mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-12 19:57:37 +00:00
Anso
866d784316
Add an optional Edit Payload editor to every notification channel
(Discord, Slack, Webhook, Apprise, ntfy). A saved template replaces the
built-in payload for that channel, with {{level}}, {{message}},
{{category}}, {{timestamp}}, {{stack_name}}, and {{actor}} substituted as
JSON-escaped values (variables may stand alone or be mixed into strings).
Templates are validated on save: known variables only, no unterminated
tokens, valid JSON after substitution, 8000 characters max. Apprise keeps
urls/tag managed by the channel fields and merges them server-side at
dispatch. ntfy publishes JSON instead of plain text when templated. Test
dispatch uses the editor template.
755 lines
26 KiB
TypeScript
755 lines
26 KiB
TypeScript
/**
|
|
* Integration tests for Alert CRUD endpoints, notification test dispatch
|
|
* validation, and auth enforcement on all alert/notification routes.
|
|
*/
|
|
import { describe, it, expect, beforeAll, afterAll, vi } from 'vitest';
|
|
import request from 'supertest';
|
|
import jwt from 'jsonwebtoken';
|
|
import bcrypt from 'bcrypt';
|
|
import { setupTestDb, cleanupTestDb, loginAsTestAdmin, TEST_JWT_SECRET } from './helpers/setupTestDb';
|
|
import { PAYLOAD_TEMPLATE_MAX_LENGTH } from '../helpers/notificationPayloadTemplate';
|
|
|
|
let tmpDir: string;
|
|
let app: import('express').Express;
|
|
let DatabaseService: typeof import('../services/DatabaseService').DatabaseService;
|
|
let ROLE_PERMISSIONS: typeof import('../middleware/permissions').ROLE_PERMISSIONS;
|
|
let authCookie: string;
|
|
let viewerCookie: string;
|
|
|
|
type SeedRole = 'admin' | 'node-admin' | 'deployer' | 'viewer' | 'auditor';
|
|
|
|
/** Seed a user with the given role and return a signed bearer token for it. */
|
|
async function seedRoleToken(username: string, role: SeedRole): Promise<string> {
|
|
const db = DatabaseService.getInstance();
|
|
let user = db.getUserByUsername(username);
|
|
if (!user) {
|
|
const hash = await bcrypt.hash('password123', 1);
|
|
db.addUser({ username, password_hash: hash, role });
|
|
user = db.getUserByUsername(username);
|
|
}
|
|
return jwt.sign({ username, role, tv: user!.token_version }, TEST_JWT_SECRET, { expiresIn: '5m' });
|
|
}
|
|
|
|
beforeAll(async () => {
|
|
tmpDir = await setupTestDb();
|
|
({ DatabaseService } = await import('../services/DatabaseService'));
|
|
({ ROLE_PERMISSIONS } = await import('../middleware/permissions'));
|
|
|
|
// Mock LicenseService so paid-gated routes are accessible
|
|
const { LicenseService } = await import('../services/LicenseService');
|
|
vi.spyOn(LicenseService.getInstance(), 'getTier').mockReturnValue('paid');
|
|
|
|
({ app } = await import('../index'));
|
|
authCookie = await loginAsTestAdmin(app);
|
|
|
|
// Create a viewer user for non-admin tests
|
|
const viewerHash = await bcrypt.hash('viewerpass', 1);
|
|
DatabaseService.getInstance().addUser({ username: 'viewer', password_hash: viewerHash, role: 'viewer' });
|
|
const viewerRes = await request(app)
|
|
.post('/api/auth/login')
|
|
.send({ username: 'viewer', password: 'viewerpass' });
|
|
const cookies = viewerRes.headers['set-cookie'] as string | string[];
|
|
viewerCookie = Array.isArray(cookies) ? cookies[0] : cookies;
|
|
});
|
|
|
|
afterAll(() => {
|
|
cleanupTestDb(tmpDir);
|
|
});
|
|
|
|
// --- GET /api/alerts ---
|
|
|
|
describe('GET /api/alerts', () => {
|
|
it('rejects unauthenticated requests with 401', async () => {
|
|
const res = await request(app).get('/api/alerts');
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('returns empty array when no alerts exist', async () => {
|
|
const res = await request(app)
|
|
.get('/api/alerts')
|
|
.set('Cookie', authCookie);
|
|
expect(res.status).toBe(200);
|
|
expect(res.body).toEqual([]);
|
|
});
|
|
|
|
it('filters alerts by stackName query param', async () => {
|
|
// Seed two alerts for different stacks
|
|
const db = DatabaseService.getInstance();
|
|
db.addStackAlert({ stack_name: 'web', service_name: null, metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
db.addStackAlert({ stack_name: 'api', service_name: null, metric: 'memory_percent', operator: '>', threshold: 90, duration_mins: 5, cooldown_mins: 60 });
|
|
|
|
const res = await request(app)
|
|
.get('/api/alerts?stackName=web')
|
|
.set('Cookie', authCookie);
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.length).toBe(1);
|
|
expect(res.body[0].stack_name).toBe('web');
|
|
});
|
|
|
|
it('denies a role without stack:read with 403 PERMISSION_DENIED', async () => {
|
|
// Every shipped role carries stack:read, so the denial path is exercised
|
|
// by temporarily removing it from viewer at runtime, proving the added
|
|
// gate actually runs rather than being a no-op.
|
|
const original = ROLE_PERMISSIONS.viewer;
|
|
ROLE_PERMISSIONS.viewer = original.filter((p) => p !== 'stack:read');
|
|
try {
|
|
const res = await request(app)
|
|
.get('/api/alerts')
|
|
.set('Cookie', viewerCookie);
|
|
expect(res.status).toBe(403);
|
|
expect(res.body.code).toBe('PERMISSION_DENIED');
|
|
} finally {
|
|
ROLE_PERMISSIONS.viewer = original;
|
|
}
|
|
});
|
|
});
|
|
|
|
// --- POST /api/alerts ---
|
|
|
|
describe('POST /api/alerts', () => {
|
|
it('rejects unauthenticated requests with 401', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.send({ stack_name: 'test', metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it.each(['viewer', 'deployer', 'auditor'] as const)(
|
|
'rejects %s with 403 PERMISSION_DENIED (lacks stack:edit)',
|
|
async (role) => {
|
|
const token = await seedRoleToken(`alerts-post-${role}`, role);
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.send({ stack_name: 'perm-gate-post', metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
expect(res.status).toBe(403);
|
|
expect(res.body.code).toBe('PERMISSION_DENIED');
|
|
},
|
|
);
|
|
|
|
it.each(['admin', 'node-admin'] as const)(
|
|
'lets %s pass the permission gate',
|
|
async (role) => {
|
|
const token = await seedRoleToken(`alerts-post-${role}`, role);
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.send({ stack_name: `perm-gate-post-${role}`, metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
expect(res.status).toBe(201);
|
|
},
|
|
);
|
|
|
|
it('creates alert and returns 201 with created resource', async () => {
|
|
const payload = {
|
|
stack_name: 'new-stack',
|
|
metric: 'memory_percent',
|
|
operator: '>=',
|
|
threshold: 85,
|
|
duration_mins: 10,
|
|
cooldown_mins: 30,
|
|
};
|
|
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send(payload);
|
|
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.id).toBeDefined();
|
|
expect(res.body.stack_name).toBe('new-stack');
|
|
expect(res.body.service_name).toBeNull();
|
|
expect(res.body.metric).toBe('memory_percent');
|
|
expect(res.body.threshold).toBe(85);
|
|
});
|
|
|
|
it('persists a valid dotted service_name', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
stack_name: 'svc-stack',
|
|
service_name: 'api.web',
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 5,
|
|
cooldown_mins: 60,
|
|
});
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.service_name).toBe('api.web');
|
|
});
|
|
|
|
it('normalizes empty service_name to null', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
stack_name: 'empty-svc',
|
|
service_name: '',
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 5,
|
|
cooldown_mins: 60,
|
|
});
|
|
expect(res.status).toBe(201);
|
|
expect(res.body.service_name).toBeNull();
|
|
});
|
|
|
|
it('rejects whitespace-only service_name', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
stack_name: 'bad-svc',
|
|
service_name: ' ',
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 5,
|
|
cooldown_mins: 60,
|
|
});
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects reserved _unlabeled service_name', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
stack_name: 'bad-svc',
|
|
service_name: '_unlabeled',
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 5,
|
|
cooldown_mins: 60,
|
|
});
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects service_name when the capability is disabled', async () => {
|
|
const { disableCapability, enableCapability, SERVICE_SCOPED_STACK_ALERT_CAPABILITY } =
|
|
await import('../services/CapabilityRegistry');
|
|
disableCapability(SERVICE_SCOPED_STACK_ALERT_CAPABILITY);
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
stack_name: 'cap-stack',
|
|
service_name: 'api',
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 5,
|
|
cooldown_mins: 60,
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.code).toBe('capability_unavailable');
|
|
} finally {
|
|
enableCapability(SERVICE_SCOPED_STACK_ALERT_CAPABILITY);
|
|
}
|
|
});
|
|
|
|
it('validates required fields and returns 400 for missing data', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'test' }); // missing metric, operator, threshold, etc.
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toBe('Invalid alert data');
|
|
});
|
|
|
|
it('rejects invalid metric values', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'test', metric: 'invalid_metric', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects negative threshold', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'test', metric: 'cpu_percent', operator: '>', threshold: -1, duration_mins: 5, cooldown_mins: 60 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects empty stack_name', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: '', metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects stack_name exceeding 255 characters', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'a'.repeat(256), metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects duration_mins exceeding 1440', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'test', metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 1441, cooldown_mins: 60 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects cooldown_mins exceeding 10080', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'test', metric: 'cpu_percent', operator: '>', threshold: 80, duration_mins: 5, cooldown_mins: 10081 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects invalid operator', async () => {
|
|
const res = await request(app)
|
|
.post('/api/alerts')
|
|
.set('Cookie', authCookie)
|
|
.send({ stack_name: 'test', metric: 'cpu_percent', operator: '!=', threshold: 80, duration_mins: 5, cooldown_mins: 60 });
|
|
|
|
expect(res.status).toBe(400);
|
|
});
|
|
});
|
|
|
|
// --- DELETE /api/alerts/:id ---
|
|
|
|
describe('DELETE /api/alerts/:id', () => {
|
|
it('rejects unauthenticated requests with 401', async () => {
|
|
const res = await request(app).delete('/api/alerts/1');
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it.each(['viewer', 'deployer', 'auditor'] as const)(
|
|
'rejects %s with 403 PERMISSION_DENIED (lacks stack:edit)',
|
|
async (role) => {
|
|
const alert = DatabaseService.getInstance().addStackAlert({
|
|
stack_name: `delete-gate-deny-${role}`,
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 90,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
const token = await seedRoleToken(`alerts-delete-${role}`, role);
|
|
const res = await request(app)
|
|
.delete(`/api/alerts/${alert.id}`)
|
|
.set('Authorization', `Bearer ${token}`);
|
|
expect(res.status).toBe(403);
|
|
expect(res.body.code).toBe('PERMISSION_DENIED');
|
|
},
|
|
);
|
|
|
|
it.each(['admin', 'node-admin'] as const)(
|
|
'lets %s delete',
|
|
async (role) => {
|
|
const alert = DatabaseService.getInstance().addStackAlert({
|
|
stack_name: `delete-gate-allow-${role}`,
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 90,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
const token = await seedRoleToken(`alerts-delete-${role}`, role);
|
|
const res = await request(app)
|
|
.delete(`/api/alerts/${alert.id}`)
|
|
.set('Authorization', `Bearer ${token}`);
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.success).toBe(true);
|
|
},
|
|
);
|
|
|
|
it('returns 404 for a nonexistent alert id', async () => {
|
|
const res = await request(app)
|
|
.delete('/api/alerts/99999')
|
|
.set('Cookie', authCookie);
|
|
expect(res.status).toBe(404);
|
|
expect(res.body).toEqual({ error: 'Alert not found' });
|
|
});
|
|
|
|
it("authorizes against the alert's own stack, not a caller's scoped grant on a different stack", async () => {
|
|
const db = DatabaseService.getInstance();
|
|
const defaultNodeId = db.getDefaultNode()!.id!;
|
|
const hash = await bcrypt.hash('password123', 1);
|
|
const userId = db.addUser({ username: 'alerts-scoped-editor', password_hash: hash, role: 'viewer' });
|
|
db.addRoleAssignment({
|
|
user_id: userId,
|
|
role: 'node-admin',
|
|
resource_type: 'stack',
|
|
resource_id: 'scoped-allowed-stack',
|
|
node_id: defaultNodeId,
|
|
});
|
|
const user = db.getUserByUsername('alerts-scoped-editor')!;
|
|
const token = jwt.sign({ username: user.username, role: user.role, tv: user.token_version }, TEST_JWT_SECRET, { expiresIn: '5m' });
|
|
|
|
try {
|
|
// The scoped grant only covers 'scoped-allowed-stack', so an alert
|
|
// belonging to a different stack must still be denied.
|
|
const deniedAlert = db.addStackAlert({
|
|
stack_name: 'scoped-other-stack',
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 90,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
const deniedRes = await request(app)
|
|
.delete(`/api/alerts/${deniedAlert.id}`)
|
|
.set('Authorization', `Bearer ${token}`);
|
|
expect(deniedRes.status).toBe(403);
|
|
expect(deniedRes.body.code).toBe('PERMISSION_DENIED');
|
|
|
|
const allowedAlert = db.addStackAlert({
|
|
stack_name: 'scoped-allowed-stack',
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 90,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
const allowedRes = await request(app)
|
|
.delete(`/api/alerts/${allowedAlert.id}`)
|
|
.set('Authorization', `Bearer ${token}`);
|
|
expect(allowedRes.status).toBe(200);
|
|
expect(allowedRes.body.success).toBe(true);
|
|
} finally {
|
|
db.deleteRoleAssignmentsByUser(userId);
|
|
db.deleteUser(userId);
|
|
}
|
|
});
|
|
|
|
it('deletes existing alert rule', async () => {
|
|
// Create an alert to delete
|
|
const created = DatabaseService.getInstance().addStackAlert({
|
|
stack_name: 'delete-me',
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 90,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/alerts/${created.id}`)
|
|
.set('Cookie', authCookie);
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.success).toBe(true);
|
|
});
|
|
|
|
it('rejects leading-junk ids like 1abc without deleting alert 1', async () => {
|
|
const created = DatabaseService.getInstance().addStackAlert({
|
|
stack_name: 'strict-id-junk',
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 90,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
expect(created.id).toBeDefined();
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/alerts/${created.id}abc`)
|
|
.set('Cookie', authCookie);
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toBe('Invalid alert id');
|
|
expect(DatabaseService.getInstance().getStackAlerts('strict-id-junk').some((a) => a.id === created.id)).toBe(true);
|
|
});
|
|
|
|
it('rejects fractional ids like 2.5 without deleting alert 2', async () => {
|
|
const first = DatabaseService.getInstance().addStackAlert({
|
|
stack_name: 'strict-id-fraction',
|
|
service_name: null,
|
|
metric: 'cpu_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
const second = DatabaseService.getInstance().addStackAlert({
|
|
stack_name: 'strict-id-fraction',
|
|
service_name: null,
|
|
metric: 'memory_percent',
|
|
operator: '>',
|
|
threshold: 80,
|
|
duration_mins: 0,
|
|
cooldown_mins: 0,
|
|
});
|
|
expect(second.id).toBeDefined();
|
|
|
|
const res = await request(app)
|
|
.delete(`/api/alerts/${second.id}.5`)
|
|
.set('Cookie', authCookie);
|
|
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toBe('Invalid alert id');
|
|
const remaining = DatabaseService.getInstance().getStackAlerts('strict-id-fraction').map((a) => a.id);
|
|
expect(remaining).toEqual(expect.arrayContaining([first.id, second.id]));
|
|
});
|
|
});
|
|
|
|
// --- POST /api/notifications/test ---
|
|
|
|
describe('POST /api/notifications/test', () => {
|
|
it('rejects unauthenticated requests with 401', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.send({ type: 'discord', url: 'https://discord.com/api/webhooks/123/abc' });
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
it('rejects non-admin users with 403', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', viewerCookie)
|
|
.send({ type: 'discord', url: 'https://discord.com/api/webhooks/123/abc' });
|
|
expect(res.status).toBe(403);
|
|
});
|
|
|
|
it('rejects invalid type with 400', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'telegram', url: 'https://example.com' });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toContain('discord, slack, webhook, apprise, ntfy');
|
|
});
|
|
|
|
it('rejects missing type with 400', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ url: 'https://example.com' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects non-HTTPS url with 400', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'discord', url: 'http://example.com' });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toContain('HTTPS');
|
|
});
|
|
|
|
it('rejects missing url with 400', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'discord' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects malformed url with 400', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'discord', url: 'https://' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('dispatches keyed Apprise test with exact payload', async () => {
|
|
const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'apprise', url: 'http://apprise.local/notify/test-key', config: { tags: 'ops' } });
|
|
expect(res.status).toBe(200);
|
|
expect(fetchMock).toHaveBeenCalledWith(
|
|
'http://apprise.local/notify/test-key',
|
|
expect.objectContaining({
|
|
method: 'POST',
|
|
body: JSON.stringify({
|
|
title: 'Sencho Alert [INFO]',
|
|
body: '🔌 Test Notification from Sencho!',
|
|
type: 'info',
|
|
tag: 'ops',
|
|
}),
|
|
}),
|
|
);
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('dispatches stateless Apprise test with urls and rejects scheme-less tokens', async () => {
|
|
const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
try {
|
|
const bad = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'apprise', url: 'http://apprise.local/notify', config: { urls: 'no-scheme' } });
|
|
expect(bad.status).toBe(400);
|
|
expect(fetchMock).not.toHaveBeenCalled();
|
|
|
|
const ok = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'apprise', url: 'http://apprise.local/notify', config: { urls: 'discord://token' } });
|
|
expect(ok.status).toBe(200);
|
|
expect(fetchMock).toHaveBeenCalledWith(
|
|
'http://apprise.local/notify',
|
|
expect.objectContaining({
|
|
body: JSON.stringify({
|
|
title: 'Sencho Alert [INFO]',
|
|
body: '🔌 Test Notification from Sencho!',
|
|
type: 'info',
|
|
urls: 'discord://token',
|
|
}),
|
|
}),
|
|
);
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('returns sanitized details on Apprise 204 without leaking secrets', async () => {
|
|
vi.stubGlobal('fetch', vi.fn().mockResolvedValue({ ok: true, status: 204 }));
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'apprise', url: 'http://apprise.local/notify/secret-key', config: {} });
|
|
expect(res.status).toBe(500);
|
|
expect(JSON.stringify(res.body)).toContain('HTTP 204');
|
|
expect(JSON.stringify(res.body)).not.toContain('secret-key');
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('dispatches a templated test with substituted variables', async () => {
|
|
const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
type: 'webhook',
|
|
url: 'https://example.com/hooks/sencho',
|
|
payload_template: '{"message": "{{message}}", "level": "{{level}}", "category": "{{category}}"}',
|
|
});
|
|
expect(res.status).toBe(200);
|
|
const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
|
|
expect(JSON.parse(String(init.body))).toEqual({
|
|
message: '🔌 Test Notification from Sencho!',
|
|
level: 'info',
|
|
category: 'system',
|
|
});
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('rejects an unknown variable on a templated test without dispatching', async () => {
|
|
const fetchMock = vi.fn();
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
type: 'webhook',
|
|
url: 'https://example.com/hooks/sencho',
|
|
payload_template: '{"a": "{{nope}}"}',
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toMatch(/Unknown template variable/);
|
|
expect(fetchMock).not.toHaveBeenCalled();
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('rejects an over-length template on a templated test', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
type: 'webhook',
|
|
url: 'https://example.com/hooks/sencho',
|
|
payload_template: `{"msg":"${'x'.repeat(PAYLOAD_TEMPLATE_MAX_LENGTH - 9)}"}`,
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toContain('8000 characters or fewer');
|
|
});
|
|
|
|
it('keeps the built-in payload when the test template is blank', async () => {
|
|
const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({ type: 'webhook', url: 'https://example.com/hooks/sencho', payload_template: ' ' });
|
|
expect(res.status).toBe(200);
|
|
const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
|
|
const body = JSON.parse(String(init.body)) as { source?: string };
|
|
expect(body.source).toBe('sencho');
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('merges Apprise destinations into a templated test dispatch', async () => {
|
|
const fetchMock = vi.fn().mockResolvedValue({ ok: true, status: 200 });
|
|
vi.stubGlobal('fetch', fetchMock);
|
|
try {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
type: 'apprise',
|
|
url: 'http://apprise.local/notify/test-key',
|
|
config: { tags: 'ops' },
|
|
payload_template: '{"title": "{{level}}"}',
|
|
});
|
|
expect(res.status).toBe(200);
|
|
const [, init] = fetchMock.mock.calls[0] as [string, RequestInit];
|
|
expect(JSON.parse(String(init.body))).toEqual({ title: 'info', tag: 'ops' });
|
|
} finally {
|
|
vi.unstubAllGlobals();
|
|
}
|
|
});
|
|
|
|
it('rejects an Apprise templated test that carries urls', async () => {
|
|
const res = await request(app)
|
|
.post('/api/notifications/test')
|
|
.set('Cookie', authCookie)
|
|
.send({
|
|
type: 'apprise',
|
|
url: 'http://apprise.local/notify',
|
|
config: { urls: 'discord://token@id' },
|
|
payload_template: '{"urls": "discord://token@id"}',
|
|
});
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toContain('urls');
|
|
});
|
|
});
|