geointel/backend/tests/test_outbound_request_guard.py

"""Bounded acquisition must stay bounded to the official host.

Every acquisition service builds its URL from configured settings, so the
request payload cannot point the runtime anywhere. The redirect chain can:
``urlopen`` follows redirects by default, so a misconfigured or compromised
upstream can send the runtime to ``127.0.0.1``, to the container network, or to
a cloud metadata endpoint — and the response is then persisted as if it were
official source data.

The product's stated rule is that acquisition fails closed and never
substitutes fabricated data for official data. A redirect off the configured
host is exactly that substitution.
"""

from __future__ import annotations

import pytest

from app.core.errors import AppError
from app.services.outbound_request_guard import (
    assert_public_http_url,
    assert_same_origin_redirect,
)


class TestUrlShape:
    def test_an_official_https_endpoint_is_accepted(self) -> None:
        assert_public_http_url("https://geo.api.vlaanderen.be/dhmv/wcs?SERVICE=WCS")

    def test_a_non_http_scheme_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_public_http_url("file:///etc/passwd")

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    @pytest.mark.parametrize(
        "url",
        [
            "http://127.0.0.1:8000/internal",
            "http://localhost/internal",
            "http://10.1.2.3/internal",
            "http://192.168.10.150/internal",
            "http://172.16.0.9/internal",
            "http://169.254.169.254/latest/meta-data/",
            "http://[::1]/internal",
        ],
    )
    def test_private_and_loopback_destinations_are_refused(self, url: str) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_public_http_url(url)

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_a_url_without_a_host_is_refused(self) -> None:
        with pytest.raises(AppError):
            assert_public_http_url("https:///no-host")


class TestRedirects:
    def test_a_redirect_within_the_same_origin_is_allowed(self) -> None:
        assert_same_origin_redirect(
            "https://geo.api.vlaanderen.be/dhmv/wcs",
            "https://geo.api.vlaanderen.be/dhmv/wcs/v2?x=1",
        )

    def test_a_redirect_to_another_host_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_same_origin_redirect(
                "https://geo.api.vlaanderen.be/dhmv/wcs",
                "https://cdn.example.net/payload.tif",
            )

        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"
        assert "cdn.example.net" in str(exc_info.value.details)

    def test_a_downgrade_to_plain_http_is_refused(self) -> None:
        with pytest.raises(AppError) as exc_info:
            assert_same_origin_redirect(
                "https://geo.api.vlaanderen.be/wcs",
                "http://geo.api.vlaanderen.be/wcs",
            )

        assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"

    def test_a_redirect_to_the_loopback_is_refused_even_on_the_same_scheme(self) -> None:
        with pytest.raises(AppError):
            assert_same_origin_redirect("https://geo.api.vlaanderen.be/wcs", "https://127.0.0.1/wcs")

    def test_an_upgrade_to_https_stays_allowed(self) -> None:
        assert_same_origin_redirect("http://geo.example.be/wcs", "https://geo.example.be/wcs")


def test_the_guard_opener_refuses_a_cross_host_redirect() -> None:
    """The opener is what the acquisition services actually call."""

    from app.services.outbound_request_guard import guarded_opener

    opener = guarded_opener("https://geo.api.vlaanderen.be/wcs")

    class _Redirecting:
        def __init__(self, location: str) -> None:
            self.url = location

        def __enter__(self):
            return self

        def __exit__(self, *_args):
            return False

    with pytest.raises(AppError) as exc_info:
        with opener(
            type("Req", (), {"full_url": "https://geo.api.vlaanderen.be/wcs"})(),
            timeout=1,
            _transport=lambda *_a, **_k: _Redirecting("https://evil.example.net/x"),
        ):
            pass

    assert exc_info.value.code == "OUTBOUND_REDIRECT_NOT_ALLOWED"


class TestTheGuardIsWiredIntoAcquisition:
    """Behavioural, not a grep: each service is called on its real fetch path.

    Every existing acquisition test injects an ``opener``, which bypasses the
    guard by design — that is how those tests stub the network. These call the
    production default instead.
    """

    def _settings(self):
        from app.core.config import Settings

        return Settings(_env_file=None)

    def test_dhmv_refuses_a_loopback_endpoint(self) -> None:
        from app.services.dhmv_acquisition_service import DhmvAcquisitionService

        with pytest.raises(AppError) as exc_info:
            DhmvAcquisitionService._fetch("http://127.0.0.1:9/wcs", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_flood_hazard_refuses_a_link_local_endpoint(self) -> None:
        from app.services.flood_hazard_acquisition_service import FloodHazardAcquisitionService

        with pytest.raises(AppError) as exc_info:
            FloodHazardAcquisitionService._fetch("http://169.254.169.254/latest/", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_thematic_raster_refuses_a_private_endpoint(self) -> None:
        from app.services.thematic_raster_acquisition_service import ThematicRasterAcquisitionService

        with pytest.raises(AppError) as exc_info:
            ThematicRasterAcquisitionService._fetch("http://10.0.0.5/product.tif", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"

    def test_orthophoto_refuses_a_private_endpoint(self) -> None:
        from app.services.orthophoto_acquisition_service import OrthophotoAcquisitionService

        with pytest.raises(AppError) as exc_info:
            OrthophotoAcquisitionService._fetch("http://192.168.10.150/wms", self._settings())

        assert exc_info.value.code == "OUTBOUND_URL_NOT_ALLOWED"