Claude
eed8c45f80
## Summary Fixed all 5 vulnerabilities identified in deep L3 security audit of PR #136: - #2 (HIGH): Incorrect JID cleanup for hosted domains - #4 (MEDIUM-HIGH): Circular dependency resolution - #5 (MEDIUM): Race condition in startup cleanup - #1 (MEDIUM): Broken test interfaces - #3 (LOW): Retry logic documentation (verified) ## Changes ### 1. Fixed Hosted JID Domain Detection (#2 - HIGH) **File:** src/Utils/decode-wa-message.ts - Fixed domain detection logic to handle @hosted and @hosted.lid JIDs correctly - Previous logic would delete wrong sessions for hosted domains - Now properly maps: lid→lid, hosted.lid→hosted.lid, hosted→hosted, s.whatsapp.net→s.whatsapp.net ### 2. Resolved Circular Dependency (#4 - MEDIUM-HIGH) **Files:** Multiple - Created src/Types/SessionCleanup.ts to hold SessionCleanupConfig interface - Removed import of DEFAULT_SESSION_CLEANUP_CONFIG from decode-wa-message.ts - Added autoCleanCorrupted parameter to decryptMessageNode function - Propagated config through SocketConfig → messages-recv.ts → decryptMessageNode - Reduced circular dependencies from 18 to 15 (-16.7%) ### 3. Fixed Race Condition in Startup Cleanup (#5 - MEDIUM) **File:** src/Signal/session-cleanup.ts - Added startupCleanupPromise tracking variable - Scheduled cleanup now waits for startup cleanup to complete - Prevents simultaneous execution of cleanup operations ### 4. Fixed Test Interface Contracts (#1 - MEDIUM) **File:** src/__tests__/Signal/session-cleanup.test.ts - Added missing cleanupOnStartup and autoCleanCorrupted properties to all test configs - Fixed 15 TypeScript compilation errors in tests ### 5. Verified Retry Documentation (#3 - LOW) **File:** src/Utils/retry-utils.ts - Confirmed retry logic is already excellently documented - Includes backoff strategies, max delay caps, jitter, circuit breaker integration ## Impact - ✅ All 5 vulnerabilities resolved - ✅ TypeScript errors in modified files: 0 - ✅ Circular dependencies reduced: 18 → 15 - ✅ Type safety maintained throughout - ✅ Backward compatibility preserved - ✅ No new race conditions or memory leaks ## Testing - TypeScript compilation: ✅ All modified files compile cleanly - Circular dependency check: ✅ Reduced from 18 to 15 cycles - Interface contracts: ✅ All tests now type-check correctly https://claude.ai/code/session_01SoNUGBEWbJwWWws3F2fuzh
544 lines
14 KiB
TypeScript
544 lines
14 KiB
TypeScript
import { jest } from '@jest/globals'
|
|
import P from 'pino'
|
|
import { makeSessionCleanup } from '../../Signal/session-cleanup'
|
|
import type { SessionActivityTracker } from '../../Signal/session-activity-tracker'
|
|
import type { LIDMappingStore } from '../../Signal/lid-mapping'
|
|
import type { SignalKeyStoreWithTransaction } from '../../Types'
|
|
|
|
const mockKeys: jest.Mocked<SignalKeyStoreWithTransaction> = {
|
|
get: jest.fn<SignalKeyStoreWithTransaction['get']>() as any,
|
|
set: jest.fn<SignalKeyStoreWithTransaction['set']>(),
|
|
transaction: jest.fn<SignalKeyStoreWithTransaction['transaction']>(async (work: () => any) => await work()) as any,
|
|
isInTransaction: jest.fn<SignalKeyStoreWithTransaction['isInTransaction']>()
|
|
}
|
|
|
|
const mockLidMapping: jest.Mocked<Pick<LIDMappingStore, 'getPNForLID'>> = {
|
|
getPNForLID: jest.fn<LIDMappingStore['getPNForLID']>() as any
|
|
}
|
|
|
|
const mockActivityTracker: jest.Mocked<Pick<SessionActivityTracker, 'getAllActivities'>> = {
|
|
getAllActivities: jest.fn<SessionActivityTracker['getAllActivities']>() as any
|
|
}
|
|
|
|
const logger = P({ level: 'silent' })
|
|
|
|
describe('SessionCleanup', () => {
|
|
const HOUR_MS = 3600000
|
|
const DAY_MS = 86400000
|
|
|
|
beforeEach(() => {
|
|
jest.clearAllMocks()
|
|
})
|
|
|
|
describe('LID Orphan Cleanup (24h threshold)', () => {
|
|
const config = {
|
|
enabled: true,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 15,
|
|
primaryDeviceInactiveDays: 30,
|
|
lidOrphanHours: 24,
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
it('should delete LID orphan after 24h of inactivity', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (25 * HOUR_MS) // 25 hours ago
|
|
|
|
// Mock sessions: 1 LID orphan
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
// Mock: No PN mapping (orphan)
|
|
mockLidMapping.getPNForLID.mockResolvedValue(null)
|
|
|
|
// Mock: Activity 25h ago
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['123456789@lid', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.lidOrphansDeleted).toBe(1)
|
|
expect(stats.totalDeleted).toBe(1)
|
|
expect(mockKeys.set).toHaveBeenCalledWith({
|
|
session: { '123456789_2.0': null }
|
|
})
|
|
})
|
|
|
|
it('should NOT delete LID orphan before 24h', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (23 * HOUR_MS) // 23 hours ago
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
mockLidMapping.getPNForLID.mockResolvedValue(null)
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['123456789@lid', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.lidOrphansDeleted).toBe(0)
|
|
expect(stats.totalDeleted).toBe(0)
|
|
expect(mockKeys.set).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('should delete LID orphan with no activity tracking', async () => {
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
mockLidMapping.getPNForLID.mockResolvedValue(null)
|
|
|
|
// No activity tracked
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(new Map())
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.lidOrphansDeleted).toBe(1)
|
|
expect(stats.totalDeleted).toBe(1)
|
|
})
|
|
|
|
it('should NOT delete LID with valid PN mapping', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (25 * HOUR_MS)
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
// Has PN mapping - not orphan
|
|
mockLidMapping.getPNForLID.mockResolvedValue('5511999999999@s.whatsapp.net')
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['123456789@lid', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.lidOrphansDeleted).toBe(0)
|
|
expect(stats.totalDeleted).toBe(0)
|
|
})
|
|
})
|
|
|
|
describe('Secondary Device Cleanup (15 days threshold)', () => {
|
|
const config = {
|
|
enabled: true,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 15,
|
|
primaryDeviceInactiveDays: 30,
|
|
lidOrphanHours: 24,
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
it('should delete secondary device (Web/Desktop) after 15 days', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (16 * DAY_MS) // 16 days ago
|
|
|
|
// Mock: Secondary device (device ID = 1)
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'5511999999999_0.1': Buffer.from('session-data')
|
|
})
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['5511999999999:1@s.whatsapp.net', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.secondaryDevicesDeleted).toBe(1)
|
|
expect(stats.totalDeleted).toBe(1)
|
|
})
|
|
|
|
it('should NOT delete secondary device before 15 days', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (14 * DAY_MS) // 14 days ago
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'5511999999999_0.1': Buffer.from('session-data')
|
|
})
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['5511999999999:1@s.whatsapp.net', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.secondaryDevicesDeleted).toBe(0)
|
|
expect(stats.totalDeleted).toBe(0)
|
|
})
|
|
|
|
it('should NOT delete secondary device without activity tracking', async () => {
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'5511999999999_0.1': Buffer.from('session-data')
|
|
})
|
|
|
|
// No activity tracked - grace period
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(new Map())
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.secondaryDevicesDeleted).toBe(0)
|
|
expect(stats.totalDeleted).toBe(0)
|
|
})
|
|
})
|
|
|
|
describe('Primary Device Cleanup (30 days threshold)', () => {
|
|
const config = {
|
|
enabled: true,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 15,
|
|
primaryDeviceInactiveDays: 30,
|
|
lidOrphanHours: 24,
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
it('should delete primary device after 30 days', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (31 * DAY_MS) // 31 days ago
|
|
|
|
// Mock: Primary device (device ID = 0)
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'5511999999999_0.0': Buffer.from('session-data')
|
|
})
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['5511999999999@s.whatsapp.net', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.primaryDevicesDeleted).toBe(1)
|
|
expect(stats.totalDeleted).toBe(1)
|
|
})
|
|
|
|
it('should NOT delete primary device before 30 days', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (29 * DAY_MS) // 29 days ago
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'5511999999999_0.0': Buffer.from('session-data')
|
|
})
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['5511999999999@s.whatsapp.net', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.primaryDevicesDeleted).toBe(0)
|
|
expect(stats.totalDeleted).toBe(0)
|
|
})
|
|
})
|
|
|
|
describe('Boundary Conditions', () => {
|
|
const config = {
|
|
enabled: true,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 15,
|
|
primaryDeviceInactiveDays: 30,
|
|
lidOrphanHours: 24,
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
it('should handle exactly 24h for LID orphan (boundary)', async () => {
|
|
const now = Date.now()
|
|
const lastActivity = now - (24 * HOUR_MS) // Exactly 24h
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
mockLidMapping.getPNForLID.mockResolvedValue(null)
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([['123456789@lid', lastActivity]])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
// Exactly 24h should NOT delete (> threshold, not >=)
|
|
expect(stats.lidOrphansDeleted).toBe(0)
|
|
})
|
|
|
|
it('should handle empty session list', async () => {
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({})
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.totalScanned).toBe(0)
|
|
expect(stats.totalDeleted).toBe(0)
|
|
})
|
|
|
|
it('should handle null sessionActivityTracker gracefully', async () => {
|
|
const now = Date.now()
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
mockLidMapping.getPNForLID.mockResolvedValue(null)
|
|
|
|
// Pass null tracker
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
null,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
// Should still work, but with no activity data
|
|
expect(stats.totalScanned).toBe(1)
|
|
// LID orphan with no activity tracking gets deleted
|
|
expect(stats.lidOrphansDeleted).toBe(1)
|
|
})
|
|
})
|
|
|
|
describe('Mixed Scenarios', () => {
|
|
const config = {
|
|
enabled: true,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 15,
|
|
primaryDeviceInactiveDays: 30,
|
|
lidOrphanHours: 24,
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
it('should delete multiple sessions of different types', async () => {
|
|
const now = Date.now()
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('lid-orphan'),
|
|
'5511999999999_0.1': Buffer.from('secondary-inactive'),
|
|
'5511888888888_0.0': Buffer.from('primary-inactive'),
|
|
'5511777777777_0.0': Buffer.from('primary-active')
|
|
})
|
|
|
|
mockLidMapping.getPNForLID.mockImplementation(async (lid: string) => {
|
|
if (lid === '123456789@lid') return null // Orphan
|
|
return '5511999999999@s.whatsapp.net'
|
|
})
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([
|
|
['123456789@lid', now - (25 * HOUR_MS)], // LID orphan: 25h ago
|
|
['5511999999999:1@s.whatsapp.net', now - (16 * DAY_MS)], // Secondary: 16 days ago
|
|
['5511888888888@s.whatsapp.net', now - (31 * DAY_MS)], // Primary: 31 days ago
|
|
['5511777777777@s.whatsapp.net', now - (5 * DAY_MS)] // Primary: 5 days ago (active)
|
|
])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.totalScanned).toBe(4)
|
|
expect(stats.lidOrphansDeleted).toBe(1)
|
|
expect(stats.secondaryDevicesDeleted).toBe(1)
|
|
expect(stats.primaryDevicesDeleted).toBe(1)
|
|
expect(stats.totalDeleted).toBe(3)
|
|
})
|
|
})
|
|
|
|
describe('Configuration', () => {
|
|
it('should respect disabled cleanup', async () => {
|
|
const config = {
|
|
enabled: false,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 15,
|
|
primaryDeviceInactiveDays: 30,
|
|
lidOrphanHours: 24,
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('session-data')
|
|
})
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
config
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.totalScanned).toBe(0)
|
|
expect(mockKeys.get).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('should respect custom thresholds', async () => {
|
|
const customConfig = {
|
|
enabled: true,
|
|
intervalMs: 86400000,
|
|
cleanupHour: 3,
|
|
secondaryDeviceInactiveDays: 5, // Custom: 5 days
|
|
primaryDeviceInactiveDays: 10, // Custom: 10 days
|
|
lidOrphanHours: 12, // Custom: 12 hours
|
|
cleanupOnStartup: false,
|
|
autoCleanCorrupted: false
|
|
}
|
|
|
|
const now = Date.now()
|
|
|
|
// @ts-ignore
|
|
mockKeys.get.mockResolvedValue({
|
|
'123456789_2.0': Buffer.from('lid-orphan'),
|
|
'5511999999999_0.1': Buffer.from('secondary')
|
|
})
|
|
|
|
mockLidMapping.getPNForLID.mockResolvedValue(null)
|
|
|
|
mockActivityTracker.getAllActivities.mockResolvedValue(
|
|
new Map([
|
|
['123456789@lid', now - (13 * HOUR_MS)], // 13h ago
|
|
['5511999999999:1@s.whatsapp.net', now - (6 * DAY_MS)] // 6 days ago
|
|
])
|
|
)
|
|
|
|
const cleanup = makeSessionCleanup(
|
|
mockKeys,
|
|
mockLidMapping as any,
|
|
mockActivityTracker as any,
|
|
logger,
|
|
customConfig
|
|
)
|
|
|
|
const stats = await cleanup.runCleanup()
|
|
|
|
expect(stats.lidOrphansDeleted).toBe(1) // 13h > 12h threshold
|
|
expect(stats.secondaryDevicesDeleted).toBe(1) // 6d > 5d threshold
|
|
expect(stats.totalDeleted).toBe(2)
|
|
})
|
|
})
|
|
})
|