702 lines
26 KiB
Go
702 lines
26 KiB
Go
package handler
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/hmac"
|
|
"crypto/sha256"
|
|
"encoding/hex"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/jackc/pgx/v5/pgtype"
|
|
db "github.com/multica-ai/multica/server/pkg/db/generated"
|
|
)
|
|
|
|
// ── Setup helpers ───────────────────────────────────────────────────────────
|
|
|
|
const testSigningSecret = "this-is-a-test-secret-32-chars-x"
|
|
|
|
func setSigningSecretViaHandler(t *testing.T, apID, triggerID, secret string) {
|
|
t.Helper()
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("PUT", fmt.Sprintf("/api/autopilots/%s/triggers/%s/signing-secret", apID, triggerID), map[string]any{
|
|
"signing_secret": secret,
|
|
})
|
|
req = withURLParams(req, "id", apID, "triggerId", triggerID)
|
|
testHandler.SetAutopilotTriggerSigningSecret(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("set signing secret: %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
func setTriggerProvider(t *testing.T, triggerID, provider string) {
|
|
t.Helper()
|
|
if _, err := testPool.Exec(context.Background(),
|
|
`UPDATE autopilot_trigger SET provider = $1 WHERE id = $2`, provider, triggerID); err != nil {
|
|
t.Fatalf("set provider: %v", err)
|
|
}
|
|
}
|
|
|
|
func signBody(secret string, body []byte) string {
|
|
mac := hmac.New(sha256.New, []byte(secret))
|
|
mac.Write(body)
|
|
return "sha256=" + hex.EncodeToString(mac.Sum(nil))
|
|
}
|
|
|
|
// listDeliveries calls ListAutopilotDeliveries and decodes the body.
|
|
func listDeliveries(t *testing.T, apID string) []map[string]any {
|
|
t.Helper()
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("GET", "/api/autopilots/"+apID+"/deliveries", nil)
|
|
req = withURLParam(req, "id", apID)
|
|
testHandler.ListAutopilotDeliveries(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("list deliveries: %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp struct {
|
|
Deliveries []map[string]any `json:"deliveries"`
|
|
}
|
|
if err := json.Unmarshal(w.Body.Bytes(), &resp); err != nil {
|
|
t.Fatalf("decode: %v", err)
|
|
}
|
|
return resp.Deliveries
|
|
}
|
|
|
|
// ── Tests ───────────────────────────────────────────────────────────────────
|
|
|
|
func TestWebhookHandler_PersistsDeliveryOnAccept(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "DeliveryPersist Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"hello": "world"}, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("status: %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if resp["delivery_id"] == nil {
|
|
t.Fatal("response should include delivery_id")
|
|
}
|
|
if resp["status"] != "accepted" {
|
|
t.Fatalf("status: %v", resp["status"])
|
|
}
|
|
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 {
|
|
t.Fatalf("expected 1 delivery, got %d", len(deliveries))
|
|
}
|
|
d := deliveries[0]
|
|
if d["status"] != "dispatched" {
|
|
t.Fatalf("delivery status: %v", d["status"])
|
|
}
|
|
if d["autopilot_run_id"] == nil {
|
|
t.Fatal("delivery should link to run")
|
|
}
|
|
if d["signature_status"] != "not_required" {
|
|
t.Fatalf("expected signature_status=not_required, got %v", d["signature_status"])
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_DedupeViaIdempotencyKey(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "DeliveryIdem Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
body := map[string]any{"event": "demo.x", "eventPayload": map[string]any{"k": "v"}}
|
|
headers := map[string]string{"Idempotency-Key": "demo-key-1"}
|
|
|
|
w1 := postWebhook(t, *trig.WebhookToken, body, headers)
|
|
if w1.Code != http.StatusOK {
|
|
t.Fatalf("first: %d body=%s", w1.Code, w1.Body.String())
|
|
}
|
|
var r1 map[string]any
|
|
json.Unmarshal(w1.Body.Bytes(), &r1)
|
|
if r1["status"] != "accepted" {
|
|
t.Fatalf("first status: %v", r1["status"])
|
|
}
|
|
firstDeliveryID := r1["delivery_id"].(string)
|
|
firstRunID := r1["run_id"].(string)
|
|
|
|
// Second identical delivery should be a duplicate.
|
|
w2 := postWebhook(t, *trig.WebhookToken, body, headers)
|
|
if w2.Code != http.StatusOK {
|
|
t.Fatalf("second: %d body=%s", w2.Code, w2.Body.String())
|
|
}
|
|
var r2 map[string]any
|
|
json.Unmarshal(w2.Body.Bytes(), &r2)
|
|
if r2["status"] != "duplicate" {
|
|
t.Fatalf("expected duplicate, got %v body=%s", r2["status"], w2.Body.String())
|
|
}
|
|
if r2["delivery_id"] != firstDeliveryID {
|
|
t.Fatalf("duplicate delivery_id mismatch: %v != %v", r2["delivery_id"], firstDeliveryID)
|
|
}
|
|
if r2["run_id"] != firstRunID {
|
|
t.Fatalf("duplicate run_id mismatch: %v != %v", r2["run_id"], firstRunID)
|
|
}
|
|
|
|
// Only one delivery should exist; attempt_count must be 2.
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 {
|
|
t.Fatalf("expected 1 delivery (dedupe), got %d", len(deliveries))
|
|
}
|
|
if int(deliveries[0]["attempt_count"].(float64)) != 2 {
|
|
t.Fatalf("attempt_count: %v", deliveries[0]["attempt_count"])
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_DedupeViaGitHubDelivery(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "DeliveryGH Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setTriggerProvider(t, trig.ID, "github")
|
|
|
|
body := map[string]any{"action": "opened"}
|
|
headers := map[string]string{
|
|
"X-GitHub-Event": "pull_request",
|
|
"X-GitHub-Delivery": "abc-123",
|
|
}
|
|
|
|
w1 := postWebhook(t, *trig.WebhookToken, body, headers)
|
|
if w1.Code != http.StatusOK {
|
|
t.Fatalf("first: %d", w1.Code)
|
|
}
|
|
var r1 map[string]any
|
|
json.Unmarshal(w1.Body.Bytes(), &r1)
|
|
if r1["status"] != "accepted" {
|
|
t.Fatalf("first status: %v", r1["status"])
|
|
}
|
|
|
|
w2 := postWebhook(t, *trig.WebhookToken, body, headers)
|
|
var r2 map[string]any
|
|
json.Unmarshal(w2.Body.Bytes(), &r2)
|
|
if r2["status"] != "duplicate" {
|
|
t.Fatalf("expected duplicate, got %v", r2["status"])
|
|
}
|
|
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 {
|
|
t.Fatalf("expected 1 delivery, got %d", len(deliveries))
|
|
}
|
|
if deliveries[0]["dedupe_source"] != "x-github-delivery" {
|
|
t.Fatalf("dedupe_source: %v", deliveries[0]["dedupe_source"])
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_InvalidSignatureReturns401AndPersistsRejected(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigInvalid Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
body := map[string]any{"hello": "world"}
|
|
w := postWebhook(t, *trig.WebhookToken, body, map[string]string{
|
|
"X-Hub-Signature-256": "sha256=deadbeef",
|
|
})
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("expected 401, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if resp["status"] != "rejected" {
|
|
t.Fatalf("status: %v", resp["status"])
|
|
}
|
|
if resp["delivery_id"] == nil {
|
|
t.Fatal("delivery_id should be present on rejected response")
|
|
}
|
|
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 {
|
|
t.Fatalf("expected 1 delivery, got %d", len(deliveries))
|
|
}
|
|
if deliveries[0]["status"] != "rejected" {
|
|
t.Fatalf("expected rejected, got %v", deliveries[0]["status"])
|
|
}
|
|
if deliveries[0]["signature_status"] != "invalid" {
|
|
t.Fatalf("expected signature_status=invalid, got %v", deliveries[0]["signature_status"])
|
|
}
|
|
if deliveries[0]["autopilot_run_id"] != nil {
|
|
t.Fatal("rejected delivery must not link to a run")
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_MissingSignatureReturns401WhenSecretSet(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigMissing Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"hello": "world"}, nil)
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("expected 401, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if resp["reason"] != "missing_signature" {
|
|
t.Fatalf("reason: %v", resp["reason"])
|
|
}
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 || deliveries[0]["signature_status"] != "missing" {
|
|
t.Fatalf("delivery missing-signature state: %#v", deliveries)
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_ValidSignatureDispatches(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigValid Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
bodyBytes := []byte(`{"hello":"world"}`)
|
|
sig := signBody(testSigningSecret, bodyBytes)
|
|
|
|
w := postWebhook(t, *trig.WebhookToken, bodyBytes, map[string]string{
|
|
"X-Hub-Signature-256": sig,
|
|
})
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if resp["status"] != "accepted" {
|
|
t.Fatalf("status: %v", resp["status"])
|
|
}
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 {
|
|
t.Fatalf("expected 1 delivery, got %d", len(deliveries))
|
|
}
|
|
if deliveries[0]["signature_status"] != "valid" {
|
|
t.Fatalf("signature_status: %v", deliveries[0]["signature_status"])
|
|
}
|
|
}
|
|
|
|
func TestSigningSecretNotEchoedInTriggerResponse(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigEcho Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
// GET the autopilot — trigger response embedded.
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("GET", "/api/autopilots/"+apID, nil)
|
|
req = withURLParam(req, "id", apID)
|
|
testHandler.GetAutopilot(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("get autopilot: %d", w.Code)
|
|
}
|
|
if bytes.Contains(w.Body.Bytes(), []byte(testSigningSecret)) {
|
|
t.Fatalf("signing secret leaked in trigger response: %s", w.Body.String())
|
|
}
|
|
if !bytes.Contains(w.Body.Bytes(), []byte(`"has_signing_secret":true`)) {
|
|
t.Fatalf("has_signing_secret should be true: %s", w.Body.String())
|
|
}
|
|
if !bytes.Contains(w.Body.Bytes(), []byte(`"signing_secret_hint":"`+testSigningSecret[len(testSigningSecret)-4:]+`"`)) {
|
|
t.Fatalf("hint should be last 4 chars: %s", w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestSigningSecret_MinLengthEnforced(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigMinLen Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("PUT", "/api/autopilots/"+apID+"/triggers/"+trig.ID+"/signing-secret", map[string]any{
|
|
"signing_secret": "short",
|
|
})
|
|
req = withURLParams(req, "id", apID, "triggerId", trig.ID)
|
|
testHandler.SetAutopilotTriggerSigningSecret(w, req)
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 for short secret, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestSigningSecret_EmptyClearsSecret(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigClear Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
// Now clear with empty string.
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("PUT", "/api/autopilots/"+apID+"/triggers/"+trig.ID+"/signing-secret", map[string]any{
|
|
"signing_secret": "",
|
|
})
|
|
req = withURLParams(req, "id", apID, "triggerId", trig.ID)
|
|
testHandler.SetAutopilotTriggerSigningSecret(w, req)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("clear secret: %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
// Unsigned request should now go through (back to not_required).
|
|
post := postWebhook(t, *trig.WebhookToken, map[string]any{"x": 1}, nil)
|
|
if post.Code != http.StatusOK {
|
|
t.Fatalf("post after clear: %d body=%s", post.Code, post.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestReplay_CreatesNewDeliveryAndDispatchesRun(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "Replay Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
// Original delivery (with dedupe key) → accepted + dispatched.
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"hello": "world"}, map[string]string{
|
|
"Idempotency-Key": "replay-original",
|
|
})
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("original: %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var orig map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &orig)
|
|
originalID := orig["delivery_id"].(string)
|
|
originalRunID := orig["run_id"].(string)
|
|
|
|
// Replay the original.
|
|
wr := httptest.NewRecorder()
|
|
req := newRequest("POST", fmt.Sprintf("/api/autopilots/%s/deliveries/%s/replay", apID, originalID), nil)
|
|
req = withURLParams(req, "id", apID, "deliveryId", originalID)
|
|
testHandler.ReplayAutopilotDelivery(wr, req)
|
|
if wr.Code != http.StatusCreated {
|
|
t.Fatalf("replay: %d body=%s", wr.Code, wr.Body.String())
|
|
}
|
|
var replay map[string]any
|
|
json.Unmarshal(wr.Body.Bytes(), &replay)
|
|
if replay["id"] == originalID {
|
|
t.Fatal("replay should create a NEW delivery, not return the original")
|
|
}
|
|
if replay["replayed_from_delivery_id"] != originalID {
|
|
t.Fatalf("replayed_from_delivery_id: %v", replay["replayed_from_delivery_id"])
|
|
}
|
|
if replay["autopilot_run_id"] == nil {
|
|
t.Fatal("replay should dispatch a run")
|
|
}
|
|
if replay["autopilot_run_id"] == originalRunID {
|
|
t.Fatal("replay should produce a NEW run, not reuse the original")
|
|
}
|
|
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 2 {
|
|
t.Fatalf("expected 2 deliveries (original + replay), got %d", len(deliveries))
|
|
}
|
|
}
|
|
|
|
func TestReplay_RejectsInvalidSignatureDelivery(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "ReplayReject Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
// Send an invalid-signature request → rejected delivery created.
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"x": 1}, map[string]string{
|
|
"X-Hub-Signature-256": "sha256=baadf00d",
|
|
})
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("setup: expected 401, got %d", w.Code)
|
|
}
|
|
var rej map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &rej)
|
|
rejectedID := rej["delivery_id"].(string)
|
|
|
|
// Replay the rejected delivery → 400.
|
|
wr := httptest.NewRecorder()
|
|
req := newRequest("POST", fmt.Sprintf("/api/autopilots/%s/deliveries/%s/replay", apID, rejectedID), nil)
|
|
req = withURLParams(req, "id", apID, "deliveryId", rejectedID)
|
|
testHandler.ReplayAutopilotDelivery(wr, req)
|
|
if wr.Code != http.StatusBadRequest {
|
|
t.Fatalf("replay of rejected: expected 400, got %d body=%s", wr.Code, wr.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestGetDelivery_ReturnsFullPayload(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "DeliveryDetail Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"event": "demo", "eventPayload": map[string]any{"answer": 42}}, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("seed: %d", w.Code)
|
|
}
|
|
var seed map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &seed)
|
|
deliveryID := seed["delivery_id"].(string)
|
|
|
|
// List response should NOT include raw_body / selected_headers.
|
|
wList := httptest.NewRecorder()
|
|
reqList := newRequest("GET", "/api/autopilots/"+apID+"/deliveries", nil)
|
|
reqList = withURLParam(reqList, "id", apID)
|
|
testHandler.ListAutopilotDeliveries(wList, reqList)
|
|
if bytes.Contains(wList.Body.Bytes(), []byte(`"raw_body"`)) {
|
|
t.Fatalf("list response should not include raw_body, body=%s", wList.Body.String())
|
|
}
|
|
|
|
// Detail response SHOULD include raw_body and selected_headers.
|
|
wDetail := httptest.NewRecorder()
|
|
reqDetail := newRequest("GET", "/api/autopilots/"+apID+"/deliveries/"+deliveryID, nil)
|
|
reqDetail = withURLParams(reqDetail, "id", apID, "deliveryId", deliveryID)
|
|
testHandler.GetAutopilotDelivery(wDetail, reqDetail)
|
|
if wDetail.Code != http.StatusOK {
|
|
t.Fatalf("detail: %d body=%s", wDetail.Code, wDetail.Body.String())
|
|
}
|
|
// raw_body is serialised as a JSON string (escaped); decode the response
|
|
// and assert against the decoded payload so we don't rely on a brittle
|
|
// substring search against the escaped form.
|
|
var detail WebhookDeliveryResponse
|
|
if err := json.Unmarshal(wDetail.Body.Bytes(), &detail); err != nil {
|
|
t.Fatalf("decode detail: %v body=%s", err, wDetail.Body.String())
|
|
}
|
|
if detail.RawBody == nil {
|
|
t.Fatalf("detail should include raw_body: %s", wDetail.Body.String())
|
|
}
|
|
var raw map[string]any
|
|
if err := json.Unmarshal([]byte(*detail.RawBody), &raw); err != nil {
|
|
t.Fatalf("raw_body should be valid JSON: %v body=%q", err, *detail.RawBody)
|
|
}
|
|
payload, ok := raw["eventPayload"].(map[string]any)
|
|
if !ok {
|
|
t.Fatalf("eventPayload missing or wrong type in raw_body: %#v", raw)
|
|
}
|
|
if v, ok := payload["answer"].(float64); !ok || v != 42 {
|
|
t.Fatalf("raw_body eventPayload.answer should be 42, got %#v", payload["answer"])
|
|
}
|
|
}
|
|
|
|
func TestGetDelivery_CrossAutopilotReturns404(t *testing.T) {
|
|
// A delivery_id from one autopilot must not be readable via another
|
|
// autopilot's URL — defense in depth even though both rows are in the
|
|
// same workspace.
|
|
agentID := createWebhookTestAgent(t, "CrossAP Agent")
|
|
apA := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
apB := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apA)
|
|
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"x": 1}, nil)
|
|
var seed map[string]any
|
|
json.Unmarshal(w.Body.Bytes(), &seed)
|
|
deliveryID := seed["delivery_id"].(string)
|
|
|
|
// Try reading via the OTHER autopilot's URL.
|
|
wDetail := httptest.NewRecorder()
|
|
reqDetail := newRequest("GET", "/api/autopilots/"+apB+"/deliveries/"+deliveryID, nil)
|
|
reqDetail = withURLParams(reqDetail, "id", apB, "deliveryId", deliveryID)
|
|
testHandler.GetAutopilotDelivery(wDetail, reqDetail)
|
|
if wDetail.Code != http.StatusNotFound {
|
|
t.Fatalf("cross-autopilot GET: expected 404, got %d", wDetail.Code)
|
|
}
|
|
}
|
|
|
|
func TestCreateAutopilotTrigger_RejectsUnknownProvider(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "ProviderInvalid Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("POST", "/api/autopilots/"+apID+"/triggers", map[string]any{
|
|
"kind": "webhook",
|
|
"provider": "stripe",
|
|
})
|
|
req = withURLParam(req, "id", apID)
|
|
testHandler.CreateAutopilotTrigger(w, req)
|
|
if w.Code != http.StatusBadRequest {
|
|
t.Fatalf("expected 400 for unknown provider, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestCreateAutopilotTrigger_AcceptsGitHubProvider(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "ProviderGH Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
|
|
w := httptest.NewRecorder()
|
|
req := newRequest("POST", "/api/autopilots/"+apID+"/triggers", map[string]any{
|
|
"kind": "webhook",
|
|
"provider": "github",
|
|
})
|
|
req = withURLParam(req, "id", apID)
|
|
testHandler.CreateAutopilotTrigger(w, req)
|
|
if w.Code != http.StatusCreated {
|
|
t.Fatalf("expected 201, got %d body=%s", w.Code, w.Body.String())
|
|
}
|
|
var resp AutopilotTriggerResponse
|
|
json.Unmarshal(w.Body.Bytes(), &resp)
|
|
if resp.Provider == nil || *resp.Provider != "github" {
|
|
t.Fatalf("provider: %v", resp.Provider)
|
|
}
|
|
}
|
|
|
|
// run_only autopilots have no issue-title duplicate guard, so dedupe via
|
|
// the delivery layer is the only thing keeping a retried provider event
|
|
// from re-running the agent. This regression test pins that path
|
|
// explicitly — it's the largest concrete win over the v1 ingress flow.
|
|
func TestWebhookHandler_RunOnlyDedupeOnGitHubDelivery(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "RunOnlyDedupe Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setTriggerProvider(t, trig.ID, "github")
|
|
|
|
headers := map[string]string{
|
|
"X-GitHub-Event": "pull_request",
|
|
"X-GitHub-Delivery": "pin-redelivery",
|
|
}
|
|
body := map[string]any{"action": "opened"}
|
|
|
|
postWebhook(t, *trig.WebhookToken, body, headers)
|
|
postWebhook(t, *trig.WebhookToken, body, headers)
|
|
postWebhook(t, *trig.WebhookToken, body, headers)
|
|
|
|
// Count autopilot_run rows linked to this trigger.
|
|
rows, err := testHandler.Queries.ListAutopilotRuns(context.Background(), db.ListAutopilotRunsParams{
|
|
AutopilotID: parseUUID(apID),
|
|
Limit: 50,
|
|
Offset: 0,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("list runs: %v", err)
|
|
}
|
|
runCount := 0
|
|
for _, r := range rows {
|
|
if r.TriggerID.Valid && uuidToString(r.TriggerID) == trig.ID {
|
|
runCount++
|
|
}
|
|
}
|
|
if runCount != 1 {
|
|
t.Fatalf("expected exactly 1 run from 3 retried deliveries, got %d", runCount)
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_InvalidSignatureCountsAgainstRateLimit(t *testing.T) {
|
|
// A stream of bad-signature attempts must not let an attacker bypass
|
|
// per-token rate limiting; the limiter increment happens before
|
|
// signature check.
|
|
agentID := createWebhookTestAgent(t, "SigRateLimit Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
setSigningSecretViaHandler(t, apID, trig.ID, testSigningSecret)
|
|
|
|
prev := testHandler.WebhookRateLimiter
|
|
testHandler.WebhookRateLimiter = NewMemoryWebhookRateLimiter(WebhookRateLimit{Limit: 2, Window: 60_000_000_000})
|
|
t.Cleanup(func() { testHandler.WebhookRateLimiter = prev })
|
|
|
|
bad := map[string]string{"X-Hub-Signature-256": "sha256=baad"}
|
|
for i := 0; i < 2; i++ {
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"i": i}, bad)
|
|
if w.Code != http.StatusUnauthorized {
|
|
t.Fatalf("request %d: expected 401, got %d", i, w.Code)
|
|
}
|
|
}
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"i": "third"}, bad)
|
|
if w.Code != http.StatusTooManyRequests {
|
|
t.Fatalf("third request expected 429 (rate-limited despite bad sig), got %d", w.Code)
|
|
}
|
|
}
|
|
|
|
func TestWebhookHandler_IgnoredPathStillPersistsDelivery(t *testing.T) {
|
|
// An ignored delivery (paused autopilot) must still leave a row so the
|
|
// operator can see "yes the request arrived, here's why we did nothing".
|
|
agentID := createWebhookTestAgent(t, "IgnoredPersist Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "paused", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
w := postWebhook(t, *trig.WebhookToken, map[string]any{"x": 1}, nil)
|
|
if w.Code != http.StatusOK {
|
|
t.Fatalf("expected 200, got %d", w.Code)
|
|
}
|
|
deliveries := listDeliveries(t, apID)
|
|
if len(deliveries) != 1 {
|
|
t.Fatalf("expected 1 delivery on paused autopilot, got %d", len(deliveries))
|
|
}
|
|
if deliveries[0]["status"] != "ignored" {
|
|
t.Fatalf("status: %v", deliveries[0]["status"])
|
|
}
|
|
}
|
|
|
|
// A `failed` delivery (e.g. transient dispatch error) must NOT permanently
|
|
// dedupe-block the provider's retry of the same event. GitHub keeps
|
|
// `X-GitHub-Delivery` stable across retries; if the unique index trapped
|
|
// the `failed` row, the second attempt would come back as `duplicate` and
|
|
// the event would be lost.
|
|
//
|
|
// The handler-level failure path is hard to force in tests (most reasons
|
|
// route through the admission check and produce a skipped run instead),
|
|
// so we exercise the partial unique index directly: insert a `failed`
|
|
// row, then a fresh `dispatched` row with the same dedupe_key — the
|
|
// index excludes both `rejected` and `failed`, so both INSERTs must
|
|
// succeed.
|
|
func TestWebhookDelivery_FailedRowDoesNotBlockDedupe(t *testing.T) {
|
|
ctx := context.Background()
|
|
agentID := createWebhookTestAgent(t, "FailedRetry Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
first, err := testHandler.Queries.CreateWebhookDelivery(ctx, db.CreateWebhookDeliveryParams{
|
|
WorkspaceID: parseUUID(testWorkspaceID),
|
|
AutopilotID: parseUUID(apID),
|
|
TriggerID: parseUUID(trig.ID),
|
|
Provider: "github",
|
|
Event: "github.pull_request",
|
|
SignatureStatus: "not_required",
|
|
Status: "failed",
|
|
SelectedHeaders: []byte("{}"),
|
|
DedupeKey: pgtype.Text{String: "retry-key", Valid: true},
|
|
DedupeSource: pgtype.Text{String: "x-github-delivery", Valid: true},
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("insert failed row: %v", err)
|
|
}
|
|
|
|
// Same dedupe_key, status=dispatched. Must succeed: the partial unique
|
|
// index excludes both `rejected` and `failed`, so the prior `failed`
|
|
// row does not consume the slot.
|
|
second, err := testHandler.Queries.CreateWebhookDelivery(ctx, db.CreateWebhookDeliveryParams{
|
|
WorkspaceID: parseUUID(testWorkspaceID),
|
|
AutopilotID: parseUUID(apID),
|
|
TriggerID: parseUUID(trig.ID),
|
|
Provider: "github",
|
|
Event: "github.pull_request",
|
|
SignatureStatus: "not_required",
|
|
Status: "dispatched",
|
|
SelectedHeaders: []byte("{}"),
|
|
DedupeKey: pgtype.Text{String: "retry-key", Valid: true},
|
|
DedupeSource: pgtype.Text{String: "x-github-delivery", Valid: true},
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("retry insert blocked by stale failed row: %v", err)
|
|
}
|
|
if uuidToString(second.ID) == uuidToString(first.ID) {
|
|
t.Fatal("retry should produce a fresh row, not reuse the failed one")
|
|
}
|
|
|
|
// And the dedupe lookup MUST prefer the non-terminal (dispatched) row,
|
|
// not the stale `failed` one, so a third attempt collapses onto the
|
|
// successful delivery rather than the failure.
|
|
got, err := testHandler.Queries.GetWebhookDeliveryByTriggerAndDedupe(ctx,
|
|
db.GetWebhookDeliveryByTriggerAndDedupeParams{
|
|
TriggerID: parseUUID(trig.ID),
|
|
DedupeKey: pgtype.Text{String: "retry-key", Valid: true},
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("lookup: %v", err)
|
|
}
|
|
if got.Status != "dispatched" {
|
|
t.Fatalf("lookup should prefer non-terminal row, got status=%q (id=%s)",
|
|
got.Status, uuidToString(got.ID))
|
|
}
|
|
}
|
|
|
|
// Confirm a column-level write — sqlc params for narg('signing_secret')
|
|
// must allow nullable NULL to clear the column, not just non-NULL strings.
|
|
func TestSetSigningSecretParams_NullableWrite(t *testing.T) {
|
|
agentID := createWebhookTestAgent(t, "SigSqlcNull Agent")
|
|
apID := createWebhookTestAutopilot(t, agentID, "active", "run_only")
|
|
trig := createWebhookTriggerViaHandler(t, apID)
|
|
|
|
if _, err := testHandler.Queries.SetAutopilotTriggerSigningSecret(context.Background(),
|
|
db.SetAutopilotTriggerSigningSecretParams{
|
|
ID: parseUUID(trig.ID),
|
|
SigningSecret: pgtype.Text{}, // explicit NULL
|
|
}); err != nil {
|
|
t.Fatalf("sqlc NULL write: %v", err)
|
|
}
|
|
}
|