electric-cherry/tests/unit/telemetry-auth.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
import { authenticateTelemetry } from '../../src/lib/server/auth/telemetry.js';
import { newFixture, type Fixture } from '../helpers/fixture.js';
import { gameEvent } from '../helpers/telemetry.js';

const token = 'ec_telemetry_0123456789abcdef0123456789abcdef';
const otherToken = 'ec_telemetry_fedcba9876543210fedcba9876543210';
const request = (values: Record<string, string | undefined> = {}, url = 'http://localhost/api/telemetry') => {
    const headers = new Headers({ 'Content-Type': 'application/json' });
    for (const [key, value] of Object.entries(values)) if (value !== undefined) headers.set(key, value);
    return new Request(url, { method: 'POST', headers, body: JSON.stringify(gameEvent('heartbeat')) });
};

beforeEach(() => { vi.stubEnv('EC_TELEMETRY_TOKEN', token); });
afterEach(() => { vi.unstubAllEnvs(); vi.restoreAllMocks(); });

describe('machine telemetry credentials', () => {
    it.each([
        { Authorization: `Bearer ${token}` },
        { authorization: `bearer ${token}` },
        { 'X-EC-Telemetry-Token': token },
        { Authorization: `Bearer ${token}`, 'X-EC-Telemetry-Token': token }
    ])('accepts an explicit telemetry secret without a browser session: %j', headers => {
        expect(authenticateTelemetry(request(headers))).toEqual({ ok: true });
    });

    it.each([undefined, '', 'too-short', 'x'.repeat(513), 'x'.repeat(40) + ' not-header-safe'])('fails closed when configuration is unusable: %s', configured => {
        vi.stubEnv('EC_TELEMETRY_TOKEN', configured);
        expect(authenticateTelemetry(request({ Authorization: `Bearer ${token}` }))).toMatchObject({ ok: false, status: 503 });
    });

    it.each([
        {},
        { Cookie: `ec_session=${token}` },
        { Authorization: `Bearer ${otherToken}` },
        { 'X-EC-Telemetry-Token': otherToken },
        { Authorization: `Basic ${token}`, 'X-EC-Telemetry-Token': token },
        { Authorization: `Bearer  ${token}` },
        { Authorization: `Bearer ${token}, Bearer ${token}` },
        { Authorization: `Bearer ${token}`, 'X-EC-Telemetry-Token': otherToken },
        { Authorization: `Bearer ${otherToken}`, 'X-EC-Telemetry-Token': token },
        { Authorization: 'Bearer short', 'X-EC-Telemetry-Token': token },
        { Authorization: `Bearer ec_host_${'1'.repeat(43)}` },
        { Authorization: `Bearer ec_enroll_${'1'.repeat(43)}` }
    ])('rejects missing, wrong, ambiguous or unrelated credentials: %j', headers => {
        const authentication = authenticateTelemetry(request(headers));
        expect(authentication).toMatchObject({ ok: false, status: 401 });
        expect(JSON.stringify(authentication)).not.toContain(token);
        expect(JSON.stringify(authentication)).not.toContain(otherToken);
    });

    it('does not accept tokens placed in query parameters', () => {
        expect(authenticateTelemetry(request({}, `http://localhost/api/telemetry?token=${token}`))).toMatchObject({ ok: false, status: 401 });
    });

    it('retains existing transport behavior for authenticated local machine relays', () => {
        expect(authenticateTelemetry(request({ 'X-EC-Telemetry-Token': token }, 'http://controller.internal/api/telemetry'))).toEqual({ ok: true });
    });

    it('uses the current configured token after rotation and safely rejects differing token lengths', () => {
        expect(authenticateTelemetry(request({ Authorization: `Bearer ${token}` }))).toEqual({ ok: true });
        vi.stubEnv('EC_TELEMETRY_TOKEN', otherToken);
        expect(authenticateTelemetry(request({ Authorization: `Bearer ${token}` }))).toMatchObject({ ok: false, status: 401 });
        expect(authenticateTelemetry(request({ Authorization: `Bearer ${otherToken}` }))).toEqual({ ok: true });
        expect(authenticateTelemetry(request({ Authorization: `Bearer ${'x'.repeat(32)}` }))).toMatchObject({ ok: false, status: 401 });
    });
});

describe('telemetry endpoint authentication boundary', () => {
    let fixture: Fixture;
    beforeEach(async () => {
        vi.resetModules();
        fixture = await newFixture();
        const { seedServerRegistry } = await import('../../src/lib/server/fleet/servers.js');
        await seedServerRegistry();
    });
    afterEach(async () => { await fixture.cleanup(); });

    it.each([401, 503])('returns %s before parsing or storing untrusted evidence', async status => {
        if (status === 503) vi.stubEnv('EC_TELEMETRY_TOKEN', undefined);
        const { POST } = await import('../../src/routes/api/telemetry/+server.js');
        const { db } = await import('../../src/lib/server/db/index.js');
        const { listTelemetry } = await import('../../src/lib/server/fleet/telemetry.js');
        const { subscribe } = await import('../../src/lib/server/pipeline/bus.js');
        const incoming = request({ Cookie: 'ec_session=browser-user' });
        const parse = vi.spyOn(incoming, 'json');
        const listener = vi.fn();
        const unsubscribe = subscribe(listener);
        const response = await POST({ request: incoming });
        unsubscribe();
        expect(response.status).toBe(status);
        expect(response.headers.get('cache-control')).toBe('no-store');
        expect(parse).not.toHaveBeenCalled();
        expect(incoming.bodyUsed).toBe(false);
        expect(listTelemetry()).toEqual([]);
        expect(db().prepare('SELECT COUNT(*) AS count FROM telemetry_requests').get()).toEqual({ count: 0 });
        expect(listener).not.toHaveBeenCalled();
    });

    it('accepts authenticated automation with the unchanged event payload and excludes headers from diagnostics', async () => {
        const { POST } = await import('../../src/routes/api/telemetry/+server.js');
        const { listTelemetryRequests } = await import('../../src/lib/server/fleet/telemetry-requests.js');
        const payload = gameEvent('heartbeat');
        const response = await POST({ request: request({ 'X-EC-Telemetry-Token': token }) });
        expect(response.status).toBe(200);
        expect(await response.json()).toMatchObject({ ok: true, telemetry: payload });
        const history = listTelemetryRequests(payload.server);
        expect(history).toHaveLength(1);
        expect(JSON.stringify(history)).not.toContain(token);
        expect(JSON.parse(history[0].payload!)).toEqual(payload);
    });
});