tapimo 0.5.3 → 0.6.0

package/src/apps/management/routes/webhooks.test.ts

@@ -0,0 +1,426 @@
+import { generatePrivateKey, privateKeyToAccount } from 'viem/accounts'
+
+import * as App from '../../../App.js'
+import * as Memberships from '../../../db/tables/memberships.js'
+import * as core_Webhooks from '../../../internal/Webhooks.js'
+import * as TestApp from '../../../../test/App.js'
+import { management } from '../App.js'
+import * as Orgs from './orgs.js'
+import * as Webhooks from './webhooks.js'
+
+const origin = 'http://localhost'
+const webhook = { supportedChainIds: [4217, 42431] } satisfies App.Webhook
+
+function json(method: 'PATCH' | 'POST', cookie: string, body: unknown) {
+  return {
+    body: JSON.stringify(body),
+    headers: { 'content-type': 'application/json', cookie },
+    method,
+  }
+}
+
+function createApp(options: createApp.Options = {}) {
+  return App.create({
+    auth: { session: { wallet: { origin } } },
+    db: options.db ?? TestApp.database(),
+    kv: { store: TestApp.kvStore() },
+  }).route('/', management({ webhook: options.webhook ?? webhook }))
+}
+
+declare namespace createApp {
+  type Options = {
+    db?: App.create.Options['db'] | undefined
+    webhook?: App.Webhook | false | undefined
+  }
+}
+
+async function session(app: TestApp.signIn.App) {
+  const account = privateKeyToAccount(generatePrivateKey())
+  const { cookie } = await TestApp.signIn(app, account)
+  return cookie!
+}
+
+async function organization(app: ReturnType<typeof createApp>, cookie: string) {
+  const response = await app.request('/v1/orgs', json('POST', cookie, { name: 'Acme' }))
+  return TestApp.json(response, Orgs.schema.Organization)
+}
+
+describe('webhooks', () => {
+  test('creates, lists, pauses, and deletes an organization webhook', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const collection = `/v1/orgs/${org.id}/webhooks`
+
+    const createdResponse = await app.request(
+      collection,
+      json('POST', cookie, {
+        chainId: 4217,
+        context: { title: 'Payments' },
+        destination: { type: 'url', url: 'https://example.com/webhooks' },
+        eventType: 'token:transfer',
+        filters: {},
+      }),
+    )
+    expect(createdResponse.status).toBe(200)
+    const created = await TestApp.json(createdResponse, Webhooks.schema.createWebhook.Response)
+    expect(created).toHaveProperty('secret', expect.stringMatching(/^whsec_/))
+
+    const listedResponse = await app.request(collection, { headers: { cookie } })
+    expect(listedResponse.status).toBe(200)
+    const listed = await TestApp.json(listedResponse, Webhooks.schema.ListResponse)
+    expect(listed.data).toMatchObject([
+      {
+        context: { title: 'Payments' },
+        id: created.id,
+        status: 'active',
+      },
+    ])
+
+    const item = `${collection}/${created.id}`
+    const pausedResponse = await app.request(item, json('PATCH', cookie, { status: 'paused' }))
+    expect(pausedResponse.status).toBe(200)
+    expect((await TestApp.json(pausedResponse, Webhooks.schema.Subscription)).status).toBe('paused')
+
+    const deletedResponse = await app.request(item, {
+      headers: { cookie },
+      method: 'DELETE',
+    })
+    expect(deletedResponse.status).toBe(200)
+    expect(await TestApp.json(deletedResponse, Webhooks.schema.DeleteResponse)).toEqual({
+      id: created.id,
+    })
+
+    const empty = await TestApp.json(
+      await app.request(collection, { headers: { cookie } }),
+      Webhooks.schema.ListResponse,
+    )
+    expect(empty.data).toEqual([])
+  })
+
+  test('lists paginated delivery history with destination credentials redacted', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const subscription = await core_Webhooks.createSubscription(db, {
+      chainId: 4217,
+      destination: {
+        type: 'url',
+        url: 'https://example.com/hooks/capability?token=secret#fragment',
+      },
+      eventType: 'token:transfer',
+      owner: { orgId: org.id, type: 'api_key' },
+    })
+    for (let attempt = 1; attempt <= 6; attempt++) {
+      const createdAt = new Date(1_700_000_000_000 + attempt * 1_000).toISOString()
+      await core_Webhooks.recordDelivery(db, {
+        attempt,
+        createdAt,
+        envelope: {
+          chainId: 4217,
+          createdAt,
+          data: {
+            address: '0x20c0000000000000000000008f5425160ebe5525',
+            amount: String(attempt),
+            blockNumber: attempt,
+            recipient: '0x9e39034aae71fb89f66061a2602eb6efec271754',
+            sender: '0xe7687128b0a808c2831ff94d4f7b2fb35c65af38',
+            timestamp: createdAt,
+            transactionHash: `0x${attempt.toString(16).padStart(64, '0')}`,
+          },
+          id: `evt_${attempt}`,
+          subscriptionId: subscription.id,
+          type: 'token:transfer',
+        },
+        eventId: `evt_${attempt}`,
+        id: `whd_${String(1_700_000_000_000 + attempt * 1_000).padStart(15, '0')}_${'0'.repeat(16)}`,
+        requestUrl: subscription.destination.url,
+        responseMs: attempt,
+        responseStatus: 200,
+        status: 'succeeded',
+        subscriptionId: subscription.id,
+      })
+    }
+
+    const path = `/v1/orgs/${org.id}/webhooks/${subscription.id}/deliveries?limit=5`
+    const response = await app.request(path, { headers: { cookie } })
+    expect(response.status).toBe(200)
+    const body = await TestApp.json(response, Webhooks.schema.listWebhookDeliveries.Response)
+    expect(body.data.map((delivery) => delivery.eventId)).toEqual([
+      'evt_6',
+      'evt_5',
+      'evt_4',
+      'evt_3',
+      'evt_2',
+    ])
+    expect(body.nextCursor).toBeTruthy()
+    expect(body.data[0]?.requestUrl).toBe('https://example.com/…')
+    expect(JSON.stringify(body)).not.toContain('capability')
+    expect(JSON.stringify(body)).not.toContain('token=secret')
+    expect(JSON.stringify(body)).not.toContain('amount')
+
+    const detailResponse = await app.request(`${path.split('?')[0]}/${body.data[0]!.id}`, {
+      headers: { cookie },
+    })
+    expect(detailResponse.status).toBe(200)
+    const detail = await TestApp.json(detailResponse, Webhooks.schema.getWebhookDelivery.Response)
+    expect(detail.envelope).toMatchObject({
+      data: { amount: '6' },
+      id: 'evt_6',
+      subscriptionId: subscription.id,
+      type: 'token:transfer',
+    })
+    expect(detail.requestUrl).toBe('https://example.com/…')
+    expect(JSON.stringify(detail)).not.toContain('capability')
+    expect(JSON.stringify(detail)).not.toContain('token=secret')
+    expect(JSON.stringify(detail)).not.toContain(subscription.secret)
+  })
+
+  test('returns delivery_not_found when loading or replaying an unknown delivery', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const subscription = await core_Webhooks.createSubscription(db, {
+      chainId: 4217,
+      destination: { type: 'url', url: 'https://example.com/webhooks' },
+      eventType: 'token:transfer',
+      owner: { orgId: org.id, type: 'api_key' },
+    })
+
+    const detailResponse = await app.request(
+      `/v1/orgs/${org.id}/webhooks/${subscription.id}/deliveries/whd_missing`,
+      { headers: { cookie } },
+    )
+    expect(detailResponse.status).toBe(404)
+    expect(await detailResponse.json()).toMatchObject({
+      error: { code: 'delivery_not_found' },
+    })
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/webhooks/${subscription.id}/deliveries/whd_missing/retry`,
+      { headers: { cookie }, method: 'POST' },
+    )
+    expect(response.status).toBe(404)
+    expect(await response.json()).toMatchObject({ error: { code: 'delivery_not_found' } })
+  })
+
+  test('hides webhooks behind foreign organizations', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const stranger = await session(app)
+
+    const response = await app.request(`/v1/orgs/${org.id}/webhooks`, {
+      headers: { cookie: stranger },
+    })
+    expect(response.status).toBe(404)
+  })
+
+  test('rejects chains the host does not poll', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const response = await app.request(
+      `/v1/orgs/${org.id}/webhooks`,
+      json('POST', cookie, {
+        chainId: 1,
+        destination: { type: 'url', url: 'https://example.com/webhooks' },
+        eventType: 'token:transfer',
+        filters: {},
+      }),
+    )
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({
+      error: { code: 'chain_id_unsupported' },
+    })
+  })
+
+  test('requires an explicit chain id', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const response = await app.request(
+      `/v1/orgs/${org.id}/webhooks`,
+      json('POST', cookie, {
+        destination: { type: 'url', url: 'https://example.com/webhooks' },
+        eventType: 'token:transfer',
+        filters: {},
+      }),
+    )
+
+    expect(response.status).toBe(400)
+    expect(await response.json()).toMatchObject({ error: { code: 'body_invalid' } })
+  })
+
+  test('redacts managed destination credentials and only returns secrets for URLs', async () => {
+    const app = createApp()
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const collection = `/v1/orgs/${org.id}/webhooks`
+
+    const url = await TestApp.json(
+      await app.request(
+        collection,
+        json('POST', cookie, {
+          chainId: 4217,
+          destination: {
+            type: 'url',
+            url: 'https://example.com/hooks/capability?token=secret#fragment',
+          },
+          eventType: 'token:transfer',
+          filters: {},
+        }),
+      ),
+      Webhooks.schema.createWebhook.Response,
+    )
+    expect(url).toMatchObject({
+      destination: {
+        type: 'url',
+        url: 'https://example.com/hooks/capability?token=secret#fragment',
+      },
+      secret: expect.stringMatching(/^whsec_/),
+    })
+    const listed = await TestApp.json(
+      await app.request(collection, { headers: { cookie } }),
+      Webhooks.schema.ListResponse,
+    )
+    expect(listed.data.find(({ id }) => id === url.id)?.destination).toEqual({
+      type: 'url',
+      url: 'https://example.com/…',
+    })
+    expect(JSON.stringify(listed)).not.toContain('capability')
+    expect(JSON.stringify(listed)).not.toContain('token=secret')
+
+    const slack = await TestApp.json(
+      await app.request(
+        collection,
+        json('POST', cookie, {
+          chainId: 4217,
+          destination: {
+            type: 'slack',
+            url: 'https://hooks.slack.com/services/T000/B000/XXXXXXXX',
+          },
+          eventType: 'token:transfer',
+          filters: {},
+        }),
+      ),
+      Webhooks.schema.createWebhook.Response,
+    )
+    expect(slack).toMatchObject({
+      destination: { type: 'slack', url: 'https://hooks.slack.com/…' },
+    })
+    expect('secret' in slack).toBe(false)
+
+    const betterstack = await TestApp.json(
+      await app.request(
+        collection,
+        json('POST', cookie, {
+          chainId: 4217,
+          destination: {
+            token: 'source-token',
+            type: 'betterstack',
+            url: 'https://s1234567.eu-nbg-2.betterstackdata.com',
+          },
+          eventType: 'token:transfer',
+          filters: {},
+        }),
+      ),
+      Webhooks.schema.createWebhook.Response,
+    )
+    expect(betterstack).toMatchObject({
+      destination: {
+        token: '[redacted]',
+        type: 'betterstack',
+        url: 'https://s1234567.eu-nbg-2.betterstackdata.com',
+      },
+    })
+    expect('secret' in betterstack).toBe(false)
+  })
+
+  test('uses the shared per-owner limit', async () => {
+    const app = createApp({
+      webhook: { maxPerOwner: 1, supportedChainIds: webhook.supportedChainIds },
+    })
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const collection = `/v1/orgs/${org.id}/webhooks`
+    const body = {
+      chainId: 4217,
+      destination: { type: 'url', url: 'https://example.com/webhooks' },
+      eventType: 'token:transfer',
+      filters: {},
+    }
+
+    expect((await app.request(collection, json('POST', cookie, body))).status).toBe(200)
+    const response = await app.request(collection, json('POST', cookie, body))
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'limit_exceeded' } })
+  })
+
+  test('lists every webhook when the creation limit is lowered', async () => {
+    const db = TestApp.database()
+    const app = createApp({
+      db,
+      webhook: { maxPerOwner: 1, supportedChainIds: webhook.supportedChainIds },
+    })
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const input = {
+      chainId: 4217,
+      destination: { type: 'url', url: 'https://example.com/webhooks' } as const,
+      eventType: 'token:transfer' as const,
+      owner: { orgId: org.id, type: 'api_key' as const },
+    }
+    await core_Webhooks.createSubscription(db, input)
+    await core_Webhooks.createSubscription(db, input)
+
+    const response = await app.request(`/v1/orgs/${org.id}/webhooks`, {
+      headers: { cookie },
+    })
+    expect(response.status).toBe(200)
+    expect((await TestApp.json(response, Webhooks.schema.ListResponse)).data).toHaveLength(2)
+  })
+
+  test('keeps management disabled unless the capability is supplied', async () => {
+    const app = createApp({ webhook: false })
+    const cookie = await session(app)
+    const org = await organization(app, cookie)
+    const response = await app.request(`/v1/orgs/${org.id}/webhooks`, {
+      headers: { cookie },
+    })
+
+    expect(response.status).toBe(404)
+    expect(await response.json()).toMatchObject({ error: { code: 'webhooks_not_enabled' } })
+    const spec = (await (await app.request('/openapi.json')).json()) as {
+      paths: Record<string, unknown>
+    }
+    expect(spec.paths[`/v1/orgs/{orgId}/webhooks`]).toBeUndefined()
+  })
+
+  test('requires an admin role for mutations', async () => {
+    const db = TestApp.database()
+    const app = createApp({ db })
+    const ownerCookie = await session(app)
+    const org = await organization(app, ownerCookie)
+    const memberAccount = privateKeyToAccount(generatePrivateKey())
+    const { cookie: memberCookie } = await TestApp.signIn(app, memberAccount)
+    const me = (await (
+      await app.request('/v1/me', { headers: { cookie: memberCookie! } })
+    ).json()) as { id: string }
+    await Memberships.create(db, { orgId: org.id, role: 'member', userId: me.id })
+
+    const response = await app.request(
+      `/v1/orgs/${org.id}/webhooks`,
+      json('POST', memberCookie!, {
+        destination: { type: 'url', url: 'https://example.com/webhooks' },
+        eventType: 'token:transfer',
+        filters: {},
+      }),
+    )
+    expect(response.status).toBe(403)
+    expect(await response.json()).toMatchObject({ error: { code: 'forbidden' } })
+  })
+})