Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/modules/federalsignal/fetch_test.go
Original SHA-256	c8671df2d86536de92bb13bb831a6de099234c682601e0816a8fd79c857bc5a3
Git blob SHA	9ea1958b99e462f34eea0998c21c6f0b73a75086
Reading-copy SHA-256	74716320a89b31da5599f5956ea53971df42e8be1d0939c4ed38a8c592ad13e5

Original source ↗

Every recorded occurrence

These 15 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / internal/modules/federalsignal/fetch_test.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓171 lines · 6.0 KB

Credential-bearing and unrelated personal details were removed from this reading copy. The source identity and original checksum remain recorded.

package federalsignal

import (
	"context"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"

	"github.com/missionworkforce/missionmatch/internal/platform/storage"
)

const fakeKey = "FAKE_SAM_KEY_do_not_log_0123456789"

// newTestServer serves a plain text body at /desc and an HTML body at /res. It records, per path,
// whether the request carried the api_key query parameter, so the test can assert the key is sent to
// SAM and never elsewhere.
func newTestServer(t *testing.T, sawKey map[string]bool) *httptest.Server {
	t.Helper()
	mux := http.NewServeMux()
	mux.HandleFunc("/desc.txt", func(w http.ResponseWriter, r *http.Request) {
		sawKey["/desc.txt"] = r.URL.Query().Get("api_key") != ""
		w.Header().Set("Content-Type", "text/plain")
		_, _ = w.Write([]byte("SIGINT Analyst x3 and one ISSO"))
	})
	mux.HandleFunc("/res.html", func(w http.ResponseWriter, r *http.Request) {
		sawKey["/res.html"] = r.URL.Query().Get("api_key") != ""
		w.Header().Set("Content-Type", "text/html")
		_, _ = w.Write([]byte("<html><body><p>COMSEC Custodian needed</p></body></html>"))
	})
	mux.HandleFunc("/broken.txt", func(w http.ResponseWriter, r *http.Request) {
		http.Error(w, "boom", http.StatusInternalServerError)
	})
	srv := httptest.NewServer(mux)
	t.Cleanup(srv.Close)
	return srv
}

func TestFetchSolicitationText(t *testing.T) {
	sawKey := map[string]bool{}
	srv := newTestServer(t, sawKey)

	// The host is treated as a SAM host for the test so the key is appended; see WithSAMHosts.
	host := strings.TrimPrefix(srv.URL, "http://")
	f := New(fakeKey, WithSAMHosts(host), WithTimeout(5*time.Second), WithMaxRetries(1))

	got, err := f.FetchSolicitationText(context.Background(),
		srv.URL+"/desc.txt",
		[]string{srv.URL + "/res.html"})
	if err != nil {
		t.Fatalf("FetchSolicitationText: %v", err)
	}

	if !strings.Contains(got, "SIGINT Analyst") {
		t.Fatalf("missing description text: %q", got)
	}
	if !strings.Contains(got, "COMSEC Custodian") {
		t.Fatalf("missing resource link text: %q", got)
	}
	// The api_key must NEVER appear in the returned text.
	if strings.Contains(got, fakeKey) {
		t.Fatalf("api_key leaked into returned text: %q", got)
	}
	if strings.Contains(got, "api_key") {
		t.Fatalf("api_key parameter name leaked into returned text: %q", got)
	}
	// The key WAS sent to the SAM host on both URLs.
	if !sawKey["/desc.txt"] || !sawKey["/res.html"] {
		t.Fatalf("api_key was not sent to the SAM host: %+v", sawKey)
	}
}

// TestFetchBestEffortOnError proves one failing attachment does not fail the whole record: the good
// attachment's text still comes back.
func TestFetchBestEffortOnError(t *testing.T) {
	sawKey := map[string]bool{}
	srv := newTestServer(t, sawKey)
	host := strings.TrimPrefix(srv.URL, "http://")
	f := New(fakeKey, WithSAMHosts(host), WithTimeout(5*time.Second), WithMaxRetries(0))

	got, err := f.FetchSolicitationText(context.Background(),
		srv.URL+"/desc.txt",
		[]string{srv.URL + "/broken.txt"}) // 500s every time
	if err != nil {
		t.Fatalf("a per attachment failure must not fail the record: %v", err)
	}
	if !strings.Contains(got, "SIGINT Analyst") {
		t.Fatalf("good attachment text missing after a sibling failed: %q", got)
	}
}

// TestFetchKeyNotSentToNonSAMHost proves the api_key is [credential removed] ONLY to SAM hosts, never to a foreign
// resource link, so the secret cannot leak to a third party.
func TestFetchKeyNotSentToNonSAMHost(t *testing.T) {
	foreignSaw := false
	foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.URL.Query().Get("api_key") != "" {
			foreignSaw = true
		}
		_, _ = w.Write([]byte("<html><body><p>External Role</p></body></html>"))
	}))
	defer foreign.Close()

	samSaw := map[string]bool{}
	sam := newTestServer(t, samSaw)
	samHost := strings.TrimPrefix(sam.URL, "http://")
	// Only the SAM server's host is registered, the foreign host is not.
	f := New(fakeKey, WithSAMHosts(samHost), WithTimeout(5*time.Second))

	got, err := f.FetchSolicitationText(context.Background(),
		sam.URL+"/desc.txt",
		[]string{foreign.URL}) // a non SAM resource link
	if err != nil {
		t.Fatalf("FetchSolicitationText: %v", err)
	}
	if foreignSaw {
		t.Fatal("api_key was sent to a non SAM host")
	}
	if !strings.Contains(got, "External Role") {
		t.Fatalf("foreign resource text should still be fetched (without the key): %q", got)
	}
}

// TestFetchStoresRawBytes proves the optional Storer receives the raw bytes under a deterministic key,
// and that passing a nil Storer skips storage without error.
func TestFetchStoresRawBytes(t *testing.T) {
	sawKey := map[string]bool{}
	srv := newTestServer(t, sawKey)
	host := strings.TrimPrefix(srv.URL, "http://")
	mem := storage.NewMemory()
	f := New(fakeKey, WithSAMHosts(host), WithStore(mem, "fedsig"))

	descURL := srv.URL + "/desc.txt"
	if _, err := f.FetchSolicitationText(context.Background(), descURL, nil); err != nil {
		t.Fatalf("FetchSolicitationText: %v", err)
	}
	// The deterministic key is the prefix plus the sha256 of the URL, so two runs of the same URL collide
	// on one object rather than piling up duplicates.
	key := rawKey("fedsig", descURL)
	raw, err := mem.Get(context.Background(), key)
	if err != nil {
		t.Fatalf("expected raw bytes stored under %q: %v", key, err)
	}
	if !strings.Contains(string(raw), "SIGINT Analyst") {
		t.Fatalf("stored bytes are not the body: %q", string(raw))
	}
	// The stored key MUST NOT contain the api_key.
	if strings.Contains(key, fakeKey) {
		t.Fatalf("api_key leaked into the storage key: %q", key)
	}

	// A nil Storer is allowed and simply skips storage.
	fNil := New(fakeKey, WithSAMHosts(host))
	if _, err := fNil.FetchSolicitationText(context.Background(), descURL, nil); err != nil {
		t.Fatalf("nil Storer should be allowed: %v", err)
	}
}

// TestFetchEmptyInputs proves no URLs yields empty text and no error.
func TestFetchEmptyInputs(t *testing.T) {
	f := New(fakeKey)
	got, err := f.FetchSolicitationText(context.Background(), "", nil)
	if err != nil {
		t.Fatalf("empty inputs should not error: %v", err)
	}
	if got != "" {
		t.Fatalf("empty inputs should yield empty text, got %q", got)
	}
}