discourse/spec/requests/admin/web_hooks_controller_spec.rb

# frozen_string_literal: true

RSpec.describe Admin::WebHooksController do
  fab!(:web_hook) { Fabricate(:web_hook) }
  fab!(:admin) { Fabricate(:admin) }
  fab!(:moderator) { Fabricate(:moderator) }
  fab!(:user) { Fabricate(:user) }

  describe "#create" do
    context "when logged in as admin" do
      before { sign_in(admin) }

      it "creates a webhook" do
        post "/admin/api/web_hooks.json",
             params: {
               web_hook: {
                 payload_url: "https://meta.discourse.org/",
                 content_type: 1,
                 secret: "a_secret_for_webhooks",
                 wildcard_web_hook: false,
                 active: true,
                 verify_certificate: true,
                 web_hook_event_type_ids: [1],
                 group_ids: [],
                 category_ids: [],
               },
             }

        expect(response.status).to eq(200)

        json = response.parsed_body
        expect(json["web_hook"]["payload_url"]).to eq("https://meta.discourse.org/")
        expect(
          UserHistory.where(
            acting_user_id: admin.id,
            action: UserHistory.actions[:web_hook_create],
          ).count,
        ).to eq(1)
      end

      it "returns error when field is not filled correctly" do
        post "/admin/api/web_hooks.json",
             params: {
               web_hook: {
                 content_type: 1,
                 secret: "a_secret_for_webhooks",
                 wildcard_web_hook: false,
                 active: true,
                 verify_certificate: true,
                 web_hook_event_type_ids: [1],
                 group_ids: [],
                 category_ids: [],
               },
             }

        expect(response.status).to eq(422)
        response_body = response.parsed_body

        expect(response_body["errors"]).to be_present
      end
    end

    shared_examples "webhook creation not allowed" do
      it "prevents creation with a 404 response" do
        post "/admin/api/web_hooks.json",
             params: {
               web_hook: {
                 payload_url: "https://meta.discourse.org/",
                 content_type: 1,
                 secret: "a_secret_for_webhooks",
                 wildcard_web_hook: false,
                 active: true,
                 verify_certificate: true,
                 web_hook_event_type_ids: [1],
                 group_ids: [],
                 category_ids: [],
               },
             }

        expect(response.status).to eq(404)
        expect(response.parsed_body["errors"]).to include(I18n.t("not_found"))
        expect(response.parsed_body["web_hook"]).to be_nil
      end
    end

    context "when logged in as a moderator" do
      before { sign_in(moderator) }

      include_examples "webhook creation not allowed"
    end

    context "when logged in as a non-staff user" do
      before { sign_in(user) }

      include_examples "webhook creation not allowed"
    end
  end

  describe "#update" do
    context "when logged in as admin" do
      before { sign_in(admin) }

      it "logs webhook update" do
        put "/admin/api/web_hooks/#{web_hook.id}.json",
            params: {
              web_hook: {
                active: false,
                payload_url: "https://test.com",
              },
            }

        expect(response.status).to eq(200)
        expect(
          UserHistory.where(
            acting_user_id: admin.id,
            action: UserHistory.actions[:web_hook_update],
            new_value: "active: false, payload_url: https://test.com",
          ).exists?,
        ).to eq(true)
      end
    end

    shared_examples "webhook update not allowed" do
      it "prevents updates with a 404 response" do
        current_payload_url = web_hook.payload_url
        put "/admin/api/web_hooks/#{web_hook.id}.json",
            params: {
              web_hook: {
                active: false,
                payload_url: "https://test.com",
              },
            }

        web_hook.reload
        expect(response.status).to eq(404)
        expect(response.parsed_body["errors"]).to include(I18n.t("not_found"))
        expect(web_hook.payload_url).to eq(current_payload_url)
      end
    end

    context "when logged in as a moderator" do
      before { sign_in(moderator) }

      include_examples "webhook update not allowed"
    end

    context "when logged in as a non-staff user" do
      before { sign_in(user) }

      include_examples "webhook update not allowed"
    end
  end

  describe "#destroy" do
    context "when logged in as admin" do
      before { sign_in(admin) }

      it "logs webhook destroy" do
        delete "/admin/api/web_hooks/#{web_hook.id}.json",
               params: {
                 web_hook: {
                   active: false,
                   payload_url: "https://test.com",
                 },
               }

        expect(response.status).to eq(200)
        expect(
          UserHistory.where(
            acting_user_id: admin.id,
            action: UserHistory.actions[:web_hook_destroy],
          ).exists?,
        ).to eq(true)
      end
    end

    shared_examples "webhook deletion not allowed" do
      it "prevents deletion with a 404 response" do
        delete "/admin/api/web_hooks/#{web_hook.id}.json"

        expect(response.status).to eq(404)
        expect(response.parsed_body["errors"]).to include(I18n.t("not_found"))
        expect(web_hook.reload).to be_present
      end
    end

    context "when logged in as a moderator" do
      before { sign_in(moderator) }

      include_examples "webhook deletion not allowed"
    end

    context "when logged in as a non-staff user" do
      before { sign_in(user) }

      include_examples "webhook deletion not allowed"
    end
  end

  describe "#ping" do
    context "when logged in as admin" do
      before { sign_in(admin) }

      it "enqueues the ping event" do
        expect do post "/admin/api/web_hooks/#{web_hook.id}/ping.json" end.to change {
          Jobs::EmitWebHookEvent.jobs.size
        }.by(1)

        expect(response.status).to eq(200)
        job_args = Jobs::EmitWebHookEvent.jobs.first["args"].first
        expect(job_args["web_hook_id"]).to eq(web_hook.id)
        expect(job_args["event_type"]).to eq("ping")
      end
    end

    shared_examples "webhook ping not allowed" do
      it "fails to enqueue a ping with 404 response" do
        expect do post "/admin/api/web_hooks/#{web_hook.id}/ping.json" end.not_to change {
          Jobs::EmitWebHookEvent.jobs.size
        }

        expect(response.status).to eq(404)
        expect(response.parsed_body["errors"]).to include(I18n.t("not_found"))
      end
    end

    context "when logged in as a moderator" do
      before { sign_in(moderator) }

      include_examples "webhook ping not allowed"
    end

    context "when logged in as a non-staff user" do
      before { sign_in(user) }

      include_examples "webhook ping not allowed"
    end
  end

  describe "#redeliver_event" do
    let!(:web_hook_event) do
      WebHookEvent.create!(web_hook: web_hook, payload: "abc", headers: JSON.dump(aa: "1", bb: "2"))
    end

    before { sign_in(admin) }

    it "emits the web hook and updates the response headers and body" do
      stub_request(:post, web_hook.payload_url).with(
        body: "abc",
        headers: {
          "aa" => 1,
          "bb" => 2,
        },
      ).to_return(
        status: 402,
        body: "efg",
        headers: {
          "Content-Type" => "application/json",
          "yoo" => "man",
        },
      )
      post "/admin/api/web_hooks/#{web_hook.id}/events/#{web_hook_event.id}/redeliver.json"
      expect(response.status).to eq(200)

      parsed_event = response.parsed_body["web_hook_event"]
      expect(parsed_event["id"]).to eq(web_hook_event.id)
      expect(parsed_event["status"]).to eq(402)

      expect(JSON.parse(parsed_event["headers"])).to eq({ "aa" => "1", "bb" => "2" })
      expect(parsed_event["payload"]).to eq("abc")

      expect(JSON.parse(parsed_event["response_headers"])).to eq(
        { "content-type" => "application/json", "yoo" => "man" },
      )
      expect(parsed_event["response_body"]).to eq("efg")
    end

    it "doesn't emit the web hook if the payload URL resolves to an internal IP" do
      FinalDestination::TestHelper.stub_to_fail do
        post "/admin/api/web_hooks/#{web_hook.id}/events/#{web_hook_event.id}/redeliver.json"
      end
      expect(response.status).to eq(200)

      parsed_event = response.parsed_body["web_hook_event"]
      expect(parsed_event["id"]).to eq(web_hook_event.id)
      expect(parsed_event["response_headers"]).to eq(
        { error: I18n.t("webhooks.payload_url.blocked_or_internal") }.to_json,
      )
      expect(parsed_event["status"]).to eq(-1)
      expect(parsed_event["response_body"]).to eq(nil)
    end

    it "doesn't emit the web hook if the payload URL resolves to a blocked IP" do
      FinalDestination::TestHelper.stub_to_fail do
        post "/admin/api/web_hooks/#{web_hook.id}/events/#{web_hook_event.id}/redeliver.json"
      end
      expect(response.status).to eq(200)

      parsed_event = response.parsed_body["web_hook_event"]
      expect(parsed_event["id"]).to eq(web_hook_event.id)
      expect(parsed_event["response_headers"]).to eq(
        { error: I18n.t("webhooks.payload_url.blocked_or_internal") }.to_json,
      )
      expect(parsed_event["status"]).to eq(-1)
      expect(parsed_event["response_body"]).to eq(nil)
    end
  end
end