|
| 1 | +/** |
| 2 | + * @vitest-environment node |
| 3 | + * |
| 4 | + * The HubSpot `properties` and `pipelines` selector routes assemble their |
| 5 | + * provider URL *here*, from a query parameter, so the reflective `request.url` |
| 6 | + * probe in `tools/hubspot/path_safety.test.ts` cannot see them. |
| 7 | + * |
| 8 | + * `objectType` is genuinely caller-supplied — the contract constrains it only |
| 9 | + * to a non-empty string, and the selector resolves it from the free-text |
| 10 | + * `customObjectTypeId` trigger field. `BUILT_IN_PATH` maps the four known |
| 11 | + * slugs to a safe constant, but the `?? objectType` fallback puts the raw value |
| 12 | + * straight into a path segment. `encodeURIComponent` does not help: `.` and |
| 13 | + * `..` are unreserved, and the WHATWG parser removes a dot segment *after* |
| 14 | + * percent-decoding, so `objectType='..'` re-aims the request one level up with |
| 15 | + * the caller's HubSpot bearer token still attached. |
| 16 | + * |
| 17 | + * Every assertion resolves the outgoing URL through `new URL(...)`, the same |
| 18 | + * normalization `fetch` applies, and compares whole-pathname segment shape |
| 19 | + * rather than the template text. |
| 20 | + */ |
| 21 | +import { createMockRequest } from '@sim/testing' |
| 22 | +import { beforeEach, describe, expect, it, vi } from 'vitest' |
| 23 | + |
| 24 | +const { mockAuthorizeCredentialUse, mockRefreshAccessToken } = vi.hoisted(() => ({ |
| 25 | + mockAuthorizeCredentialUse: vi.fn(), |
| 26 | + mockRefreshAccessToken: vi.fn(), |
| 27 | +})) |
| 28 | + |
| 29 | +vi.mock('@/lib/auth/credential-access', () => ({ |
| 30 | + authorizeCredentialUse: mockAuthorizeCredentialUse, |
| 31 | +})) |
| 32 | + |
| 33 | +vi.mock('@/lib/oauth/credential-service', () => ({ |
| 34 | + refreshAccessTokenIfNeeded: mockRefreshAccessToken, |
| 35 | +})) |
| 36 | + |
| 37 | +import { GET as GET_PIPELINES } from '@/app/api/tools/hubspot/pipelines/route' |
| 38 | +import { GET as GET_PROPERTIES } from '@/app/api/tools/hubspot/properties/route' |
| 39 | + |
| 40 | +const ORIGIN = 'https://api.hubapi.com' |
| 41 | +const CREDENTIAL_ID = 'cred-1' |
| 42 | + |
| 43 | +/** |
| 44 | + * Values that must be rejected outright. `' .. '` is included because a |
| 45 | + * padded dot segment is only inert if nothing later trims it. |
| 46 | + */ |
| 47 | +const REJECTED = ['..', '.', '%2e%2e', 'a/b', ' .. ', '..%2f..', '../..'] as const |
| 48 | + |
| 49 | +/** |
| 50 | + * The three legal `objectType` spellings from HubSpot's Schemas API — |
| 51 | + * portal-qualified custom object, `{meta-type}-{unique id}`, and a bare custom |
| 52 | + * object name — plus the built-in slug that maps through `BUILT_IN_PATH`. |
| 53 | + */ |
| 54 | +const LEGITIMATE = ['p7878787_my_object', '2-123456', '0-1', 'my_object'] as const |
| 55 | + |
| 56 | +let fetchMock: ReturnType<typeof vi.fn> |
| 57 | + |
| 58 | +beforeEach(() => { |
| 59 | + vi.clearAllMocks() |
| 60 | + mockAuthorizeCredentialUse.mockResolvedValue({ |
| 61 | + ok: true, |
| 62 | + credentialOwnerUserId: 'user-1', |
| 63 | + resolvedCredentialId: CREDENTIAL_ID, |
| 64 | + }) |
| 65 | + mockRefreshAccessToken.mockResolvedValue('inert-token') |
| 66 | + fetchMock = vi.fn().mockResolvedValue({ |
| 67 | + ok: true, |
| 68 | + status: 200, |
| 69 | + json: async () => ({ results: [] }), |
| 70 | + text: async () => '', |
| 71 | + }) |
| 72 | + vi.stubGlobal('fetch', fetchMock) |
| 73 | +}) |
| 74 | + |
| 75 | +function request(path: string, objectType: string) { |
| 76 | + const url = new URL(`http://localhost:3000/api/tools/hubspot/${path}`) |
| 77 | + url.searchParams.set('credentialId', CREDENTIAL_ID) |
| 78 | + url.searchParams.set('objectType', objectType) |
| 79 | + return createMockRequest('GET', undefined, {}, url.toString()) |
| 80 | +} |
| 81 | + |
| 82 | +function outgoingUrl(): URL { |
| 83 | + expect(fetchMock).toHaveBeenCalledTimes(1) |
| 84 | + return new URL(fetchMock.mock.calls[0][0] as string) |
| 85 | +} |
| 86 | + |
| 87 | +const ROUTES = [ |
| 88 | + { name: 'properties', handler: GET_PROPERTIES, collection: 'properties' }, |
| 89 | + { name: 'pipelines', handler: GET_PIPELINES, collection: 'pipelines' }, |
| 90 | +] as const |
| 91 | + |
| 92 | +describe.each(ROUTES)( |
| 93 | + 'GET /api/tools/hubspot/$name path safety', |
| 94 | + ({ name, handler, collection }) => { |
| 95 | + it('maps a built-in slug to its documented plural constant', async () => { |
| 96 | + const response = await handler(request(name, 'contact')) |
| 97 | + expect(response.status).toBe(200) |
| 98 | + |
| 99 | + const url = outgoingUrl() |
| 100 | + expect(url.origin).toBe(ORIGIN) |
| 101 | + expect(url.pathname.split('/')).toEqual(['', 'crm', 'v3', collection, 'contacts']) |
| 102 | + expect([...url.searchParams.keys()]).toEqual([]) |
| 103 | + }) |
| 104 | + |
| 105 | + it.each(LEGITIMATE)('passes %j through byte-identically', async (objectType) => { |
| 106 | + const response = await handler(request(name, objectType)) |
| 107 | + expect(response.status).toBe(200) |
| 108 | + |
| 109 | + const url = outgoingUrl() |
| 110 | + expect(fetchMock.mock.calls[0][0]).toBe(`${ORIGIN}/crm/v3/${collection}/${objectType}`) |
| 111 | + expect(url.pathname.split('/')).toEqual(['', 'crm', 'v3', collection, objectType]) |
| 112 | + }) |
| 113 | + |
| 114 | + it.each(REJECTED)( |
| 115 | + 'rejects objectType=%j with a 400 and never calls HubSpot', |
| 116 | + async (objectType) => { |
| 117 | + const response = await handler(request(name, objectType)) |
| 118 | + |
| 119 | + expect(response.status).toBe(400) |
| 120 | + expect((await response.json()).error).toMatch(/objectType/) |
| 121 | + expect(fetchMock).not.toHaveBeenCalled() |
| 122 | + } |
| 123 | + ) |
| 124 | + } |
| 125 | +) |
0 commit comments