new-api/service/webhook_test.go

package service

import (
	"io"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/QuantumNous/new-api/common"
	"github.com/QuantumNous/new-api/dto"
	"github.com/QuantumNous/new-api/setting/system_setting"
	"github.com/stretchr/testify/require"
)

func TestGenerateSignatureIsStableAndSecretBound(t *testing.T) {
	payload := []byte(`{"event":"quota_exceed"}`)

	require.Equal(t, "e8c1ac446d1fab782a3587e16b8dae9b42afd915f6c56a25702806f35db4ecaf", generateSignature("webhook-secret", payload))
	require.NotEqual(t, generateSignature("other-secret", payload), generateSignature("webhook-secret", payload))
	require.NotEqual(t, generateSignature("webhook-secret", []byte(`{"event":"other"}`)), generateSignature("webhook-secret", payload))
}

func TestSendWebhookNotifyReplacesValuePlaceholdersBeforeSigningAndSending(t *testing.T) {
	var received WebhookPayload
	var signature string
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		body, err := io.ReadAll(r.Body)
		require.NoError(t, err)
		require.NoError(t, common.Unmarshal(body, &received))
		signature = r.Header.Get("X-Webhook-Signature")
		w.WriteHeader(http.StatusNoContent)
	}))
	defer server.Close()

	oldClient := httpClient
	httpClient = server.Client()
	t.Cleanup(func() { httpClient = oldClient })
	setting := system_setting.GetFetchSetting()
	oldSetting := *setting
	*setting = system_setting.FetchSetting{EnableSSRFProtection: false}
	t.Cleanup(func() { *setting = oldSetting })

	err := SendWebhookNotify(server.URL, "secret", dto.NewNotify("quota", "Quota", "remaining: {{value}}, used: {{value}}", []interface{}{12, 3}))

	require.NoError(t, err)
	require.Equal(t, "remaining: 12, used: 3", received.Content)
	require.NotEmpty(t, signature)
}