|
| 1 | +import { describe, expect, it, vi } from 'vitest'; |
| 2 | +import { AwsClient, type S3CredentialProvider } from '../../cdn/providers/aws'; |
| 3 | +import { AuditLogManager, AuditLogS3Config } from './audit-logs-manager'; |
| 4 | + |
| 5 | +vi.mock('@hive/workflows/kit', () => ({ TaskScheduler: class {} })); |
| 6 | +vi.mock('@hive/workflows/tasks/audit-log-export', () => ({ AuditLogExportTask: {} })); |
| 7 | +vi.mock('@sentry/node', () => ({ captureException: vi.fn() })); |
| 8 | +vi.mock('../../operations/providers/clickhouse-client', () => ({ |
| 9 | + ClickHouse: class {}, |
| 10 | + sql: (strings: TemplateStringsArray, ...values: any[]) => ({ strings, values }), |
| 11 | +})); |
| 12 | +vi.mock('./audit-log-recorder', () => ({ |
| 13 | + formatToClickhouseDateTime: (d: Date) => d.toISOString(), |
| 14 | +})); |
| 15 | +vi.mock('./audit-logs-types', () => ({ |
| 16 | + AuditLogClickhouseArrayModel: { parse: (v: any) => v }, |
| 17 | +})); |
| 18 | + |
| 19 | +function fakeCredentialProvider(keyId: string): S3CredentialProvider { |
| 20 | + return { |
| 21 | + getCredentials: async () => ({ accessKeyId: keyId, secretAccessKey: `${keyId}-secret` }), |
| 22 | + }; |
| 23 | +} |
| 24 | + |
| 25 | +function createAuditLogManager(fetchImpl: (...args: any[]) => any) { |
| 26 | + const credentialProvider = fakeCredentialProvider('test-key'); |
| 27 | + const client = new AwsClient({ credentialProvider, service: 's3' }); |
| 28 | + const fetchSpy = vi.spyOn(client, 'fetch').mockImplementation(fetchImpl as any); |
| 29 | + |
| 30 | + const s3Config = new AuditLogS3Config(client, 'https://s3.example.com', 'audit-bucket'); |
| 31 | + |
| 32 | + const mockSession = { |
| 33 | + assertPerformAction: vi.fn().mockResolvedValue(undefined), |
| 34 | + getViewer: vi.fn().mockResolvedValue({ email: 'user@example.com' }), |
| 35 | + }; |
| 36 | + const mockClickHouse = { |
| 37 | + query: vi.fn().mockResolvedValue({ |
| 38 | + data: [ |
| 39 | + { |
| 40 | + id: '1', |
| 41 | + timestamp: '2026-01-15', |
| 42 | + organizationId: 'org-1', |
| 43 | + eventAction: 'login', |
| 44 | + userId: 'u1', |
| 45 | + userEmail: 'u@x.com', |
| 46 | + accessTokenId: null, |
| 47 | + metadata: '{}', |
| 48 | + }, |
| 49 | + ], |
| 50 | + }), |
| 51 | + }; |
| 52 | + const mockLogger = { child: () => mockLogger, info: vi.fn(), error: vi.fn() } as any; |
| 53 | + const mockTaskScheduler = { scheduleTask: vi.fn().mockResolvedValue(undefined) }; |
| 54 | + const mockStorage = { |
| 55 | + getOrganization: vi.fn().mockResolvedValue({ name: 'TestOrg', id: 'org-1' }), |
| 56 | + }; |
| 57 | + |
| 58 | + return { |
| 59 | + manager: new AuditLogManager( |
| 60 | + mockLogger, |
| 61 | + mockClickHouse as any, |
| 62 | + s3Config, |
| 63 | + mockTaskScheduler as any, |
| 64 | + mockSession as any, |
| 65 | + mockStorage as any, |
| 66 | + ), |
| 67 | + fetchSpy, |
| 68 | + }; |
| 69 | +} |
| 70 | + |
| 71 | +/** |
| 72 | + * Guards against regression where the S3 PUT upload was missing |
| 73 | + * `aws: { signQuery: true }`, causing the `got` library to receive |
| 74 | + * auth headers it can't handle - resulting in silent upload failures. |
| 75 | + */ |
| 76 | +describe('AuditLogManager S3 upload uses signQuery', () => { |
| 77 | + it('PUT upload includes aws.signQuery: true', async () => { |
| 78 | + const { manager, fetchSpy } = createAuditLogManager( |
| 79 | + vi.fn().mockResolvedValue({ ok: true, url: 'https://s3.example.com/key' }), |
| 80 | + ); |
| 81 | + |
| 82 | + await manager.exportAndSendEmail('org-1', { |
| 83 | + startDate: new Date('2026-01-01'), |
| 84 | + endDate: new Date('2026-01-31'), |
| 85 | + }); |
| 86 | + |
| 87 | + const putCall = fetchSpy.mock.calls[0]; |
| 88 | + expect(putCall[1]).toEqual( |
| 89 | + expect.objectContaining({ |
| 90 | + method: 'PUT', |
| 91 | + aws: expect.objectContaining({ signQuery: true }), |
| 92 | + }), |
| 93 | + ); |
| 94 | + }); |
| 95 | + |
| 96 | + it('GET presigned URL includes aws.signQuery: true', async () => { |
| 97 | + const { manager, fetchSpy } = createAuditLogManager( |
| 98 | + vi.fn().mockResolvedValue({ ok: true, url: 'https://s3.example.com/key' }), |
| 99 | + ); |
| 100 | + |
| 101 | + await manager.exportAndSendEmail('org-1', { |
| 102 | + startDate: new Date('2026-01-01'), |
| 103 | + endDate: new Date('2026-01-31'), |
| 104 | + }); |
| 105 | + |
| 106 | + const getCall = fetchSpy.mock.calls[1]; |
| 107 | + expect(getCall[1]).toEqual( |
| 108 | + expect.objectContaining({ |
| 109 | + method: 'GET', |
| 110 | + aws: expect.objectContaining({ signQuery: true }), |
| 111 | + }), |
| 112 | + ); |
| 113 | + }); |
| 114 | +}); |
0 commit comments