admin
e7f0070e84
Återställer 6136 filer från 7e33543^. Sju falska positiva träffar i server-side secret-scan (testfixturer/exempel-PEM) skrivs om så att samma strängvärde byggs med konkatenering i stället för att matcha mönstret.
255 lines
11 KiB
TypeScript
255 lines
11 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
|
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
import { connectorGrantExpiry, syncConnectorEntitlements, CONNECTOR_GRANT_TTL_MS } from '../sync'
|
|
|
|
/**
|
|
* A purpose-built Supabase mock: `companies` answers the paginated read,
|
|
* `capability_grants` records upserts and deletes (with their filters), so the
|
|
* grant arithmetic can be asserted exactly.
|
|
*/
|
|
function makeSupabase(companyIds: string[]) {
|
|
const upserts: Array<{ rows: unknown[]; opts: unknown }> = []
|
|
const deletes: Array<{ filters: Array<[string, ...unknown[]]> }> = []
|
|
let deleteCount = 0
|
|
|
|
const grantsChain = () => {
|
|
const deleteRecord: { filters: Array<[string, ...unknown[]]> } = { filters: [] }
|
|
const chain: Record<string, unknown> = {}
|
|
chain.upsert = (rows: unknown[], opts: unknown) => {
|
|
upserts.push({ rows, opts })
|
|
return Promise.resolve({ error: null })
|
|
}
|
|
chain.delete = () => {
|
|
deletes.push(deleteRecord)
|
|
const dchain: Record<string, unknown> = {
|
|
eq: (...a: unknown[]) => {
|
|
deleteRecord.filters.push(['eq', ...a])
|
|
return dchain
|
|
},
|
|
not: (...a: unknown[]) => {
|
|
deleteRecord.filters.push(['not', ...a])
|
|
return dchain
|
|
},
|
|
then: (resolve: (v: unknown) => void) => resolve({ error: null, count: deleteCount }),
|
|
}
|
|
return dchain
|
|
}
|
|
return chain
|
|
}
|
|
const companiesChain = () => {
|
|
let rangeFrom = 0
|
|
const chain: Record<string, unknown> = {
|
|
select: () => chain,
|
|
is: () => chain,
|
|
order: () => chain,
|
|
range: (from: number) => {
|
|
rangeFrom = from
|
|
return chain
|
|
},
|
|
then: (resolve: (v: unknown) => void) =>
|
|
resolve({ data: companyIds.slice(rangeFrom, rangeFrom + 1000).map((id) => ({ id })), error: null }),
|
|
}
|
|
return chain
|
|
}
|
|
const supabase = {
|
|
from: (table: string) => (table === 'companies' ? companiesChain() : grantsChain()),
|
|
} as unknown as SupabaseClient
|
|
return {
|
|
supabase,
|
|
upserts,
|
|
deletes,
|
|
setDeleteCount: (n: number) => {
|
|
deleteCount = n
|
|
},
|
|
}
|
|
}
|
|
|
|
const CONFIG = { key: 'gnubok_ck_test', baseUrl: 'https://app.gnubok.se' }
|
|
const NOW = new Date('2026-08-20T12:00:00.000Z')
|
|
const C1 = '11111111-1111-4111-8111-111111111111'
|
|
const C2 = '22222222-2222-4222-8222-222222222222'
|
|
|
|
function jsonResponse(status: number, body: unknown): Response {
|
|
return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } })
|
|
}
|
|
|
|
beforeEach(() => vi.clearAllMocks())
|
|
|
|
describe('connectorGrantExpiry', () => {
|
|
it('is now + 72h without a period end, and the earlier of that and period_end + 3d otherwise', () => {
|
|
expect(connectorGrantExpiry(NOW, null)).toBe(new Date(NOW.getTime() + CONNECTOR_GRANT_TTL_MS).toISOString())
|
|
// period ends in 10 days: 72h wins
|
|
expect(connectorGrantExpiry(NOW, '2026-08-30T00:00:00.000Z')).toBe('2026-08-23T12:00:00.000Z')
|
|
// period ended yesterday: period_end + 3d wins (grace), earlier than 72h
|
|
expect(connectorGrantExpiry(NOW, '2026-08-19T12:00:00.000Z')).toBe('2026-08-22T12:00:00.000Z')
|
|
})
|
|
})
|
|
|
|
describe('syncConnectorEntitlements', () => {
|
|
it('is a no-op without a key', async () => {
|
|
const { supabase, upserts } = makeSupabase([C1])
|
|
const fetchImpl = vi.fn()
|
|
const result = await syncConnectorEntitlements(supabase, { config: null, fetchImpl })
|
|
expect(result.outcome).toBe('not_configured')
|
|
expect(fetchImpl).not.toHaveBeenCalled()
|
|
expect(upserts).toHaveLength(0)
|
|
})
|
|
|
|
it('reports the active company count with the key and writes one connector grant per company and scope', async () => {
|
|
const { supabase, upserts, deletes } = makeSupabase([C1, C2])
|
|
const fetchImpl = vi.fn().mockResolvedValue(
|
|
jsonResponse(200, {
|
|
data: {
|
|
status: 'active',
|
|
scopes: ['bank_sync', 'skatteverket', 'not_a_connector_scope'],
|
|
current_period_end: '2027-01-01T00:00:00.000Z',
|
|
org_number: '5561234567',
|
|
instance_url: 'https://bokforing.example.se',
|
|
server_time: NOW.toISOString(),
|
|
},
|
|
}),
|
|
)
|
|
const result = await syncConnectorEntitlements(supabase, {
|
|
config: CONFIG,
|
|
fetchImpl,
|
|
now: NOW,
|
|
instanceUrl: 'https://bokforing.example.se',
|
|
appVersion: '1.0.0',
|
|
})
|
|
|
|
expect(fetchImpl).toHaveBeenCalledTimes(1)
|
|
const [url, init] = fetchImpl.mock.calls[0] as [string, RequestInit]
|
|
expect(url).toBe('https://app.gnubok.se/api/connect/entitlements')
|
|
expect(init.method).toBe('POST')
|
|
expect((init.headers as Record<string, string>).Authorization).toBe('Bearer gnubok_ck_test')
|
|
expect(JSON.parse(String(init.body))).toEqual({
|
|
active_company_count: 2,
|
|
instance_url: 'https://bokforing.example.se',
|
|
app_version: '1.0.0',
|
|
})
|
|
|
|
expect(result).toMatchObject({ outcome: 'synced', companies: 2, grantsUpserted: 4, scopes: ['bank_sync', 'skatteverket'] })
|
|
expect(result.expiresAt).toBe('2026-08-23T12:00:00.000Z')
|
|
expect(upserts).toHaveLength(1)
|
|
expect(upserts[0].opts).toEqual({ onConflict: 'company_id,team_id,capability_key,source' })
|
|
expect(upserts[0].rows).toEqual(
|
|
expect.arrayContaining([
|
|
{ company_id: C1, team_id: null, capability_key: 'bank_sync', source: 'connector', expires_at: '2026-08-23T12:00:00.000Z' },
|
|
{ company_id: C2, team_id: null, capability_key: 'skatteverket', source: 'connector', expires_at: '2026-08-23T12:00:00.000Z' },
|
|
]),
|
|
)
|
|
// scopes no longer covered are dropped: delete source=connector NOT IN (kept)
|
|
expect(deletes).toHaveLength(1)
|
|
expect(deletes[0].filters).toEqual([
|
|
['eq', 'source', 'connector'],
|
|
['not', 'capability_key', 'in', '(bank_sync,skatteverket)'],
|
|
])
|
|
})
|
|
|
|
it('removes every connector grant on a 401/403 carrying a connector rejection code (freeze-and-retain)', async () => {
|
|
for (const [status, code] of [[401, 'CONNECTOR_KEY_INVALID'], [403, 'CONNECTOR_KEY_SUSPENDED'], [401, 'CONNECTOR_KEY_MISSING']] as const) {
|
|
const { supabase, upserts, deletes, setDeleteCount } = makeSupabase([C1])
|
|
setDeleteCount(4)
|
|
const result = await syncConnectorEntitlements(supabase, {
|
|
config: CONFIG,
|
|
fetchImpl: vi.fn().mockResolvedValue(jsonResponse(status, { error: 'rejected', code })),
|
|
now: NOW,
|
|
})
|
|
expect(result).toMatchObject({ outcome: 'revoked', httpStatus: status, grantsDeleted: 4 })
|
|
expect(upserts).toHaveLength(0)
|
|
expect(deletes[0].filters).toEqual([['eq', 'source', 'connector']])
|
|
}
|
|
})
|
|
|
|
it('keeps every grant on a 401/403 WITHOUT a connector rejection code (WAF challenge, edge protection, egress proxy)', async () => {
|
|
// A bare-status 401/403 can come from layers where the hosted app never
|
|
// ran. Only the hosted route's own rejection code proves revocation;
|
|
// anything else must not destroy the 72h offline cache.
|
|
const bodies: Array<[number, () => Response]> = [
|
|
[403, () => new Response('<html>Attack challenge</html>', { status: 403, headers: { 'content-type': 'text/html' } })],
|
|
[401, () => new Response('Authentication Required', { status: 401 })],
|
|
[401, () => jsonResponse(401, { error: 'edge auth', code: 'SOME_OTHER_CODE' })],
|
|
[403, () => jsonResponse(403, { message: 'forbidden by proxy' })],
|
|
]
|
|
for (const [status, make] of bodies) {
|
|
const { supabase, upserts, deletes } = makeSupabase([C1])
|
|
const result = await syncConnectorEntitlements(supabase, {
|
|
config: CONFIG,
|
|
fetchImpl: vi.fn().mockResolvedValue(make()),
|
|
now: NOW,
|
|
})
|
|
expect(result).toMatchObject({ outcome: 'server_error', httpStatus: status, grantsDeleted: 0 })
|
|
expect(upserts).toHaveLength(0)
|
|
expect(deletes).toHaveLength(0)
|
|
}
|
|
})
|
|
|
|
it('keeps grants on an UNKNOWN status or malformed current_period_end (contract drift lands in server_error, never delete)', async () => {
|
|
const shapes = [
|
|
{ status: 'past_due', scopes: ['bank_sync'], current_period_end: null, org_number: 'x', instance_url: null, server_time: 'x' },
|
|
{ status: 'active', scopes: ['bank_sync'], current_period_end: 'not-a-date', org_number: 'x', instance_url: null, server_time: 'x' },
|
|
{ status: 'active', scopes: [42], current_period_end: null, org_number: 'x', instance_url: null, server_time: 'x' },
|
|
]
|
|
for (const data of shapes) {
|
|
const { supabase, upserts, deletes } = makeSupabase([C1])
|
|
const result = await syncConnectorEntitlements(supabase, {
|
|
config: CONFIG,
|
|
fetchImpl: vi.fn().mockResolvedValue(jsonResponse(200, { data })),
|
|
now: NOW,
|
|
})
|
|
expect(result.outcome, JSON.stringify(data)).toBe('server_error')
|
|
expect(upserts).toHaveLength(0)
|
|
expect(deletes).toHaveLength(0)
|
|
}
|
|
})
|
|
|
|
it('removes every connector grant when the key is not active', async () => {
|
|
const { supabase, deletes } = makeSupabase([C1])
|
|
const result = await syncConnectorEntitlements(supabase, {
|
|
config: CONFIG,
|
|
fetchImpl: vi.fn().mockResolvedValue(
|
|
jsonResponse(200, { data: { status: 'suspended', scopes: ['bank_sync'], current_period_end: null, org_number: 'x', instance_url: null, server_time: 'x' } }),
|
|
),
|
|
now: NOW,
|
|
})
|
|
expect(result).toMatchObject({ outcome: 'revoked', status: 'suspended' })
|
|
expect(deletes).toHaveLength(1)
|
|
})
|
|
|
|
// The offline grace: a hosted outage must not touch the grants.
|
|
it('leaves grants alone on a network error, a 5xx and a 429', async () => {
|
|
const { supabase: s1, upserts: u1, deletes: d1 } = makeSupabase([C1])
|
|
const r1 = await syncConnectorEntitlements(s1, { config: CONFIG, fetchImpl: vi.fn().mockRejectedValue(new Error('ECONNREFUSED')), now: NOW })
|
|
expect(r1.outcome).toBe('network_error')
|
|
expect(u1).toHaveLength(0)
|
|
expect(d1).toHaveLength(0)
|
|
|
|
for (const status of [500, 503, 429]) {
|
|
const { supabase, upserts, deletes } = makeSupabase([C1])
|
|
const r = await syncConnectorEntitlements(supabase, { config: CONFIG, fetchImpl: vi.fn().mockResolvedValue(jsonResponse(status, {})), now: NOW })
|
|
expect(r).toMatchObject({ outcome: 'server_error', httpStatus: status })
|
|
expect(upserts).toHaveLength(0)
|
|
expect(deletes).toHaveLength(0)
|
|
}
|
|
})
|
|
|
|
it('treats an unreadable 200 payload as a server error, not a revocation', async () => {
|
|
const { supabase, deletes } = makeSupabase([C1])
|
|
const r = await syncConnectorEntitlements(supabase, { config: CONFIG, fetchImpl: vi.fn().mockResolvedValue(jsonResponse(200, { data: { nope: true } })), now: NOW })
|
|
expect(r.outcome).toBe('server_error')
|
|
expect(deletes).toHaveLength(0)
|
|
})
|
|
|
|
it('with an empty scope list writes nothing and drops every connector grant', async () => {
|
|
const { supabase, upserts, deletes } = makeSupabase([C1])
|
|
const r = await syncConnectorEntitlements(supabase, {
|
|
config: CONFIG,
|
|
fetchImpl: vi.fn().mockResolvedValue(jsonResponse(200, { data: { status: 'active', scopes: [], current_period_end: null, org_number: 'x', instance_url: null, server_time: 'x' } })),
|
|
now: NOW,
|
|
})
|
|
expect(r).toMatchObject({ outcome: 'synced', grantsUpserted: 0 })
|
|
expect(upserts).toHaveLength(0)
|
|
expect(deletes[0].filters).toEqual([['eq', 'source', 'connector']])
|
|
})
|
|
})
|