webhook/test/routes/github/index.spec.ts at 2b63309147eaa45cda88e692adb00ab5c3f0fa64 · streamdevs/webhook · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
import { initServer } from '../../../src/server';
import { getConfig } from '../../../src/config';

describe('POST /github', () => {
	it('returns 400 on requests without payload', async () => {
		const subject = await initServer(getConfig());

		const { statusCode } = await subject.inject({
			method: 'POST',
			url: '/github',
			headers: {
				'X-GitHub-Event': 'ping',
			},
		});

		expect(statusCode).toBe(400);
	});

	it("returns 400 on requests without 'X-GitHub-Event' header", async () => {
		const subject = await initServer(getConfig());

		const { statusCode } = await subject.inject({
			method: 'POST',
			url: '/github',
			payload: {
				action: 'created',
				repository: {
					full_name: 'a',
				},
				sender: {
					login: 'b',
				},
			},
		});

		expect(statusCode).toBe(400);
	});

	it('handles unknown actions gracefully', async () => {
		const subject = await initServer(getConfig());

		const { statusCode, result } = await subject.inject({
			method: 'POST',
			url: '/github',
			headers: {
				'Content-Type': 'application/json',
				'X-GitHub-Event': 'project',
			},
			payload: {
				hook: { events: ['created'] },
				sender: {
					login: 'user',
				},
				repository: {
					full_name: 'org/repo',
				},
			},
		});

		expect(statusCode).toBe(200);
		expect(result).toEqual({ message: `Ignoring event: 'project'` });
	});

	describe("with 'GITHUB_SECRET' configured", () => {
		it("rejects requests without 'X-Hub-Signature' header", async () => {
			const subject = await initServer({ ...getConfig(), GITHUB_SECRET: 'patatas' });
			const request = {
				method: 'POST',
				url: '/github',
				headers: {
					'Content-Type': 'application/json',
					'X-GitHub-Event': 'project',
				},
				payload: {
					hook: { events: ['created'] },
					sender: {
						login: 'user',
					},
					repository: {
						full_name: 'org/repo',
					},
				},
			};

			const { statusCode } = await subject.inject(request);

			expect(statusCode).toEqual(403);
		});

		it("rejects requests with invalid 'X-Hub-Signature' header", async () => {
			const subject = await initServer({ ...getConfig(), GITHUB_SECRET: 'patatas' });
			const request = {
				method: 'POST',
				url: '/github',
				headers: {
					'Content-Type': 'application/json',
					'X-GitHub-Event': 'project',
					'X-Hub-Signature': 'patatas',
				},
				payload: {
					hook: { events: ['created'] },
					sender: {
						login: 'user',
					},
					repository: {
						full_name: 'org/repo',
					},
				},
			};

			const { statusCode } = await subject.inject(request);

			expect(statusCode).toEqual(403);
		});

		it("accept requests with valid 'X-Hub-Signature' header", async () => {
			const subject = await initServer({ ...getConfig(), GITHUB_SECRET: 'patatas' });
			const request = {
				method: 'POST',
				url: '/github',
				headers: {
					'Content-Type': 'application/json',
					'X-GitHub-Event': 'project',
					'X-Hub-Signature': 'sha1=7027fb0d07cb42f7c273aa2258f54f6626ca3f3c',
				},
				payload: {
					hook: { events: ['created'] },
					sender: {
						login: 'user',
					},
					repository: {
						full_name: 'org/repo',
					},
				},
			};

			const { statusCode } = await subject.inject(request);

			expect(statusCode).toEqual(200);
		});
	});
});