standalone-asm.spec.js

'use strict'

const assert = require('node:assert/strict')
const path = require('path')
const { inspect } = require('node:util')

const {
  assertClientComputedStats,
  sandboxCwd,
  useSandbox,
  FakeAgent,
  spawnProc,
  stopProc,
  curlAndAssertMessage,
  curl,
} = require('../helpers')
const { USER_KEEP, AUTO_REJECT, AUTO_KEEP } = require('../../ext/priority')

describe('Standalone ASM', () => {
  let cwd, startupTestFile, agent, proc, env

  useSandbox(['express'])

  before(() => {
    cwd = sandboxCwd()
    startupTestFile = path.join(cwd, 'standalone-asm/index.js')
  })

  function assertKeep ({ meta, metrics }) {
    assert.strictEqual(meta['_dd.p.ts'], '02')

    assert.strictEqual(metrics._sampling_priority_v1, USER_KEEP)
    assert.strictEqual(metrics['_dd.apm.enabled'], 0)
  }

  function assertDrop ({ meta, metrics }) {
    assert.ok(!('_dd.p.ts' in meta))

    assert.strictEqual(metrics._sampling_priority_v1, AUTO_REJECT)
    assert.strictEqual(metrics['_dd.apm.enabled'], 0)
  }

  async function doWarmupRequests (procOrUrl, number = 3) {
    for (let i = number; i > 0; i--) {
      await curl(procOrUrl)
    }
  }

  function isLateOutboundSpan (span) {
    return span.name === 'http.request' && span.meta['http.url']?.endsWith('/intake/v2/events')
  }

  function isLateOutboundRoot (span) {
    return span.resource === 'GET /late-outbound'
  }

  describe('enabled', () => {
    beforeEach(async () => {
      agent = await new FakeAgent().start()

      env = {
        AGENT_PORT: agent.port,
        DD_APM_TRACING_ENABLED: 'false',
        DD_APPSEC_ENABLED: 'true',
        DD_API_SECURITY_ENABLED: 'false',
      }

      const execArgv = []

      proc = await spawnProc(startupTestFile, { cwd, env, execArgv })
    })

    afterEach(async () => {
      await stopProc(proc)
      await agent.stop()
    })

    // first req initializes the waf and reports the first appsec event adding manual.keep tag
    it('should send correct headers and tags on first req', async () => {
      return curlAndAssertMessage(agent, proc, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 1)
        assert.ok(Array.isArray(payload[0]), `Expected array, got ${inspect(payload[0])}`)

        // express.request + router.middleware x 2
        assert.strictEqual(payload[0].length, 3)

        assertKeep(payload[0][0])
      })
    })

    it('should add _dd.apm.enabled tag to delayed local child chunks', async () => {
      const seenGroups = []
      const groups = await agent.collectGroups({
        trigger: () => curl(`${proc.url}/late-outbound`),
        predicate: group => {
          seenGroups.push(group.map(span => ({
            name: span.name,
            resource: span.resource,
            url: span.meta['http.url'],
            apmEnabled: span.metrics['_dd.apm.enabled'],
          })))

          return group.some(isLateOutboundRoot) || group.some(isLateOutboundSpan)
        },
        expectedCount: 2,
      }).catch(error => {
        error.message += `\nSeen groups: ${inspect(seenGroups, { depth: null })}`
        throw error
      })

      const rootGroup = groups.find(group => group.some(isLateOutboundRoot))
      const outboundGroup = groups.find(group => group.some(isLateOutboundSpan))
      const rootSpan = rootGroup?.find(isLateOutboundRoot)
      const outboundSpan = outboundGroup?.find(isLateOutboundSpan)

      // Two distinct chunks: parent flushes first, delayed child flushes later.
      assert.notStrictEqual(rootGroup, undefined)
      assert.notStrictEqual(outboundGroup, undefined)
      assert.notStrictEqual(outboundGroup, rootGroup)
      assert.ok(groups.indexOf(rootGroup) < groups.indexOf(outboundGroup))
      assert.strictEqual(String(outboundSpan.parent_id), String(rootSpan.span_id))

      // Load-bearing: every span in every chunk must carry the billing marker,
      // including the delayed child whose parent is a local (non-remote) span.
      for (const group of groups) {
        for (const span of group) {
          assert.strictEqual(
            span.metrics['_dd.apm.enabled'], 0,
            `span ${span.name}/${span.resource} missing _dd.apm.enabled:0`
          )
        }
      }
    })

    it('should keep fifth req because RateLimiter allows 1 req/min', async () => {
      const promise = curlAndAssertMessage(agent, proc, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        if (payload.length === 4) {
          assertKeep(payload[0][0])
          assertDrop(payload[1][0])
          assertDrop(payload[2][0])
          assertDrop(payload[3][0])

          // req after a minute
        } else {
          const fifthReq = payload[0]
          assert.ok(Array.isArray(fifthReq), `Expected array, got ${inspect(fifthReq)}`)
          assert.strictEqual(fifthReq.length, 3)

          const { meta, metrics } = fifthReq[0]
          assert.ok(!('manual.keep' in meta))
          assert.ok(!('_dd.p.ts' in meta))

          assert.strictEqual(metrics._sampling_priority_v1, AUTO_KEEP)
          assert.strictEqual(metrics['_dd.apm.enabled'], 0)
        }
      }, 70000, 2)

      // 1st req kept because waf init
      // next in the first minute are dropped
      // 5nd req kept because RateLimiter allows 1 req/min
      await doWarmupRequests(proc)

      await new Promise(resolve => setTimeout(resolve, 60000))

      await curl(proc)

      return promise
    }).timeout(70000)

    it('should keep attack requests', async () => {
      await doWarmupRequests(proc)

      const urlAttack = proc.url + '?query=1 or 1=1'
      return curlAndAssertMessage(agent, urlAttack, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 4)

        assertKeep(payload[3][0])
      })
    })

    it('should keep sdk events', async () => {
      await doWarmupRequests(proc)

      const url = proc.url + '/login?user=test'
      return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 4)

        assertKeep(payload[3][0])
      })
    })

    it('should keep custom sdk events', async () => {
      await doWarmupRequests(proc)

      const url = proc.url + '/sdk'
      return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 4)

        assertKeep(payload[3][0])
      })
    })

    it('should keep iast events', async () => {
      await doWarmupRequests(proc)

      const url = proc.url + '/vulnerableHash'
      return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 4)

        const expressReq4 = payload[3][0]
        assertKeep(expressReq4)
        assert.ok(
          Object.hasOwn(expressReq4.meta, '_dd.iast.json'),
          `Available keys: ${inspect(Object.keys(expressReq4.meta))}`
        )
        assert.strictEqual(expressReq4.metrics['_dd.iast.enabled'], 1)
      })
    })

    describe('propagation', () => {
      let proc2
      let port2

      beforeEach(async () => {
        const execArgv = []

        proc2 = await spawnProc(startupTestFile, { cwd, env, execArgv })

        port2 = parseInt(proc2.url.substring(proc2.url.lastIndexOf(':') + 1), 10)
      })

      afterEach(async () => {
        await stopProc(proc2)
      })

      // proc/drop-and-call-sdk:
      // after setting a manual.drop calls to downstream proc2/sdk which triggers an appsec event
      it('should keep trace even if parent prio is -1 but there is an event in the local trace', async () => {
        await doWarmupRequests(proc)
        await doWarmupRequests(proc2)

        const url = `${proc.url}/propagation-after-drop-and-call-sdk?port=${port2}`
        return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
          assertClientComputedStats(headers)
          assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)

          const innerReq = payload.find(p => p[0].resource === 'GET /sdk')
          assert.notStrictEqual(innerReq, undefined)
          assertKeep(innerReq[0])
        }, undefined, undefined, true)
      })

      // proc/propagation-with-event triggers an appsec event and calls downstream proc2/down with no event
      it('should keep if parent trace is (prio:2, _dd.p.ts:02) but there is no event in the local trace',
        async () => {
          await doWarmupRequests(proc)
          await doWarmupRequests(proc2)

          const url = `${proc.url}/propagation-with-event?port=${port2}`
          return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
            assertClientComputedStats(headers)
            assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)

            const innerReq = payload.find(p => p[0].resource === 'GET /down')
            assert.notStrictEqual(innerReq, undefined)
            assertKeep(innerReq[0])
          }, undefined, undefined, true)
        })

      it('should remove parent trace data if there is no event in the local trace', async () => {
        await doWarmupRequests(proc)
        await doWarmupRequests(proc2)

        const url = `${proc.url}/propagation-without-event?port=${port2}`
        return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
          assertClientComputedStats(headers)
          assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)

          const innerReq = payload.find(p => p[0].resource === 'GET /down')
          assert.notStrictEqual(innerReq, undefined)
          assert.ok(!('_dd.p.other' in innerReq[0].meta))
        }, undefined, undefined, true)
      })

      it('should not remove parent trace data if there is event in the local trace', async () => {
        await doWarmupRequests(proc)

        const url = `${proc.url}/propagation-with-event?port=${port2}`
        return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
          assertClientComputedStats(headers)
          assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)

          const innerReq = payload.find(p => p[0].resource === 'GET /down')
          assert.notStrictEqual(innerReq, undefined)
          assert.ok(
            Object.hasOwn(innerReq[0].meta, '_dd.p.other'),
            `Available keys: ${inspect(Object.keys(innerReq[0].meta))}`
          )
        }, undefined, undefined, true)
      })
    })
  })

  describe('With API Security enabled', () => {
    beforeEach(async () => {
      agent = await new FakeAgent().start()

      env = {
        AGENT_PORT: agent.port,
        DD_APM_TRACING_ENABLED: 'false',
        DD_APPSEC_ENABLED: 'true',
      }

      const execArgv = []

      proc = await spawnProc(startupTestFile, { cwd, env, execArgv })
    })

    afterEach(async () => {
      await stopProc(proc)
      await agent.stop()
    })

    it('should keep fifth req because of api security sampler', async () => {
      const promise = curlAndAssertMessage(agent, proc, ({ headers, payload }) => {
        assertClientComputedStats(headers)
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        if (payload.length === 4) {
          assertKeep(payload[0][0])
          assertDrop(payload[1][0])
          assertDrop(payload[2][0])
          assertDrop(payload[3][0])

          // req after 30s
        } else {
          const fifthReq = payload[0]
          assert.ok(Array.isArray(fifthReq), `Expected array, got ${inspect(fifthReq)}`)
          assert.strictEqual(fifthReq.length, 3)
          assertKeep(fifthReq[0])
        }
      }, 40000, 2)

      // 1st req kept because waf init
      // next in the 30s are dropped
      // 5nd req manual kept because of api security sampler
      await doWarmupRequests(proc)

      await new Promise(resolve => setTimeout(resolve, 30000))

      await curl(proc)

      return promise
    }).timeout(40000)
  })

  describe('disabled', () => {
    beforeEach(async () => {
      agent = await new FakeAgent().start()

      env = {
        AGENT_PORT: agent.port,
      }

      proc = await spawnProc(startupTestFile, { cwd, env })
    })

    afterEach(async () => {
      await stopProc(proc)
      await agent.stop()
    })

    it('should not add standalone related tags in iast events', () => {
      const url = proc.url + '/vulnerableHash'
      return curlAndAssertMessage(agent, url, ({ headers, payload }) => {
        assert.ok(!('datadog-client-computed-stats' in headers))
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 1)
        assert.ok(Array.isArray(payload[0]), `Expected array, got ${inspect(payload[0])}`)

        // express.request + router.middleware x 2
        assert.strictEqual(payload[0].length, 3)

        const { meta, metrics } = payload[0][0]
        assert.ok(
          Object.hasOwn(meta, '_dd.iast.json'),
          `Available keys: ${inspect(Object.keys(meta))}`
        ) // WEAK_HASH and XCONTENTTYPE_HEADER_MISSING reported

        assert.ok(!('_dd.p.ts' in meta))
        assert.ok(!('_dd.apm.enabled' in metrics))
      })
    })

    it('should not add standalone related tags in appsec events', () => {
      const urlAttack = proc.url + '?query=1 or 1=1'

      return curlAndAssertMessage(agent, urlAttack, ({ headers, payload }) => {
        assert.ok(!('datadog-client-computed-stats' in headers))
        assert.ok(Array.isArray(payload), `Expected array, got ${inspect(payload)}`)
        assert.strictEqual(payload.length, 1)
        assert.ok(Array.isArray(payload[0]), `Expected array, got ${inspect(payload[0])}`)

        // express.request + router.middleware x 2
        assert.strictEqual(payload[0].length, 3)

        const { meta, metrics } = payload[0][0]
        assert.ok(
          Object.hasOwn(meta, '_dd.appsec.json'),
          `Available keys: ${inspect(Object.keys(meta))}`
        ) // crs-942-100 triggered

        assert.ok(!('_dd.p.ts' in meta))
        assert.ok(!('_dd.apm.enabled' in metrics))
      })
    })
  })
})