geointel/backend/tests/test_outbound_request_guard.py

"""Bounded acquisition must stay bounded to the official host.

Every acquisition service builds its URL from configured settings, so the
request payload cannot point the runtime anywhere. The redirect chain can:
``urlopen`` follows redirects by default, so a misconfigured or compromised
upstream can send the runtime to ``127.0.0.1``, to the container network, or to
a cloud metadata endpoint — and the response is then persisted as if it were
official source data.

The product's stated rule is that acquisition fails closed and never
substitutes fabricated data for official data. A redirect off the configured
host is exactly that substitution.
"""

from __future__ import annotations

import pytest

from app.core.errors import AppError
from app.services.outbound_request_guard import (
    _ValidatedRedirects,
    assert_public_http_url,
    assert_same_origin_redirect,
    validated_redirect_opener,
)


class TestUrlShape:
    def test_an_official_https_endpoint_is_accepted(self) -> None:
        assert_public_http_url("https://geo.api.vlaanderen.be/dhmv/wcs?SERVICE=WCS")

    def test_a_non_http_scheme_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_public_http_url("file:///etc/passwd")

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    @pytest.mark.parametrize(
        "url",
        [
            "http://127.0.0.1:8000/internal",
            "http://localhost/internal",
            "http://10.1.2.3/internal",
            "http://192.168.123.45/internal",
            "http://172.16.0.9/internal",
            "http://169.254.169.254/latest/meta-data/",
            "http://[::1]/internal",
        ],
    )
    def test_private_and_loopback_destinations_are_refused(self, url: str) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_public_http_url(url)

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_a_url_without_a_host_is_refused(self) -> None:
        with pytest.raises(AppError):
            assert_public_http_url("https:///no-host")


class TestRedirects:
    def test_a_redirect_within_the_same_origin_is_allowed(self) -> None:
        assert_same_origin_redirect(
            "https://geo.api.vlaanderen.be/dhmv/wcs",
            "https://geo.api.vlaanderen.be/dhmv/wcs/v2?x=1",
        )

    def test_a_redirect_to_another_host_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_same_origin_redirect(
                "https://geo.api.vlaanderen.be/dhmv/wcs",
                "https://cdn.example.net/payload.tif",
            )

        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"
        assert "cdn.example.net" in str(exc_info.value.details)

    def test_a_downgrade_to_plain_http_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_same_origin_redirect(
                "https://geo.api.vlaanderen.be/wcs",
                "http://geo.api.vlaanderen.be/wcs",
            )

        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"

    def test_a_redirect_to_the_loopback_is_refused_even_on_the_same_scheme(self) -> None:
        with pytest.raises(AppError):
            assert_same_origin_redirect("https://geo.api.vlaanderen.be/wcs", "https://127.0.0.1/wcs")

    def test_an_upgrade_to_https_stays_allowed(self) -> None:
        assert_same_origin_redirect("http://geo.example.be/wcs", "https://geo.example.be/wcs")

    def test_a_redirect_to_another_port_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_same_origin_redirect(
                "https://geo.api.vlaanderen.be/wcs",
                "https://geo.api.vlaanderen.be:8443/wcs",
            )

        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"

    def test_embedded_credentials_are_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_public_http_url("https://operator:secret@geo.example.be/wcs")

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_a_redirect_with_an_invalid_port_fails_closed(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_same_origin_redirect(
                "https://geo.api.vlaanderen.be/wcs",
                "https://geo.api.vlaanderen.be:not-a-port/wcs",
            )

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"


def test_the_guard_opener_refuses_a_cross_host_redirect() -> None:
    """The opener is what the acquisition services actually call."""

    from app.services.outbound_request_guard import guarded_opener

    opener = guarded_opener("https://geo.api.vlaanderen.be/wcs")

    class _Redirecting:
        def __init__(self, location: str) -> None:
            self.url = location

        def __enter__(self):
            return self

        def __exit__(self, *_args):
            return False

    with pytest.raises(AppError) as exc_info:
        with opener(
            type("Req", (), {"full_url": "https://geo.api.vlaanderen.be/wcs"})(),
            timeout=1,
            _transport=lambda *_a, **_k: _Redirecting("https://evil.example.net/x"),
        ):
            pass

    assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"


class TestTheGuardIsWiredIntoAcquisition:
    """Behavioural, not a grep: each service is called on its real fetch path.

    Every existing acquisition test injects an ``opener``, which bypasses the
    guard by design — that is how those tests stub the network. These call the
    production default instead.
    """

    def _settings(self):
        from app.core.config import Settings

        return Settings(_env_file=None)

    def test_dhmv_refuses_a_loopback_endpoint(self) -> None:
        from app.services.dhmv_acquisition_service import DhmvAcquisitionService

        with pytest.raises(AppError) as exc_info:
            DhmvAcquisitionService._fetch("http://127.0.0.1:9/wcs", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_flood_hazard_refuses_a_link_local_endpoint(self) -> None:
        from app.services.flood_hazard_acquisition_service import FloodHazardAcquisitionService

        with pytest.raises(AppError) as exc_info:
            FloodHazardAcquisitionService._fetch("http://169.254.169.254/latest/", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_thematic_raster_refuses_a_private_endpoint(self) -> None:
        from app.services.thematic_raster_acquisition_service import ThematicRasterAcquisitionService

        with pytest.raises(AppError) as exc_info:
            ThematicRasterAcquisitionService._fetch("http://10.0.0.5/product.tif", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_orthophoto_refuses_a_private_endpoint(self) -> None:
        from app.services.orthophoto_acquisition_service import OrthophotoAcquisitionService

        with pytest.raises(AppError) as exc_info:
            OrthophotoAcquisitionService._fetch("http://192.168.123.45/wms", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"


class TestOneRedirectPolicy:
    """Two acquisition services rejected every redirect through their own
    opener while eight allowed a same-origin one through this guard. Two
    policies with no stated reason, and only one of them checked where the
    response actually came from."""

    def test_the_strict_policy_refuses_any_redirect(self) -> None:
        from app.services.outbound_request_guard import guarded_opener

        opener = guarded_opener("https://geo.api.vlaanderen.be/GRB/wfs", allow_redirect=False)

        class _Redirected:
            url = "https://geo.api.vlaanderen.be/GRB/wfs/v2"

            def __enter__(self):
                return self

            def __exit__(self, *_args):
                return False

        with pytest.raises(AppError) as exc_info:
            with opener(object(), timeout=1, _transport=lambda *_a, **_k: _Redirected()):
                pass

        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"

    def test_the_strict_policy_still_allows_the_response_it_asked_for(self) -> None:
        from app.services.outbound_request_guard import guarded_opener

        url = "https://geo.api.vlaanderen.be/GRB/wfs"
        opener = guarded_opener(url, allow_redirect=False)

        class _Direct:
            def __init__(self) -> None:
                self.url = url

            def __enter__(self):
                return self

            def __exit__(self, *_args):
                return False

        with opener(object(), timeout=1, _transport=lambda *_a, **_k: _Direct()) as response:
            assert response.url == url

    def test_both_policies_refuse_a_private_destination(self) -> None:
        from app.services.outbound_request_guard import guarded_opener

        for allow_redirect in (True, False):
            with pytest.raises(AppError) as exc_info:
                guarded_opener("http://10.0.0.5/wfs", allow_redirect=allow_redirect)
            assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_the_strict_services_use_the_shared_guard(self) -> None:
        """Behavioural: their own fetch paths refuse a private endpoint, which
        the hand-rolled opener never checked."""

        from app.core.config import Settings
        from app.services.grb_acquisition_service import GrbAcquisitionService
        from app.services.official_vector_acquisition_service import OfficialVectorAcquisitionService

        settings = Settings(_env_file=None)
        for service in (GrbAcquisitionService, OfficialVectorAcquisitionService):
            with pytest.raises(AppError) as exc_info:
                service._read_page("http://127.0.0.1:9/wfs", settings, None)
            assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"


def test_a_refused_redirect_is_never_requested() -> None:
    """Rejecting after the fact still sends the request.

    Checking ``response.url`` means urllib has already followed the chain: the
    connection to the redirect target was opened and the response read. For a
    destination like a metadata endpoint that is the whole attack. The strict
    policy must refuse to follow, not refuse afterwards.
    """

    from app.services.outbound_request_guard import no_redirect_opener

    opener = no_redirect_opener()
    handlers = [type(handler).__name__ for handler in opener.handlers]

    assert "_RejectRedirects" in handlers


def test_the_default_guard_validates_before_following_a_redirect() -> None:
    opener = validated_redirect_opener("https://geo.api.vlaanderen.be/wcs")
    handlers = [type(handler).__name__ for handler in opener.handlers]

    assert "_ValidatedRedirects" in handlers

    handler = _ValidatedRedirects("https://geo.api.vlaanderen.be/wcs")
    with pytest.raises(AppError) as exc_info:
        handler.redirect_request(
            None,
            None,
            302,
            "Found",
            {},
            "http://169.254.169.254/latest/meta-data/",
        )

    assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"


def test_the_rejecting_handler_returns_no_new_request() -> None:
    from app.services.outbound_request_guard import _RejectRedirects

    handler = _RejectRedirects()

    assert handler.redirect_request(None, None, 302, "Found", {}, "http://169.254.169.254/") is None