ValidateSpec.hs

module Amazon.SNS.Verify.ValidateSpec
  ( spec
  ) where

import Amazon.SNS.Verify.TestPrelude

import Amazon.SNS.Verify.Payload
import Amazon.SNS.Verify.Validate
import Data.X509.Validation (SignatureFailure (..))

spec :: Spec
spec = around_ useCertServer $ do
  describe "validateSnsMessage" $ do
    it "successfully validates an SNS notification" $ do
      let message = "Some message"
      x <-
        validateSnsMessage
          $ SNSPayload
            { snsMessage = message
            , snsMessageId = "78d4d7a0-a3eb-5c4d-834f-8d5fa9813ab6"
            , snsTimestamp = "2022-05-18T14:52:26.952Z"
            , snsTopicArn = "arn:aws:sns:us-west-2:123456789012:MyTopic"
            , snsType = "Notification"
            , snsSignatureVersion = "1"
            , snsSignature =
                "Dg24trcOUiLjclt5JwyJS0JEOnEEbi6P30XS6KBxMCwzZ08a04UwjaFTW9Ae8xurhBS5YESz1fY28vTwvEmxh/20WmB3bWIDOMp9v5RI8XSZOvpMm+hdQJ43VqGhEDyAvRU6iCDLihDlZNc/sBCwl9X0H4kh/8vIElRif9gFBbYI94ZHGgqEV+Zc3gVKo9Udrl/MxNvMVadsO/+/oPVUeWibQr3xfGK95oc/ocuNAgi0MOxZmLVnibHu36KOTSvy2qSLonnRRFcbaauYZJ4js7oTq+1ujXNO72oPLaeG3pVJ2grqMc5z8tKQxFnSTE3es7wQarU/CLrbO8j0isbnWw=="
            , snsSigningCertURL = cert
            , snsTypePayload =
                Notification
                  $ SNSNotification
                    { snsSubject =
                        Just
                          "SynthesisTaskNotification { TaskId: 680a1f1b-f3ae-4474-aa8f-3b6dfe52e656, Status: COMPLETED }"
                    }
            }
      x `shouldBe` Right (SNSMessage message)

    it "fails to validate a currupt SNS notification" $ do
      let go =
            validateSnsMessage
              $ SNSPayload
                { snsMessage = "Some message"
                , snsMessageId = "corrupt"
                , snsTimestamp = "2022-05-18T14:52:26.952Z"
                , snsTopicArn = "arn:aws:sns:us-west-2:123456789012:MyTopic"
                , snsType = "Notification"
                , snsSignatureVersion = "1"
                , snsSignature =
                    "Dg24trcOUiLjclt5JwyJS0JEOnEEbi6P30XS6KBxMCwzZ08a04UwjaFTW9Ae8xurhBS5YESz1fY28vTwvEmxh/20WmB3bWIDOMp9v5RI8XSZOvpMm+hdQJ43VqGhEDyAvRU6iCDLihDlZNc/sBCwl9X0H4kh/8vIElRif9gFBbYI94ZHGgqEV+Zc3gVKo9Udrl/MxNvMVadsO/+/oPVUeWibQr3xfGK95oc/ocuNAgi0MOxZmLVnibHu36KOTSvy2qSLonnRRFcbaauYZJ4js7oTq+1ujXNO72oPLaeG3pVJ2grqMc5z8tKQxFnSTE3es7wQarU/CLrbO8j0isbnWw=="
                , snsSigningCertURL = cert
                , snsTypePayload =
                    Notification
                      $ SNSNotification
                        { snsSubject =
                            Just
                              "SynthesisTaskNotification { TaskId: 680a1f1b-f3ae-4474-aa8f-3b6dfe52e656, Status: COMPLETED }"
                        }
                }
      go `shouldReturn` Left (InvalidPayload SignatureInvalid)

    it "fails to validate a bad PEM" $ do
      let go =
            validateSnsMessage
              $ SNSPayload
                { snsMessage = "Some message"
                , snsMessageId = "corrupt"
                , snsTimestamp = "2022-05-18T14:52:26.952Z"
                , snsTopicArn = "arn:aws:sns:us-west-2:123456789012:MyTopic"
                , snsType = "Notification"
                , snsSignatureVersion = "1"
                , snsSignature =
                    "Dg24trcOUiLjclt5JwyJS0JEOnEEbi6P30XS6KBxMCwzZ08a04UwjaFTW9Ae8xurhBS5YESz1fY28vTwvEmxh/20WmB3bWIDOMp9v5RI8XSZOvpMm+hdQJ43VqGhEDyAvRU6iCDLihDlZNc/sBCwl9X0H4kh/8vIElRif9gFBbYI94ZHGgqEV+Zc3gVKo9Udrl/MxNvMVadsO/+/oPVUeWibQr3xfGK95oc/ocuNAgi0MOxZmLVnibHu36KOTSvy2qSLonnRRFcbaauYZJ4js7oTq+1ujXNO72oPLaeG3pVJ2grqMc5z8tKQxFnSTE3es7wQarU/CLrbO8j0isbnWw=="
                , snsSigningCertURL = "http://localhost:3000/404"
                , snsTypePayload =
                    Notification
                      $ SNSNotification
                        { snsSubject =
                            Just
                              "SynthesisTaskNotification { TaskId: 680a1f1b-f3ae-4474-aa8f-3b6dfe52e656, Status: COMPLETED }"
                        }
                }
      go `shouldReturn` Left (BadPem "Empty List")

    it "fails to validate an unexpected url" $ do
      let go =
            validateSnsMessage
              $ SNSPayload
                { snsMessage = "Some message"
                , snsMessageId = "corrupt"
                , snsTimestamp = "2022-05-18T14:52:26.952Z"
                , snsTopicArn = "arn:aws:sns:us-west-2:123456789012:MyTopic"
                , snsType = "Notification"
                , snsSignatureVersion = "1"
                , snsSignature =
                    "Dg24trcOUiLjclt5JwyJS0JEOnEEbi6P30XS6KBxMCwzZ08a04UwjaFTW9Ae8xurhBS5YESz1fY28vTwvEmxh/20WmB3bWIDOMp9v5RI8XSZOvpMm+hdQJ43VqGhEDyAvRU6iCDLihDlZNc/sBCwl9X0H4kh/8vIElRif9gFBbYI94ZHGgqEV+Zc3gVKo9Udrl/MxNvMVadsO/+/oPVUeWibQr3xfGK95oc/ocuNAgi0MOxZmLVnibHu36KOTSvy2qSLonnRRFcbaauYZJ4js7oTq+1ujXNO72oPLaeG3pVJ2grqMc5z8tKQxFnSTE3es7wQarU/CLrbO8j0isbnWw=="
                , snsSigningCertURL = "http://attacker.com/evil.pem"
                , snsTypePayload =
                    Notification
                      $ SNSNotification
                        { snsSubject =
                            Just
                              "SynthesisTaskNotification { TaskId: 680a1f1b-f3ae-4474-aa8f-3b6dfe52e656, Status: COMPLETED }"
                        }
                }
      go `shouldReturn` Left (BadUri "http://attacker.com/evil.pem")

    it "successfully validates an SNS subscription" $ do
      -- pendingWith "need valid subscription payload"
      let
        message =
          "You have chosen to subscribe to the topic arn:aws:sns:us-west-2:123456789012:MyTopic.\nTo confirm the subscription, visit the SubscribeURL included in this message."
        subscription =
          SNSSubscription
            { snsToken = "2336412f37..."
            , snsSubscribeURL =
                "https://sns.us-west-2.amazonaws.com/?Action=ConfirmSubscription&TopicArn=arn:aws:sns:us-west-2:123456789012:MyTopic&Token=2336412f37..."
            }
      x <-
        validateSnsMessage
          $ SNSPayload
            { snsMessage = message
            , snsMessageId = "165545c9-2a5c-472c-8df2-7ff2be2b3b1b"
            , snsTimestamp = "2012-04-26T20:45:04.751Z"
            , snsTopicArn = "arn:aws:sns:us-west-2:123456789012:MyTopic"
            , snsType = "SubscriptionConfirmation"
            , snsSignatureVersion = "1"
            , snsSignature =
                "Jec/VlsopbiA2fCckj/IwTPjDbSuFkl2hNKL898sQuZcMeKeOLthYs7YlF+xLi+Ip6rG/X08GZKtCqpoiSgKW8D9PI6eHVM2JQa76sFJO5ZdPylrDH+URwBf28gT+1l/VYk4p3VK8RZo+3Wkn87HXwxTq1YoN390o5ncT34zaBDtLx2cUA8+JOnYjItmYjVXDhrEBF6xad/vIY8V2o5xyQOfEWLm71/Tcs3radzNoSj2xlLQyJKPOzV661fG6Xz1vVKfDVC03+Q4Pn67SmU1wWRRT1nDwPPzQlcDAiAGRjB1U/C5iHfLQFF3dKo4azylkrM2ReTCMm9KMyIWqjq5eg=="
            , snsSigningCertURL = cert
            , snsTypePayload = SubscriptionConfirmation subscription
            }
      x `shouldBe` Right (SNSSubscribe subscription)

    it "successfully validates an SNS unsubscribe" $ do
      -- pendingWith "need valid subscription payload"
      let
        message =
          "You have chosen to subscribe to the topic arn:aws:sns:us-west-2:123456789012:MyTopic.\nTo confirm the subscription, visit the SubscribeURL included in this message."
        subscription =
          SNSSubscription
            { snsToken = "2336412f37..."
            , snsSubscribeURL =
                "https://sns.us-west-2.amazonaws.com/?Action=ConfirmSubscription&TopicArn=arn:aws:sns:us-west-2:123456789012:MyTopic&Token=2336412f37..."
            }
      x <-
        validateSnsMessage
          $ SNSPayload
            { snsMessage = message
            , snsMessageId = "165545c9-2a5c-472c-8df2-7ff2be2b3b1b"
            , snsTimestamp = "2012-04-26T20:45:04.751Z"
            , snsTopicArn = "arn:aws:sns:us-west-2:123456789012:MyTopic"
            , snsType = "UnsubscribeConfirmation"
            , snsSignatureVersion = "1"
            , snsSignature =
                "fKtmZTE6xvGhbcCTchFPLmuhdoXI7hxWrE9qe1RjeLDecMaZGmqsn4rOrFDsteqot4ItLuJqvV7RtImGXrMa/JNnZdP71lG6FdrKTiGqZNrnxZZYbIuZMAsSQM4E8VaRwbxLXuPQY9IYFP4y9GfsdpDYx0tpbXOxGz/JFVQjTFpHY55BmV6Ec73g0X/eLSEdKfHtWg/gVf6W27ewa40jXvaa78VmcVXbPXIKwzGgSSSe9t6xxVe0kLjKXaDyJTl3rbZJZJgBLInbychWNq1vGHGZQhtCyxjKRfKIWNWDbHdM/fUBGUhuv089CblWpq8g/21HiJ9n+S3VSn0hCXB5hg=="
            , snsSigningCertURL = cert
            , snsTypePayload = UnsubscribeConfirmation subscription
            }
      x `shouldBe` Right (SNSUnsubscribe subscription)

cert :: Text
cert = "http://localhost:3000"