webhooker/internal/handlers/event_request_test.go

package handlers_test

import (
	"encoding/json"
	"net/http"
	"slices"
	"strings"
	"testing"
	"time"

	"github.com/google/uuid"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"gorm.io/gorm/clause"
	"sneak.berlin/go/webhooker/internal/database"
)

// arrivedAt is how a page names the entrypoint an event arrived at.
func arrivedAt(name string) string {
	return `Arrived at <span class="text-gray-900">` + name + `</span>`
}

// originalArrivedAt is how a page names the entrypoint a resubmitted
// copy's original arrived at.
func originalArrivedAt(name string) string {
	return `Its original arrived at <span class="text-gray-900">` +
		name + `</span>`
}

// headerLine is how a page shows one request header line.
func headerLine(line string) string {
	return `<div class="whitespace-pre-wrap">` + line + `</div>`
}

// showHeadersLink is the event log's link to an event's own page for
// request headers it leaves out.
func showHeadersLink(webhookID, eventID string) string {
	return `<a href="/hook/` + webhookID + `/events/` + eventID +
		`" class="btn-small">Show the request headers</a>`
}

// entrypoint records one of the fixture webhook's entrypoints.
func (f *recentEventsFixture) entrypoint(
	t *testing.T, description string,
) *database.Entrypoint {
	t.Helper()

	ep := &database.Entrypoint{
		WebhookID:   f.webhook.ID,
		Path:        uuid.NewString(),
		Description: description,
		Active:      true,
	}

	require.NoError(t, f.db.DB().Omit(clause.Associations).Create(ep).Error)

	return ep
}

// eventAt records an event that arrived at the entrypoint with the
// given request headers, stored as JSON as the receiver stores them.
func (f *recentEventsFixture) eventAt(
	t *testing.T,
	ep *database.Entrypoint,
	headersJSON string,
	receivedAt time.Time,
) *database.Event {
	t.Helper()

	event := &database.Event{
		WebhookID:    f.webhook.ID,
		EntrypointID: ep.ID,
		Method:       http.MethodPost,
		Headers:      headersJSON,
		Body:         "{}",
		BodyBytes:    2,
		ContentType:  contentTypeJSON,
	}
	event.CreatedAt = receivedAt

	require.NoError(t, f.webhookDB.Omit(
		clause.Associations,
	).Create(event).Error)

	return event
}

// TestEventRequest_EachEventShowsItsOwnEntrypointAndHeaders proves two
// events that arrived at two entrypoints each show their own
// entrypoint and request headers, in the event log and on their own
// pages, with the headers sorted by name, escaped and keeping their
// whitespace, and never the entrypoint's URL.
func TestEventRequest_EachEventShowsItsOwnEntrypointAndHeaders(
	t *testing.T,
) {
	t.Parallel()

	f := newRecentEventsFixture(t)
	billing := f.entrypoint(t, "Billing sender")
	unnamed := f.entrypoint(t, "")

	// Stored in reverse name order.
	older := f.eventAt(t, billing,
		`{"X-Shop-Event":["order.created"],`+
			`"User-Agent":["shop/1  build\t7"],"Accept":["*/*"]}`,
		time.Now().Add(-time.Minute))
	newer := f.eventAt(t, unnamed,
		`{"X-Shop-Event":["order.paid"],"X-Note":["<b>hi</b>"]}`,
		time.Now())

	olderShows := func(t *testing.T, page string) {
		t.Helper()

		const (
			accept    = "Accept: */*"
			userAgent = "User-Agent: shop/1  build\t7"
			shopEvent = "X-Shop-Event: order.created"
		)

		assert.Contains(t, page, arrivedAt("Billing sender"))
		assert.Contains(t, page, headerLine(accept))
		assert.Contains(t, page, headerLine(userAgent))
		assert.Contains(t, page, headerLine(shopEvent))
		assert.Less(t,
			strings.Index(page, accept), strings.Index(page, userAgent),
			"headers are sorted by name",
		)
		assert.Less(t,
			strings.Index(page, userAgent), strings.Index(page, shopEvent),
			"headers are sorted by name",
		)
		assert.NotContains(t, page, "order.paid")
		assert.NotContains(t, page, billing.Path)
	}

	newerShows := func(t *testing.T, page string) {
		t.Helper()

		assert.Contains(t, page, arrivedAt("Entrypoint"))
		assert.Contains(t, page, headerLine("X-Shop-Event: order.paid"))
		assert.Contains(t, page, headerLine("X-Note: &lt;b&gt;hi&lt;/b&gt;"))
		assert.NotContains(t, page, "<b>hi</b>")
		assert.NotContains(t, page, "order.created")
		assert.NotContains(t, page, unnamed.Path)
	}

	// The log lists the newer event first, so everything between
	// the two events' first mentions belongs to the newer one.
	_, rest, found := strings.Cut(renderSourceLogsPage(
		t, f.h, f.sess, f.webhook.ID,
	), newer.ID)
	require.True(t, found)

	newerPart, olderPart, found := strings.Cut(rest, older.ID)
	require.True(t, found)

	newerShows(t, newerPart)
	olderShows(t, olderPart)

	w := serveEventPage(t, f.h, f.sess, f.webhook.ID, newer.ID)
	require.Equal(t, http.StatusOK, w.Code)
	newerShows(t, w.Body.String())

	w = serveEventPage(t, f.h, f.sess, f.webhook.ID, older.ID)
	require.Equal(t, http.StatusOK, w.Code)
	olderShows(t, w.Body.String())
}

// TestEventRequest_DeletedEntrypoint proves an event whose entrypoint
// has since been deleted says so in the event log and on its own page.
func TestEventRequest_DeletedEntrypoint(t *testing.T) {
	t.Parallel()

	f := newRecentEventsFixture(t)
	ep := f.entrypoint(t, "Retired sender")
	event := f.eventAt(t, ep, `{}`, time.Now())

	require.NoError(t, f.db.DB().Delete(ep).Error)

	page := renderSourceLogsPage(t, f.h, f.sess, f.webhook.ID)
	assert.Contains(t, page, arrivedAt("deleted entrypoint"))
	assert.NotContains(t, page, "Retired sender")

	w := serveEventPage(t, f.h, f.sess, f.webhook.ID, event.ID)
	require.Equal(t, http.StatusOK, w.Code)
	assert.Contains(t, w.Body.String(), arrivedAt("deleted entrypoint"))
	assert.NotContains(t, w.Body.String(), "Retired sender")
}

// TestEventRequest_ResubmittedCopy proves a resubmitted copy says its
// original arrived at the entrypoint, in the event log and on its own
// page, and never that the copy did.
func TestEventRequest_ResubmittedCopy(t *testing.T) {
	t.Parallel()

	f := newRecentEventsFixture(t)
	ep := f.entrypoint(t, "Billing sender")
	original := f.eventAt(t, ep, `{}`, time.Now().Add(-time.Minute))
	copied := f.eventAt(t, ep, `{}`, time.Now())

	require.NoError(t, f.webhookDB.Model(copied).Update(
		"resubmitted_from_id", original.ID,
	).Error)

	// The log lists the copy first, and the original's Resubmit form
	// comes after all of the copy and before the original's
	// entrypoint.
	copyPart, originalPart, found := strings.Cut(
		renderSourceLogsPage(t, f.h, f.sess, f.webhook.ID),
		"/events/"+original.ID+"/resubmit",
	)
	require.True(t, found)

	assert.Contains(t, copyPart, originalArrivedAt("Billing sender"))
	assert.NotContains(t, copyPart, arrivedAt("Billing sender"))
	assert.Contains(t, originalPart, arrivedAt("Billing sender"))
	assert.NotContains(t, originalPart, originalArrivedAt("Billing sender"))

	w := serveEventPage(t, f.h, f.sess, f.webhook.ID, copied.ID)
	require.Equal(t, http.StatusOK, w.Code)
	assert.Contains(t, w.Body.String(), originalArrivedAt("Billing sender"))
	assert.NotContains(t, w.Body.String(), arrivedAt("Billing sender"))
}

// TestEventRequest_HeadersOverTheLimit proves the event log leaves out
// request headers that hold more than it shows of a body, whether
// stored or as lines, and links to the event's own page, which shows
// them all.
func TestEventRequest_HeadersOverTheLimit(t *testing.T) {
	t.Parallel()

	// The receiver stores each "<" as six bytes of JSON, so this
	// header is over the limit stored but not as a line.
	const lessThans = bodyCap/6 + 1

	// A header sent many times is stored with its name once, and
	// shown with it on every line.
	repeatedName := "X-Repeated-" + strings.Repeat("r", 1000)

	tests := map[string]struct {
		headers http.Header
		line    string
	}{
		"stored": {
			headers: http.Header{"X-Long": {strings.Repeat("<", lessThans)}},
			line:    "X-Long: " + strings.Repeat("&lt;", lessThans),
		},
		"as lines": {
			headers: http.Header{repeatedName: slices.Repeat([]string{""}, 41)},
			line:    repeatedName + ": ",
		},
	}

	for name, tc := range tests {
		t.Run(name, func(t *testing.T) {
			t.Parallel()

			headersJSON, err := json.Marshal(tc.headers)
			require.NoError(t, err)

			f := newRecentEventsFixture(t)
			ep := f.entrypoint(t, "Billing sender")
			event := f.eventAt(t, ep, string(headersJSON), time.Now())

			page := renderSourceLogsPage(t, f.h, f.sess, f.webhook.ID)
			assert.Contains(t, page, showHeadersLink(f.webhook.ID, event.ID))
			assert.NotContains(t, page, tc.line)
			assert.Less(t, len(page), 4*bodyCap)

			w := serveEventPage(t, f.h, f.sess, f.webhook.ID, event.ID)
			require.Equal(t, http.StatusOK, w.Code)
			assert.Contains(t, w.Body.String(), headerLine(tc.line))
			assert.NotContains(t, w.Body.String(), "Show the request headers")
		})
	}
}