ApiCore/ApiCore-Backend/test/webhooks.e2e-spec.ts

import { INestApplication } from '@nestjs/common';
import * as http from 'node:http';
import * as crypto from 'node:crypto';
import * as bcrypt from 'bcryptjs';
import request from 'supertest';
import { App } from 'supertest/types';
import { PrismaService } from '../src/prisma/prisma.service';
import { createTestApp } from './utils/create-test-app';
import { login } from './utils/api';

interface WebhookSubscriptionBody {
  id: string;
  url: string;
  events: string[];
  secret: string;
  active: boolean;
}

interface ReceivedRequest {
  body: string;
  headers: http.IncomingHttpHeaders;
}

describe('Webhooks (e2e)', () => {
  let app: INestApplication<App>;
  let prisma: PrismaService;
  const adminEmail = `webhooks-e2e-admin-${Date.now()}@example.com`;
  const staffEmail = `webhooks-e2e-staff-${Date.now()}@example.com`;
  const password = 'SuperSecret123!';
  let adminId: string;
  let staffId: string;
  let adminAccessToken: string;
  let staffAccessToken: string;
  let subscriptionId: string;
  let deliverySubscriptionId: string;

  let receiverServer: http.Server;
  let receiverUrl: string;
  let receivedRequests: ReceivedRequest[] = [];

  beforeAll(async () => {
    app = await createTestApp();
    prisma = app.get(PrismaService);

    const passwordHash = await bcrypt.hash(password, 12);
    const admin = await prisma.user.create({
      data: {
        email: adminEmail,
        passwordHash,
        name: 'Webhooks E2E Admin',
        role: { connect: { key: 'ADMIN' } },
      },
    });
    adminId = admin.id;
    const staff = await prisma.user.create({
      data: {
        email: staffEmail,
        passwordHash,
        name: 'Webhooks E2E Staff',
        role: { connect: { key: 'STAFF' } },
      },
    });
    staffId = staff.id;
    adminAccessToken = (await login(app, adminEmail, password)).accessToken;
    staffAccessToken = (await login(app, staffEmail, password)).accessToken;

    receivedRequests = [];
    receiverServer = http.createServer((req, res) => {
      const chunks: Buffer[] = [];
      req.on('data', (chunk: Buffer) => chunks.push(chunk));
      req.on('end', () => {
        receivedRequests.push({
          body: Buffer.concat(chunks).toString('utf-8'),
          headers: req.headers,
        });
        res.writeHead(200);
        res.end('ok');
      });
    });
    await new Promise<void>((resolve) =>
      receiverServer.listen(0, '127.0.0.1', resolve),
    );
    const address = receiverServer.address();
    if (address === null || typeof address === 'string') {
      throw new Error('Failed to determine receiver server address');
    }
    receiverUrl = `http://127.0.0.1:${address.port}/hook`;
  });

  afterAll(async () => {
    await new Promise<void>((resolve, reject) =>
      receiverServer.close((error) => (error ? reject(error) : resolve())),
    );
    await prisma.webhookSubscription.deleteMany({
      where: { id: { in: [subscriptionId, deliverySubscriptionId] } },
    });
    await prisma.task.deleteMany({
      where: { createdByUserId: { in: [adminId, staffId] } },
    });
    await prisma.refreshToken.deleteMany({
      where: { userId: { in: [adminId, staffId] } },
    });
    await prisma.auditLog.deleteMany({
      where: { userId: { in: [adminId, staffId] } },
    });
    await prisma.user.deleteMany({ where: { id: { in: [adminId, staffId] } } });
    await app.close();
  });

  it('rejects non-admin roles from listing webhooks', () => {
    return request(app.getHttpServer())
      .get('/api/v1/webhooks')
      .set('Authorization', `Bearer ${staffAccessToken}`)
      .expect(403);
  });

  it('rejects a webhook URL targeting a private or loopback address (SSRF guard)', async () => {
    await request(app.getHttpServer())
      .post('/api/v1/webhooks')
      .set('Authorization', `Bearer ${adminAccessToken}`)
      .send({ url: receiverUrl, events: ['task.created'] })
      .expect(400);
    await request(app.getHttpServer())
      .post('/api/v1/webhooks')
      .set('Authorization', `Bearer ${adminAccessToken}`)
      .send({
        url: 'http://169.254.169.254/latest/meta-data/',
        events: ['task.created'],
      })
      .expect(400);
  });

  it('lets an admin create a webhook subscription with a generated secret', async () => {
    const response = await request(app.getHttpServer())
      .post('/api/v1/webhooks')
      .set('Authorization', `Bearer ${adminAccessToken}`)
      .send({ url: 'https://example.com/hook', events: ['task.created'] })
      .expect(201);
    const body = response.body as WebhookSubscriptionBody;
    subscriptionId = body.id;
    expect(body.secret).toHaveLength(64);
    expect(body.events).toEqual(['task.created']);
  });

  it('excludes the secret from the list response', async () => {
    const response = await request(app.getHttpServer())
      .get('/api/v1/webhooks')
      .set('Authorization', `Bearer ${adminAccessToken}`)
      .expect(200);
    const body = response.body as Partial<WebhookSubscriptionBody>[];
    const listed = body.find((entry) => entry.id === subscriptionId);
    expect(listed?.secret).toBeUndefined();
  });

  it('never delivers to a private address, even from a row that bypassed the create guard', async () => {
    // Stands in for DNS rebinding or a tampered row: the stored URL points
    // at a loopback receiver. The connection-time check must refuse it, and
    // the request that fired the event must not wait for the receiver.
    // Signing is covered by webhooks.service.spec.ts.
    const subscription = await prisma.webhookSubscription.create({
      data: {
        url: receiverUrl,
        events: ['task.created'],
        secret: crypto.randomBytes(32).toString('hex'),
        createdByUserId: adminId,
      },
    });
    deliverySubscriptionId = subscription.id;

    await request(app.getHttpServer())
      .post('/api/v1/tasks')
      .set('Authorization', `Bearer ${adminAccessToken}`)
      .send({ title: `Webhook-Test ${Date.now()}` })
      .expect(201);
    await new Promise((resolve) => setTimeout(resolve, 300));

    expect(receivedRequests).toHaveLength(0);
  });

  it('lets an admin delete a webhook subscription', () => {
    return request(app.getHttpServer())
      .delete(`/api/v1/webhooks/${subscriptionId}`)
      .set('Authorization', `Bearer ${adminAccessToken}`)
      .expect(204);
  });
});