231 lines
8.9 KiB
TypeScript
231 lines
8.9 KiB
TypeScript
import { describe, expect, it, vi } from 'vitest';
|
|
|
|
import { validateBridgeMessage, validateBridgeTyping } from '../bridge.dto.js';
|
|
import { AppserviceIntent, MatrixApiError } from '../intent.js';
|
|
import { buildRegistration, registrationToYaml } from '../registration.js';
|
|
import { TransactionHandler } from '../transactions.js';
|
|
import type { AppserviceConfig, MatrixEvent } from '../types.js';
|
|
|
|
const cfg: AppserviceConfig = {
|
|
homeserverUrl: 'https://hs.example',
|
|
domain: 'hs.example',
|
|
asToken: 'as-secret',
|
|
hsToken: 'hs-secret',
|
|
};
|
|
|
|
const jsonResponse = (status: number, body: unknown): Response =>
|
|
new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json' } });
|
|
|
|
describe('TransactionHandler', () => {
|
|
const makeHandler = (onEvent = vi.fn()) => ({
|
|
onEvent,
|
|
handler: new TransactionHandler({ hsToken: 'hs-secret', onEvent }),
|
|
});
|
|
|
|
it('rejects a bad hs_token with M_FORBIDDEN', async () => {
|
|
const { handler, onEvent } = makeHandler();
|
|
const res = await handler.handle(
|
|
't1',
|
|
{ events: [{ type: 'm.room.message' }] },
|
|
{ authorizationHeader: 'Bearer wrong' },
|
|
);
|
|
expect(res.status).toBe(403);
|
|
expect(res.body.errcode).toBe('M_FORBIDDEN');
|
|
expect(onEvent).not.toHaveBeenCalled();
|
|
});
|
|
|
|
it('accepts Bearer auth and legacy access_token param', async () => {
|
|
const { handler } = makeHandler();
|
|
expect(
|
|
(await handler.handle('t1', { events: [] }, { authorizationHeader: 'Bearer hs-secret' }))
|
|
.status,
|
|
).toBe(200);
|
|
expect(
|
|
(await handler.handle('t2', { events: [] }, { accessTokenParam: 'hs-secret' })).status,
|
|
).toBe(200);
|
|
});
|
|
|
|
it('processes events once per txnId (idempotent retries)', async () => {
|
|
const { handler, onEvent } = makeHandler();
|
|
const body = { events: [{ type: 'm.room.message', event_id: '$e1' }] };
|
|
await handler.handle('t1', body, { authorizationHeader: 'Bearer hs-secret' });
|
|
const retry = await handler.handle('t1', body, { authorizationHeader: 'Bearer hs-secret' });
|
|
expect(retry.status).toBe(200);
|
|
expect(onEvent).toHaveBeenCalledTimes(1);
|
|
});
|
|
|
|
it('a throwing event handler does not fail the transaction', async () => {
|
|
const onError = vi.fn();
|
|
const handler = new TransactionHandler({
|
|
hsToken: 'hs-secret',
|
|
onEvent: () => {
|
|
throw new Error('boom');
|
|
},
|
|
onError,
|
|
});
|
|
const res = await handler.handle(
|
|
't1',
|
|
{ events: [{ type: 'x' }, { type: 'y' }] },
|
|
{ authorizationHeader: 'Bearer hs-secret' },
|
|
);
|
|
expect(res.status).toBe(200);
|
|
expect(onError).toHaveBeenCalledTimes(2);
|
|
});
|
|
});
|
|
|
|
describe('AppserviceIntent', () => {
|
|
it('derives namespaced user ids and rejects bad slugs', () => {
|
|
const intent = new AppserviceIntent(cfg);
|
|
expect(intent.agentUserId('pi0-web1')).toBe('@agent-pi0-web1:hs.example');
|
|
expect(intent.agentUserId('Pi0-Web1')).toBe('@agent-pi0-web1:hs.example');
|
|
expect(() => intent.agentUserId('../evil')).toThrow();
|
|
expect(() => intent.agentUserId('')).toThrow();
|
|
});
|
|
|
|
it('uses uuid transaction ids', async () => {
|
|
const calls: string[] = [];
|
|
const fetchMock = vi.fn(async (input: URL | string) => {
|
|
calls.push(new URL(String(input)).pathname);
|
|
return jsonResponse(200, {});
|
|
});
|
|
const intent = new AppserviceIntent(cfg, fetchMock as unknown as typeof fetch);
|
|
await intent.sendAsAgent({ roomId: '!r:hs.example', agent: 'pi0', body: 'x' });
|
|
const send = calls.find((p) => p.includes('/send/m.room.message/'));
|
|
expect(send).toMatch(/mosaic-as-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/);
|
|
});
|
|
|
|
it('registers once, impersonates via user_id, threads replies', async () => {
|
|
const calls: Array<{ url: URL; init: RequestInit }> = [];
|
|
const fetchMock = vi.fn(async (input: URL | string, init?: RequestInit) => {
|
|
calls.push({ url: new URL(String(input)), init: init ?? {} });
|
|
return jsonResponse(200, { event_id: '$sent' });
|
|
});
|
|
const intent = new AppserviceIntent(cfg, fetchMock as unknown as typeof fetch);
|
|
|
|
const eventId = await intent.sendAsAgent({
|
|
roomId: '!room:hs.example',
|
|
agent: 'pi0-web1',
|
|
body: 'hello',
|
|
threadRoot: '$req',
|
|
});
|
|
await intent.sendAsAgent({ roomId: '!room:hs.example', agent: 'pi0-web1', body: 'again' });
|
|
|
|
expect(eventId).toBe('$sent');
|
|
const paths = calls.map((c) => c.url.pathname);
|
|
expect(paths.filter((p) => p.endsWith('/register'))).toHaveLength(1); // cached
|
|
expect(paths.filter((p) => p.includes('/join'))).toHaveLength(1); // cached
|
|
|
|
const send = calls.find((c) => c.url.pathname.includes('/send/m.room.message/'));
|
|
expect(send).toBeDefined();
|
|
expect(send!.url.searchParams.get('user_id')).toBe('@agent-pi0-web1:hs.example');
|
|
const content = JSON.parse(String(send!.init.body)) as Record<string, unknown>;
|
|
const rel = content['m.relates_to'] as Record<string, unknown>;
|
|
expect(rel.rel_type).toBe('m.thread');
|
|
expect(rel.event_id).toBe('$req');
|
|
expect(rel.is_falling_back).toBe(true);
|
|
expect(
|
|
calls.every(
|
|
(c) => (c.init.headers as Record<string, string>).Authorization === 'Bearer as-secret',
|
|
),
|
|
).toBe(true);
|
|
});
|
|
|
|
it('tolerates M_USER_IN_USE and surfaces other register errors', async () => {
|
|
const inUse = vi.fn(async () =>
|
|
jsonResponse(400, { errcode: 'M_USER_IN_USE', error: 'taken' }),
|
|
);
|
|
const intent = new AppserviceIntent(cfg, inUse as unknown as typeof fetch);
|
|
await expect(intent.ensureRegistered('pi0-web1')).resolves.toBe('@agent-pi0-web1:hs.example');
|
|
|
|
const denied = vi.fn(async () =>
|
|
jsonResponse(401, { errcode: 'M_UNKNOWN_TOKEN', error: 'nope' }),
|
|
);
|
|
const intent2 = new AppserviceIntent(cfg, denied as unknown as typeof fetch);
|
|
await expect(intent2.ensureRegistered('pi0-web1')).rejects.toThrow(MatrixApiError);
|
|
});
|
|
|
|
it('invites then joins on M_FORBIDDEN join', async () => {
|
|
const paths: string[] = [];
|
|
const fetchMock = vi.fn(async (input: URL | string) => {
|
|
const url = new URL(String(input));
|
|
paths.push(url.pathname);
|
|
if (url.pathname.endsWith('/join') && paths.filter((p) => p.endsWith('/join')).length === 1) {
|
|
return jsonResponse(403, { errcode: 'M_FORBIDDEN', error: 'not invited' });
|
|
}
|
|
return jsonResponse(200, {});
|
|
});
|
|
const intent = new AppserviceIntent(cfg, fetchMock as unknown as typeof fetch);
|
|
await intent.ensureJoined('!room:hs.example', 'pi0-web1');
|
|
expect(paths.filter((p) => p.endsWith('/invite'))).toHaveLength(1);
|
|
expect(paths.filter((p) => p.endsWith('/join'))).toHaveLength(2);
|
|
});
|
|
});
|
|
|
|
describe('registration', () => {
|
|
it('builds an exclusive escaped user namespace', () => {
|
|
const reg = buildRegistration(cfg, { url: 'http://mosaic-as:8008' });
|
|
expect(reg.namespaces.users[0]).toEqual({
|
|
regex: '@agent-.*:hs\\.example',
|
|
exclusive: true,
|
|
});
|
|
expect(reg.rate_limited).toBe(false);
|
|
const yaml = registrationToYaml(reg);
|
|
expect(yaml).toContain("sender_localpart: 'mosaic-as'");
|
|
expect(yaml).toContain("as_token: 'as-secret'");
|
|
expect(yaml).toContain('exclusive: true');
|
|
});
|
|
});
|
|
|
|
describe('registration hardening', () => {
|
|
it('rejects control characters in registration values', () => {
|
|
const reg = buildRegistration(
|
|
{ ...cfg, asToken: 'abc\nhttp_injected: true' },
|
|
{ url: 'http://mosaic-as:8008' },
|
|
);
|
|
expect(() => registrationToYaml(reg)).toThrow(/control characters/);
|
|
});
|
|
|
|
it('escapes single quotes in token values', () => {
|
|
const reg = buildRegistration({ ...cfg, asToken: "it's" }, { url: 'http://mosaic-as:8008' });
|
|
expect(registrationToYaml(reg)).toContain("as_token: 'it''s'");
|
|
});
|
|
});
|
|
|
|
describe('bridge DTOs', () => {
|
|
it('validates message and typing payloads', () => {
|
|
expect(() =>
|
|
validateBridgeMessage({ room_id: '!r:hs', agent: 'pi0', body: 'x' }),
|
|
).not.toThrow();
|
|
expect(() => validateBridgeMessage({ room_id: 'bad', agent: 'pi0', body: 'x' })).toThrow();
|
|
expect(() => validateBridgeMessage({ room_id: '!r:hs', agent: '', body: 'x' })).toThrow();
|
|
expect(() => validateBridgeMessage({ room_id: '!r:hs', agent: '../evil', body: 'x' })).toThrow(
|
|
/agent must match/,
|
|
);
|
|
expect(() =>
|
|
validateBridgeTyping({ room_id: '!r:hs', agent: 'pi0', typing: true }),
|
|
).not.toThrow();
|
|
expect(() => validateBridgeTyping({ room_id: '!r:hs', agent: 'pi0', typing: 'yes' })).toThrow();
|
|
});
|
|
});
|
|
|
|
describe('event shape', () => {
|
|
it('transaction events flow through to the handler', async () => {
|
|
const seen: MatrixEvent[] = [];
|
|
const handler = new TransactionHandler({
|
|
hsToken: 'hs-secret',
|
|
onEvent: (e) => void seen.push(e),
|
|
});
|
|
await handler.handle(
|
|
't1',
|
|
{
|
|
events: [
|
|
{ type: 'm.room.message', room_id: '!r:hs', sender: '@u:hs', content: { body: 'hi' } },
|
|
],
|
|
},
|
|
{ authorizationHeader: 'Bearer hs-secret' },
|
|
);
|
|
expect(seen).toHaveLength(1);
|
|
expect(seen[0]!.content?.body).toBe('hi');
|
|
});
|
|
});
|