TASK22057: phase17 closeout hash/input consistency hardening
This commit is contained in:
@@ -0,0 +1,261 @@
|
||||
const fs = require("fs");
|
||||
const path = require("path");
|
||||
const vm = require("vm");
|
||||
const assert = require("assert");
|
||||
|
||||
const rootDir = path.resolve(__dirname, "..", "..");
|
||||
|
||||
const loadModule = (relativePath, injected = {}) => {
|
||||
const filePath = path.join(rootDir, relativePath);
|
||||
let source = fs.readFileSync(filePath, "utf8");
|
||||
|
||||
source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
|
||||
source = source.replace(
|
||||
/ReactPDF\.renderToStream\(\s*<MyDocument[\s\S]*?\/>(?:\s*)\)/g,
|
||||
"ReactPDF.renderToStream({})"
|
||||
);
|
||||
source = source.replace(
|
||||
/export default async function\s+(\w+)\s*\(/,
|
||||
"async function $1("
|
||||
);
|
||||
source = source.replace(/export const\s+/g, "const ");
|
||||
source = source.replace(
|
||||
/export default\s+(\w+);/g,
|
||||
"module.exports.default = $1;"
|
||||
);
|
||||
|
||||
source +=
|
||||
'\nif (typeof ApiProxy !== "undefined" && !module.exports.default) module.exports.default = ApiProxy;\n';
|
||||
source +=
|
||||
'\nif (typeof handler !== "undefined" && !module.exports.default) module.exports.default = handler;\n';
|
||||
|
||||
const context = {
|
||||
module: { exports: {} },
|
||||
exports: {},
|
||||
require,
|
||||
process,
|
||||
console: {
|
||||
log: () => {},
|
||||
info: () => {},
|
||||
warn: () => {},
|
||||
error: () => {}
|
||||
},
|
||||
port: 3000,
|
||||
...injected
|
||||
};
|
||||
|
||||
vm.runInNewContext(source, context, { filename: filePath });
|
||||
return context.module.exports;
|
||||
};
|
||||
|
||||
const createRes = () => {
|
||||
const state = {
|
||||
statusCode: null,
|
||||
jsonBody: undefined
|
||||
};
|
||||
|
||||
return {
|
||||
state,
|
||||
status(code) {
|
||||
state.statusCode = code;
|
||||
return this;
|
||||
},
|
||||
json(payload) {
|
||||
state.jsonBody = payload;
|
||||
return payload;
|
||||
}
|
||||
};
|
||||
};
|
||||
|
||||
const tests = [];
|
||||
const test = (name, fn) => tests.push({ name, fn });
|
||||
|
||||
const createNextConnectMock = () => {
|
||||
const router = {
|
||||
handler: null,
|
||||
use: () => {},
|
||||
get(fn) {
|
||||
this.handler = fn;
|
||||
},
|
||||
post(fn) {
|
||||
this.handler = fn;
|
||||
}
|
||||
};
|
||||
|
||||
return () => router;
|
||||
};
|
||||
|
||||
test("generatepdf rejects missing hash with 400", async () => {
|
||||
const createRepPDFBlobCalls = [];
|
||||
const mod = loadModule("pages/api/file/generatepdf.js", {
|
||||
hashAPIPath: () => "?hash=expected",
|
||||
ReactPDF: {
|
||||
renderToStream: async () => ({
|
||||
on: (event, cb) => {
|
||||
if (event === "data") cb(Buffer.from("pdf"));
|
||||
if (event === "end") cb();
|
||||
}
|
||||
})
|
||||
},
|
||||
createRepPDFBlob: async (...args) => {
|
||||
createRepPDFBlobCalls.push(args);
|
||||
return { ok: true };
|
||||
},
|
||||
consoleLogger: () => {}
|
||||
});
|
||||
|
||||
const req = { query: {}, body: { caseRef: "c1", repfile_name: "r1" } };
|
||||
const res = createRes();
|
||||
|
||||
await mod.default(req, res);
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
assert.strictEqual(createRepPDFBlobCalls.length, 0);
|
||||
});
|
||||
|
||||
test("generatepdf rejects invalid hash with 400", async () => {
|
||||
const mod = loadModule("pages/api/file/generatepdf.js", {
|
||||
hashAPIPath: () => "?hash=expected",
|
||||
ReactPDF: {
|
||||
renderToStream: async () => ({
|
||||
on: (event, cb) => {
|
||||
if (event === "data") cb(Buffer.from("pdf"));
|
||||
if (event === "end") cb();
|
||||
}
|
||||
})
|
||||
},
|
||||
createRepPDFBlob: async () => ({ ok: true }),
|
||||
consoleLogger: () => {}
|
||||
});
|
||||
|
||||
const req = {
|
||||
query: { hash: "wrong" },
|
||||
body: { caseRef: "c1", repfile_name: "r1" }
|
||||
};
|
||||
const res = createRes();
|
||||
|
||||
await mod.default(req, res);
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
});
|
||||
|
||||
test("generateappealpdf rejects missing required input with 400", async () => {
|
||||
const calls = [];
|
||||
const mod = loadModule("pages/api/file/generateappealpdf.js", {
|
||||
hashAPIPath: () => "&hash=expected",
|
||||
getTempCaseBlob: async (...args) => {
|
||||
calls.push(args);
|
||||
return {};
|
||||
},
|
||||
getProgressBlobs: async () => ({ path: "p1" }),
|
||||
downloadProgressFile: async () => ({ filesList: [] }),
|
||||
getPickLists: async () => ({}),
|
||||
ReactPDF: {
|
||||
renderToStream: async () => ({
|
||||
on: (event, cb) => {
|
||||
if (event === "data") cb(Buffer.from("pdf"));
|
||||
if (event === "end") cb();
|
||||
}
|
||||
})
|
||||
},
|
||||
createAppealPDFBlob: async () => ({ ok: true })
|
||||
});
|
||||
|
||||
const req = { query: { hash: "expected" }, body: {} };
|
||||
const res = createRes();
|
||||
await mod.default(req, res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
assert.strictEqual(calls.length, 0);
|
||||
});
|
||||
|
||||
test("generateappealpdf rejects invalid hash with 400", async () => {
|
||||
const mod = loadModule("pages/api/file/generateappealpdf.js", {
|
||||
hashAPIPath: () => "&hash=expected",
|
||||
getTempCaseBlob: async () => ({}),
|
||||
getProgressBlobs: async () => ({ path: "p1" }),
|
||||
downloadProgressFile: async () => ({ filesList: [] }),
|
||||
getPickLists: async () => ({}),
|
||||
ReactPDF: {
|
||||
renderToStream: async () => ({
|
||||
on: (event, cb) => {
|
||||
if (event === "data") cb(Buffer.from("pdf"));
|
||||
if (event === "end") cb();
|
||||
}
|
||||
})
|
||||
},
|
||||
createAppealPDFBlob: async () => ({ ok: true })
|
||||
});
|
||||
|
||||
const req = {
|
||||
query: { hash: "wrong", appealType: "846040000" },
|
||||
body: { containerID: "c1", casefolderID: "case-1", filesList: [] }
|
||||
};
|
||||
const res = createRes();
|
||||
await mod.default(req, res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
});
|
||||
|
||||
test("createappealcompletemessageproxy_api rejects missing params with 400", async () => {
|
||||
const mod = loadModule(
|
||||
"pages/api/file/createappealcompletemessageproxy_api.js",
|
||||
{
|
||||
getToken: async () => ({ access_token: "t" }),
|
||||
hashAPIPath: () => "&hash=expected",
|
||||
azureHeaders: () => ({}),
|
||||
axios: { get: async () => ({ data: { ok: true } }) },
|
||||
consoleLogger: () => {},
|
||||
nextConnect: createNextConnectMock(),
|
||||
middleware: () => {}
|
||||
}
|
||||
);
|
||||
|
||||
const req = { query: { container: "c1" } };
|
||||
const res = createRes();
|
||||
await mod.default.handler(req, res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 400);
|
||||
});
|
||||
|
||||
test("createappealcompletemessageproxy_api valid input returns 200", async () => {
|
||||
const mod = loadModule(
|
||||
"pages/api/file/createappealcompletemessageproxy_api.js",
|
||||
{
|
||||
getToken: async () => ({ access_token: "t" }),
|
||||
hashAPIPath: () => "&hash=expected",
|
||||
azureHeaders: () => ({}),
|
||||
axios: {
|
||||
get: async () => ({ data: { status: "success" } })
|
||||
},
|
||||
consoleLogger: () => {},
|
||||
nextConnect: createNextConnectMock(),
|
||||
middleware: () => {}
|
||||
}
|
||||
);
|
||||
|
||||
const req = { query: { container: "c1", tempcaseref: "tmp-1" } };
|
||||
const res = createRes();
|
||||
await mod.default.handler(req, res);
|
||||
|
||||
assert.strictEqual(res.state.statusCode, 200);
|
||||
assert.deepStrictEqual(JSON.parse(JSON.stringify(res.state.jsonBody)), {
|
||||
status: "success"
|
||||
});
|
||||
});
|
||||
|
||||
const run = async () => {
|
||||
let passed = 0;
|
||||
|
||||
for (const currentTest of tests) {
|
||||
await currentTest.fn();
|
||||
passed += 1;
|
||||
}
|
||||
|
||||
console.log(
|
||||
`Phase 17 behavioural tests passed (${passed}/${tests.length}).`
|
||||
);
|
||||
};
|
||||
|
||||
run().catch((error) => {
|
||||
console.error(error);
|
||||
process.exit(1);
|
||||
});
|
||||
Reference in New Issue
Block a user