feat: v1.1.0 账号化重构 + 三级 Webhook + 设置中心 + Vite 工具链
- 账号化:节点更名账号,/nodes -> /accounts;添加账号直达 Cloudflare OAuth,自动创建账号并同步账号下全部域名(catch-all 邮箱随同步创建) - 域名:移除手工添加;点击域名『设置 Email Workers』= 部署账号级 Email Worker + Email Routing + catch-all;支持按账号筛选 - Webhook 三级模型:邮箱 -> 域名 -> 全局,收信取第一个命中者;支持自定义请求头与 key(默认 Authorization: Bearer <key>,兼做 X-WmailHub-Signature 签名);独立 webhooks 实体与 /webhooks、/keys 页面删除,Key 管理收进设置模态窗口 - 设置中心:全局 Webhook / 默认 Node Ingress 地址 / 修改密码 / API & MCP Keys(生成、撤销、删除) - UI:Header 标题副标题紧凑化(修复溢出),LOGO 加版本号 tag(v1.1.0 取自 package.json),各列表页搜索框 - 工具链:前端构建 Bun.build -> Vite(vite 8 + @vitejs/plugin-react) - 后端:/api/settings、POST /api/domains/:id/setup、0002 迁移(投递行固化三级目标配置);MCP 去 list_webhooks(5 工具);迁移执行器加 _migrations 记录 - 测试:44/44(新增 settings 套件、webhook 三级优先级/SSRF/签名);UI 冒烟 11/11
This commit is contained in:
bigcode
+137
-86
@@ -1,7 +1,7 @@
|
||||
/** Webhook 测试:SSRF 校验、投递签名、重试与退避、失败状态、手动测试投递 */
|
||||
/** Webhook 测试(v1.1.0 三级模型):SSRF 校验、三级优先级、签名/key/自定义头、重试与退避 */
|
||||
import { describe, expect, test } from "bun:test";
|
||||
import { ingestEmail } from "../console/src/services/email_ingest.ts";
|
||||
import { attemptDelivery, processDueDeliveries } from "../console/src/services/webhook_delivery.ts";
|
||||
import { attemptDelivery, processDueDeliveries, resolveWebhookConfig } from "../console/src/services/webhook_delivery.ts";
|
||||
import { hmacSha256Hex } from "../shared/src/index.ts";
|
||||
import { authedFetch, loginCookie, makeTestEnv, TEST_MAIL } from "./helpers.ts";
|
||||
|
||||
@@ -21,8 +21,25 @@ function startReceiver(mode: "ok" | "fail500"): { url: string; requests: { heade
|
||||
return { url: `http://127.0.0.1:${server.port}/hook`, requests, stop: () => server.stop(true) };
|
||||
}
|
||||
|
||||
describe("Webhook", () => {
|
||||
test("创建 webhook 时拒绝私网/localhost endpoint(SSRF)", async () => {
|
||||
/** # 函数
|
||||
* 直接给域名/邮箱行写 webhook 配置(key 以空占位,投递 key 传 "" 即可)
|
||||
*/
|
||||
async function setScopedWebhook(
|
||||
t: Awaited<ReturnType<typeof makeTestEnv>>,
|
||||
table: "mailboxes" | "domains",
|
||||
id: string,
|
||||
url: string | null,
|
||||
headers: Record<string, string> = {},
|
||||
) {
|
||||
await t.env.DB.prepare(
|
||||
`UPDATE ${table} SET webhook_url = ?, webhook_headers = ?, webhook_key_enc = NULL WHERE id = ?`,
|
||||
)
|
||||
.bind(url, Object.keys(headers).length ? JSON.stringify(headers) : null, id)
|
||||
.run();
|
||||
}
|
||||
|
||||
describe("Webhook(邮箱 -> 域名 -> 全局)", () => {
|
||||
test("保存配置时拒绝私网/localhost endpoint(SSRF)", async () => {
|
||||
const t = await makeTestEnv();
|
||||
// SSRF 防护在"未开启本地联调开关"时生效(生产默认态)
|
||||
delete (t.env as { WMAILHUB_ALLOW_PRIVATE_WEBHOOKS?: string }).WMAILHUB_ALLOW_PRIVATE_WEBHOOKS;
|
||||
@@ -35,57 +52,54 @@ describe("Webhook", () => {
|
||||
"http://[::1]/hook",
|
||||
"ftp://example.com/x",
|
||||
]) {
|
||||
const resp = await authedFetch(t, cookie, "http://localhost/api/webhooks", {
|
||||
method: "POST",
|
||||
const resp = await authedFetch(t, cookie, "http://localhost/api/settings", {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ name: "x", endpoint }),
|
||||
body: JSON.stringify({ webhook: { url: endpoint } }),
|
||||
});
|
||||
expect(resp.status).toBe(400);
|
||||
const resp2 = await authedFetch(t, cookie, `http://localhost/api/mailboxes/${t.mailboxId}/webhook`, {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ url: endpoint }),
|
||||
});
|
||||
expect(resp2.status).toBe(400);
|
||||
}
|
||||
});
|
||||
|
||||
test("允许公网 endpoint 创建成功", async () => {
|
||||
const t = await makeTestEnv();
|
||||
const cookie = await loginCookie(t);
|
||||
const resp = await authedFetch(t, cookie, "http://localhost/api/webhooks", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ name: "ok", endpoint: "https://hooks.example.com/wmail" }),
|
||||
});
|
||||
expect(resp.status).toBe(201);
|
||||
const data = (await resp.json()) as { secret: string };
|
||||
expect(data.secret.startsWith("whsec_")).toBe(true);
|
||||
});
|
||||
|
||||
test("投递成功:签名头正确且 2xx 落 success", async () => {
|
||||
test("全局 Webhook 投递:key 走 Authorization,签名与自定义头正确", async () => {
|
||||
const t = await makeTestEnv();
|
||||
const recv = startReceiver("ok");
|
||||
const now = new Date().toISOString();
|
||||
await t.env.DB.prepare(
|
||||
"INSERT INTO webhooks (id, name, endpoint, secret, enabled, created_at, updated_at) VALUES ('whk1', 'w', ?, 'whsec_test', 1, ?, ?)",
|
||||
)
|
||||
.bind(recv.url, now, now)
|
||||
.run();
|
||||
const cookie = await loginCookie(t);
|
||||
const save = await authedFetch(t, cookie, "http://localhost/api/settings", {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({
|
||||
webhook: { url: recv.url, headers: { "X-Custom": "wmailhub" }, key: "wmh_global_key_1234567890" },
|
||||
}),
|
||||
});
|
||||
expect(save.status).toBe(200);
|
||||
|
||||
const email = await ingestEmail(t.env, {
|
||||
raw: new TextEncoder().encode(TEST_MAIL),
|
||||
mailFrom: "a@b.c",
|
||||
rcptTo: "hello@example.test",
|
||||
nodeId: t.nodeId,
|
||||
});
|
||||
const dlv = await t.env.DB.prepare("SELECT id FROM webhook_deliveries").first<{ id: string }>();
|
||||
expect(dlv).not.toBeNull();
|
||||
const dlv = await t.env.DB.prepare("SELECT id, target_type FROM webhook_deliveries").first<{
|
||||
id: string;
|
||||
target_type: string;
|
||||
}>();
|
||||
expect(dlv?.target_type).toBe("global");
|
||||
|
||||
const stats = await processDueDeliveries(t.env, undefined, 20, true);
|
||||
expect(stats.success).toBe(1);
|
||||
const row = await t.env.DB.prepare("SELECT status, delivered_at FROM webhook_deliveries").first<{
|
||||
status: string;
|
||||
delivered_at: string | null;
|
||||
}>();
|
||||
expect(row?.status).toBe("success");
|
||||
|
||||
// 验证签名
|
||||
const req = recv.requests[0];
|
||||
expect(req.headers.get("Authorization") ?? null).toBe("Bearer wmh_global_key_1234567890");
|
||||
expect(req.headers.get("X-Custom") ?? null).toBe("wmailhub");
|
||||
const ts = req.headers.get("X-WmailHub-Timestamp") ?? "";
|
||||
const sig = await hmacSha256Hex("whsec_test", String(ts).concat(".", req.body));
|
||||
const sig = await hmacSha256Hex("wmh_global_key_1234567890", String(ts).concat(".", req.body));
|
||||
expect(req.headers.get("X-WmailHub-Signature") ?? null).toBe(sig);
|
||||
expect(req.headers.get("X-WmailHub-Event") ?? null).toBe("email.received");
|
||||
expect(req.headers.get("X-WmailHub-Delivery") ?? null).toBe(dlv?.id ?? null);
|
||||
@@ -96,77 +110,114 @@ describe("Webhook", () => {
|
||||
recv.stop();
|
||||
});
|
||||
|
||||
test("5xx 失败进入重试队列,退避时间递增,超过上限 exhausted", async () => {
|
||||
test("三级优先级:邮箱 > 域名 > 全局,命中即止;逐级回退", async () => {
|
||||
const t = await makeTestEnv();
|
||||
const now = new Date().toISOString();
|
||||
const globalRecv = startReceiver("ok");
|
||||
const domainRecv = startReceiver("ok");
|
||||
const mailboxRecv = startReceiver("ok");
|
||||
|
||||
// 三级全配
|
||||
await setScopedWebhook(t, "domains", t.domainId, domainRecv.url);
|
||||
await setScopedWebhook(t, "mailboxes", t.mailboxId, mailboxRecv.url);
|
||||
await t.env.DB.prepare(
|
||||
"INSERT INTO webhook_deliveries (id, webhook_id, email_id, status, attempt_count, created_at) VALUES ('d1', 'whk_gone', 'msg_gone', 'pending', 0, ?)",
|
||||
"INSERT INTO settings (key, value) VALUES ('global_webhook', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value",
|
||||
)
|
||||
.bind(now)
|
||||
.bind(JSON.stringify({ url: globalRecv.url, headers: {} }))
|
||||
.run();
|
||||
// msg_gone 不存在(触发 email expired 分支前先看 join):join 不到直接跳过 — 改用真实邮件
|
||||
await t.env.DB.prepare("DELETE FROM webhook_deliveries WHERE id='d1'").run();
|
||||
// 建真实 webhook 行(endpoint 不可达),投递 join 需要
|
||||
await t.env.DB.prepare(
|
||||
"INSERT INTO webhooks (id, name, endpoint, secret, enabled, created_at, updated_at) VALUES ('whk_gone', 'gone', 'http://127.0.0.1:1/hook', 's', 1, ?, ?)",
|
||||
)
|
||||
.bind(now, now)
|
||||
.run();
|
||||
const email = await ingestEmail(t.env, {
|
||||
|
||||
await ingestEmail(t.env, {
|
||||
raw: new TextEncoder().encode(TEST_MAIL),
|
||||
mailFrom: "a@b.c",
|
||||
rcptTo: "hello@example.test",
|
||||
nodeId: t.nodeId,
|
||||
});
|
||||
await t.env.DB.prepare(
|
||||
"INSERT INTO webhook_deliveries (id, webhook_id, email_id, status, attempt_count, created_at) VALUES ('d2', 'whk_gone', ?, 'pending', 0, ?)",
|
||||
)
|
||||
.bind(email.id, now)
|
||||
.run();
|
||||
// 直连 attemptDelivery 到一个 5xx 地址(fetch 会失败)
|
||||
await processDueDeliveries(t.env, undefined, 20, true);
|
||||
expect(mailboxRecv.requests.length).toBe(1);
|
||||
expect(domainRecv.requests.length).toBe(0);
|
||||
expect(globalRecv.requests.length).toBe(0);
|
||||
const level1 = await t.env.DB.prepare("SELECT target_type FROM webhook_deliveries ORDER BY created_at DESC LIMIT 1").first<{ target_type: string }>();
|
||||
expect(level1?.target_type).toBe("mailbox");
|
||||
|
||||
// 清除邮箱级 -> 回退域名级
|
||||
await setScopedWebhook(t, "mailboxes", t.mailboxId, null);
|
||||
expect((await resolveWebhookConfig(t.env, t.mailboxId))?.targetType).toBe("domain");
|
||||
await ingestEmail(t.env, {
|
||||
raw: new TextEncoder().encode(TEST_MAIL),
|
||||
mailFrom: "a@b.c",
|
||||
rcptTo: "hello@example.test",
|
||||
nodeId: t.nodeId,
|
||||
});
|
||||
await processDueDeliveries(t.env, undefined, 20, true);
|
||||
expect(domainRecv.requests.length).toBe(1);
|
||||
|
||||
// 再清除域名级 -> 回退全局
|
||||
await setScopedWebhook(t, "domains", t.domainId, null);
|
||||
expect((await resolveWebhookConfig(t.env, t.mailboxId))?.targetType).toBe("global");
|
||||
await ingestEmail(t.env, {
|
||||
raw: new TextEncoder().encode(TEST_MAIL),
|
||||
mailFrom: "a@b.c",
|
||||
rcptTo: "hello@example.test",
|
||||
nodeId: t.nodeId,
|
||||
});
|
||||
await processDueDeliveries(t.env, undefined, 20, true);
|
||||
expect(globalRecv.requests.length).toBe(1);
|
||||
|
||||
for (const r of [globalRecv, domainRecv, mailboxRecv]) r.stop();
|
||||
});
|
||||
|
||||
test("三级都未配置:不入队投递", async () => {
|
||||
const t = await makeTestEnv();
|
||||
await ingestEmail(t.env, {
|
||||
raw: new TextEncoder().encode(TEST_MAIL),
|
||||
mailFrom: "a@b.c",
|
||||
rcptTo: "hello@example.test",
|
||||
nodeId: t.nodeId,
|
||||
});
|
||||
const count = await t.env.DB.prepare("SELECT COUNT(*) AS n FROM webhook_deliveries").first<{ n: number }>();
|
||||
expect(count?.n).toBe(0);
|
||||
});
|
||||
|
||||
test("连续失败进入重试并最终 exhausted(退避递增)", async () => {
|
||||
const t = await makeTestEnv();
|
||||
// 直接连一个不可达地址,验证 attemptDelivery 失败路径
|
||||
const result = await attemptDelivery(
|
||||
{ id: "whk_gone", endpoint: "http://127.0.0.1:1/hook", secret: "s" },
|
||||
"d2",
|
||||
{ url: "http://127.0.0.1:1/hook", headers: {}, key: "" },
|
||||
"d_test",
|
||||
{ event: "email.received" },
|
||||
undefined,
|
||||
true,
|
||||
);
|
||||
expect(result.ok).toBe(false);
|
||||
|
||||
// 状态机:连续失败到上限 → exhausted(每轮把 next_retry_at 拉回现在模拟时间流逝)
|
||||
// 状态机:把全局 webhook 指向不可达地址,反复处理直到 exhausted
|
||||
const cookie = await loginCookie(t);
|
||||
await authedFetch(t, cookie, "http://localhost/api/settings", {
|
||||
method: "PUT",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ webhook: { url: "http://127.0.0.1:1/hook" } }),
|
||||
});
|
||||
await ingestEmail(t.env, {
|
||||
raw: new TextEncoder().encode(TEST_MAIL),
|
||||
mailFrom: "a@b.c",
|
||||
rcptTo: "hello@example.test",
|
||||
nodeId: t.nodeId,
|
||||
});
|
||||
const { WEBHOOK_MAX_ATTEMPTS } = await import("../shared/src/index.ts");
|
||||
let attempts = 0;
|
||||
const row0 = await t.env.DB.prepare(
|
||||
"SELECT id FROM webhook_deliveries WHERE status = 'pending' ORDER BY created_at DESC LIMIT 1",
|
||||
).first<{ id: string }>();
|
||||
expect(row0).not.toBeNull();
|
||||
for (let i = 0; i < WEBHOOK_MAX_ATTEMPTS + 1; i++) {
|
||||
const stats = await processDueDeliveries(t.env, undefined, 20, true);
|
||||
if (stats.processed === 0) break;
|
||||
attempts++;
|
||||
await t.env.DB.prepare("UPDATE webhook_deliveries SET next_retry_at = ? WHERE id='d2'")
|
||||
.bind(new Date().toISOString())
|
||||
await t.env.DB.prepare("UPDATE webhook_deliveries SET next_retry_at = ? WHERE id = ?")
|
||||
.bind(new Date().toISOString(), row0!.id)
|
||||
.run();
|
||||
}
|
||||
const row = await t.env.DB.prepare("SELECT status, attempt_count FROM webhook_deliveries WHERE id='d2'").first<{
|
||||
status: string;
|
||||
attempt_count: number;
|
||||
}>();
|
||||
// 目标不可达(端口 1),每次都失败,最终 exhausted
|
||||
expect(row?.status).toBe("exhausted");
|
||||
expect(row?.attempt_count).toBe(attempts);
|
||||
});
|
||||
|
||||
test("手动 test 投递走同一条签名链路", async () => {
|
||||
const t = await makeTestEnv();
|
||||
const recv = startReceiver("ok");
|
||||
const cookie = await loginCookie(t);
|
||||
const create = await authedFetch(t, cookie, "http://localhost/api/webhooks", {
|
||||
method: "POST",
|
||||
headers: { "Content-Type": "application/json" },
|
||||
body: JSON.stringify({ name: "t", endpoint: recv.url }),
|
||||
});
|
||||
const { id } = (await create.json()) as { id: string };
|
||||
const testResp = await authedFetch(t, cookie, `http://localhost/api/webhooks/${id}/test`, { method: "POST" });
|
||||
const data = (await testResp.json()) as { ok: boolean };
|
||||
expect(data.ok).toBe(true);
|
||||
expect(recv.requests.length).toBeGreaterThanOrEqual(1);
|
||||
recv.stop();
|
||||
const final = await t.env.DB.prepare("SELECT status, attempt_count FROM webhook_deliveries WHERE id = ?")
|
||||
.bind(row0!.id)
|
||||
.first<{ status: string; attempt_count: number }>();
|
||||
expect(final?.status).toBe("exhausted");
|
||||
expect(final?.attempt_count).toBe(WEBHOOK_MAX_ATTEMPTS);
|
||||
});
|
||||
});
|
||||
|
||||
Reference in New Issue
Block a user