at-container-registry/pkg/appview/handlers/webhook_url_test.go

package handlers

import (
	"html/template"
	"net/http/httptest"
	"net/url"
	"strings"
	"testing"

	"atcr.io/pkg/appview/db"
	"atcr.io/pkg/appview/middleware"
)

// Finding 35: the creation-time check said "must be https" but accepted
// http://, so POST /api/webhooks with http://127.0.0.1:9/hook returned 200 and
// created a webhook the appview would then dial on demand.

// webhookTestTemplates provides the two templates the webhook handlers render.
// The bodies only need to be identifiable, not faithful.
func webhookTestTemplates(t *testing.T) *template.Template {
	t.Helper()
	tmpl := template.Must(template.New("alert").Parse(`ALERT:{{ .Message }}`))
	template.Must(tmpl.New("webhooks_list").Parse(
		`LIST:{{ range .Webhooks }}{{ .URL }};{{ end }}`))
	return tmpl
}

func postWebhook(t *testing.T, h *AddWebhookHandler, webhookURL string) string {
	t.Helper()
	form := url.Values{}
	form.Set("url", webhookURL)
	form.Set("trigger_push", "on")

	req := httptest.NewRequest("POST", "/api/webhooks", strings.NewReader(form.Encode()))
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req = middleware.WithUser(req, &db.User{DID: "did:plc:webhooktester", Handle: "wh.test"})

	rr := httptest.NewRecorder()
	h.ServeHTTP(rr, req)
	return rr.Body.String()
}

func TestAddWebhook_RejectsNonHTTPSAndPrivateDestinations(t *testing.T) {
	database := setupTestDB(t)
	defer database.Close()

	h := &AddWebhookHandler{BaseUIHandler: BaseUIHandler{
		Templates:  webhookTestTemplates(t),
		DB:         database,
		ReadOnlyDB: database,
	}}

	tests := []struct {
		name    string
		url     string
		wantMsg string
	}{
		{"plain http loopback", "http://127.0.0.1:9/hook", "must be https"},
		{"plain http public host", "http://example.com/hook", "must be https"},
		{"no scheme", "example.com/hook", "must be https"},
		{"file scheme", "file:///etc/passwd", "must be https"},
		{"https loopback", "https://127.0.0.1:9/hook", "private or loopback"},
		{"https loopback v6", "https://[::1]/hook", "private or loopback"},
		{"https rfc1918", "https://10.0.0.1/hook", "private or loopback"},
		{"https link-local metadata", "https://169.254.169.254/latest/meta-data/", "private or loopback"},
		{"https ipv4-mapped loopback", "https://[::ffff:127.0.0.1]/hook", "private or loopback"},
		{"https localhost name", "https://localhost:9/hook", "private or loopback"},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			body := postWebhook(t, h, tt.url)
			if !strings.HasPrefix(body, "ALERT:") {
				t.Fatalf("expected an error alert, got %q", body)
			}
			if !strings.Contains(body, tt.wantMsg) {
				t.Errorf("error message %q does not mention %q", body, tt.wantMsg)
			}
		})
	}

	// Nothing above may have been stored.
	stored, err := db.ListWebhooks(database, "did:plc:webhooktester")
	if err != nil {
		t.Fatalf("list webhooks: %v", err)
	}
	if len(stored) != 0 {
		t.Fatalf("rejected URLs were persisted anyway: %+v", stored)
	}
}

func TestAddWebhook_AcceptsPublicHTTPS(t *testing.T) {
	database := setupTestDB(t)
	defer database.Close()

	h := &AddWebhookHandler{BaseUIHandler: BaseUIHandler{
		Templates:  webhookTestTemplates(t),
		DB:         database,
		ReadOnlyDB: database,
	}}

	// The webhooks table has a FK on the owning user.
	if err := db.InsertUserIfNotExists(database, &db.User{DID: "did:plc:webhooktester", Handle: "wh.test"}); err != nil {
		t.Fatalf("seed user: %v", err)
	}

	const good = "https://hooks.example.com/services/abc"
	body := postWebhook(t, h, good)
	if !strings.HasPrefix(body, "LIST:") {
		t.Fatalf("expected the webhook list to render, got %q", body)
	}
	// ListWebhooks masks the path for display, so match on the host prefix.
	const displayPrefix = "https://hooks.example.com/"
	if !strings.Contains(body, displayPrefix) {
		t.Errorf("rendered list %q does not contain the new webhook", body)
	}

	stored, err := db.ListWebhooks(database, "did:plc:webhooktester")
	if err != nil {
		t.Fatalf("list webhooks: %v", err)
	}
	if len(stored) != 1 || !strings.HasPrefix(stored[0].URL, displayPrefix) {
		t.Fatalf("expected the public https webhook to be stored, got %+v", stored)
	}
}