whale-code 6.5.11 → 6.6.0

package/dist/server/handlers/__tests__/e2e/workflow-security.e2e.test.js

@@ -1,311 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { randomUUID } from "node:crypto";
-import { isBlockedUrl } from "../../../lib/ssrf-guard.js";
-import { HAS_TEST_DB, getTestClient, seedTracked, cleanup, RUN_PREFIX } from "../../__test-utils__/test-db.js";
-
-// ============================================================================
-// Real Supabase client
-// ============================================================================
-
-const sb = getTestClient();
-
-// ============================================================================
-// Auth Helpers
-// ============================================================================
-
-let jwtCounter = 0;
-function generateJwt(userId, storeId, expiresInMs = 3600000) {
-  const header = {
-    alg: "HS256",
-    typ: "JWT"
-  };
-  const payload = {
-    sub: userId,
-    store_id: storeId,
-    iat: Date.now(),
-    exp: Date.now() + expiresInMs,
-    jti: `${Date.now()}_${++jwtCounter}`
-  };
-  const b64 = obj => Buffer.from(JSON.stringify(obj)).toString("base64url");
-  return `${b64(header)}.${b64(payload)}.mock_signature`;
-}
-function parseJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    return payload;
-  } catch {
-    return null;
-  }
-}
-async function authenticateRequest(authHeader) {
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Missing or invalid Authorization header",
-      statusCode: 401
-    };
-  }
-  const token = authHeader.slice(7);
-  const payload = parseJwt(token);
-  if (!payload) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Invalid token",
-      statusCode: 401
-    };
-  }
-  if (payload.exp < Date.now()) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Token expired",
-      statusCode: 401
-    };
-  }
-  const {
-    data: user
-  } = await sb.from("platform_users").select().eq("id", payload.sub);
-  if (!user || user.length === 0) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "User not found",
-      statusCode: 401
-    };
-  }
-  return {
-    userId: payload.sub,
-    storeId: payload.store_id,
-    error: null,
-    statusCode: 200
-  };
-}
-
-// ============================================================================
-// Workflow API Handlers (simulated)
-// ============================================================================
-
-/** Validate senderId -- reject injection characters */
-function validateSenderId(senderId) {
-  const INJECTION_PATTERN = /['";\{\}\$\(\)<>\\]/;
-  if (INJECTION_PATTERN.test(senderId)) {
-    return {
-      valid: false,
-      error: "senderId contains invalid characters"
-    };
-  }
-  if (senderId.length > 128) {
-    return {
-      valid: false,
-      error: "senderId exceeds maximum length"
-    };
-  }
-  if (senderId.trim().length === 0) {
-    return {
-      valid: false,
-      error: "senderId cannot be empty"
-    };
-  }
-  return {
-    valid: true
-  };
-}
-
-/** Simulated SSE stream endpoint -- checks store authorization */
-async function requestSSEStream(authHeader, targetStoreId) {
-  const auth = await authenticateRequest(authHeader);
-  if (auth.error) {
-    return {
-      error: auth.error,
-      statusCode: auth.statusCode
-    };
-  }
-  if (auth.storeId !== targetStoreId) {
-    await seedTracked("error_events", [{
-      id: randomUUID(),
-      store_id: targetStoreId,
-      error_type: "sse_stream_denied",
-      error_message: "Forbidden: store access denied",
-      severity: "warning",
-      user_id: auth.userId,
-      tags: {
-        reason: "store_mismatch",
-        authorized: false
-      }
-    }]);
-    return {
-      error: "Forbidden: store access denied",
-      statusCode: 403
-    };
-  }
-  return {
-    error: null,
-    statusCode: 200,
-    stream: `sse:${targetStoreId}`
-  };
-}
-
-/** Simulated graph action endpoint -- checks store authorization */
-async function executeGraphAction(authHeader, targetStoreId, action) {
-  const auth = await authenticateRequest(authHeader);
-  if (auth.error) {
-    return {
-      data: null,
-      error: auth.error,
-      statusCode: auth.statusCode
-    };
-  }
-  if (auth.storeId !== targetStoreId) {
-    return {
-      data: null,
-      error: "Forbidden: cannot access workflows in another store",
-      statusCode: 403
-    };
-  }
-  return {
-    data: {
-      action,
-      store_id: targetStoreId,
-      result: "ok"
-    },
-    error: null,
-    statusCode: 200
-  };
-}
-
-// ============================================================================
-// E2E Tests: Workflow Security + Concurrency
-// ============================================================================
-
-describe.skipIf(!HAS_TEST_DB)("Workflow Security E2E", () => {
-  let storeAId;
-  let storeBId;
-  let user1Id;
-  let user2Id;
-  beforeEach(async () => {
-    storeAId = randomUUID();
-    storeBId = randomUUID();
-    user1Id = randomUUID();
-    user2Id = randomUUID();
-
-    // Seed stores (email is NOT NULL)
-    await seedTracked("stores", [{
-      id: storeAId,
-      store_name: `${RUN_PREFIX}_Store Alpha`,
-      slug: `${RUN_PREFIX}-store-alpha-ws`,
-      email: `${RUN_PREFIX}_alpha@example.com`
-    }, {
-      id: storeBId,
-      store_name: `${RUN_PREFIX}_Store Beta`,
-      slug: `${RUN_PREFIX}-store-beta-ws`,
-      email: `${RUN_PREFIX}_beta@example.com`
-    }]);
-
-    // Seed users
-    await seedTracked("platform_users", [{
-      id: user1Id,
-      email: `${RUN_PREFIX}_alice_ws@example.com`
-    }, {
-      id: user2Id,
-      email: `${RUN_PREFIX}_bob_ws@example.com`
-    }]);
-  });
-  afterEach(async () => {
-    await cleanup();
-  });
-
-  // --------------------------------------------------------------------------
-  // Authentication
-  // --------------------------------------------------------------------------
-
-  it("unauthenticated request returns 401", async () => {
-    // No auth header
-    const result1 = await authenticateRequest(undefined);
-    expect(result1.statusCode).toBe(401);
-    expect(result1.error).toContain("Missing");
-
-    // Empty header
-    const result2 = await authenticateRequest("");
-    expect(result2.statusCode).toBe(401);
-    expect(result2.error).toContain("Missing");
-
-    // Invalid bearer format
-    const result3 = await authenticateRequest("Basic dXNlcjpwYXNz");
-    expect(result3.statusCode).toBe(401);
-    expect(result3.error).toContain("Missing");
-
-    // Malformed JWT
-    const result4 = await authenticateRequest("Bearer not.valid.jwt.extra");
-    expect(result4.statusCode).toBe(401);
-  });
-
-  // --------------------------------------------------------------------------
-  // SSRF Protection
-  // --------------------------------------------------------------------------
-
-  it("SSRF attempt on webhook URL is blocked", () => {
-    // Internal/private IPs
-    expect(isBlockedUrl("http://127.0.0.1/callback")).toBe(true);
-    expect(isBlockedUrl("http://localhost/hook")).toBe(true);
-    expect(isBlockedUrl("http://10.0.0.1/internal")).toBe(true);
-    expect(isBlockedUrl("http://192.168.1.1/admin")).toBe(true);
-    expect(isBlockedUrl("http://172.16.0.1/secret")).toBe(true);
-
-    // Cloud metadata
-    expect(isBlockedUrl("http://169.254.169.254/latest/meta-data/")).toBe(true);
-
-    // Internal infrastructure
-    expect(isBlockedUrl("https://whale-agent.fly.dev/api")).toBe(true);
-
-    // Non-HTTP schemes
-    expect(isBlockedUrl("file:///etc/passwd")).toBe(true);
-    expect(isBlockedUrl("gopher://evil.com")).toBe(true);
-
-    // Internal TLDs
-    expect(isBlockedUrl("http://service.internal/api")).toBe(true);
-    expect(isBlockedUrl("http://db.local/query")).toBe(true);
-
-    // Public URLs should be allowed
-    expect(isBlockedUrl("https://api.example.com/webhook")).toBe(false);
-    expect(isBlockedUrl("https://hooks.slack.com/services/T/B/X")).toBe(false);
-  });
-
-  // --------------------------------------------------------------------------
-  // Input Validation
-  // --------------------------------------------------------------------------
-
-  it("senderId with injection characters is rejected (400)", () => {
-    // SQL injection attempts
-    expect(validateSenderId("'; DROP TABLE users;--").valid).toBe(false);
-    expect(validateSenderId('user" OR 1=1').valid).toBe(false);
-
-    // Template injection
-    expect(validateSenderId("{{steps.steal.data}}").valid).toBe(false);
-
-    // NoSQL injection
-    expect(validateSenderId('{"$gt": ""}').valid).toBe(false);
-
-    // Script injection
-    expect(validateSenderId("<script>alert(1)</script>").valid).toBe(false);
-
-    // Shell injection
-    expect(validateSenderId("user$(whoami)").valid).toBe(false);
-
-    // Backslash traversal
-    expect(validateSenderId("..\\..\\etc\\passwd").valid).toBe(false);
-
-    // Valid senderIds should pass
-    expect(validateSenderId("user_123").valid).toBe(true);
-    expect(validateSenderId("alice@example.com").valid).toBe(true);
-    expect(validateSenderId("store-abc-def").valid).toBe(true);
-
-    // Empty and too long
-    expect(validateSenderId("").valid).toBe(false);
-    expect(validateSenderId("   ").valid).toBe(false);
-    expect(validateSenderId("a".repeat(200)).valid).toBe(false);
-  });
-});

package/dist/server/handlers/__tests__/e2e/workflow-security.part2.e2e.test.js

@@ -1,267 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from "vitest";
-import { randomUUID } from "node:crypto";
-import { HAS_TEST_DB, getTestClient, seedTracked, cleanup, RUN_PREFIX } from "../../__test-utils__/test-db.js";
-
-// ============================================================================
-// Real Supabase client
-// ============================================================================
-
-const sb = getTestClient();
-
-// ============================================================================
-// Auth Helpers
-// ============================================================================
-
-let jwtCounter = 0;
-function generateJwt(userId, storeId, expiresInMs = 3600000) {
-  const header = {
-    alg: "HS256",
-    typ: "JWT"
-  };
-  const payload = {
-    sub: userId,
-    store_id: storeId,
-    iat: Date.now(),
-    exp: Date.now() + expiresInMs,
-    jti: `${Date.now()}_${++jwtCounter}`
-  };
-  const b64 = obj => Buffer.from(JSON.stringify(obj)).toString("base64url");
-  return `${b64(header)}.${b64(payload)}.mock_signature`;
-}
-function parseJwt(token) {
-  try {
-    const parts = token.split(".");
-    if (parts.length !== 3) return null;
-    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
-    return payload;
-  } catch {
-    return null;
-  }
-}
-async function authenticateRequest(authHeader) {
-  if (!authHeader || !authHeader.startsWith("Bearer ")) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Missing or invalid Authorization header",
-      statusCode: 401
-    };
-  }
-  const token = authHeader.slice(7);
-  const payload = parseJwt(token);
-  if (!payload) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Invalid token",
-      statusCode: 401
-    };
-  }
-  if (payload.exp < Date.now()) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "Token expired",
-      statusCode: 401
-    };
-  }
-  const {
-    data: user
-  } = await sb.from("platform_users").select().eq("id", payload.sub);
-  if (!user || user.length === 0) {
-    return {
-      userId: null,
-      storeId: null,
-      error: "User not found",
-      statusCode: 401
-    };
-  }
-  return {
-    userId: payload.sub,
-    storeId: payload.store_id,
-    error: null,
-    statusCode: 200
-  };
-}
-
-// ============================================================================
-// Workflow API Handlers (simulated)
-// ============================================================================
-
-/** Simulated SSE stream endpoint -- checks store authorization */
-async function requestSSEStream(authHeader, targetStoreId) {
-  const auth = await authenticateRequest(authHeader);
-  if (auth.error) {
-    return {
-      error: auth.error,
-      statusCode: auth.statusCode
-    };
-  }
-  if (auth.storeId !== targetStoreId) {
-    await seedTracked("error_events", [{
-      id: randomUUID(),
-      store_id: targetStoreId,
-      error_type: "sse_stream_denied",
-      error_message: "Forbidden: store access denied",
-      severity: "warning",
-      user_id: auth.userId,
-      tags: {
-        reason: "store_mismatch",
-        authorized: false
-      }
-    }]);
-    return {
-      error: "Forbidden: store access denied",
-      statusCode: 403
-    };
-  }
-  return {
-    error: null,
-    statusCode: 200,
-    stream: `sse:${targetStoreId}`
-  };
-}
-
-/** Simulated graph action endpoint -- checks store authorization */
-async function executeGraphAction(authHeader, targetStoreId, action) {
-  const auth = await authenticateRequest(authHeader);
-  if (auth.error) {
-    return {
-      data: null,
-      error: auth.error,
-      statusCode: auth.statusCode
-    };
-  }
-  if (auth.storeId !== targetStoreId) {
-    return {
-      data: null,
-      error: "Forbidden: cannot access workflows in another store",
-      statusCode: 403
-    };
-  }
-  return {
-    data: {
-      action,
-      store_id: targetStoreId,
-      result: "ok"
-    },
-    error: null,
-    statusCode: 200
-  };
-}
-
-// ============================================================================
-// E2E Tests: Store Isolation & Unauthenticated Access
-// ============================================================================
-
-describe.skipIf(!HAS_TEST_DB)("Workflow Security E2E — isolation & expiry", () => {
-  let storeAId;
-  let storeBId;
-  let user1Id;
-  let user2Id;
-  beforeEach(async () => {
-    storeAId = randomUUID();
-    storeBId = randomUUID();
-    user1Id = randomUUID();
-    user2Id = randomUUID();
-
-    // Seed stores (email is NOT NULL)
-    await seedTracked("stores", [{
-      id: storeAId,
-      store_name: `${RUN_PREFIX}_Store Alpha`,
-      slug: `${RUN_PREFIX}-store-alpha-p2`,
-      email: `${RUN_PREFIX}_alpha_p2@example.com`
-    }, {
-      id: storeBId,
-      store_name: `${RUN_PREFIX}_Store Beta`,
-      slug: `${RUN_PREFIX}-store-beta-p2`,
-      email: `${RUN_PREFIX}_beta_p2@example.com`
-    }]);
-
-    // Seed users
-    await seedTracked("platform_users", [{
-      id: user1Id,
-      email: `${RUN_PREFIX}_alice_p2@example.com`
-    }, {
-      id: user2Id,
-      email: `${RUN_PREFIX}_bob_p2@example.com`
-    }]);
-  });
-  afterEach(async () => {
-    await cleanup();
-  });
-
-  // --------------------------------------------------------------------------
-  // Store Isolation: SSE Stream
-  // --------------------------------------------------------------------------
-
-  it("SSE stream for wrong store returns 403", async () => {
-    const aliceToken = generateJwt(user1Id, storeAId);
-
-    // Alice (store_A) should NOT be able to subscribe to store_B events
-    const result = await requestSSEStream(`Bearer ${aliceToken}`, storeBId);
-    expect(result.statusCode).toBe(403);
-    expect(result.error).toBe("Forbidden: store access denied");
-    expect(result.stream).toBeUndefined();
-
-    // Verify the unauthorized attempt was logged
-    const {
-      data: logs
-    } = await sb.from("error_events").select().eq("user_id", user1Id).eq("error_type", "sse_stream_denied");
-    expect(logs).toBeDefined();
-    expect(logs.length).toBeGreaterThanOrEqual(1);
-
-    // Alice should be able to subscribe to her own store
-    const ownResult = await requestSSEStream(`Bearer ${aliceToken}`, storeAId);
-    expect(ownResult.statusCode).toBe(200);
-    expect(ownResult.stream).toBe(`sse:${storeAId}`);
-  });
-
-  // --------------------------------------------------------------------------
-  // Store Isolation: Graph Actions
-  // --------------------------------------------------------------------------
-
-  it("graph action with wrong store returns error", async () => {
-    const bobToken = generateJwt(user2Id, storeBId);
-
-    // Bob (store_B) should NOT be able to execute graph actions on store_A
-    const result = await executeGraphAction(`Bearer ${bobToken}`, storeAId, "run_workflow");
-    expect(result.statusCode).toBe(403);
-    expect(result.error).toContain("Forbidden");
-    expect(result.data).toBeNull();
-
-    // Bob should be able to execute on his own store
-    const ownResult = await executeGraphAction(`Bearer ${bobToken}`, storeBId, "run_workflow");
-    expect(ownResult.statusCode).toBe(200);
-    expect(ownResult.data).toEqual({
-      action: "run_workflow",
-      store_id: storeBId,
-      result: "ok"
-    });
-  });
-
-  // --------------------------------------------------------------------------
-  // Unauthenticated SSE / Graph
-  // --------------------------------------------------------------------------
-
-  it("SSE stream without auth returns 401", async () => {
-    const result = await requestSSEStream(undefined, storeAId);
-    expect(result.statusCode).toBe(401);
-    expect(result.error).toContain("Missing");
-  });
-  it("graph action without auth returns 401", async () => {
-    const result = await executeGraphAction(undefined, storeAId, "run_workflow");
-    expect(result.statusCode).toBe(401);
-    expect(result.error).toContain("Missing");
-  });
-  it("expired token is rejected across all endpoints", async () => {
-    const expiredToken = generateJwt(user1Id, storeAId, -1000);
-    const authResult = await authenticateRequest(`Bearer ${expiredToken}`);
-    expect(authResult.statusCode).toBe(401);
-    expect(authResult.error).toBe("Token expired");
-    const sseResult = await requestSSEStream(`Bearer ${expiredToken}`, storeAId);
-    expect(sseResult.statusCode).toBe(401);
-    const graphResult = await executeGraphAction(`Bearer ${expiredToken}`, storeAId, "run");
-    expect(graphResult.statusCode).toBe(401);
-  });
-});