Alta-Proxy-Tool/test/alta-client.test.js

'use strict';

const test = require('node:test');
const assert = require('node:assert/strict');
const { SessionStore } = require('../src/session-store');
const { AltaClient } = require('../src/alta-client');

const ORIGIN = 'https://tenant.avasecurity.com';
const SENTINEL = 'HERMES_SENTINEL_SECRET';

function readyStore() {
  const store = new SessionStore();
  store.establish(ORIGIN, SENTINEL);
  return store;
}

function response(data, overrides = {}) {
  return { status: 200, headers: {}, data, ...overrides };
}

test('uses only stored authority, fixed endpoint paths and hardened transport options', async () => {
  const calls = [];
  const transport = async (options) => {
    calls.push(options);
    if (options.url.endsWith('/devices')) return response([]);
    if (options.url.endsWith('/deviceSites')) return response([{ id: 'site-1' }]);
    return response({ user: 'engineer' });
  };
  const client = new AltaClient({ sessionStore: readyStore(), transport });

  assert.deepEqual(await client.getDevices(), []);
  assert.deepEqual(await client.getDeviceSites(), [{ id: 'site-1' }]);
  assert.deepEqual(await client.getAuthInfo(), { user: 'engineer' });

  assert.deepEqual(calls.map((call) => call.url), [
    `${ORIGIN}/api/v1/devices`,
    `${ORIGIN}/api/v1/deviceSites`,
    `${ORIGIN}/api/v1/auth`,
  ]);
  for (const call of calls) {
    assert.equal(call.method, 'GET');
    assert.equal(call.proxy, false);
    assert.equal(call.maxRedirects, 0);
    assert.match(call.headers.Cookie, /^va=HERMES_SENTINEL_SECRET$/);
    assert.ok(call.timeout > 0 && call.timeout <= 10_000);
    assert.ok(call.maxResponseBytes > 0);
  }
});

test('rejects renderer-supplied URL/cookie parameters before transport', async () => {
  let calls = 0;
  const client = new AltaClient({
    sessionStore: readyStore(),
    transport: async () => { calls += 1; return response([]); },
  });

  await assert.rejects(
    client.getDevices({ deploymentUrl: 'https://evil.example', cookies: [SENTINEL] }),
    { code: 'INVALID_ALTA_ARGUMENTS' },
  );
  await assert.rejects(client.getAuthInfo(SENTINEL), { code: 'INVALID_ALTA_ARGUMENTS' });
  assert.equal(calls, 0);
});

test('allows only bounded exact-same-origin redirects', async () => {
  const seen = [];
  const transport = async (options) => {
    seen.push(options.url);
    if (seen.length === 1) {
      return response('', { status: 307, headers: { location: '/api/v1/devices?cursor=next' } });
    }
    return response([]);
  };
  const client = new AltaClient({ sessionStore: readyStore(), transport });
  assert.deepEqual(await client.getDevices(), []);
  assert.deepEqual(seen, [
    `${ORIGIN}/api/v1/devices`,
    `${ORIGIN}/api/v1/devices?cursor=next`,
  ]);

  for (const location of [
    'https://evil.example/steal',
    'https://other.avasecurity.com/api/v1/devices',
    'http://tenant.avasecurity.com/api/v1/devices',
    '//evil.example/steal',
    `https://user:pass@tenant.avasecurity.com/api/v1/devices`,
    `${ORIGIN}/api/v1/devices#not-sent-to-server`,
  ]) {
    let count = 0;
    const blocked = new AltaClient({
      sessionStore: readyStore(),
      transport: async () => {
        count += 1;
        return response('', { status: 302, headers: { location } });
      },
    });
    await assert.rejects(blocked.getDevices(), { code: 'UNSAFE_ALTA_REDIRECT' });
    assert.equal(count, 1, location);
  }
});

test('enforces redirect limit and rejects redirects without locations', async () => {
  const looping = new AltaClient({
    sessionStore: readyStore(),
    maxRedirects: 2,
    transport: async () => response('', { status: 302, headers: { location: '/api/v1/devices' } }),
  });
  await assert.rejects(looping.getDevices(), { code: 'TOO_MANY_ALTA_REDIRECTS' });

  const missing = new AltaClient({
    sessionStore: readyStore(),
    transport: async () => response('', { status: 302, headers: {} }),
  });
  await assert.rejects(missing.getDevices(), { code: 'UNSAFE_ALTA_REDIRECT' });
});

test('enforces a total timeout even when injected transport does not cooperate', async () => {
  const client = new AltaClient({
    sessionStore: readyStore(),
    timeoutMs: 25,
    transport: async () => new Promise(() => {}),
  });
  await assert.rejects(client.getDevices(), { code: 'ALTA_TIMEOUT', timeout: true });
});

test('rejects oversized responses using content-length and actual data size', async () => {
  const byHeader = new AltaClient({
    sessionStore: readyStore(),
    maxResponseBytes: 32,
    transport: async () => response([], { headers: { 'content-length': '33' } }),
  });
  await assert.rejects(byHeader.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });

  const byBody = new AltaClient({
    sessionStore: readyStore(),
    maxResponseBytes: 32,
    transport: async () => response(JSON.stringify([{ value: 'x'.repeat(40) }])),
  });
  await assert.rejects(byBody.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });

  for (const status of [302, 500]) {
    const oversizedFailure = new AltaClient({
      sessionStore: readyStore(),
      maxResponseBytes: 32,
      transport: async () => response('x'.repeat(33), {
        status,
        headers: status === 302 ? { location: '/api/v1/devices' } : {},
      }),
    });
    await assert.rejects(oversizedFailure.getDevices(), { code: 'ALTA_RESPONSE_TOO_LARGE' });
  }
});

test('rejects malformed response envelopes, JSON, status and endpoint data shapes', async () => {
  const cases = [
    [undefined, 'INVALID_ALTA_RESPONSE'],
    [response('{broken'), 'INVALID_ALTA_RESPONSE_DATA'],
    [response([], { status: 500 }), 'ALTA_HTTP_ERROR'],
    [response({ not: 'an array' }), 'INVALID_ALTA_RESPONSE_DATA'],
  ];
  for (const [value, code] of cases) {
    const client = new AltaClient({ sessionStore: readyStore(), transport: async () => value });
    await assert.rejects(client.getDevices(), { code });
  }

  const authClient = new AltaClient({ sessionStore: readyStore(), transport: async () => response([]) });
  await assert.rejects(authClient.getAuthInfo(), { code: 'INVALID_ALTA_RESPONSE_DATA' });
});

test('revalidates the stored origin before each request', async () => {
  const store = { requireSession: () => Object.freeze({ origin: 'https://evil.example', cookie: SENTINEL }) };
  let called = false;
  const client = new AltaClient({ sessionStore: store, transport: async () => { called = true; } });
  await assert.rejects(client.getDevices(), { code: 'INVALID_ALTA_ORIGIN' });
  assert.equal(called, false);
});