| 1 | import { createDecipheriv, randomBytes } from 'node:crypto'; |
| 2 | import { describe, expect |
| 3 | |
| 4 | import { |
| 5 | blockedAddress, |
| 6 | sealWebhookSecret, |
| 7 | webhookSecretKey, |
| 8 | webhookUrlProblem, |
| 9 | } from './webhooks.js'; |
| 10 | |
| 11 | function open(key: |
| 12 | const data = |
| 13 | const decipher = |
| 14 | decipher.setAuthTag(data |
| 15 | return Buffer.concat |
| 16 | decipher.update(data |
| 17 | decipher.final(), |
| 18 | ]).toString('utf8' |
| 19 | } |
| 20 | |
| 21 | describe('webhook secrets', () |
| 22 | it('seal as v1: nonce, ciphertext, tag, which opens with the same key', |
| 23 | const key = |
| 24 | const sealed = |
| 25 | expect(sealed).toMatch |
| 26 | expect(open(key |
| 27 | expect(sealWebhookSecret(key |
| 28 | }); |
| 29 | |
| 30 | it('take only a 32-byte key', |
| 31 | expect(webhookSecretKey(randomBytes |
| 32 | 32, |
| 33 | ); |
| 34 | expect( |
| 35 | webhookSecretKey(randomBytes(16) |
| 36 | ).toBeUndefined(); |
| 37 | expect(webhookSecretKey(undefined)) |
| 38 | }); |
| 39 | }); |
| 40 | |
| 41 | describe('webhook addresses', () |
| 42 | it.each([ |
| 43 | ['93.184.216.34', false, |
| 44 | ['127.0.0.1', true, |
| 45 | ['::1', true, |
| 46 | ['10.1.2.3', true, |
| 47 | ['192.168.1.4', true, |
| 48 | ['100.64.0.1', true, |
| 49 | ['fd00::1', true, |
| 50 | ['::ffff:127.0.0.1', true, |
| 51 | ['169.254.169.254', true, |
| 52 | ['fe80::1', true, |
| 53 | ['0.0.0.0', true, |
| 54 | ])( |
| 55 | '%s: blocked %s, with private networks allowed %s', |
| 56 | (address, strict, |
| 57 | expect(blockedAddress(address |
| 58 | expect(blockedAddress(address |
| 59 | }, |
| 60 | ); |
| 61 | |
| 62 | it('explain what is wrong with a URL', |
| 63 | expect(await webhookUrlProblem |
| 64 | null, |
| 65 | ); |
| 66 | expect(await webhookUrlProblem |
| 67 | /https:\/\//, |
| 68 | ); |
| 69 | expect(await webhookUrlProblem |
| 70 | expect(await webhookUrlProblem |
| 71 | /username or password/, |
| 72 | ); |
| 73 | expect(await webhookUrlProblem |
| 74 | /private or reserved/, |
| 75 | ); |
| 76 | expect(await webhookUrlProblem |
| 77 | /private or reserved/, |
| 78 | ); |
| 79 | expect(await webhookUrlProblem |
| 80 | }); |
| 81 | }); |