etherpad-lite/src/tests/backend/common.ts

'use strict';

import {MapArrayType} from "../../node/types/MapType";

import AttributePool from '../../static/js/AttributePool';
const assert = require('assert').strict;
const io = require('socket.io-client');
const log4js = require('log4js');
import padutils from '../../static/js/pad_utils';
const process = require('process');
const server = require('../../node/server');
const setCookieParser = require('set-cookie-parser');
import settings from '../../node/utils/Settings';
import supertest from 'supertest';
import TestAgent from "supertest/lib/agent";
import {Http2Server} from "node:http2";
import {SignJWT} from "jose";
import {privateKeyExported} from "../../node/security/OAuth2Provider";
const webaccess = require('../../node/hooks/express/webaccess');

const backups:MapArrayType<any> = {};
let agentPromise:Promise<any>|null = null;

export let agent: TestAgent|null = null;
export let baseUrl:string|null = null;
export let httpServer: Http2Server|null = null;
export const logger = log4js.getLogger('test');

const logLevel = logger.level;

// Log unhandled Promise rejections; do NOT rethrow and do NOT process.exit().
//
// Root cause of the long-standing Windows backend "silent ELIFECYCLE" flake
// (confirmed via a procdump full-memory capture showing node::ReallyExit
// firing from a microtask): a timing-fragile test (e.g. SessionStore touch/
// expiry specs) gets timed out and abandoned by mocha, but its async body
// keeps running; when its trailing assertion later throws, it surfaces as an
// *orphan* unhandled rejection — one that belongs to no currently-awaited
// test. PR #7663 rethrew these (→ uncaughtException) and an earlier revision
// even called process.exit(), and server.ts's production handler turned them
// into a full Etherpad shutdown. Any one orphan rejection therefore killed
// the whole suite mid-run with no mocha summary.
//
// Orphan rejections cannot be cleanly attributed to a test, so rethrowing
// just produces an ERR_MOCHA_MULTIPLE_DONE mess and a non-deterministic
// abort. Log them loudly instead. Real failures are unaffected: an assertion
// inside a test's own awaited path rejects THAT test's promise and mocha
// fails it normally — it never reaches this global handler. The companion
// fix is in server.ts, where the production process-exit handlers are now
// gated on `require.main === module` so they don't fire under the test runner.
process.on('unhandledRejection', (reason: any) => {
  process.stderr.write(`[backend tests] unhandledRejection (logged, non-fatal): ${
    reason && reason.stack ? reason.stack : String(reason)}\n`);
});

before(async function () {
  this.timeout(60000);
  await init();
});


export const generateJWTToken =  () => {
  const jwt = new SignJWT({
    sub: 'admin',
    jti: '123',
    exp: Math.floor(Date.now() / 1000) + 60 * 60,
    aud: 'account',
    iss: 'http://localhost:9001',
    admin: true
  })
  jwt.setProtectedHeader({alg: 'RS256'})
  return jwt.sign(privateKeyExported!)
}


export const generateJWTTokenUser =  () => {
  const jwt = new SignJWT({
    sub: 'admin',
    jti: '123',
    exp: Math.floor(Date.now() / 1000) + 60 * 60,
    aud: 'account',
    iss: 'http://localhost:9001',
  })
  jwt.setProtectedHeader({alg: 'RS256'})
  return jwt.sign(privateKeyExported!)
}

// Token whose `admin` claim is explicitly `false`. Used to pin the
// API's JWT validation: tokens that carry the claim with a non-true
// value must be rejected, not just tokens that omit it entirely.
export const generateJWTTokenAdminFalse = () => {
  const jwt = new SignJWT({
    sub: 'admin',
    jti: '123',
    exp: Math.floor(Date.now() / 1000) + 60 * 60,
    aud: 'account',
    iss: 'http://localhost:9001',
    admin: false,
  });
  jwt.setProtectedHeader({alg: 'RS256'});
  return jwt.sign(privateKeyExported!);
};

export const init = async function () {
  if (agentPromise != null) return await agentPromise;
  let agentResolve;
  agentPromise = new Promise((resolve) => { agentResolve = resolve; });

  if (!logLevel.isLessThanOrEqualTo(log4js.levels.DEBUG)) {
    logger.warn('Disabling non-test logging for the duration of the test. ' +
                'To enable non-test logging, change the loglevel setting to DEBUG.');
  }

  // Note: This is only a shallow backup.
  backups.settings = Object.assign({}, settings);
  // Start the Etherpad server on a random unused port.
  settings.port = 0;
  settings.ip = 'localhost';
  settings.importExportRateLimiting = {max: 999999};
  settings.commitRateLimiting = {duration: 0.001, points: 1e6};
  httpServer = await server.start();
  // @ts-ignore
  baseUrl = `http://localhost:${httpServer!.address()!.port}`;
  logger.debug(`HTTP server at ${baseUrl}`);
  // Create a supertest user agent for the HTTP server.
  agent = supertest(baseUrl)
      //.set('Authorization', `Bearer ${await generateJWTToken()}`);
  // Speed up authn tests.
  backups.authnFailureDelayMs = webaccess.authnFailureDelayMs;
  webaccess.authnFailureDelayMs = 0;

  after(async function () {
    webaccess.authnFailureDelayMs = backups.authnFailureDelayMs;
    // Note: This does not unset settings that were added.
    Object.assign(settings, backups.settings);
    await server.exit();
  });

  agentResolve!(agent);
  return agent;
};

/**
 * Waits for the next named socket.io event. Rejects if there is an error event while waiting
 * (unless waiting for that error event).
 *
 * @param {io.Socket} socket - The socket.io Socket object to listen on.
 * @param {string} event - The socket.io Socket event to listen for.
 * @returns The argument(s) passed to the event handler.
 */
export const waitForSocketEvent = async (socket: any, event:string, timeoutMs = 1000) => {
  const errorEvents = [
    'error',
    'connect_error',
    'connect_timeout',
    'reconnect_error',
    'reconnect_failed',
  ];
  const handlers = new Map();
  let cancelTimeout;
  try {
    const timeoutP = new Promise<void>((resolve, reject) => {
      const timeout = setTimeout(() => {
        reject(new Error(`timed out waiting for ${event} event`));
        cancelTimeout = () => {};
      }, timeoutMs);
      cancelTimeout = () => {
        clearTimeout(timeout);
        resolve();
        cancelTimeout = () => {};
      };
    });
    const errorEventP = Promise.race(errorEvents.map((event) => new Promise((resolve, reject) => {
      handlers.set(event, (errorString:string) => {
        logger.debug(`socket.io ${event} event: ${errorString}`);
        reject(new Error(errorString));
      });
    })));
    const eventP = new Promise<string|string[]>((resolve) => {
      // This will overwrite one of the above handlers if the user is waiting for an error event.
      handlers.set(event, (...args:string[]) => {
        logger.debug(`socket.io ${event} event`);
        if (args.length > 1) return resolve(args);
        resolve(args[0]);
      });
    });
    for (const [event, handler] of handlers) socket.on(event, handler);
    // timeoutP and errorEventP are guaranteed to never resolve here (they can only reject), so the
    // Promise returned by Promise.race() is guaranteed to resolve to the eventP value (if
    // the event arrives).
    return await Promise.race([timeoutP, errorEventP, eventP]);
  } finally {
    cancelTimeout!();
    for (const [event, handler] of handlers) socket.off(event, handler);
  }
};

/**
 * Establishes a new socket.io connection.
 *
 * @param {object} [res] - Optional HTTP response object. The cookies from this response's
 *     `set-cookie` header(s) are passed to the server when opening the socket.io connection. If
 *     nullish, no cookies are passed to the server.
 * @returns {io.Socket} A socket.io client Socket object.
 */
export const connect = async (res:any = null) => {
  // Convert the `set-cookie` header(s) into a `cookie` header.
  const resCookies = (res == null) ? {} : setCookieParser.parse(res, {map: true});
  const reqCookieHdr = Object.entries(resCookies).map(
      // @ts-ignore
      ([name, cookie]) => `${name}=${encodeURIComponent(cookie.value)}`).join('; ');

  logger.debug('socket.io connecting...');
  let padId = null;
  if (res) {
    padId = res.req.path.split('/p/')[1];
  }
  const socket = io(`${baseUrl}/`, {
    forceNew: true, // Different tests will have different query parameters.
    // socketio.js-client on node.js doesn't support cookies (see https://git.io/JU8u9), so the
    // express_sid cookie must be passed as a query parameter.
    query: {cookie: reqCookieHdr, padId},
  });
  try {
    // Connect is a known slow path on loaded CI runners — give it a longer budget than the
    // default per-message wait used elsewhere.
    await waitForSocketEvent(socket, 'connect', 5000);
  } catch (e) {
    socket.close();
    throw e;
  }
  logger.debug('socket.io connected');

  return socket;
};

/**
 * Helper function to exchange CLIENT_READY+CLIENT_VARS messages for the named pad.
 *
 * @param {io.Socket} socket - Connected socket.io Socket object.
 * @param {string} padId - Which pad to join.
 * @param token
 * @returns The CLIENT_VARS message from the server.
 */
export const handshake = async (socket: any, padId:string, token = padutils.generateAuthorToken()) => {
  logger.debug('sending CLIENT_READY...');
  socket.emit('message', {
    component: 'pad',
    type: 'CLIENT_READY',
    padId,
    sessionID: null,
    token,
  });
  logger.debug('waiting for CLIENT_VARS response...');
  // CLIENT_VARS is a known slow path on loaded CI runners (auth + pad load) — give it a longer
  // budget than the default per-message wait used elsewhere.
  const msg = await waitForSocketEvent(socket, 'message', 5000);
  logger.debug('received CLIENT_VARS message');
  return msg;
};

/**
 * Convenience wrapper around `socket.send()` that waits for acknowledgement.
 */
export const sendMessage = async (socket: any, message:any) => await new Promise<void>((resolve, reject) => {
  socket.emit('message', message, (errInfo:{
    name: string,
    message: string,
  }) => {
    if (errInfo != null) {
      const {name, message} = errInfo;
      const err = new Error(message);
      err.name = name;
      reject(err);
      return;
    }
    resolve();
  });
});

/**
 * Convenience function to send a USER_CHANGES message. Waits for acknowledgement.
 */
export const sendUserChanges = async (socket:any, data:any) => await sendMessage(socket, {
  type: 'COLLABROOM',
  component: 'pad',
  data: {
    type: 'USER_CHANGES',
    apool: new AttributePool(),
    ...data,
  },
});


/*
  * Convenience function to send a delete pad request.
 */
export const sendPadDelete = async (socket:any, data:any) => await sendMessage(socket, {
  type: 'PAD_DELETE',
  component: 'pad',
  data: {
    padId: data.padId
  },
});


/**
 * Convenience function that waits for an ACCEPT_COMMIT message. Asserts that the new revision
 * matches the expected revision.
 *
 * Note: To avoid a race condition, this should be called before the USER_CHANGES message is sent.
 * For example:
 *
 *     await Promise.all([
 *       common.waitForAcceptCommit(socket, rev + 1),
 *       common.sendUserChanges(socket, {baseRev: rev, changeset}),
 *     ]);
 */
export const waitForAcceptCommit = async (socket:any, wantRev: number) => {
  const msg = await waitForSocketEvent(socket, 'message');
  assert.deepEqual(msg, {
    type: 'COLLABROOM',
    data: {
      type: 'ACCEPT_COMMIT',
      newRev: wantRev,
    },
  });
};

const alphabet = 'abcdefghijklmnopqrstuvwxyz';

/**
 * Generates a random string.
 *
 * @param {number} [len] - The desired length of the generated string.
 * @param {string} [charset] - Characters to pick from.
 * @returns {string}
 */
export const randomString = (len: number = 10, charset: string = `${alphabet}${alphabet.toUpperCase()}0123456789`): string => {
  let ret = '';
  while (ret.length < len) ret += charset[Math.floor(Math.random() * charset.length)];
  return ret;
};