pinned: only https on 443, which is all the PDF export ever needs.
+                _a.sent();
+                return [4 /*yield*/, expect_result('proxy-image refuses a non-443 port', function () { return call_authenticated_1('https://example.com:8443/logo.png'); }, function (r) { return r.status === 400; })];
+            case 9:
+                _a.sent();
+                return [3 /*break*/, 15];
+            case 10:
+                sentinel.close();
+                if (!tenant) return [3 /*break*/, 14];
+                _a.label = 11;
+            case 11:
+                _a.trys.push([11, 13, , 14]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 12:
+                _a.sent();
+                return [3 /*break*/, 14];
+            case 13:
+                e_1 = _a.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 14];
+            case 14: return [7 /*endfinally*/];
+            case 15: return [2 /*return*/, checks];
+        }
     });
-};
+}); };
+exports.proxy_image_ssrf_checks = proxy_image_ssrf_checks;
+/** Asserting wrapper, for standalone runs. */
+var proxy_image_ssrf_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = setup_isolated_1.assert_checks;
+                _b = ['Proxy-image unauthenticated SSRF'];
+                return [4 /*yield*/, (0, exports.proxy_image_ssrf_checks)()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
 exports.proxy_image_ssrf_tests = proxy_image_ssrf_tests;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+exports.ISOLATED_SUITE = {
+    name: 'Proxy-image unauthenticated SSRF',
+    run: exports.proxy_image_ssrf_checks,
+};
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_2 = new sdk_1.Session({ host: host });
-    var sdkNonAdmin_1 = new sdk_1.Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, (0, setup_1.setup_tests)(sdk_2, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, (0, exports.proxy_image_ssrf_tests)({ sdk: sdk_2, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    (0, exports.proxy_image_ssrf_tests)()
         .then(function () {
         console.log("✅ proxy-image SSRF test suite completed successfully");
         process.exit(0);

package/lib/cjs/tests/api_tests/security/proxy-image-unauth-ssrf.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy-image-unauth-ssrf.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,8CAAuB;AACvB,gDAAyB;AACzB,oCAAsC;AACtC,+CAG4B;AAC5B,qCAAyC;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEzD;;;;GAIG;AACH,IAAM,gBAAgB,GAAG;IACvB,IAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAA;IACvC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACvC,MAAM,IAAI,KAAK,CACb,uDAAgD,IAAI,QAAK;cACvD,wGAAwG,CAC3G,CAAA;KACF;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACI,IAAM,sBAAsB,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAChD,IAAA,oBAAU,EAAC,kCAAkC,CAAC,CAAA;oBAC9C,gBAAgB,EAAE,CAAA;oBAEZ,QAAQ,GAAG,yBAAkB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;oBAClF,YAAY,GAAG,CAAC,CAAA;oBAId,QAAQ,GAAG,cAAI,CAAC,YAAY,CAAC,UAAC,CAAC,EAAE,GAAG;wBACxC,YAAY,EAAE,CAAA;wBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;wBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;oBAC/E,CAAC,CAAC,CAAA;;;;oBAGA,qBAAM,IAAI,OAAO,CAAO,UAAA,OAAO,IAAI,OAAA,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAM,OAAA,OAAO,EAAE,EAAT,CAAS,CAAC,EAAhD,CAAgD,CAAC,EAAA;;oBAApF,SAAoF,CAAA;oBAC9E,YAAY,GAAI,QAAQ,CAAC,OAAO,EAAU,CAAC,IAAI,CAAA;oBAC/C,gBAAc,2BAAoB,YAAY,gDAA6C,CAAA;oBAI3F,oBAAoB,GAAG;;;;;;oCAC3B,YAAY,GAAG,CAAC,CAAA;oCACJ,qBAAM,eAAK,CAAC,GAAG,CAAC,UAAG,IAAI,oBAAiB,EAAE;4CACpD,MAAM,EAAE,EAAE,GAAG,EAAE,aAAW,EAAE;4CAC5B,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4CAC1B,YAAY,EAAE,MAAM;4CACpB,iBAAiB,EAAE,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAD,CAAC,CAAC;4CAClC,OAAO,EAAE,KAAM;yCACT,CAAC,EAAA;;oCANH,GAAG,GAAG,SAMH;oCAEH,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;oCACrF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,cAAA,EAAE,EAAA;;;yBAC7E,CAAA;oBAED,+FAA+F;oBAC/F,qBAAM,IAAA,oBAAU,EACd,yFAAyF,EACzF,oBAAoB,EACpB;4BACE,+FAA+F;4BAC/F,sFAAsF;4BACtF,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CACpB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;mCACzB,CAAC,CAAC,MAAM,KAAK,KAAK;mCAClB,CAAC,CAAC,YAAY,KAAK,CAAC,CACxB,EAJqB,CAIrB;yBACF,CACF;wBAED,yFAAyF;wBACzF,iGAAiG;sBAHhG;;oBAbD,+FAA+F;oBAC/F,SAYC,CAAA;oBAED,yFAAyF;oBACzF,iGAAiG;oBACjG,qBAAM,IAAA,oBAAU,EACd,mFAAmF,EACnF,oBAAoB,EACpB,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAzD,CAAyD,EAAE,CACpF;wBAED,kGAAkG;wBAClG,2FAA2F;sBAH1F;;oBAND,yFAAyF;oBACzF,iGAAiG;oBACjG,SAIC,CAAA;oBAIK,uBAAqB,UAAO,GAAW;;;;;oCAC3C,YAAY,GAAG,CAAC,CAAA;oCACJ,qBAAM,eAAK,CAAC,IAAI,CAAC,UAAG,IAAI,oBAAiB,EAAE,EAAE,GAAG,KAAA,EAAE,EAAE;4CAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,GAAG,CAAC,SAAS,CAAE,EAAE;4CACrD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;4CAC1B,OAAO,EAAE,KAAM;yCACT,CAAC,EAAA;;oCAJH,GAAG,GAAG,SAIH;oCACT,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,cAAA,EAAE,EAAA;;;yBAC5C,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,mFAAmF,EACnF,cAAM,OAAA,oBAAkB,CAAC,aAAW,CAAC,EAA/B,CAA+B,EACrC,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAxC,CAAwC,EAAE,CACnE,EAAA;;oBAJD,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,uEAAuE,EACvE,cAAM,OAAA,oBAAkB,CAAC,2CAA2C,CAAC,EAA/D,CAA+D,EACrE,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C;wBAED,yFAAyF;sBAFxF;;oBAJD,SAIC,CAAA;oBAED,yFAAyF;oBACzF,qBAAM,IAAA,oBAAU,EACd,8CAA8C,EAC9C,cAAM,OAAA,oBAAkB,CAAC,6BAA6B,CAAC,EAAjD,CAAiD,EACvD,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C,EAAA;;oBALD,yFAAyF;oBACzF,SAIC,CAAA;oBAED,qBAAM,IAAA,oBAAU,EACd,oCAAoC,EACpC,cAAM,OAAA,oBAAkB,CAAC,mCAAmC,CAAC,EAAvD,CAAuD,EAC7D,EAAE,QAAQ,EAAE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,EAAE,CAC3C,EAAA;;oBAJD,SAIC,CAAA;;;oBAED,QAAQ,CAAC,KAAK,EAAE,CAAA;;;;;;CAEnB,CAAA;AAlGY,QAAA,sBAAsB,0BAkGlC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,aAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,IAAA,mBAAW,EAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,IAAA,8BAAsB,EAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAAlD,SAAkD,CAAA;;;;SACnD,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAA;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"proxy-image-unauth-ssrf.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/proxy-image-unauth-ssrf.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,8CAAuB;AACvB,gDAAyB;AACzB,uDAK6B;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAgC,CAAA;AAEpE,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,eAAe,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACI,IAAM,uBAAuB,GAAG;;;;;gBAC/B,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAI/F,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAA;gBACvC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;oBACvC,MAAM,CACJ,qCAAqC,EACrC,KAAK,EACL,qBAAc,IAAI,iFAA8E;0BAC9F,8FAA8F;0BAC9F,2FAA2F,CAC9F,CAAA;oBACD,sBAAO,MAAM,EAAA;iBACd;gBAEK,QAAQ,GAAG,yBAAkB,IAAI,CAAC,GAAG,EAAE,cAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,CAAA;gBAClF,YAAY,GAAG,CAAC,CAAA;gBAId,QAAQ,GAAG,cAAI,CAAC,YAAY,CAAC,UAAC,CAAC,EAAE,GAAG;oBACxC,YAAY,EAAE,CAAA;oBACd,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAA;oBAC1D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAA;gBAC/E,CAAC,CAAC,CAAA;gBAMI,aAAa,GAAG,UAAW,KAAa,EAAE,EAAoB,EAAE,QAA2B;;;;;;gCAE9E,qBAAM,EAAE,EAAE;oCACzB,gEAAgE;kCADvC;;gCAAnB,MAAM,GAAG,SAAU;gCAEnB,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gCAC1C,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAU,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAE,CAAC,CAAA;;;;gCAE/F,OAAO,GAAG,OAAO,CAAA,GAAC,aAAD,GAAC,uBAAD,GAAC,CAAE,OAAO,CAAA,KAAK,QAAQ,IAAI,GAAC,CAAC,OAAO,KAAK,EAAE;oCAChE,CAAC,CAAC,GAAC,CAAC,OAAO;oCACX,CAAC,CAAC,CAAC,GAAC,KAAK,SAAS,IAAI,GAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAC,CAAC,CAAC,CAAA;gCACnE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,yCAAkC,OAAO,CAAE,CAAC,CAAA;;;;;qBAEpE,CAAA;;;;gBAKU,qBAAM,IAAA,sCAAqB,EAAC;wBACnC,IAAI,EAAE,2CAAoC,IAAI,EAAE,CAAE;wBAClD,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;wBAC1B,OAAO,EAAE,CAAC;qBACX,CAAC,EAAA;;gBAJF,MAAM,GAAG,SAIP,CAAA;gBACM,QAAQ,MAAM,IAAX,CAAW;gBAEtB,qBAAM,IAAI,OAAO,CAAO,UAAA,OAAO,IAAI,OAAA,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,cAAM,OAAA,OAAO,EAAE,EAAT,CAAS,CAAC,EAAhD,CAAgD,CAAC,EAAA;;gBAApF,SAAoF,CAAA;gBAC9E,YAAY,GAAI,QAAQ,CAAC,OAAO,EAAU,CAAC,IAAI,CAAA;gBAC/C,gBAAc,2BAAoB,YAAY,gDAA6C,CAAA;gBAI3F,oBAAoB,GAAG;;;;;;gCAC3B,YAAY,GAAG,CAAC,CAAA;gCACJ,qBAAM,eAAK,CAAC,GAAG,CAAC,UAAG,IAAI,oBAAiB,EAAE;wCACpD,MAAM,EAAE,EAAE,GAAG,EAAE,aAAW,EAAE;wCAC5B,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;wCAC1B,YAAY,EAAE,MAAM;wCACpB,iBAAiB,EAAE,CAAC,UAAC,CAAM,IAAK,OAAA,CAAC,EAAD,CAAC,CAAC;wCAClC,OAAO,EAAE,KAAM;qCACT,CAAC,EAAA;;gCANH,GAAG,GAAG,SAMH;gCAEH,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAA,GAAG,CAAC,IAAI,mCAAI,EAAE,CAAC,CAAA;gCACrF,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,cAAA,EAAE,EAAA;;;qBAC7E,CAAA;gBAED,+FAA+F;gBAC/F,qBAAM,aAAa,CACjB,yFAAyF,EACzF,oBAAoB;oBACpB,+FAA+F;oBAC/F,sFAAsF;oBACtF,UAAC,CAAM,IAAK,OAAA,CACV,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;2BACzB,CAAC,CAAC,MAAM,KAAK,KAAK;2BAClB,CAAC,CAAC,YAAY,KAAK,CAAC,CACxB,EAJW,CAIX,CACF;oBAED,yFAAyF;oBACzF,iGAAiG;kBAHhG;;gBAXD,+FAA+F;gBAC/F,SAUC,CAAA;gBAED,yFAAyF;gBACzF,iGAAiG;gBACjG,qBAAM,aAAa,CACjB,mFAAmF,EACnF,oBAAoB;oBACpB,2FAA2F;oBAC3F,4FAA4F;oBAC5F,2FAA2F;oBAC3F,qDAAqD;oBACrD,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAA7E,CAA6E,CAC1F;oBAED,kGAAkG;oBAClG,2FAA2F;kBAH1F;;gBAVD,yFAAyF;gBACzF,iGAAiG;gBACjG,SAQC,CAAA;gBAIK,uBAAqB,UAAO,GAAW;;;;;gCAC3C,YAAY,GAAG,CAAC,CAAA;gCACJ,qBAAM,eAAK,CAAC,IAAI,CAAC,UAAG,IAAI,oBAAiB,EAAE,EAAE,GAAG,KAAA,EAAE,EAAE;wCAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAU,KAAG,CAAC,SAAS,CAAE,EAAE;wCACrD,cAAc,EAAE,cAAM,OAAA,IAAI,EAAJ,CAAI;wCAC1B,OAAO,EAAE,KAAM;qCACT,CAAC,EAAA;;gCAJH,GAAG,GAAG,SAIH;gCACT,sBAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,cAAA,EAAE,EAAA;;;qBAC5C,CAAA;gBAED,qBAAM,aAAa,CACjB,mFAAmF,EACnF,cAAM,OAAA,oBAAkB,CAAC,aAAW,CAAC,EAA/B,CAA+B,EACrC,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,EAAxC,CAAwC,CACrD,EAAA;;gBAJD,SAIC,CAAA;gBAED,qBAAM,aAAa,CACjB,uEAAuE,EACvE,cAAM,OAAA,oBAAkB,CAAC,2CAA2C,CAAC,EAA/D,CAA+D,EACrE,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,CAC7B;oBAED,yFAAyF;kBAFxF;;gBAJD,SAIC,CAAA;gBAED,yFAAyF;gBACzF,qBAAM,aAAa,CACjB,8CAA8C,EAC9C,cAAM,OAAA,oBAAkB,CAAC,6BAA6B,CAAC,EAAjD,CAAiD,EACvD,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,CAC7B,EAAA;;gBALD,yFAAyF;gBACzF,SAIC,CAAA;gBAED,qBAAM,aAAa,CACjB,oCAAoC,EACpC,cAAM,OAAA,oBAAkB,CAAC,mCAAmC,CAAC,EAAvD,CAAuD,EAC7D,UAAC,CAAM,IAAK,OAAA,CAAC,CAAC,MAAM,KAAK,GAAG,EAAhB,CAAgB,CAC7B,EAAA;;gBAJD,SAIC,CAAA;;;gBAED,QAAQ,CAAC,KAAK,EAAE,CAAA;qBAEZ,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAG/F,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAjJY,QAAA,uBAAuB,2BAiJnC;AAED,8CAA8C;AACvC,IAAM,sBAAsB,GAAG;;;;;gBACpC,KAAA,8BAAa,CAAA;sBAAC,kCAAkC;gBAAE,qBAAM,IAAA,+BAAuB,GAAE,EAAA;;gBAAjF,4BAAkD,SAA+B,GAAC,CAAA;;;;KACnF,CAAA;AAFY,QAAA,sBAAsB,0BAElC;AAED,oGAAoG;AACvF,QAAA,cAAc,GAAkB;IAC3C,IAAI,EAAE,kCAAkC;IACxC,GAAG,EAAE,+BAAuB;CAC7B,CAAA;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAA,8BAAsB,GAAE;SACrB,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAA;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.d.ts

@@ -1,4 +1,4 @@
-import { Session } from "../../../sdk";
+import { Check, IsolatedSuite } from "../../setup_isolated";
 /**
  * Reproduction + regression test for the reported vulnerability:
  *
@@ -12,25 +12,27 @@ import { Session } from "../../../sdk";
  * caller-supplied businessId onto a new `accountType: 'Business'` user — bypassing the
  * globalUnique: ['email'] enforcement that only runs in the generic create route.
  *
- * The "victim org" here is the test admin's own org (sdk.userInfo.businessId): an org the
- * anonymous caller was never invited to. The admin is used purely to OBSERVE whether an
- * uninvited user record materialized inside their org (getOne({ email }) is org-scoped and
- * throws when the email is absent from the caller's tenant).
+ * The "victim org" is this suite's OWN provisioned tenant (tenant.businessId): an org the
+ * anonymous caller was never invited to. Its admin is used purely to OBSERVE whether an uninvited
+ * user record materialized inside the org (getOne({ email }) is org-scoped and throws when the
+ * email is absent from the caller's tenant). Running on a throwaway tenant rather than the shared
+ * fixture means a failing (vulnerable) run plants its user in an org that is then torn down.
  *
  * Expected results:
- *   - VULNERABLE code: the assertions FAIL — the planted user appears inside the victim org,
- *     proving the exploit ("EXPLOIT CONFIRMED" in the failure message).
+ *   - VULNERABLE code: the checks FAIL — the planted user appears inside the victim org,
+ *     proving the exploit ("EXPLOIT CONFIRMED" in the failure detail).
  *   - FIXED code: register ignores the caller-supplied businessId (self-signups are created
  *     org-less and duplicates are rejected globally), so nothing appears in the victim org and
- *     the assertions PASS.
+ *     the checks PASS.
  *
- * Uses unique emails per run (Date.now()) so re-runs never collide on the platform-wide unique
- * email constraint. NOTE: on the FIXED path these registrations create org-less user records
- * that an org-scoped admin cannot delete — harmless residue (unique emails), inherent to the
- * legitimate "root register, no org" signup behavior.
+ * Uses unique emails per run so re-runs never collide on the platform-wide unique email
+ * constraint. NOTE: on the FIXED path these registrations create org-less user records that
+ * neither an org-scoped admin nor the tenant teardown (which deletes by businessId) can remove —
+ * harmless residue (unique emails), inherent to the legitimate "root register, no org" signup.
  */
-export declare const register_business_id_injection_tests: ({ sdk }: {
-    sdk: Session;
-    sdkNonAdmin: Session;
-}) => Promise<void>;
+export declare const register_business_id_injection_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs. */
+export declare const register_business_id_injection_tests: () => Promise<void>;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export declare const ISOLATED_SUITE: IsolatedSuite;
 //# sourceMappingURL=register_business_id_injection.test.d.ts.map

package/lib/cjs/tests/api_tests/security/register_business_id_injection.test.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register_business_id_injection.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/register_business_id_injection.test.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAsBtC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,oCAAoC;SAA2B,OAAO;iBAAe,OAAO;mBA+DxG,CAAA"}
+{"version":3,"file":"register_business_id_injection.test.d.ts","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/register_business_id_injection.test.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,EACL,aAAa,EAEd,MAAM,sBAAsB,CAAA;AA6B7B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,qCAAqC,QAAa,QAAQ,KAAK,EAAE,CAoF7E,CAAA;AAED,8CAA8C;AAC9C,eAAO,MAAM,oCAAoC,qBAEhD,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,cAAc,EAAE,aAG5B,CAAA"}