ModelRouter/internal/lua/plugin_http_test.go

package lua

// The plugin HTTP bridge is the one capability that lets a .lua file — installed
// from a textarea in the WebUI — reach out on the gateway's own network. That
// makes its DENY rules the security boundary, and these tests exist to pin the
// refusals rather than the happy path.
//
// The failure this guards against is concrete: an operator installs a quota
// plugin that reads a vendor's balance, and a later plugin (or a compromised
// one) posts that gateway key material to an attacker, or reads the cloud
// metadata endpoint, because __llmsproxy_http happened to be a general HTTP
// client.

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	golua "github.com/aarzilli/golua/lua"
)

// newTestState returns a bare Lua state for the argument-decoding tests.
func newTestState(t *testing.T) *golua.State {
	t.Helper()
	L := golua.NewState()
	t.Cleanup(L.Close)
	L.OpenLibs()
	return L
}

func TestPluginHTTPAllowlistRejectsUnlistedHost(t *testing.T) {
	allow := newHTTPAllowlist([]string{"api.example.com"})
	for _, raw := range []string{
		"https://evil.test/steal",
		"https://169.254.169.254/latest/meta-data/",
		"https://api.example.com.evil.test/x", // suffix trick
		"https://user@evil.test/",
	} {
		if _, err := allow.checkURL(raw); err == nil {
			t.Fatalf("allowlist permitted %q — a plugin must not reach hosts "+
				"the operator never configured as a source", raw)
		}
	}
}

func TestPluginHTTPAllowlistAcceptsConfiguredHost(t *testing.T) {
	allow := newHTTPAllowlist([]string{"api.example.com"})
	for _, raw := range []string{
		"https://api.example.com/alpha/credits",
		"https://API.EXAMPLE.COM/x", // host compare must be case-insensitive
		"https://api.example.com:443/x",
	} {
		if _, err := allow.checkURL(raw); err != nil {
			t.Fatalf("allowlist refused configured host %q: %v", raw, err)
		}
	}
}

func TestPluginHTTPRefusesPlainHTTPOffLoopback(t *testing.T) {
	allow := newHTTPAllowlist([]string{"api.example.com"})
	// Allowed host, but plain HTTP would put the API key on the wire in clear.
	if _, err := allow.checkURL("http://api.example.com/alpha"); err == nil {
		t.Fatal("plain http to an allowed non-loopback host must be refused")
	}
	// Loopback stays allowed: it cannot leave the machine, and the billing rules
	// UI reads the gateway's own API over plain HTTP in dev setups.
	for _, raw := range []string{"http://127.0.0.1:8081/api/x", "http://localhost:8081/x"} {
		if _, err := allow.checkURL(raw); err != nil {
			t.Fatalf("loopback http must stay usable, got %v for %q", err, raw)
		}
	}
}

func TestPluginHTTPRejectsBadSchemesAndMissingURL(t *testing.T) {
	allow := newHTTPAllowlist([]string{"api.example.com"})
	for _, raw := range []string{"file:///etc/passwd", "ftp://api.example.com/x", "gopher://x"} {
		if _, err := allow.checkURL(raw); err == nil {
			t.Fatalf("scheme in %q must be refused", raw)
		}
	}
	// An empty allowlist must deny, not fall open.
	if _, err := newHTTPAllowlist(nil).checkURL("https://api.example.com/x"); err == nil {
		t.Fatal("an unconfigured gateway must deny outbound HTTP entirely")
	}
}

// A redirect is a hop the allowlist never saw. Following it would let an
// allowed host bounce a plugin's request (and its headers) anywhere.
func TestPluginHTTPDoesNotFollowRedirects(t *testing.T) {
	if httpClient.CheckRedirect == nil {
		t.Fatal("CheckRedirect must be set: following a redirect escapes the allowlist")
	}
	req, _ := http.NewRequest(http.MethodGet, "https://api.example.com/x", nil)
	err := httpClient.CheckRedirect(req, []*http.Request{req})
	if err != http.ErrUseLastResponse {
		t.Fatalf("CheckRedirect must return ErrUseLastResponse so the 3xx is "+
			"handed back unfollowed, got %v", err)
	}
}

func TestPluginHTTPTimeoutAndBodyAreClamped(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		_, _ = w.Write([]byte(`{"ok":true}`))
	}))
	defer srv.Close()
	allow := newHTTPAllowlist([]string{"127.0.0.1"})
	u, err := allow.checkURL(srv.URL)
	if err != nil {
		t.Fatalf("loopback test server must be allowed: %v", err)
	}
	// An absurd timeout is clamped instead of honoured.
	res, err := performHTTP(u, httpRequestSpec{Timeout: 24 * time.Hour})
	if err != nil {
		t.Fatalf("clamped request failed: %v", err)
	}
	if res.Status != 200 || !strings.Contains(res.Body, `"ok"`) {
		t.Fatalf("unexpected result: status=%d body=%q", res.Status, res.Body)
	}
}

func TestPluginHTTPOversizedBodyIsRefused(t *testing.T) {
	big := strings.Repeat("x", httpMaxResponse+64)
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		_, _ = w.Write([]byte(big))
	}))
	defer srv.Close()
	allow := newHTTPAllowlist([]string{"127.0.0.1"})
	u, _ := allow.checkURL(srv.URL)
	// Refusing beats truncating: a truncated body parses as corrupt JSON and the
	// plugin would report a parse error instead of the real cause.
	if _, err := performHTTP(u, httpRequestSpec{}); err == nil {
		t.Fatal("an oversized response must be refused, not silently truncated")
	}
}

func TestPluginHTTPErrorPathIsPairNotRaise(t *testing.T) {
	// Lua-side contract: the bridge returns (nil, message) on every failure so a
	// plugin mistake never raises through golua (see the SIGSEGV note on
	// hookGuardSrc — an escaping error can take the gateway down).
	allow := newHTTPAllowlist([]string{"api.example.com"})
	if _, err := allow.checkURL("https://evil.test/"); err == nil {
		t.Fatal("expected refusal")
	}
	// readHTTPRequestSpec must reject a non-table without touching the stack.
	L := newTestState(t)
	if _, err := readHTTPRequestSpec(L); err == nil {
		t.Fatal("a missing argument table must be an error, not a panic")
	}
}

// The bridge must be reachable under the name plugins actually call.
//
// This exists because the registration once used the CONSTANT'S IDENTIFIER as
// the Lua global name (`registerFn(L, "httpGlobal", …)`) rather than its VALUE,
// so the bridge was published as `httpGlobal` while every plugin called
// `__llmsproxy_http`. The failure only appeared at runtime, as
// "attempt to call global '__llmsproxy_http' (a nil value)" on the first real
// request — after the unit tests were green, because they drove the Go-side
// helpers directly and never went through Lua name resolution.
//
// So this test boots a real plugin and calls the bridge the way a plugin does.
func TestPluginHTTPBridgeIsReachableUnderItsLuaName(t *testing.T) {
	dir := t.TempDir()
	ps := NewPlugins(NewVM(dir), dir)
	ps.SetOutboundHosts([]string{"127.0.0.1"})

	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.Header().Set("Content-Type", "application/json")
		_, _ = w.Write([]byte(`{"credits":{"monthlyCredits":1.5}}`))
	}))
	defer srv.Close()

	// The plugin asks for a loopback URL, which is allowed without being
	// configured as a source. It type-checks both the table and arg.url, so a
	// malformed call is reported by the plugin rather than as a bewildering URL
	// parse error from the bridge.
	src := `
local P = {}
P.name = "httpprobe"
P.version = "1.0.0"
P.exports = { "probe" }
-- Call passes the WHOLE argument table as a single Lua argument, which is the
-- same convention the hooks use and what a plugin page's pluginAPI.call ends up
-- producing. Taking the table (not a bare string) is the correct shape.
function P.probe(arg)
  if type(arg) ~= "table" then return { error = "probe takes the args table, got " .. type(arg) } end
  if type(arg.url) ~= "string" then return { error = "arg.url must be a string, got " .. type(arg.url) } end
  local res, err = ` + httpGlobal + `({ url = arg.url, method = "GET" })
  if res == nil then return { error = tostring(err) } end
  return { status = res.status, body = res.body }
end
return P
`
	if err := ps.LoadSource("httpprobe", src); err != nil {
		t.Fatalf("load: %v", err)
	}
	got, err := ps.Call("httpprobe", "probe", map[string]interface{}{"url": srv.URL})
	if err != nil {
		t.Fatalf("call: %v", err)
	}
	m, _ := got.(map[string]interface{})
	if m == nil {
		t.Fatalf("probe returned %T, want a table", got)
	}
	// A nil global surfaces as {error = "attempt to call global ... (a nil value)"} —
	// which is a table too, so the error field is what distinguishes it.
	if e, ok := m["error"]; ok {
		t.Fatalf("the bridge is not reachable as %s: %v", httpGlobal, e)
	}
	if s, _ := m["status"].(float64); int(s) != 200 {
		t.Fatalf("status=%v body=%v, want 200 from the loopback test server", m["status"], m["body"])
	}
	if body, _ := m["body"].(string); !strings.Contains(body, "monthlyCredits") {
		t.Fatalf("body=%q, want the server's JSON", body)
	}
}