diff --git a/app/components/token/ApiUrlsCard.vue b/app/components/token/ApiUrlsCard.vue new file mode 100644 index 0000000..884173c --- /dev/null +++ b/app/components/token/ApiUrlsCard.vue @@ -0,0 +1,112 @@ + + + diff --git a/app/pages/token/[id].vue b/app/pages/token/[id].vue index 78e0b23..faf8e39 100644 --- a/app/pages/token/[id].vue +++ b/app/pages/token/[id].vue @@ -32,6 +32,7 @@
+ + contentType: string + contentLength: number + isBinary: boolean + body: string | null + clientIp: string + remoteIp: string + createdAt: string +} + +/** + * LLM-friendly API response + */ +interface LLMResponse { + token: { + id: string + friendlyId: string | null + createdAt: string + payloadUrl: string + } + requests: LLMRequest[] + total: number +} + +/** + * Convert Request to LLM-friendly format with body content + */ +const formatRequestForLLM = async (request: Request, db: ReturnType): Promise => { + let parsedHeaders: Record = {} + try { + parsedHeaders = JSON.parse(request.headers) + } catch { + parsedHeaders = {} + } + + let bodyContent: string | null = null + if (request.bodyPath && request.contentLength > 0) { + if (request.isBinary) { + bodyContent = '[Binary data not included]' + } else { + const bodyBuffer = await db.requests.getBody(request.sessionId, request.tokenId, request.id) + if (bodyBuffer) { + try { + bodyContent = new TextDecoder('utf-8').decode(bodyBuffer) + } catch { + bodyContent = '[Unable to decode body as text]' + } + } + } + } + + return { + id: request.id, + method: request.method, + url: request.url, + headers: parsedHeaders, + contentType: request.contentType, + contentLength: request.contentLength, + isBinary: request.isBinary, + body: bodyContent, + clientIp: request.clientIp, + remoteIp: request.remoteIp, + createdAt: request.createdAt.toISOString(), + } +} + +/** + * API endpoint for automation/LLM access to token requests + * + * URL: /api/view/{friendlyId}?secret={tokenUUID} + * + * - friendlyId: The 8-character short ID of the token + * - secret: Must be the full token UUID (token.id) for authentication + * + * Returns LLM-friendly JSON with all requests and their bodies + */ +export default defineEventHandler(async (event: H3Event) => { + const method = event.node.req.method?.toUpperCase() || 'GET' + + if ('GET' !== method) { + throw createError({ statusCode: 405, message: 'Method not allowed' }) + } + + type EventContextParams = { params?: Record } + const ctx = (event.context as unknown as EventContextParams) || {} + const params = ctx.params || {} + const shortId = params.shortId + + if (!shortId) { + throw createError({ statusCode: 400, message: 'Short ID is required' }) + } + + const query = getQuery(event) + const secret = query.secret as string | undefined + + if (!secret) { + throw createError({ statusCode: 401, message: 'Secret parameter is required' }) + } + + // Secret must be a valid UUID + if (!isUUID(secret)) { + throw createError({ statusCode: 401, message: 'Invalid secret format' }) + } + + const db = useDatabase() + + // Only accept friendlyId (short ID) in the URL path + const token = await db.tokens.getByFriendlyId(shortId) + if (!token) { + throw createError({ statusCode: 404, message: 'Token not found' }) + } + + // Verify that the secret matches the token ID + if (token.id !== secret) { + throw createError({ statusCode: 403, message: 'Invalid secret' }) + } + + // Fetch all requests for this token + const requests = await db.requests.list(token.sessionId, token.id) + + // Format requests for LLM consumption + const formattedRequests: LLMRequest[] = [] + for (const request of requests) { + const formatted = await formatRequestForLLM(request, db) + formattedRequests.push(formatted) + } + + // Build payload URL for webhook ingestion + // Try to get from request headers, fallback to config or localhost + const host = event.node.req.headers.host || 'localhost:3000' + const protocol = event.node.req.headers['x-forwarded-proto'] || 'http' + const baseUrl = `${protocol}://${host}` + const payloadUrl = `${baseUrl}/api/payload/${token.friendlyId || token.id}` + + const response: LLMResponse = { + token: { + id: token.id, + friendlyId: token.friendlyId, + createdAt: token.createdAt.toISOString(), + payloadUrl, + }, + requests: formattedRequests, + total: formattedRequests.length, + } + + return response +}) diff --git a/test/integration/view-api.spec.ts b/test/integration/view-api.spec.ts new file mode 100644 index 0000000..f7c733d --- /dev/null +++ b/test/integration/view-api.spec.ts @@ -0,0 +1,357 @@ +import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest' +import createH3Event from '../utils/createH3Event' +import type { H3Event } from 'h3' +import type { Token, Request } from '../../shared/types' + +// Mock getQuery from h3 to parse URL query strings +vi.mock('h3', async () => { + const actual = await vi.importActual('h3') + return { + ...actual, + getQuery: vi.fn((event: H3Event) => { + const url = event.node.req.url || '' + const queryString = url.split('?')[1] || '' + const params: Record = {} + if (queryString) { + const pairs = queryString.split('&') + for (const pair of pairs) { + const [key, value] = pair.split('=') + if (key) { + params[key] = decodeURIComponent(value || '') + } + } + } + return params + }), + } +}) + +// Mock data +const mockToken: Token = { + id: '550e8400-e29b-41d4-a716-446655440000', + friendlyId: 'abc123xy', + sessionId: '650e8400-e29b-41d4-a716-446655440001', + createdAt: new Date('2024-01-01'), + responseEnabled: false, + responseStatus: 200, + responseHeaders: null, + responseBody: null, +} + +const mockRequests: Request[] = [ + { + id: '750e8400-e29b-41d4-a716-446655440002', + tokenId: '550e8400-e29b-41d4-a716-446655440000', + sessionId: '650e8400-e29b-41d4-a716-446655440001', + method: 'POST', + url: 'https://example.com/test', + headers: JSON.stringify({ 'Content-Type': 'application/json', 'User-Agent': 'test' }), + contentType: 'application/json', + contentLength: 15, + isBinary: false, + clientIp: '127.0.0.1', + remoteIp: '127.0.0.1', + bodyPath: 'session-123/token-uuid-123/req-1', + createdAt: new Date('2024-01-01T10:00:00Z'), + }, + { + id: '850e8400-e29b-41d4-a716-446655440003', + tokenId: '550e8400-e29b-41d4-a716-446655440000', + sessionId: '650e8400-e29b-41d4-a716-446655440001', + method: 'POST', + url: 'https://example.com/image', + headers: JSON.stringify({ 'Content-Type': 'image/png' }), + contentType: 'image/png', + contentLength: 6, + isBinary: true, + clientIp: '127.0.0.1', + remoteIp: '127.0.0.1', + bodyPath: 'session-123/token-uuid-123/req-2', + createdAt: new Date('2024-01-01T11:00:00Z'), + }, +] + +// Mock database operations +const mockGetByFriendlyId = vi.fn(async (friendlyId: string): Promise => { + if (friendlyId === mockToken.friendlyId) { + return mockToken + } + return null +}) + +const mockGetSessionId = vi.fn(async (tokenId: string): Promise => { + if (tokenId === mockToken.id) { + return mockToken.sessionId + } + return null +}) + +const mockGetToken = vi.fn(async (sessionId: string, tokenId: string): Promise => { + if (sessionId === mockToken.sessionId && tokenId === mockToken.id) { + return mockToken + } + return null +}) + +const mockListRequests = vi.fn(async (_sessionId: string, _tokenId: string): Promise => { + return mockRequests +}) + +const mockGetBody = vi.fn(async (sessionId: string, tokenId: string, requestId: string): Promise => { + if (requestId === '750e8400-e29b-41d4-a716-446655440002') { + return new TextEncoder().encode('{"test":"data"}') + } + if (requestId === '850e8400-e29b-41d4-a716-446655440003') { + return new Uint8Array([0x89, 0x50, 0x4E, 0x47]) + } + return null +}) + +vi.mock('~~/server/lib/db', () => ({ + useDatabase: () => ({ + tokens: { + getByFriendlyId: mockGetByFriendlyId, + getSessionId: mockGetSessionId, + get: mockGetToken, + }, + requests: { + list: mockListRequests, + getBody: mockGetBody, + }, + }), +})) + +// Helper to create test event with proper headers +const createTestEvent = (overrides: Parameters[0]) => { + return createH3Event({ + ...overrides, + node: { + ...overrides?.node, + req: { + ...overrides?.node?.req, + headers: { + host: 'localhost:3000', + ...overrides?.node?.req?.headers, + }, + }, + }, + }) +} + +describe('GET /api/view/[shortId]', () => { + let handler: (event: H3Event) => Promise + + beforeEach(async () => { + vi.clearAllMocks() + handler = (await import('../../server/api/view/[shortId]')).default + }) + + afterEach(() => { + vi.clearAllMocks() + }) + + describe('Authentication', () => { + it('should require secret parameter', async () => { + const url = `/api/view/${mockToken.friendlyId}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + await expect(handler(event)).rejects.toThrow('Secret parameter is required') + }) + + it('should reject invalid secret format', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=invalid` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + await expect(handler(event)).rejects.toThrow('Invalid secret format') + }) + + it('should reject wrong secret (UUID mismatch)', async () => { + const wrongSecret = '00000000-0000-0000-0000-000000000000' + const url = `/api/view/${mockToken.friendlyId}?secret=${wrongSecret}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + await expect(handler(event)).rejects.toThrow('Invalid secret') + }) + + it('should accept correct secret', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + const result = await handler(event) + expect(result).toBeDefined() + }) + }) + + describe('Token lookup', () => { + it('should work with friendlyId', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + const result = await handler(event) as { token: { id: string; friendlyId: string | null } } + expect(result.token.id).toBe(mockToken.id) + expect(result.token.friendlyId).toBe(mockToken.friendlyId) + expect(mockGetByFriendlyId).toHaveBeenCalledWith(mockToken.friendlyId) + }) + + it('should return 404 for non-existent token', async () => { + const url = `/api/view/notfound?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: 'notfound' } }, + node: { req: { url } }, + }) + + await expect(handler(event)).rejects.toThrow('Token not found') + }) + }) + + describe('Response format', () => { + it('should return LLM-friendly JSON structure', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + const result = await handler(event) as { + token: { id: string; friendlyId: string | null; createdAt: string; payloadUrl: string } + requests: unknown[] + total: number + } + + // Check top-level structure + expect(result).toHaveProperty('token') + expect(result).toHaveProperty('requests') + expect(result).toHaveProperty('total') + + // Check token structure + expect(result.token).toHaveProperty('id') + expect(result.token).toHaveProperty('friendlyId') + expect(result.token).toHaveProperty('createdAt') + expect(result.token).toHaveProperty('payloadUrl') + expect(typeof result.token.createdAt).toBe('string') + expect(typeof result.token.payloadUrl).toBe('string') + expect(result.token.payloadUrl).toContain('/api/payload/') + + // Check requests is array + expect(Array.isArray(result.requests)).toBe(true) + expect(result.total).toBe(result.requests.length) + }) + }) + + describe('Request data', () => { + it('should include request details', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + const result = await handler(event) as { requests: Array<{ + id: string + method: string + url: string + headers: Record + contentType: string + contentLength: number + isBinary: boolean + body: string | null + clientIp: string + remoteIp: string + createdAt: string + }> } + + expect(result.requests.length).toBeGreaterThan(0) + + const request = result.requests[0] + expect(request).toHaveProperty('id') + expect(request).toHaveProperty('method') + expect(request).toHaveProperty('url') + expect(request).toHaveProperty('headers') + expect(request).toHaveProperty('contentType') + expect(request).toHaveProperty('contentLength') + expect(request).toHaveProperty('isBinary') + expect(request).toHaveProperty('body') + expect(request).toHaveProperty('clientIp') + expect(request).toHaveProperty('remoteIp') + expect(request).toHaveProperty('createdAt') + + expect(typeof request.headers).toBe('object') + expect(typeof request.createdAt).toBe('string') + }) + + it('should include text body content', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + const result = await handler(event) as { requests: Array<{ contentType: string; body: string }> } + + const textRequest = result.requests.find(r => r.contentType === 'application/json') + + expect(textRequest).toBeDefined() + expect(textRequest?.body).toContain('test') + expect(textRequest?.body).toContain('data') + }) + + it('should mark binary content appropriately', async () => { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url } }, + }) + + const result = await handler(event) as { requests: Array<{ contentType: string; isBinary: boolean; body: string }> } + + const binaryRequest = result.requests.find(r => r.contentType === 'image/png') + + expect(binaryRequest).toBeDefined() + expect(binaryRequest?.isBinary).toBe(true) + expect(binaryRequest?.body).toBe('[Binary data not included]') + }) + }) + + describe('Method restrictions', () => { + it('should only accept GET requests', async () => { + const methods = ['POST', 'PUT', 'PATCH', 'DELETE'] + + for (const method of methods) { + const url = `/api/view/${mockToken.friendlyId}?secret=${mockToken.id}` + + const event = createTestEvent({ + context: { params: { shortId: mockToken.friendlyId } }, + node: { req: { url, method } }, + }) + + await expect(handler(event)).rejects.toThrow('Method not allowed') + } + }) + }) +}) +