EpicNext-Cms/src/lib/crowdsec-api.test.ts

import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
import {
	type CrowdsecVerdict,
	crowdsecEnabled,
	getCrowdsecApiConfig,
	getCrowdsecBlockMeta,
	getCrowdsecQuotaUsage,
	getLastCrowdsecVerify,
	getMemoryVerdictCacheSize,
	lookupCrowdsecVerdict,
	maybeAutoBlockCrowdsec,
	resetCrowdsecCache,
	setLastCrowdsecVerify,
	verdictIsMalicious,
	verifyCrowdsecConnection,
} from "./crowdsec-api";

// Unit-test the CTI client in isolation: a deterministic in-memory Redis fake
// and a silenced logger, so fetch calls count only CrowdSec lookups. CrowdSec
// deliberately never touches Cloudflare, so no Cloudflare surface is stubbed.
const state = vi.hoisted(() => ({ map: new Map<string, string>() }));

vi.mock("@/lib/redis", () => ({
	redis: {
		get: async (key: string) => state.map.get(key) ?? null,
		set: async (
			key: string,
			value: string,
			_mode?: string,
			_seconds?: number,
			nx?: string,
		) => {
			if (nx === "NX" && state.map.has(key)) return null;
			state.map.set(key, value);
			return "OK";
		},
		del: async (...keys: string[]) => {
			for (const key of keys) state.map.delete(key);
			return keys.length;
		},
		incr: async (key: string) => {
			const next = (Number(state.map.get(key)) || 0) + 1;
			state.map.set(key, String(next));
			return next;
		},
		expire: async () => 1,
		pttl: async () => 60_000,
	},
	__esModule: true,
}));

vi.mock("@/lib/logger", () => ({
	logger: {
		info: vi.fn(),
		warn: vi.fn(),
		error: vi.fn(),
		debug: vi.fn(),
	},
}));

function jsonResponse(body: unknown, status = 200): Response {
	return new Response(JSON.stringify(body), {
		status,
		headers: { "content-type": "application/json" },
	});
}

function maliciousItem(ip: string, score = 5): unknown {
	return {
		ip,
		reputation: "malicious",
		confidence: "0.95",
		scores: { overall: { aggressiveness: 4, total: score } },
		behaviors: [{ name: "http:bruteforce" }, { name: "http:scan" }],
		classifications: { false_positives: [] },
	};
}

function suspiciousItem(ip: string, score: number): unknown {
	return {
		ip,
		reputation: "suspicious",
		scores: { overall: { total: score } },
	};
}

function verdict(minimal: Partial<CrowdsecVerdict> = {}): CrowdsecVerdict {
	return {
		ip: "198.51.100.1",
		reputation: "suspicious",
		score: 3,
		aggressiveness: 0,
		confidence: null,
		behaviors: [],
		falsePositive: false,
		checkedAt: Date.now(),
		...minimal,
	};
}

function blockIp(): string {
	return "198.51.100.1";
}

describe("crowdsec-api", () => {
	let fetchMock: ReturnType<typeof vi.fn>;

	beforeEach(() => {
		vi.unstubAllGlobals();
		vi.unstubAllEnvs();
		state.map.clear();
		resetCrowdsecCache();
		fetchMock = vi.fn();
		vi.stubGlobal("fetch", fetchMock);
	});

	afterEach(() => {
		vi.unstubAllGlobals();
		vi.unstubAllEnvs();
		state.map.clear();
		resetCrowdsecCache();
		vi.restoreAllMocks();
	});

	it("is enabled only when a non-blank API key is configured", () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		vi.stubEnv("CROWDSEC_CTI_BASE_URL", "https://cti.example.test");
		expect(crowdsecEnabled()).toBe(true);
		expect(getCrowdsecApiConfig().apiKey).toBe("cs_key");
		expect(getCrowdsecApiConfig().baseUrl).toBe("https://cti.example.test");

		vi.stubEnv("CROWDSEC_API_KEY", "  ");
		expect(crowdsecEnabled()).toBe(false);
		vi.stubEnv("CROWDSEC_CTI_BASE_URL", "");
		expect(getCrowdsecApiConfig().baseUrl).toBe(
			"https://cti.api.crowdsec.net/v2",
		);
	});

	it("blocks malicious reputations at any threshold", () => {
		expect(
			verdictIsMalicious(verdict({ reputation: "malicious", score: 0 }), 5),
		).toBe(true);
	});

	it("never blocks safe or benign reputations", () => {
		expect(verdictIsMalicious(verdict({ reputation: "safe" }), 0)).toBe(false);
		expect(verdictIsMalicious(verdict({ reputation: "benign" }), 1)).toBe(
			false,
		);
	});

	it("vetoes a false-positive tag even for a malicious reputation", () => {
		expect(
			verdictIsMalicious(
				verdict({ reputation: "malicious", score: 5, falsePositive: true }),
				4,
			),
		).toBe(false);
	});

	it("applies the score threshold to suspicious/known attackers", () => {
		const v4 = verdict({ reputation: "suspicious", score: 4 });
		expect(verdictIsMalicious(v4, 4)).toBe(true);
		expect(verdictIsMalicious(v4, 5)).toBe(false);
		expect(verdictIsMalicious(verdict({ score: 3 }), 4)).toBe(false);
	});

	it("never blocks score-0 (unknown) IPs even at threshold 0", () => {
		expect(
			verdictIsMalicious(verdict({ score: 0, reputation: "unknown" }), 0),
		).toBe(false);
	});

	it("does nothing without an API key", async () => {
		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(fetchMock).not.toHaveBeenCalled();
	});

	it("does nothing when the runtime toggle is off", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: false,
		});
		expect(fetchMock).not.toHaveBeenCalled();
	});

	it("never consults CrowdSec for the unknown-IP sentinel", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		await maybeAutoBlockCrowdsec({
			ip: "0.0.0.0",
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(fetchMock).not.toHaveBeenCalled();
	});

	it("hard-blocks a malicious IP in the shared gate key only", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 86_400,
			scoreThreshold: 4,
			enabled: true,
		});

		expect(state.map.get(`antiddos:block:${blockIp()}`)).toBe("crowdsec");
		// No Cloudflare keys may ever be written by CrowdSec.
		expect(
			[...state.map.keys()].some((key) => key.includes("cloudflare")),
		).toBe(false);
		expect(fetchMock).toHaveBeenCalledTimes(1);
		const [url, init] = fetchMock.mock.calls[0];
		expect(String(url)).toContain(`/smoke/${blockIp()}`);
		expect((init.headers as Record<string, string>)["x-api-key"]).toBe(
			"cs_key",
		);
	});

	it("does not block an IP the community knows nothing about", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse({}, 404));

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});

		expect(state.map.has(`antiddos:block:${blockIp()}`)).toBe(false);
	});

	it("respects a custom score threshold", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse(suspiciousItem(blockIp(), 3)));

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(state.map.has(`antiddos:block:${blockIp()}`)).toBe(false);

		fetchMock.mockResolvedValue(jsonResponse(suspiciousItem(blockIp(), 3)));
		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 3,
			enabled: true,
		});
		expect(state.map.get(`antiddos:block:${blockIp()}`)).toBe("crowdsec");
	});

	it("dedupes concurrent lookups into a single API call", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));

		await Promise.all([
			maybeAutoBlockCrowdsec({
				ip: blockIp(),
				category: "api",
				ttlSeconds: 600,
				scoreThreshold: 4,
				enabled: true,
			}),
			maybeAutoBlockCrowdsec({
				ip: blockIp(),
				category: "api",
				ttlSeconds: 600,
				scoreThreshold: 4,
				enabled: true,
			}),
		]);
		expect(fetchMock).toHaveBeenCalledTimes(1);
	});

	it("reuses the Redis verdict cache for repeat offenders", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));

		for (let i = 0; i < 3; i += 1) {
			await maybeAutoBlockCrowdsec({
				ip: blockIp(),
				category: "api",
				ttlSeconds: 600,
				scoreThreshold: 4,
				enabled: true,
			});
		}
		expect(fetchMock).toHaveBeenCalledTimes(1);
	});

	it("never shortens an existing longer host block", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));

		state.map.set(`antiddos:block:${blockIp()}`, "1");
		const redis = (await import("@/lib/redis")).redis;
		vi.spyOn(redis as NonNullable<typeof redis>, "pttl").mockImplementation(
			async () => 86_400_000,
		);

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});

		expect(state.map.get(`antiddos:block:${blockIp()}`)).toBe("1");
	});

	it("backs off after a 403 so it stops hammering a rejected key", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse({ message: "Invalid key" }, 403));

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		await maybeAutoBlockCrowdsec({
			ip: "203.0.113.9",
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(fetchMock).toHaveBeenCalledTimes(1);
	});

	it("backs off after a 429 rate limit as well", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse({ message: "rate limited" }, 429));

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		await maybeAutoBlockCrowdsec({
			ip: "198.51.100.2",
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(fetchMock).toHaveBeenCalledTimes(1);
	});

	it("swallows API failures instead of throwing on the hot path", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse({ message: "boom" }, 500));

		await expect(
			maybeAutoBlockCrowdsec({
				ip: blockIp(),
				category: "api",
				ttlSeconds: 600,
				scoreThreshold: 4,
				enabled: true,
			}),
		).resolves.toBeUndefined();
		expect(state.map.has(`antiddos:block:${blockIp()}`)).toBe(false);
	});

	it("reports a missing credential without calling the API", async () => {
		const status = await verifyCrowdsecConnection();
		expect(status.ok).toBe(false);
		expect(status.message).toContain("CROWDSEC_API_KEY");
		expect(fetchMock).not.toHaveBeenCalled();
	});

	it("verifies the key against the CTI probe endpoint", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(
			jsonResponse({ ip: "1.1.1.1", reputation: "safe" }),
		);

		const status = await verifyCrowdsecConnection();
		expect(status.ok).toBe(true);
		expect(status.message).toContain("1.1.1.1");
		expect(String(fetchMock.mock.calls[0][0])).toContain("/smoke/1.1.1.1");
		expect(
			(fetchMock.mock.calls[0][1].headers as Record<string, string>)[
				"x-api-key"
			],
		).toBe("cs_key");
	});

	it("surfaces a rejected credential", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse({ message: "Invalid key" }, 403));

		const status = await verifyCrowdsecConnection();
		expect(status.ok).toBe(false);
		expect(status.message).toContain("Invalid key");
	});

	it("round-trips the last verify status through Redis and memory", async () => {
		const status = { ok: true, message: "CTI key accepted", at: Date.now() };
		await setLastCrowdsecVerify(status);
		expect(await getLastCrowdsecVerify()).toEqual(status);
		expect(JSON.parse(state.map.get("crowdsec:last-verify") ?? "{}")).toEqual(
			status,
		);
	});

	it("records why it blocked an IP next to the gate key", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		fetchMock.mockResolvedValue(jsonResponse(maliciousItem(blockIp())));

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 86_400,
			scoreThreshold: 4,
			enabled: true,
		});

		const meta = await getCrowdsecBlockMeta(blockIp());
		expect(meta).not.toBeNull();
		expect(meta?.source).toBe("crowdsec");
		expect(meta?.reputation).toBe("malicious");
		expect(meta?.score).toBe(5);
		expect(meta?.behaviors).toEqual(["http:bruteforce", "http:scan"]);
		expect(meta?.category).toBe("api");
		expect(meta?.ttlSeconds).toBe(86_400);
		expect(meta?.blockedAt).toBeGreaterThan(0);
	});

	it("stops consulting the API once today's quota is spent", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "2");
		// Fresh Response per call — a consumed body must never be re-parsed.
		fetchMock.mockImplementation(() =>
			Promise.resolve(jsonResponse(maliciousItem(blockIp()))),
		);

		await maybeAutoBlockCrowdsec({
			ip: blockIp(),
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		await maybeAutoBlockCrowdsec({
			ip: "198.51.100.2",
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(fetchMock).toHaveBeenCalledTimes(2);
		expect(state.map.get(`antiddos:block:198.51.100.2`)).toBe("crowdsec");

		// Third bucket-tripping IP arrives after the quota counter hit 2.
		await maybeAutoBlockCrowdsec({
			ip: "198.51.100.3",
			category: "api",
			ttlSeconds: 600,
			scoreThreshold: 4,
			enabled: true,
		});
		expect(fetchMock).toHaveBeenCalledTimes(2);
		expect(state.map.has(`antiddos:block:198.51.100.3`)).toBe(false);

		const usage = await getCrowdsecQuotaUsage();
		expect(usage.quota).toBe(2);
		expect(usage.used).toBe(2);
		expect(usage.exhausted).toBe(true);
	});

	it("exposes today's quota usage for the admin panel", async () => {
		vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "10000");
		const before = await getCrowdsecQuotaUsage();
		expect(before.quota).toBe(10000);
		expect(before.used).toBe(0);
		expect(before.exhausted).toBe(false);
		expect(before.date).toMatch(/^\d{4}-\d{2}-\d{2}$/);

		state.map.set(`crowdsec:usage:${before.date}`, "9876");
		const after = await getCrowdsecQuotaUsage();
		expect(after.used).toBe(9876);
	});

	it("caps the in-process verdict cache so it cannot grow forever", async () => {
		vi.stubEnv("CROWDSEC_API_KEY", "cs_key");
		vi.stubEnv("CROWDSEC_CTI_DAILY_QUOTA", "0");
		fetchMock.mockImplementation((url: string | URL) =>
			Promise.resolve(
				jsonResponse(maliciousItem(String(url).split("/").pop() ?? "ip")),
			),
		);

		// One lookup per distinct IP (never cached before), exceeding the cap —
		// the oldest entries are evicted first, so the cache stays bounded.
		for (let i = 0; i < 2100; i += 1) {
			await lookupCrowdsecVerdict(`198.51.100.${i}`);
		}
		expect(getMemoryVerdictCacheSize()).toBe(2000);
	});
});