kongruity/backend/tests/webhooks.routes.test.ts

import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
import request from 'supertest';
import { createHmac } from 'node:crypto';
import app from '../app.js';
import { configureQueue, drain } from '../lib/queue.js';

vi.mock('../db/ingest_events.dao.js', () => ({
  recordDelivery: vi.fn(),
  markProcessing: vi.fn(),
  markDone: vi.fn(),
  markFailed: vi.fn(),
  resetStaleProcessing: vi.fn(),
}));

vi.mock('../db/notes.dao.js', () => ({
  createNotes: vi.fn(),
  getAllNotes: vi.fn(),
  streamAllNotes: vi.fn(),
}));

import {
  recordDelivery,
  markDone,
  markFailed,
  markProcessing,
} from '../db/ingest_events.dao.js';
import { createNotes } from '../db/notes.dao.js';

const mockRecordDelivery = vi.mocked(recordDelivery);
const mockCreateNotes = vi.mocked(createNotes);
const mockMarkDone = vi.mocked(markDone);
const mockMarkFailed = vi.mocked(markFailed);
const mockMarkProcessing = vi.mocked(markProcessing);

const SECRET = 'linear-test-secret';

// Deliberately irregular spacing: if any middleware parsed and re-serialized
// this body, the signature computed over these exact bytes would not verify.
const RAW_BODY = '{"action":"create", "type":"Comment","data":{"id":"cmt_1","body":"Deploys are scary","url":"https://linear.app/c/1","user":{"name":"jane"}} }';

const sign = (body: string, secret = SECRET): string =>
  createHmac('sha256', secret).update(body).digest('hex');

const postLinear = (body: string, signature: string) =>
  request(app)
    .post('/v1/webhooks/linear')
    .set('Content-Type', 'application/json')
    .set('linear-signature', signature)
    .send(body);

describe('POST /v1/webhooks/:provider', () => {
  const originalSecret = process.env.LINEAR_SIGNING_SECRET;

  beforeEach(() => {
    vi.clearAllMocks();
    process.env.LINEAR_SIGNING_SECRET = SECRET;
    configureQueue({ baseDelayMs: 0, maxAttempts: 2 });
    mockRecordDelivery.mockResolvedValue(42);
    mockCreateNotes.mockResolvedValue([]);
  });

  afterEach(async () => {
    await drain();
    if (originalSecret === undefined) {
      delete process.env.LINEAR_SIGNING_SECRET;
    } else {
      process.env.LINEAR_SIGNING_SECRET = originalSecret;
    }
  });

  it('should accept a correctly signed delivery', async () => {
    const res = await postLinear(RAW_BODY, sign(RAW_BODY));

    expect(res.status).toBe(200);
    expect(res.body).toEqual({ accepted: true, notes: 1 });
  });

  it('should preserve the exact request bytes for signature verification', async () => {
    // The signature is over RAW_BODY verbatim. This passing is the regression
    // test for express.raw being mounted ahead of express.json in app.ts.
    const res = await postLinear(RAW_BODY, sign(RAW_BODY));

    expect(res.status).toBe(200);
  });

  it('should insert the normalized note after responding', async () => {
    await postLinear(RAW_BODY, sign(RAW_BODY));
    await drain();

    expect(mockCreateNotes).toHaveBeenCalledOnce();
    const [notes] = mockCreateNotes.mock.calls[0];
    expect(notes).toHaveLength(1);
    expect(notes[0].text).toBe('Deploys are scary');
    expect(notes[0].author).toBe('jane');
    expect(notes[0].id).toBe('linear_cmt_1');
  });

  it('should record provenance on the ingested note', async () => {
    await postLinear(RAW_BODY, sign(RAW_BODY));
    await drain();

    const [notes] = mockCreateNotes.mock.calls[0];
    expect(notes[0].sourceMeta).toMatchObject({
      provider: 'linear',
      externalId: 'cmt_1',
      permalink: 'https://linear.app/c/1',
    });
  });

  it('should mark the delivery done once the insert succeeds', async () => {
    await postLinear(RAW_BODY, sign(RAW_BODY));
    await drain();

    expect(mockMarkProcessing).toHaveBeenCalledWith(42);
    expect(mockMarkDone).toHaveBeenCalledWith(42);
    expect(mockMarkFailed).not.toHaveBeenCalled();
  });

  it('should mark the delivery failed when the insert keeps failing', async () => {
    mockCreateNotes.mockRejectedValue(new Error('connection refused'));

    await postLinear(RAW_BODY, sign(RAW_BODY));
    await drain();

    expect(mockMarkFailed).toHaveBeenCalledWith(42, 'connection refused');
    expect(mockMarkDone).not.toHaveBeenCalled();
  });

  it('should respond without waiting for the insert to finish', async () => {
    let finishInsert: () => void = () => {};
    mockCreateNotes.mockImplementation(
      () => new Promise((resolve) => {
        finishInsert = () => resolve([]);
      })
    );

    const res = await postLinear(RAW_BODY, sign(RAW_BODY));

    expect(res.status).toBe(200);
    expect(mockMarkDone).not.toHaveBeenCalled();

    finishInsert();
    await drain();

    expect(mockMarkDone).toHaveBeenCalledWith(42);
  });

  it('should drop a redelivery without enqueueing work', async () => {
    mockRecordDelivery.mockResolvedValue(null);

    const res = await postLinear(RAW_BODY, sign(RAW_BODY));
    await drain();

    expect(res.status).toBe(200);
    expect(res.body).toEqual({ duplicate: true });
    expect(mockCreateNotes).not.toHaveBeenCalled();
  });

  it('should reject a signature computed with the wrong secret', async () => {
    const res = await postLinear(RAW_BODY, sign(RAW_BODY, 'wrong-secret'));

    expect(res.status).toBe(401);
    expect(mockRecordDelivery).not.toHaveBeenCalled();
  });

  it('should reject a delivery whose body was altered after signing', async () => {
    const signature = sign(RAW_BODY);
    const tampered = RAW_BODY.replace('Deploys are scary', 'Deploys are fine');

    const res = await postLinear(tampered, signature);

    expect(res.status).toBe(401);
  });

  it('should reject a delivery with no signature header', async () => {
    const res = await request(app)
      .post('/v1/webhooks/linear')
      .set('Content-Type', 'application/json')
      .send(RAW_BODY);

    expect(res.status).toBe(401);
  });

  it('should return 500 when no signing secret is configured', async () => {
    delete process.env.LINEAR_SIGNING_SECRET;

    const res = await postLinear(RAW_BODY, sign(RAW_BODY));

    expect(res.status).toBe(500);
    expect(mockRecordDelivery).not.toHaveBeenCalled();
  });

  it('should return 500 when recording the delivery fails', async () => {
    mockRecordDelivery.mockRejectedValue(new Error('connection refused'));

    const res = await postLinear(RAW_BODY, sign(RAW_BODY));

    expect(res.status).toBe(500);
    expect(mockCreateNotes).not.toHaveBeenCalled();
  });

  it('should return 404 for an unregistered provider', async () => {
    const res = await request(app)
      .post('/v1/webhooks/notion')
      .set('Content-Type', 'application/json')
      .send('{}');

    expect(res.status).toBe(404);
  });

  it('should return 501 for a provider with no ingestion mapping yet', async () => {
    process.env.GITHUB_WEBHOOK_SECRET = 'gh-secret';
    const body = '{"action":"created"}';
    const signature = `sha256=${createHmac('sha256', 'gh-secret').update(body).digest('hex')}`;

    const res = await request(app)
      .post('/v1/webhooks/github')
      .set('Content-Type', 'application/json')
      .set('x-hub-signature-256', signature)
      .send(body);

    delete process.env.GITHUB_WEBHOOK_SECRET;

    expect(res.status).toBe(501);
  });

  it('should return 400 for a body that is not valid JSON', async () => {
    const body = 'not json at all';

    const res = await postLinear(body, sign(body));

    expect(res.status).toBe(400);
  });

  it('should return 400 when the payload is missing the fields the provider guarantees', async () => {
    const body = '{"action":"create","data":{}}';

    const res = await postLinear(body, sign(body));

    expect(res.status).toBe(400);
    expect(mockRecordDelivery).not.toHaveBeenCalled();
  });

  it('should answer a Slack url_verification handshake without a signature', async () => {
    const res = await request(app)
      .post('/v1/webhooks/slack')
      .set('Content-Type', 'application/json')
      .send('{"type":"url_verification","challenge":"abc123"}');

    expect(res.status).toBe(200);
    expect(res.body).toEqual({ challenge: 'abc123' });
  });
});