discourse/spec/requests/webhooks_controller_spec.rb

# frozen_string_literal: true

RSpec.describe WebhooksController do
  before { Discourse.redis.flushdb }

  let(:email) { "em@il.com" }
  let(:message_id) { "12345@il.com" }

  describe "#mailgun" do
    let(:token) { "705a8ccd2ce932be8e98c221fe701c1b4a0afcb8bbd57726de" }
    let(:timestamp) { Time.now.to_i }
    let(:data) { "#{timestamp}#{token}" }
    let(:signature) { OpenSSL::HMAC.hexdigest("SHA256", SiteSetting.mailgun_api_key, data) }

    before do
      SiteSetting.mailgun_api_key = "key-8221462f0c915af3f6f2e2df7aa5a493"
      ActionController::Base.allow_forgery_protection = true # Ensure the endpoint works, even with CSRF protection generally enabled
    end

    after { ActionController::Base.allow_forgery_protection = false }

    it "works (deprecated)" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailgun.json",
           params: {
             "token" => token,
             "timestamp" => timestamp,
             "event" => "dropped",
             "recipient" => email,
             "Message-Id" => "<#{message_id}>",
             "signature" => signature,
             "error" => "smtp; 550-5.1.1 The email account that you tried to reach does not exist.",
             "code" => "5.1.1",
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq("5.1.1")
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "works (new)" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailgun.json",
           params: {
             "signature" => {
               "token" => token,
               "timestamp" => timestamp,
               "signature" => signature,
             },
             "event-data" => {
               "event" => "failed",
               "severity" => "temporary",
               "recipient" => email,
               "message" => {
                 "headers" => {
                   "message-id" => message_id,
                 },
               },
             },
             "delivery-status" => {
               "message" =>
                 "smtp; 550-5.1.1 The email account that you tried to reach does not exist.",
               "code" => "5.1.1",
               "description" => "",
             },
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq("5.1.1")
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.soft_bounce_score)
    end
  end

  describe "#sendgrid" do
    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/sendgrid.json",
           params: {
             "_json" => [
               {
                 "email" => email,
                 "smtp-id" => "<12345@il.com>",
                 "event" => "bounce",
                 "status" => "5.0.0",
               },
             ],
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq("5.0.0")
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "verifies signatures" do
      SiteSetting.sendgrid_verification_key =
        "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE83T4O/n84iotIvIW4mdBgQ/7dAfSmpqIM8kF9mN1flpVKS3GRqe62gw+2fNNRaINXvVpiglSI8eNEc6wEA3F+g=="

      post "/webhooks/sendgrid.json",
           headers: {
             "X-Twilio-Email-Event-Webhook-Signature" =>
               "MEUCIGHQVtGj+Y3LkG9fLcxf3qfI10QysgDWmMOVmxG0u6ZUAiEAyBiXDWzM+uOe5W0JuG+luQAbPIqHh89M15TluLtEZtM=",
             "X-Twilio-Email-Event-Webhook-Timestamp" => "1600112502",
           },
           params:
             "[{\"email\":\"hello@world.com\",\"event\":\"dropped\",\"reason\":\"Bounced Address\",\"sg_event_id\":\"ZHJvcC0xMDk5NDkxOS1MUnpYbF9OSFN0T0doUTRrb2ZTbV9BLTA\",\"sg_message_id\":\"LRzXl_NHStOGhQ4kofSm_A.filterdrecv-p3mdw1-756b745b58-kmzbl-18-5F5FC76C-9.0\",\"smtp-id\":\"<LRzXl_NHStOGhQ4kofSm_A@ismtpd0039p1iad1.sendgrid.net>\",\"timestamp\":1600112492}]\r\n"

      expect(response.status).to eq(200)
    end

    it "returns error if signature verification fails" do
      SiteSetting.sendgrid_verification_key =
        "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE83T4O/n84iotIvIW4mdBgQ/7dAfSmpqIM8kF9mN1flpVKS3GRqe62gw+2fNNRaINXvVpiglSI8eNEc6wEA3F+g=="

      post "/webhooks/sendgrid.json",
           headers: {
             "X-Twilio-Email-Event-Webhook-Signature" =>
               "MEUCIQCtIHJeH93Y+qpYeWrySphQgpNGNr/U+UyUlBkU6n7RAwIgJTz2C+8a8xonZGi6BpSzoQsbVRamr2nlxFDWYNH3j/0=",
             "X-Twilio-Email-Event-Webhook-Timestamp" => "1600112502",
           },
           params:
             "[{\"email\":\"hello@world.com\",\"event\":\"dropped\",\"reason\":\"Bounced Address\",\"sg_event_id\":\"ZHJvcC0xMDk5NDkxOS1MUnpYbF9OSFN0T0doUTRrb2ZTbV9BLTA\",\"sg_message_id\":\"LRzXl_NHStOGhQ4kofSm_A.filterdrecv-p3mdw1-756b745b58-kmzbl-18-5F5FC76C-9.0\",\"smtp-id\":\"<LRzXl_NHStOGhQ4kofSm_A@ismtpd0039p1iad1.sendgrid.net>\",\"timestamp\":1600112492}]\r\n"

      expect(response.status).to eq(406)
    end

    it "returns error if signature is invalid" do
      SiteSetting.sendgrid_verification_key = "foo"

      post "/webhooks/sendgrid.json",
           headers: {
             "X-Twilio-Email-Event-Webhook-Signature" =>
               "MEUCIQCtIHJeH93Y+qpYeWrySphQgpNGNr/U+UyUlBkU6n7RAwIgJTz2C+8a8xonZGi6BpSzoQsbVRamr2nlxFDWYNH3j/0=",
             "X-Twilio-Email-Event-Webhook-Timestamp" => "1600112502",
           },
           params:
             "[{\"email\":\"hello@world.com\",\"event\":\"dropped\",\"reason\":\"Bounced Address\",\"sg_event_id\":\"ZHJvcC0xMDk5NDkxOS1MUnpYbF9OSFN0T0doUTRrb2ZTbV9BLTA\",\"sg_message_id\":\"LRzXl_NHStOGhQ4kofSm_A.filterdrecv-p3mdw1-756b745b58-kmzbl-18-5F5FC76C-9.0\",\"smtp-id\":\"<LRzXl_NHStOGhQ4kofSm_A@ismtpd0039p1iad1.sendgrid.net>\",\"timestamp\":1600112492}]\r\n"

      expect(response.status).to eq(406)
    end
  end

  describe "#mailjet" do
    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailjet.json",
           params: {
             "event" => "bounce",
             "email" => email,
             "hard_bounce" => true,
             "CustomID" => message_id,
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq(nil) # mailjet doesn't give us this
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "verifies signatures" do
      SiteSetting.mailjet_webhook_token = "foo"
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailjet.json?t=foo",
           params: {
             "event" => "bounce",
             "email" => email,
             "hard_bounce" => true,
             "CustomID" => message_id,
           }

      expect(response.status).to eq(200)
      expect(email_log.reload.bounced).to eq(true)
    end

    it "returns error if signature verification fails" do
      SiteSetting.mailjet_webhook_token = "foo"
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailjet.json?t=bar",
           params: {
             "event" => "bounce",
             "email" => email,
             "hard_bounce" => true,
             "CustomID" => message_id,
           }

      expect(response.status).to eq(406)
      expect(email_log.reload.bounced).to eq(false)
    end
  end

  describe "#mailpace" do
    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailpace.json",
           params: {
             event: "email.bounced",
             payload: {
               status: "bounced",
               to: email,
               message_id: "<#{message_id}>",
             },
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq(nil) # mailpace doesn't give us this
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "soft bounces" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mailpace.json",
           params: {
             event: "email.deferred",
             payload: {
               status: "deferred",
               to: email,
               message_id: "<#{message_id}>",
             },
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq(nil) # mailpace doesn't give us this
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.soft_bounce_score)
    end
  end

  describe "#mandrill" do
    let(:payload) do
      "mandrill_events=%5B%7B%22event%22%3A%22hard_bounce%22%2C%22msg%22%3A%7B%22email%22%3A%22em%40il.com%22%2C%22diag%22%3A%225.1.1%22%2C%22bounce_description%22%3A%22smtp%3B+550-5.1.1+The+email+account+that+you+tried+to+reach+does+not+exist.%22%2C%22metadata%22%3A%7B%22message_id%22%3A%2212345%40il.com%22%7D%7D%7D%5D"
    end

    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/mandrill.json",
           params: {
             mandrill_events: [
               {
                 "event" => "hard_bounce",
                 "msg" => {
                   "email" => email,
                   "diag" => "5.1.1",
                   :"bounce_description" =>
                     "smtp; 550-5.1.1 The email account that you tried to reach does not exist.",
                   "metadata" => {
                     "message_id" => message_id,
                   },
                 },
               },
             ].to_json,
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq("5.1.1")
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "verifies signatures" do
      SiteSetting.mandrill_authentication_key = "wr_JeJNO9OI65RFDrvk3Zw"

      post "/webhooks/mandrill.json",
           headers: {
             "X-Mandrill-Signature" => "Q5pCb903EjEqRZ99gZrlYKOfvIU=",
           },
           params: payload

      expect(response.status).to eq(200)
    end

    it "returns error if signature verification fails" do
      SiteSetting.mandrill_authentication_key = "wr_JeJNO9OI65RFDrvk3Zw"

      post "/webhooks/mandrill.json", headers: { "X-Mandrill-Signature" => "foo" }, params: payload

      expect(response.status).to eq(406)
    end

    it "returns error if signature is invalid" do
      SiteSetting.mandrill_authentication_key = "foo"

      post "/webhooks/mandrill.json",
           headers: {
             "X-Mandrill-Signature" => "Q5pCb903EjEqRZ99gZrlYKOfvIU=",
           },
           params: payload

      expect(response.status).to eq(406)
    end
  end

  describe "#mandrill_head" do
    it "works" do
      head "/webhooks/mandrill.json"

      expect(response.status).to eq(200)
    end
  end

  describe "#postmark" do
    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/postmark.json",
           params: {
             "Type" => "HardBounce",
             "MessageID" => message_id,
             "Email" => email,
           }
      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq(nil) # postmark doesn't give us this
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "soft bounces" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/postmark.json",
           params: {
             "Type" => "SoftBounce",
             "MessageID" => message_id,
             "Email" => email,
           }
      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.bounce_error_code).to eq(nil) # postmark doesn't give us this
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.soft_bounce_score)
    end

    it "verifies signatures" do
      SiteSetting.postmark_webhook_token = "foo"
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/postmark.json?t=foo",
           params: {
             "Type" => "HardBounce",
             "MessageID" => message_id,
             "Email" => email,
           }

      expect(response.status).to eq(200)
      expect(email_log.reload.bounced).to eq(true)
    end

    it "returns error if signature verification fails" do
      SiteSetting.postmark_webhook_token = "foo"
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/postmark.json?t=bar",
           params: {
             "Type" => "HardBounce",
             "MessageID" => message_id,
             "Email" => email,
           }

      expect(response.status).to eq(406)
      expect(email_log.reload.bounced).to eq(false)
    end
  end

  describe "#sparkpost" do
    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/sparkpost.json",
           params: {
             "_json" => [
               {
                 "msys" => {
                   "message_event" => {
                     "bounce_class" => 10,
                     "error_code" => "554",
                     "rcpt_to" => email,
                     "rcpt_meta" => {
                       "message_id" => message_id,
                     },
                   },
                 },
               },
             ],
           }

      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end

    it "verifies signatures" do
      SiteSetting.sparkpost_webhook_token = "foo"
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/sparkpost.json?t=foo",
           params: {
             "_json" => [
               {
                 "msys" => {
                   "message_event" => {
                     "bounce_class" => 10,
                     "error_code" => "554",
                     "rcpt_to" => email,
                     "rcpt_meta" => {
                       "message_id" => message_id,
                     },
                   },
                 },
               },
             ],
           }

      expect(response.status).to eq(200)
      expect(email_log.reload.bounced).to eq(true)
    end

    it "returns error if signature verification fails" do
      SiteSetting.sparkpost_webhook_token = "foo"
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      post "/webhooks/sparkpost.json?t=bar",
           params: {
             "_json" => [
               {
                 "msys" => {
                   "message_event" => {
                     "bounce_class" => 10,
                     "error_code" => "554",
                     "rcpt_to" => email,
                     "rcpt_meta" => {
                       "message_id" => message_id,
                     },
                   },
                 },
               },
             ],
           }

      expect(response.status).to eq(406)
      expect(email_log.reload.bounced).to eq(false)
    end
  end

  describe "#aws" do
    let(:payload) do
      {
        "Type" => "Notification",
        "Message" => {
          "notificationType" => "Bounce",
          :"bounce" => {
            "bounceType" => "Permanent",
            "reportingMTA" => "dns; email.example.com",
            :"bouncedRecipients" => [
              {
                "emailAddress" => email,
                "status" => "5.1.1",
                "action" => "failed",
                "diagnosticCode" => "smtp; 550 5.1.1 <#{email}>... User",
              },
            ],
            "bounceSubType" => "General",
            "timestamp" => "2016-01-27T14:59:38.237Z",
            "feedbackId" => "00000138111222aa-33322211-cccc-cccc-cccc-ddddaaaa068a-000000",
            "remoteMtaIp" => "127.0.2.0",
          },
          :"mail" => {
            "timestamp" => "2016-01-27T14:59:38.237Z",
            "source" => "john@example.com",
            "sourceArn" => "arn:aws:ses:us-east-1:888888888888:identity/example.com",
            "sourceIp" => "127.0.3.0",
            "sendingAccountId" => "123456789012",
            "callerIdentity" => "IAM_user_or_role_name",
            "messageId" => message_id,
            "destination" => [email, "jane@example.com", "mary@example.com", "richard@example.com"],
            "headersTruncated" => false,
            "headers" => [
              { "name" => "From", "value" => "\"John Doe\" <john@example.com>" },
              {
                "name" => "To",
                "value" =>
                  "\"Test\" <#{email}>, \"Jane Doe\" <jane@example.com>, \"Mary Doe\" <mary@example.com>, \"Richard Doe\" <richard@example.com>",
              },
              { "name" => "Message-ID", "value" => message_id },
              { "name" => "Subject", "value" => "Hello" },
              { "name" => "Content-Type", "value" => "text/plain; charset=\"UTF-8\"" },
              { "name" => "Content-Transfer-Encoding", "value" => "base64" },
              { "name" => "Date", "value" => "Wed, 27 Jan 2016 14:05:45 +0000" },
            ],
            "commonHeaders" => {
              "from" => ["John Doe <john@example.com>"],
              "date" => "Wed, 27 Jan 2016 14:05:45 +0000",
              "to" => [
                "\"Test\" <#{email}>, Jane Doe <jane@example.com>, Mary Doe <mary@example.com>, Richard Doe <richard@example.com>",
              ],
              "messageId" => message_id,
              "subject" => "Hello",
            },
          },
        }.to_json,
      }.to_json
    end

    before { Jobs.run_immediately! }

    it "works" do
      user = Fabricate(:user, email: email)
      email_log = Fabricate(:email_log, user: user, message_id: message_id, to_address: email)

      require "aws-sdk-sns"
      Aws::SNS::MessageVerifier.any_instance.stubs(:authentic?).with(payload).returns(true)

      post "/webhooks/aws.json", headers: { "RAW_POST_DATA" => payload }
      expect(response.status).to eq(200)

      email_log.reload
      expect(email_log.bounced).to eq(true)
      expect(email_log.user.user_stat.bounce_score).to eq(SiteSetting.hard_bounce_score)
    end
  end
end