88 lines
5.7 KiB
JavaScript
88 lines
5.7 KiB
JavaScript
import test from 'node:test'
|
|
import assert from 'node:assert/strict'
|
|
import { spawnSync } from 'node:child_process'
|
|
import { fileURLToPath } from 'node:url'
|
|
|
|
test('offline proxy routing/authentication/TTL/transparency and redaction (no sockets or HTTP)', () => {
|
|
const script = String.raw`
|
|
import importlib.util,json,sys,unittest
|
|
spec=importlib.util.spec_from_file_location('proxy',sys.argv[1]);p=importlib.util.module_from_spec(spec);spec.loader.exec_module(p)
|
|
class ProxyTests(unittest.TestCase):
|
|
def setUp(self):
|
|
self.now=[10.0];self.calls=[];self.logs=[]
|
|
self.config={'customerId':'7','receivingWarehouseId':'30','controlToken':'private-control','internalToken':'private-internal-token',
|
|
'orderIps':['172.20.0.10'],'requestIds':['fixture-request'],'upstreams':{'IAM':'http://iam.invalid:9201','FINANCE':'http://finance.invalid:9207','WAREHOUSE':'http://warehouse.invalid:9202'}}
|
|
def forward(*args): self.calls.append(args);return 201,{'X-Upstream':'kept'},b'original-response'
|
|
self.router=p.Router(self.config,forward=forward,clock=lambda:self.now[0],record=self.logs.append)
|
|
self.headers={'X-Internal-Service-Token':'private-internal-token','X-Request-Id':'fixture-request'}
|
|
self.path='/iam/internal/iam/tenants/7/order-eligibility'
|
|
def send(self,path=None,method='GET',headers=None,peer='172.20.0.10'):
|
|
return self.router.dispatch(method,path or self.path,headers or self.headers,b'original-body',peer)
|
|
def test_default_pass_and_transport_are_unchanged(self):
|
|
self.assertEqual(self.send(),(201,{'X-Upstream':'kept'},b'original-response'))
|
|
self.assertEqual(self.calls[0][2],'/internal/iam/tenants/7/order-eligibility')
|
|
self.assertEqual(self.calls[0][3]['X-Internal-Service-Token'],'private-internal-token')
|
|
self.assertEqual(self.calls[0][4],b'original-body')
|
|
def test_only_exact_authenticated_customer_get_from_order_faults(self):
|
|
self.router.set_mode('private-control','IAM',60)
|
|
self.assertEqual(self.send()[0],503);self.assertEqual(len(self.calls),0)
|
|
for path,method,headers,peer in [
|
|
(self.path.replace('/7/','/8/'),'GET',self.headers,'172.20.0.10'),
|
|
(self.path+'?other=1','GET',self.headers,'172.20.0.10'),
|
|
(self.path,'POST',self.headers,'172.20.0.10'),
|
|
(self.path,'GET',{'X-Internal-Service-Token':'wrong'},'172.20.0.10'),
|
|
(self.path,'GET',{**self.headers,'X-Request-Id':'other-order-request'},'172.20.0.10'),
|
|
(self.path,'GET',self.headers,'172.20.0.11'),
|
|
('/finance/internal/finance/v1/wallet/accounts/7','GET',self.headers,'172.20.0.10'),
|
|
('/iam/internal/iam/finance-customers?page=1','GET',self.headers,'172.20.0.10')]:
|
|
self.assertEqual(self.send(path,method,headers,peer)[0],201)
|
|
def test_expiry_needs_no_control_request_and_returns_to_pass(self):
|
|
self.router.set_mode('private-control','FINANCE',5)
|
|
path='/finance/internal/finance/v1/wallet/accounts/7'
|
|
self.assertEqual(self.send(path)[0],503)
|
|
self.now[0]=15.0
|
|
self.assertEqual(self.send(path)[0],201);self.assertEqual(self.router.status()['mode'],'PASS')
|
|
def test_public_warehouse_fault_is_bounded_by_exact_warehouse_request_and_order_identity(self):
|
|
self.router.set_mode('private-control','WAREHOUSE',60)
|
|
path='/warehouse/internal/warehouses/0/30/active'
|
|
self.assertEqual(self.send(path)[0],503)
|
|
for other,method,headers,peer in [
|
|
(path.replace('/30/','/31/'),'GET',self.headers,'172.20.0.10'),
|
|
(path.replace('/0/','/7/'),'GET',self.headers,'172.20.0.10'),
|
|
(path+'?extra=1','GET',self.headers,'172.20.0.10'),
|
|
(path,'POST',self.headers,'172.20.0.10'),
|
|
(path,'GET',{**self.headers,'X-Request-Id':'another-customer-request'},'172.20.0.10'),
|
|
(path,'GET',{**self.headers,'X-Internal-Service-Token':'wrong'},'172.20.0.10'),
|
|
(path,'GET',self.headers,'172.20.0.11')]:
|
|
self.assertEqual(self.send(other,method,headers,peer)[0],201)
|
|
self.now[0]=70.0
|
|
self.assertEqual(self.send(path)[0],201)
|
|
def test_invalid_receiving_warehouse_scope_is_rejected(self):
|
|
for value in ['0','../30','30?all=true','']:
|
|
with self.assertRaises(ValueError):p.Router({**self.config,'receivingWarehouseId':value})
|
|
def test_control_auth_and_malformed_authenticated_command(self):
|
|
self.router.set_mode('private-control','IAM',10)
|
|
with self.assertRaises(PermissionError):self.router.set_mode('wrong','PASS')
|
|
for mode,ttl in [('UNKNOWN',10),('IAM',0),('IAM',61),('IAM',True)]:
|
|
with self.assertRaises(ValueError):self.router.set_mode('private-control',mode,ttl)
|
|
self.assertEqual(self.router.status()['mode'],'PASS')
|
|
def test_evidence_contains_no_secret_headers_or_payload(self):
|
|
self.router.set_mode('private-control','IAM',10);self.send()
|
|
serialized=json.dumps(self.logs)
|
|
for secret in ['private-control','private-internal-token','original-body']:self.assertNotIn(secret,serialized)
|
|
self.assertTrue(self.logs[0]['internalTokenValidated']);self.assertFalse(self.logs[0]['forwarded'])
|
|
self.assertEqual(self.logs[0]['requestId'],'fixture-request')
|
|
def test_hop_headers_removed_but_identity_preserved(self):
|
|
headers=p.forward_headers({'connection':'x-hop','x-hop':'drop','Host':'old','X-Internal-Service-Token':'keep','Content-Length':'99'},3)
|
|
self.assertNotIn('x-hop',headers);self.assertNotIn('Host',headers)
|
|
self.assertEqual(headers['X-Internal-Service-Token'],'keep');self.assertEqual(headers['Content-Length'],'3')
|
|
result=unittest.TextTestRunner().run(unittest.defaultTestLoader.loadTestsFromTestCase(ProxyTests))
|
|
sys.exit(0 if result.wasSuccessful() else 1)
|
|
`
|
|
const result = spawnSync(process.env.PYTHON || 'python', ['-c', script,
|
|
fileURLToPath(new URL('./order-submit-dependency-fault-proxy.py', import.meta.url))],
|
|
{ encoding:'utf8', env:{...process.env,PYTHONDONTWRITEBYTECODE:'1'} })
|
|
assert.equal(result.status,0,result.stderr || result.error?.message)
|
|
assert.match(result.stderr,/Ran 8 tests/)
|
|
})
|