mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-30 16:19:21 +00:00
* fix: comprehensive security hardening across all layers Critical: - Replace --dangerously-skip-permissions with explicit tool allowlist via settings.json (Claude Code bridge) - Constant-time token comparison (subtle crate) in web auth and orchestrator auth to prevent timing attacks High: - Revoke tokens and clean up handles on container creation failure - Drop SETUID/SETGID capabilities from containers (keep only CHOWN) - Disable redirect following in HTTP tool and WASM wrapper (SSRF) - Reject URL userinfo (@) in WASM allowlist parser (host confusion) - Fix binary body bypassing leak detection (from_utf8 -> from_utf8_lossy) - Protect identity files from LLM overwrites (prompt injection defense) - Prevent tool shadowing: built-in tools cannot be replaced dynamically - User-scoped job APIs: list/detail/cancel/restart/prompt/events/files - CORS restricted to localhost origins, WebSocket origin validation - Sandbox shell fail-closed: no silent fallback to unsandboxed execution - Scrub secrets from log broadcaster before SSE broadcast - XSS sanitization on rendered markdown in web UI - WASM epoch ticker thread so timeout deadlines actually fire Medium: - Cap state transition history at 200 entries - SSE/WebSocket connection limit (100 max) - Request body size limit (1MB) - Response body size limit enforcement in WASM HTTP - UTF-8 safe string truncation (routine engine, shell tool) - Fix PolicyAction::Sanitize to actually run the sanitizer - TOCTOU fix in scheduler and context manager (hold write lock) - Project file serving moved behind auth - Path traversal guard on project_id - Session file permissions set to 0600 on unix - AtomicUsize for routine running_count (panic-safe) - Completion detection hardened against false positives and tool injection - Tool output no longer drives job completion (only LLM response) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address security review findings across all layers - Fix path traversal sandbox bypass via lexical normalization (file.rs) - Fix SSRF via DNS rebinding with pre-request hostname resolution (http.rs) - Add token budget enforcement on LLM calls (reasoning.rs, state.rs) - Fix cross-user chat history leak with ownership verification (store.rs, server.rs) - Add sliding-window rate limiter on gateway chat endpoint (server.rs) - Harden extension install: HTTPS-only, 50MB cap, WASM magic validation (manager.rs) - Add destructive command blocklist that overrides shell auto-approval (shell.rs) - Add 5MB response body size cap to HTTP tool (http.rs) Co-Authored-By: Claude Opus 4.6 <[email protected]> * refactor: deduplicate shared helpers and remove dead code Extract floor_char_boundary and llm_signals_completion into src/util.rs, unifying diverging phrase lists from agent/worker.rs and worker/runtime.rs. Remove dead RespondResult::usage(), duplicate PROTECTED_IDENTITY_FILES constant, double LeakDetector scanning in WebLogLayer, and invalid 0.0.0.0 origin from WebSocket allow list. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR review findings and CI test failures - Fix record_failed_approve: .truncate(true) wiped the attempts file before reading, so failed pairing attempts never accumulated and rate limiting never triggered. - Guard wizard WASM test: skip gracefully when channel build artifacts are absent (CI doesn't compile wasm32-wasip2 targets). - Fix DNS rebinding check: use port 0 instead of hardcoded 443, since the port is irrelevant for hostname resolution. - Remove hardcoded CORS port 3001: the dynamic addr.port() entries already cover the actual server port. - Require WebSocket Origin header: reject connections that omit it entirely, since browsers always send Origin for WS upgrades and a missing header indicates a non-browser client bypassing the check. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address second round of PR review findings - store.rs: reintroduce file locking around read-modify-write in record_failed_approve (concurrent callers could clobber each other). - sse.rs: replace load+check+fetch_add with atomic fetch_update in both subscribe_raw() and subscribe() to prevent overshooting max_connections. - ws.rs: decrement WS tracker before early return when subscribe_raw() returns None (connection limit reached), fixing a counter leak. - server.rs: parse WS Origin host exactly instead of prefix matching, preventing bypass via crafted origins like http://localhost.evil.com. - workspace_integration.rs: skip tests gracefully when Postgres is unreachable instead of panicking (fixes 10 CI failures). Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: add Origin header to WS integration tests The Origin header requirement added in a3b0190 broke the WS gateway integration tests. Test clients now send Origin: http://127.0.0.1:{port} to match the server's localhost validation. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>
332 lines
11 KiB
Rust
332 lines
11 KiB
Rust
//! End-to-end integration tests for the WebSocket gateway.
|
|
//!
|
|
//! These tests start a real Axum server on a random port, connect a WebSocket
|
|
//! client, and verify the full message flow:
|
|
//! - WebSocket upgrade with auth
|
|
//! - Ping/pong
|
|
//! - Client message → agent msg_tx
|
|
//! - Broadcast SSE event → WebSocket client
|
|
//! - Connection tracking (counter increment/decrement)
|
|
//! - Gateway status endpoint
|
|
|
|
use std::net::SocketAddr;
|
|
use std::sync::Arc;
|
|
use std::time::Duration;
|
|
|
|
use futures::{SinkExt, StreamExt};
|
|
use tokio::sync::mpsc;
|
|
use tokio::time::timeout;
|
|
use tokio_tungstenite::tungstenite::Message;
|
|
use tokio_tungstenite::tungstenite::client::IntoClientRequest;
|
|
|
|
use ironclaw::channels::IncomingMessage;
|
|
use ironclaw::channels::web::server::{GatewayState, start_server};
|
|
use ironclaw::channels::web::sse::SseManager;
|
|
use ironclaw::channels::web::types::SseEvent;
|
|
use ironclaw::channels::web::ws::WsConnectionTracker;
|
|
|
|
const AUTH_TOKEN: &str = "test-token-12345";
|
|
const TIMEOUT: Duration = Duration::from_secs(5);
|
|
|
|
/// Start a gateway server on a random port and return the bound address + agent
|
|
/// message receiver.
|
|
async fn start_test_server() -> (
|
|
SocketAddr,
|
|
Arc<GatewayState>,
|
|
mpsc::Receiver<IncomingMessage>,
|
|
) {
|
|
let (agent_tx, agent_rx) = mpsc::channel(64);
|
|
|
|
let state = Arc::new(GatewayState {
|
|
msg_tx: tokio::sync::RwLock::new(Some(agent_tx)),
|
|
sse: SseManager::new(),
|
|
workspace: None,
|
|
session_manager: None,
|
|
log_broadcaster: None,
|
|
extension_manager: None,
|
|
tool_registry: None,
|
|
store: None,
|
|
job_manager: None,
|
|
prompt_queue: None,
|
|
user_id: "test-user".to_string(),
|
|
shutdown_tx: tokio::sync::RwLock::new(None),
|
|
ws_tracker: Some(Arc::new(WsConnectionTracker::new())),
|
|
chat_rate_limiter: ironclaw::channels::web::server::RateLimiter::new(30, 60),
|
|
});
|
|
|
|
let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
|
|
let bound_addr = start_server(addr, state.clone(), AUTH_TOKEN.to_string())
|
|
.await
|
|
.expect("Failed to start test server");
|
|
|
|
(bound_addr, state, agent_rx)
|
|
}
|
|
|
|
/// Connect a WebSocket client with auth token in query parameter.
|
|
async fn connect_ws(
|
|
addr: SocketAddr,
|
|
) -> tokio_tungstenite::WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>> {
|
|
let url = format!("ws://{}/api/chat/ws?token={}", addr, AUTH_TOKEN);
|
|
let mut request = url.into_client_request().unwrap();
|
|
// Server requires an Origin header from localhost to prevent cross-site WS hijacking.
|
|
request.headers_mut().insert(
|
|
"Origin",
|
|
format!("http://127.0.0.1:{}", addr.port()).parse().unwrap(),
|
|
);
|
|
let (stream, _response) = tokio_tungstenite::connect_async(request)
|
|
.await
|
|
.expect("Failed to connect WebSocket");
|
|
stream
|
|
}
|
|
|
|
/// Read the next text frame from the WebSocket, with a timeout.
|
|
async fn recv_text(
|
|
stream: &mut (impl StreamExt<Item = Result<Message, tokio_tungstenite::tungstenite::Error>> + Unpin),
|
|
) -> String {
|
|
let msg = timeout(TIMEOUT, stream.next())
|
|
.await
|
|
.expect("Timed out waiting for WS message")
|
|
.expect("Stream ended")
|
|
.expect("WS error");
|
|
match msg {
|
|
Message::Text(text) => text.to_string(),
|
|
other => panic!("Expected Text frame, got {:?}", other),
|
|
}
|
|
}
|
|
|
|
// ============================================================================
|
|
// Tests
|
|
// ============================================================================
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_ping_pong() {
|
|
let (addr, _state, _agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
|
|
// Send ping
|
|
let ping = r#"{"type":"ping"}"#;
|
|
ws.send(Message::Text(ping.into())).await.unwrap();
|
|
|
|
// Expect pong
|
|
let text = recv_text(&mut ws).await;
|
|
let parsed: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
assert_eq!(parsed["type"], "pong");
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_message_reaches_agent() {
|
|
let (addr, _state, mut agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
|
|
// Send a chat message
|
|
let msg = r#"{"type":"message","content":"hello from ws","thread_id":"t42"}"#;
|
|
ws.send(Message::Text(msg.into())).await.unwrap();
|
|
|
|
// Verify it arrives on the agent's msg_tx
|
|
let incoming = timeout(TIMEOUT, agent_rx.recv())
|
|
.await
|
|
.expect("Timed out waiting for agent message")
|
|
.expect("Agent channel closed");
|
|
|
|
assert_eq!(incoming.content, "hello from ws");
|
|
assert_eq!(incoming.thread_id.as_deref(), Some("t42"));
|
|
assert_eq!(incoming.channel, "gateway");
|
|
assert_eq!(incoming.user_id, "test-user");
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_broadcast_event_received() {
|
|
let (addr, state, _agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
|
|
// Give the connection a moment to fully establish
|
|
tokio::time::sleep(Duration::from_millis(50)).await;
|
|
|
|
// Broadcast an SSE event (simulates agent sending a response)
|
|
state.sse.broadcast(SseEvent::Response {
|
|
content: "agent says hi".to_string(),
|
|
thread_id: "t1".to_string(),
|
|
});
|
|
|
|
// The WS client should receive it
|
|
let text = recv_text(&mut ws).await;
|
|
let parsed: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
assert_eq!(parsed["type"], "event");
|
|
assert_eq!(parsed["event_type"], "response");
|
|
assert_eq!(parsed["data"]["content"], "agent says hi");
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_thinking_event() {
|
|
let (addr, state, _agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
tokio::time::sleep(Duration::from_millis(50)).await;
|
|
|
|
state.sse.broadcast(SseEvent::Thinking {
|
|
message: "analyzing...".to_string(),
|
|
thread_id: None,
|
|
});
|
|
|
|
let text = recv_text(&mut ws).await;
|
|
let parsed: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
assert_eq!(parsed["type"], "event");
|
|
assert_eq!(parsed["event_type"], "thinking");
|
|
assert_eq!(parsed["data"]["message"], "analyzing...");
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_connection_tracking() {
|
|
let (addr, state, _agent_rx) = start_test_server().await;
|
|
let tracker = state.ws_tracker.as_ref().unwrap();
|
|
|
|
assert_eq!(tracker.connection_count(), 0);
|
|
|
|
// Connect first client
|
|
let ws1 = connect_ws(addr).await;
|
|
tokio::time::sleep(Duration::from_millis(50)).await;
|
|
assert_eq!(tracker.connection_count(), 1);
|
|
|
|
// Connect second client
|
|
let ws2 = connect_ws(addr).await;
|
|
tokio::time::sleep(Duration::from_millis(50)).await;
|
|
assert_eq!(tracker.connection_count(), 2);
|
|
|
|
// Disconnect first
|
|
drop(ws1);
|
|
tokio::time::sleep(Duration::from_millis(100)).await;
|
|
assert_eq!(tracker.connection_count(), 1);
|
|
|
|
// Disconnect second
|
|
drop(ws2);
|
|
tokio::time::sleep(Duration::from_millis(100)).await;
|
|
assert_eq!(tracker.connection_count(), 0);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_invalid_message_returns_error() {
|
|
let (addr, _state, _agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
|
|
// Send invalid JSON
|
|
ws.send(Message::Text("not json".into())).await.unwrap();
|
|
|
|
// Should get an error message back
|
|
let text = recv_text(&mut ws).await;
|
|
let parsed: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
assert_eq!(parsed["type"], "error");
|
|
assert!(
|
|
parsed["message"]
|
|
.as_str()
|
|
.unwrap()
|
|
.contains("Invalid message")
|
|
);
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_unknown_type_returns_error() {
|
|
let (addr, _state, _agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
|
|
// Send valid JSON but unknown message type
|
|
ws.send(Message::Text(r#"{"type":"foobar"}"#.into()))
|
|
.await
|
|
.unwrap();
|
|
|
|
let text = recv_text(&mut ws).await;
|
|
let parsed: serde_json::Value = serde_json::from_str(&text).unwrap();
|
|
assert_eq!(parsed["type"], "error");
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_gateway_status_endpoint() {
|
|
let (addr, _state, _agent_rx) = start_test_server().await;
|
|
|
|
// Connect a WS client
|
|
let _ws = connect_ws(addr).await;
|
|
tokio::time::sleep(Duration::from_millis(50)).await;
|
|
|
|
// Hit the status endpoint
|
|
let client = reqwest::Client::new();
|
|
let resp = client
|
|
.get(format!("http://{}/api/gateway/status", addr))
|
|
.header("Authorization", format!("Bearer {}", AUTH_TOKEN))
|
|
.send()
|
|
.await
|
|
.expect("Failed to fetch status");
|
|
|
|
assert_eq!(resp.status(), 200);
|
|
|
|
let body: serde_json::Value = resp.json().await.unwrap();
|
|
assert_eq!(body["ws_connections"], 1);
|
|
assert!(body["total_connections"].as_u64().unwrap() >= 1);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_no_auth_rejected() {
|
|
let (addr, _state, _agent_rx) = start_test_server().await;
|
|
|
|
// Try to connect without auth token
|
|
let url = format!("ws://{}/api/chat/ws", addr);
|
|
let request = url.into_client_request().unwrap();
|
|
let result = tokio_tungstenite::connect_async(request).await;
|
|
|
|
// Should fail (401 from auth middleware before WS upgrade)
|
|
assert!(result.is_err());
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_ws_multiple_events_in_sequence() {
|
|
let (addr, state, _agent_rx) = start_test_server().await;
|
|
let mut ws = connect_ws(addr).await;
|
|
tokio::time::sleep(Duration::from_millis(50)).await;
|
|
|
|
// Broadcast multiple events rapidly
|
|
state.sse.broadcast(SseEvent::Thinking {
|
|
message: "step 1".to_string(),
|
|
thread_id: None,
|
|
});
|
|
state.sse.broadcast(SseEvent::ToolStarted {
|
|
name: "shell".to_string(),
|
|
thread_id: None,
|
|
});
|
|
state.sse.broadcast(SseEvent::ToolCompleted {
|
|
name: "shell".to_string(),
|
|
success: true,
|
|
thread_id: None,
|
|
});
|
|
state.sse.broadcast(SseEvent::Response {
|
|
content: "done".to_string(),
|
|
thread_id: "t1".to_string(),
|
|
});
|
|
|
|
// Receive all 4 in order
|
|
let t1 = recv_text(&mut ws).await;
|
|
let t2 = recv_text(&mut ws).await;
|
|
let t3 = recv_text(&mut ws).await;
|
|
let t4 = recv_text(&mut ws).await;
|
|
|
|
let p1: serde_json::Value = serde_json::from_str(&t1).unwrap();
|
|
let p2: serde_json::Value = serde_json::from_str(&t2).unwrap();
|
|
let p3: serde_json::Value = serde_json::from_str(&t3).unwrap();
|
|
let p4: serde_json::Value = serde_json::from_str(&t4).unwrap();
|
|
|
|
assert_eq!(p1["event_type"], "thinking");
|
|
assert_eq!(p2["event_type"], "tool_started");
|
|
assert_eq!(p3["event_type"], "tool_completed");
|
|
assert_eq!(p4["event_type"], "response");
|
|
|
|
ws.close(None).await.unwrap();
|
|
}
|