|
1 | 1 | // Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license. |
2 | 2 | import { describe, it, expect } from 'vitest'; |
3 | | -import { isAuthGateAllowlisted, evaluateAuthGate, normalizeAuthGate } from './auth-gate'; |
| 3 | +import { isAuthGateAllowlisted, evaluateAuthGate, normalizeAuthGate, matchInboundHookRoute } from './auth-gate'; |
4 | 4 |
|
5 | 5 | describe('auth-gate (ADR-0069 session gate)', () => { |
6 | 6 | describe('isAuthGateAllowlisted', () => { |
@@ -443,6 +443,218 @@ describe('auth-gate (ADR-0069 session gate)', () => { |
443 | 443 | }); |
444 | 444 | }); |
445 | 445 |
|
| 446 | + // ── [#22773] The allow-list's first PARAMETERISED row ─────────────────── |
| 447 | + // |
| 448 | + // Ruling A on #22757 (director record `6105447950`): the inbound automation |
| 449 | + // hook is admitted with no session, through to the trigger's own HMAC |
| 450 | + // verifier, by ONE route-exact row in the dispatcher's spelling. Condition 1 |
| 451 | + // binds its shape: exactly four segments (`automation`, `hooks`, one flow |
| 452 | + // name, one hook id), `POST` only, no prefix and no wildcard beyond the two |
| 453 | + // parameters — and `/automation/hooks`, `/automation/hooks/x`, |
| 454 | + // `/automation/hooks/x/y/z` and every other `/automation` path still gated. |
| 455 | + // |
| 456 | + // ⛔ These pin the DECISION per (path, method), never the entry's spelling. |
| 457 | + describe('[#22773] the inbound hook is exempt as the exact four-segment POST route, and nothing wider', () => { |
| 458 | + it('PIN 1 — exempts POST on the exact route, unscoped or under one /environments/:id scope', () => { |
| 459 | + for (const p of [ |
| 460 | + '/automation/hooks/stripe_orders/default', // the dispatcher spelling: the hono adapter strips the app prefix |
| 461 | + '/automation/hooks/f/h', |
| 462 | + '/automation/hooks/f/h/', // trailing slashes stripped, as for every row |
| 463 | + '/automation/hooks/f/h//', |
| 464 | + '/automation/hooks/f/h?x=1', // query stripped, as for every row |
| 465 | + '/automation/hooks/f%2Fx/h%20y', // parameters are any one segment, raw |
| 466 | + '/automation/hooks/hooks/automation', // a parameter may spell a literal |
| 467 | + '/environments/env_1/automation/hooks/f/h', // scoped: the dispatcher gates BEFORE its scoped-URL strip |
| 468 | + ]) { |
| 469 | + expect(isAuthGateAllowlisted(p, 'POST'), p).toBe(true); |
| 470 | + expect(isAuthGateAllowlisted(p, 'post'), `${p} (method case)`).toBe(true); |
| 471 | + } |
| 472 | + }); |
| 473 | + |
| 474 | + it('PIN 2 — the method: POST only, and no method exempts nothing on this row', () => { |
| 475 | + const p = '/automation/hooks/f/h'; |
| 476 | + for (const method of ['GET', 'HEAD', 'PUT', 'PATCH', 'DELETE', 'OPTIONS', 'CONNECT', 'TRACE', 'POSTX', '']) { |
| 477 | + expect(isAuthGateAllowlisted(p, method), method).toBe(false); |
| 478 | + } |
| 479 | + expect(isAuthGateAllowlisted(p)).toBe(false); |
| 480 | + expect(isAuthGateAllowlisted(p, undefined)).toBe(false); |
| 481 | + expect(isAuthGateAllowlisted(p, null)).toBe(false); |
| 482 | + // ⭐ CONTROL: the rows that were exempt for every method still are, with |
| 483 | + // a method or without one. |
| 484 | + for (const method of [undefined, 'GET', 'POST', 'DELETE']) { |
| 485 | + expect(isAuthGateAllowlisted('/approvals/act', method), String(method)).toBe(true); |
| 486 | + expect(isAuthGateAllowlisted('/api/v1/auth/sign-out', method), String(method)).toBe(true); |
| 487 | + } |
| 488 | + }); |
| 489 | + |
| 490 | + it('PIN 3 — condition 1: every other segment count, and every other /automation path, stays gated', () => { |
| 491 | + for (const p of [ |
| 492 | + // the card's own three, and the bare domain |
| 493 | + '/automation/hooks', '/automation/hooks/x', '/automation/hooks/x/y/z', '/automation', |
| 494 | + '/automation/hooks/x/y/z/w', '/automation/hooks/f/h/runs/r1/resume', |
| 495 | + // the domain's real routes, at every depth |
| 496 | + '/automation/trigger/f', '/automation/f/trigger', '/automation/f/toggle', '/automation/f/clone', |
| 497 | + '/automation/f/runs', '/automation/f/runs/r1', '/automation/f/runs/r1/resume', |
| 498 | + '/automation/hooks/trigger', '/automation/hooks/runs/r1/cancel', |
| 499 | + // a sibling literal in either fixed position |
| 500 | + '/automation/hooksx/f/h', '/automation/hook/f/h', '/automation/webhooks/f/h', '/automationx/hooks/f/h', |
| 501 | + '/automation/f/hooks/h', '/hooks/automation/f/h', |
| 502 | + // literals are matched unencoded and case-sensitively, as the router matches them |
| 503 | + '/Automation/hooks/f/h', '/automation/HOOKS/f/h', '/automation/%68ooks/f/h', '/%61utomation/hooks/f/h', |
| 504 | + '/automation/hooks%2Ff/h', |
| 505 | + ]) { |
| 506 | + expect(isAuthGateAllowlisted(p, 'POST'), p).toBe(false); |
| 507 | + } |
| 508 | + }); |
| 509 | + |
| 510 | + it('PIN 4 — the dispatcher spelling only: no mount base, no retired scope, no empty segment', () => { |
| 511 | + for (const p of [ |
| 512 | + // a mount base: the route exists on the dispatcher alone, whose path |
| 513 | + // arrives base-stripped, so a based spelling there is a doubled prefix |
| 514 | + // the router serves nothing at |
| 515 | + '/api/v1/automation/hooks/f/h', '/api/automation/hooks/f/h', '/api/v1/environments/env_1/automation/hooks/f/h', |
| 516 | + // the retired `projects` scope, which the dispatcher's scope strip does not remove |
| 517 | + '/projects/env_1/automation/hooks/f/h', |
| 518 | + // the route below a non-mount segment, whose value a tenant controls |
| 519 | + '/data/automation/hooks/f/h', '/meta/automation/hooks/f/h', '/x/automation/hooks/f/h', |
| 520 | + // two scopes, or a scope with no id (the id is `automation`) |
| 521 | + '/environments/a/environments/b/automation/hooks/f/h', '/environments/automation/hooks/f/h', |
| 522 | + // an empty segment anywhere: the scope strip and the domain claim do not drop it |
| 523 | + '//automation/hooks/f/h', '/automation//hooks/f/h', '/automation/hooks//h', '/automation/hooks/f//h', |
| 524 | + '/automation/hooks//f/h', '/environments//env_1/automation/hooks/f/h', '/environments/env_1//automation/hooks/f/h', |
| 525 | + // not a path at all |
| 526 | + 'automation/hooks/f/h', '', '/', |
| 527 | + ]) { |
| 528 | + expect(isAuthGateAllowlisted(p, 'POST'), p).toBe(false); |
| 529 | + } |
| 530 | + }); |
| 531 | + |
| 532 | + it('matchInboundHookRoute: the one reading, its parameters raw — and null wherever the row is', () => { |
| 533 | + expect(matchInboundHookRoute('/automation/hooks/f/h', 'POST')).toEqual({ flowName: 'f', hookId: 'h' }); |
| 534 | + expect(matchInboundHookRoute('/automation/hooks/f%2Fx/h%20y', 'POST')).toEqual({ flowName: 'f%2Fx', hookId: 'h%20y' }); |
| 535 | + expect(matchInboundHookRoute('/environments/env_1/automation/hooks/f/h/?q=1', 'post')).toEqual({ flowName: 'f', hookId: 'h' }); |
| 536 | + for (const [p, m] of [ |
| 537 | + ['/automation/hooks/f/h', 'GET'], ['/automation/hooks/f/h', undefined], ['/automation/hooks/f', 'POST'], |
| 538 | + ['/automation//hooks/f/h', 'POST'], ['/api/v1/automation/hooks/f/h', 'POST'], [undefined, 'POST'], |
| 539 | + ] as const) { |
| 540 | + expect(matchInboundHookRoute(p, m), `${p} ${m}`).toBeNull(); |
| 541 | + } |
| 542 | + // The row and the reading are one: they answer the same on every spelling PIN 1-4 name. |
| 543 | + for (const p of ['/automation/hooks/f/h', '/automation/hooks/x', '//automation/hooks/f/h', '/projects/e/automation/hooks/f/h']) { |
| 544 | + for (const m of ['POST', 'GET', undefined]) { |
| 545 | + expect(isAuthGateAllowlisted(p, m), `${p} ${m}`).toBe(matchInboundHookRoute(p, m) !== null); |
| 546 | + } |
| 547 | + } |
| 548 | + }); |
| 549 | + |
| 550 | + it('carries through `evaluateAuthGate`: a gated session passes the POST and stays gated on every other method', () => { |
| 551 | + const gated = { id: 'u1', authGate: { code: 'MFA_REQUIRED', message: 'enrol' } }; |
| 552 | + expect(evaluateAuthGate(gated, '/automation/hooks/f/h', 'POST')).toBeNull(); |
| 553 | + expect(evaluateAuthGate(gated, '/environments/env_1/automation/hooks/f/h', 'POST')).toBeNull(); |
| 554 | + // ⭐ The control: `GET /automation/hooks/runs/r1` is a run read of a flow |
| 555 | + // named `hooks` — the reason the row is POST-only. |
| 556 | + expect(evaluateAuthGate(gated, '/automation/hooks/runs/r1', 'GET')).toEqual({ code: 'MFA_REQUIRED', message: 'enrol' }); |
| 557 | + expect(evaluateAuthGate(gated, '/automation/hooks/f/h')).toEqual({ code: 'MFA_REQUIRED', message: 'enrol' }); |
| 558 | + expect(evaluateAuthGate(gated, '/automation/hooks/x', 'POST')).toEqual({ code: 'MFA_REQUIRED', message: 'enrol' }); |
| 559 | + }); |
| 560 | + |
| 561 | + // ⭐ CLAUSE ② — the widening, measured rather than asserted. |
| 562 | + // |
| 563 | + // `preEntryAllowlisted` is this file's subject as it stood before the row, |
| 564 | + // transcribed from `origin/main` 12b9daf7 (it takes no method: no row read |
| 565 | + // one). Over every path of up to five segments drawn from a vocabulary that |
| 566 | + // mixes the new route's tokens with the existing ones, plus the six-segment |
| 567 | + // scoped shape, and over methods that include none at all, the set of |
| 568 | + // (path, method) answers that moved must be EXACTLY the hook route — POST, |
| 569 | + // in either case — unscoped or under one `/environments/:id` scope, every |
| 570 | + // move a newly exempt answer, none newly gated. |
| 571 | + it('BOUNDARY — newly exempt is exactly POST on the four-segment hook route, unscoped or scoped, nothing else', () => { |
| 572 | + const PRE_MOUNT_BASES: readonly (readonly string[])[] = [['api', 'v1'], ['api'], []]; |
| 573 | + const PRE_SCOPE_SEGMENTS: readonly string[] = ['environments', 'projects']; |
| 574 | + const PRE_ALLOW_ROUTES: readonly (readonly string[])[] = [ |
| 575 | + ['health'], ['ready'], ['discovery'], ['me', 'apps'], ['me', 'localization'], ['approvals', 'act'], |
| 576 | + ]; |
| 577 | + const startsWith = (segments: readonly string[], prefix: readonly string[]): boolean => { |
| 578 | + if (segments.length < prefix.length) return false; |
| 579 | + for (let k = 0; k < prefix.length; k++) if (segments[k] !== prefix[k]) return false; |
| 580 | + return true; |
| 581 | + }; |
| 582 | + const preEntryAllowlisted = (rawPath: string | undefined | null): boolean => { |
| 583 | + if (!rawPath) return false; |
| 584 | + let path = rawPath.split('?')[0] || '/'; |
| 585 | + let end = path.length; |
| 586 | + while (end > 1 && path.charCodeAt(end - 1) === 47) end--; |
| 587 | + path = path.slice(0, end) || '/'; |
| 588 | + const segments = path.split('/').filter((s) => s !== ''); |
| 589 | + for (const base of PRE_MOUNT_BASES) { |
| 590 | + if (!startsWith(segments, base)) continue; |
| 591 | + let i = base.length; |
| 592 | + let scoped = false; |
| 593 | + if (i + 1 < segments.length && PRE_SCOPE_SEGMENTS.includes(segments[i] as string)) { |
| 594 | + i += 2; |
| 595 | + scoped = true; |
| 596 | + } |
| 597 | + if (segments[i] === 'auth') { |
| 598 | + if (i + 1 < segments.length) return true; |
| 599 | + if (!scoped) return true; |
| 600 | + } |
| 601 | + for (const route of PRE_ALLOW_ROUTES) { |
| 602 | + if (segments.length - i === route.length && startsWith(segments.slice(i), route)) return true; |
| 603 | + } |
| 604 | + } |
| 605 | + return false; |
| 606 | + }; |
| 607 | + |
| 608 | + const SEG = ['automation', 'hooks', 'environments', 'projects', 'env1', 'f', 'api', 'v1', 'health', 'runs']; |
| 609 | + const corpus: string[] = ['', '/']; |
| 610 | + const walk = (prefix: string, depth: number) => { |
| 611 | + if (depth === 0) return; |
| 612 | + for (const s of SEG) { |
| 613 | + const p = `${prefix}/${s}`; |
| 614 | + corpus.push(p); |
| 615 | + walk(p, depth - 1); |
| 616 | + } |
| 617 | + }; |
| 618 | + walk('', 5); |
| 619 | + // The scoped shape is six segments deep: `/environments/<id>/automation/hooks/<f>/<h>`. |
| 620 | + const SCOPE_IDS = ['env1', 'hooks']; |
| 621 | + for (const id of SCOPE_IDS) walk(`/environments/${id}`, 4); |
| 622 | + const METHODS = ['POST', 'post', 'GET', 'DELETE', 'OPTIONS', undefined] as const; |
| 623 | + |
| 624 | + // Built independently of the predicate: (unscoped | scope × id) × route × method. |
| 625 | + const expected = new Set<string>(); |
| 626 | + for (const scope of [[], ...SCOPE_IDS.map((id) => ['environments', id])]) { |
| 627 | + for (const a of SEG) for (const b of SEG) { |
| 628 | + for (const m of ['POST', 'post']) expected.add(`${m} /${[...scope, 'automation', 'hooks', a, b].join('/')}`); |
| 629 | + } |
| 630 | + } |
| 631 | + |
| 632 | + const newlyExempt: string[] = []; |
| 633 | + const newlyGated: string[] = []; |
| 634 | + for (const p of corpus) { |
| 635 | + const before = preEntryAllowlisted(p); |
| 636 | + for (const m of METHODS) { |
| 637 | + const after = isAuthGateAllowlisted(p, m); |
| 638 | + if (after && !before) newlyExempt.push(`${m} ${p}`); |
| 639 | + if (!after && before) newlyGated.push(`${m} ${p}`); |
| 640 | + } |
| 641 | + } |
| 642 | + expect(newlyGated).toEqual([]); |
| 643 | + expect([...new Set(newlyExempt)].sort()).toEqual([...expected].sort()); |
| 644 | + |
| 645 | + // Anti-vacuity: the corpus reaches every expected path, both predicates |
| 646 | + // answer both ways, and the card's own siblings are in it and gated. |
| 647 | + const inCorpus = new Set(corpus); |
| 648 | + for (const e of expected) expect(inCorpus.has(e.slice(e.indexOf(' ') + 1)), e).toBe(true); |
| 649 | + expect(corpus.length).toBeGreaterThan(100_000); |
| 650 | + expect(corpus.filter((p) => preEntryAllowlisted(p)).length).toBeGreaterThan(0); |
| 651 | + for (const p of ['/automation/hooks', '/automation/hooks/f', '/automation/hooks/f/runs/health', '/automation/f/hooks/runs']) { |
| 652 | + expect(inCorpus.has(p), p).toBe(true); |
| 653 | + expect(isAuthGateAllowlisted(p, 'POST'), p).toBe(false); |
| 654 | + } |
| 655 | + }); |
| 656 | + }); |
| 657 | + |
446 | 658 | describe('evaluateAuthGate', () => { |
447 | 659 | it('returns null when the user carries no authGate', () => { |
448 | 660 | expect(evaluateAuthGate({ id: 'u1' }, '/api/v1/data/x')).toBeNull(); |
|
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments