refactor(api): harden relay forwarding with timeout, retries and redacted logs

tests/phase21/relay-forwarding-hardening.test.cjs

@@ -0,0 +1,167 @@
+const assert = require("assert");
+const fs = require("fs");
+const path = require("path");
+const vm = require("vm");
+
+const rootDir = path.resolve(__dirname, "..", "..");
+
+const loadRelayForwardingModule = (injected = {}) => {
+    const filePath = path.join(
+        rootDir,
+        "pages/api/middleware/relayForwarding.js"
+    );
+    let source = fs.readFileSync(filePath, "utf8");
+
+    source = source.replace(/import[\s\S]*?from\s+"[^"]+";\n?/g, "");
+    source = source.replace(/export const\s+/g, "const ");
+
+    source +=
+        "\nmodule.exports = { relayGet, relayGetData, forwardGetData };\n";
+
+    const context = {
+        module: { exports: {} },
+        exports: {},
+        require,
+        process,
+        setTimeout,
+        clearTimeout,
+        console: {
+            log: () => {},
+            info: () => {},
+            warn: () => {},
+            error: () => {}
+        },
+        ...injected
+    };
+
+    vm.runInNewContext(source, context, { filename: filePath });
+    return context.module.exports;
+};
+
+const tests = [];
+const test = (name, fn) => tests.push({ name, fn });
+
+test("forwardGetData retries retryable HTTP status and then succeeds", async () => {
+    let callCount = 0;
+
+    const mod = loadRelayForwardingModule({
+        axios: {
+            get: async () => {
+                callCount += 1;
+                if (callCount === 1) {
+                    const error = new Error("temporary outage");
+                    error.response = { status: 503 };
+                    throw error;
+                }
+
+                return { data: { ok: true } };
+            }
+        },
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=abc",
+        azureHeaders: () => ({ headers: { Authorization: "Bearer token" } }),
+        redactSensitive: (value) => value,
+        consoleLogger: () => {}
+    });
+
+    const result = await mod.forwardGetData({
+        queryUrl: "incidents?$top=1",
+        maxRetries: 1,
+        retryBaseDelayMs: 0,
+        retryMaxDelayMs: 0
+    });
+
+    assert.strictEqual(callCount, 2);
+    assert.deepStrictEqual(result.data, { ok: true });
+    assert.strictEqual(result.accessToken, "token");
+});
+
+test("forwardGetData does not retry non-retryable HTTP status", async () => {
+    let callCount = 0;
+
+    const mod = loadRelayForwardingModule({
+        axios: {
+            get: async () => {
+                callCount += 1;
+                const error = new Error("bad request");
+                error.response = { status: 400 };
+                throw error;
+            }
+        },
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=abc",
+        azureHeaders: () => ({ headers: {} }),
+        redactSensitive: (value) => value,
+        consoleLogger: () => {}
+    });
+
+    let thrown = null;
+    try {
+        await mod.forwardGetData({
+            queryUrl: "incidents?$top=1",
+            maxRetries: 3,
+            retryBaseDelayMs: 0,
+            retryMaxDelayMs: 0
+        });
+    } catch (error) {
+        thrown = error;
+    }
+
+    assert.ok(thrown);
+    assert.strictEqual(callCount, 1);
+});
+
+test("forwardGetData applies timeout and appendHash=false behavior", async () => {
+    let capturedUrl = null;
+    let capturedOptions = null;
+
+    const mod = loadRelayForwardingModule({
+        axios: {
+            get: async (url, options) => {
+                capturedUrl = url;
+                capturedOptions = options;
+                return { data: { ok: true } };
+            }
+        },
+        getToken: async () => ({ access_token: "token" }),
+        hashAPIPath: () => "&hash=abc",
+        azureHeaders: () => ({ headers: { Accept: "application/json" } }),
+        redactSensitive: (value) => value,
+        consoleLogger: () => {}
+    });
+
+    await mod.forwardGetData({
+        baseUrl: "http://localhost:3000",
+        queryUrl: "/api/endpoint/example",
+        appendHash: false,
+        timeoutMs: 1234,
+        maxRetries: 0
+    });
+
+    assert.strictEqual(
+        capturedUrl,
+        "http://localhost:3000/api/endpoint/example"
+    );
+    assert.strictEqual(capturedOptions.timeout, 1234);
+    assert.strictEqual(capturedOptions.headers.Accept, "application/json");
+});
+
+const run = async () => {
+    let passed = 0;
+    for (const currentTest of tests) {
+        await currentTest.fn();
+        passed += 1;
+    }
+    console.log(
+        `Phase 21 relay-forwarding hardening tests passed (${passed}/${tests.length}).`
+    );
+};
+
+module.exports = run;
+
+if (require.main === module) {
+    run().catch((error) => {
+        console.error(error);
+        process.exit(1);
+    });
+}