webhooker/internal/delivery/client_ssrf_test.go

package delivery_test

import (
	"context"
	"log/slog"
	"net/http"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"sneak.berlin/go/webhooker/internal/delivery"
)

// newSSRFTestEngine builds an Engine whose shared client
// carries the SSRF-safe transport, mirroring production.
func newSSRFTestEngine() *delivery.Engine {
	log := slog.New(slog.DiscardHandler)

	client := &http.Client{
		Timeout: 30 * time.Second,
		Transport: delivery.NewTestGuard().
			NewSSRFSafeTransport(),
	}

	return delivery.NewTestEngine(log, client, 1)
}

// TestClientForRequest_TimeoutKeepsSSRFGuard asserts that a
// client returned by clientForRequest for a config with a
// per-target timeout still refuses connections to
// private/reserved addresses (the timeout must not drop the
// SSRF-safe transport).
func TestClientForRequest_TimeoutKeepsSSRFGuard(t *testing.T) {
	t.Parallel()

	engine := newSSRFTestEngine()

	blocked := []string{
		loopbackHookURL,
		metadataURL,
		"http://[fe80::1]/hook",
	}

	for _, target := range blocked {
		t.Run(target, func(t *testing.T) {
			t.Parallel()

			cfg := &delivery.HTTPTargetConfig{
				URL:     target,
				Timeout: 5,
			}

			client := engine.ExportClientForRequest(cfg, nil)

			require.NotSame(t, engine.ExportClient(), client,
				"a per-target timeout must yield a "+
					"distinct client",
			)

			assert.Equal(t,
				5*time.Second, client.Timeout,
				"the per-target timeout must be applied",
			)

			assert.Same(t,
				engine.ExportClient().Transport,
				client.Transport,
				"the SSRF-safe transport must be reused, "+
					"not dropped",
			)

			req, err := http.NewRequestWithContext(
				context.Background(),
				http.MethodPost, target, nil,
			)
			require.NoError(t, err)

			resp, doErr := client.Do(req)
			if resp != nil {
				_ = resp.Body.Close()
			}

			require.Error(t, doErr,
				"request to %s must be blocked", target,
			)

			assert.Contains(t, doErr.Error(), "blocked",
				"error must come from the SSRF guard",
			)
		})
	}
}

// TestClientForRequest_NoTimeoutUnchanged asserts that a
// request with neither a per-target timeout nor an origin-scoped
// header gets the shared SSRF-safe client unchanged: there is then
// nothing for a redirect policy to strip.
func TestClientForRequest_NoTimeoutUnchanged(t *testing.T) {
	t.Parallel()

	engine := newSSRFTestEngine()

	cfg := &delivery.HTTPTargetConfig{
		URL: "https://example.com/hook",
	}

	client := engine.ExportClientForRequest(cfg, nil)

	assert.Same(t, engine.ExportClient(), client,
		"without a per-target timeout the shared client "+
			"must be returned unchanged",
	)
}

// TestClientForRequest_HeadersKeepSSRFGuard asserts that the
// redirect policy an origin-scoped header installs is added to a
// client that still carries the SSRF-safe transport. The guard is
// a dial hook, so keeping it is what makes each redirect hop pass
// the private-IP check too.
func TestClientForRequest_HeadersKeepSSRFGuard(t *testing.T) {
	t.Parallel()

	engine := newSSRFTestEngine()

	cfg := &delivery.HTTPTargetConfig{
		URL: "https://example.com/with-headers",
		Headers: map[string]string{
			"X-Api-Key": "configured",
		},
	}

	client := engine.ExportClientForRequest(
		cfg, []string{"X-Api-Key"},
	)

	require.NotNil(t, client.CheckRedirect,
		"an origin-scoped header must install a redirect policy",
	)

	assert.Same(t,
		engine.ExportClient().Transport, client.Transport,
		"the SSRF-safe transport must be reused, not dropped",
	)

	assert.Equal(t,
		engine.ExportClient().Timeout, client.Timeout,
		"the shared client's timeout must be inherited",
	)
}