test(protect): port engine unit suite + restructure tests/protect/ (#58)

* feat(protect): rule-driven Tier-3 — response-leak redaction + egress SSRF; array params

Brings the output-side protection into the vendored runtime, as RULES (nothing hardcoded),
via rule phases:
- new rule properties: `phase` (request|response|egress, default request) + `category`
- engine: resolve `response.status|body|header.*` and `egress.url|host|method`; new
  `internal_host` match type (private/loopback/link-local/metadata ranges)
- runtime (createProtection): response phase screens the outgoing body; egress phase
  (opt-in `egress:true`) wraps global fetch to screen outbound calls. Driven by default
  bundles in defaults.js (overridable via responseRules/egressRules).

Response leak handling supports per-rule `action`:
- `redact` (default for the secret rules) — mask only the offending span(s) and still
  serve the page; a legit response that leaks one key gets that key masked, not withheld
- `block` — withhold the whole response

Also fixes a real engine bug: array `parameter` (["get.a","post.b"]) — used pervasively in
rule_v2 — silently never matched (`parameter.indexOf('.')` on an array returns -1).
#evaluateCondition now resolves each element and ORs them.

Enforcement only in block mode; dry-run observes + serves original. Fail-open throughout.
createSupabaseGuard / createServerFnGuard unchanged. Full suite: 151 pass; build + typecheck green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(protect): port the engine unit suite + restructure tests/protect/

When the node-waf engine was vendored into src/protect/engine/, its ~180 unit tests did
NOT come along — connect only had the runtime integration test, leaving matchValue /
resolver / normalizer / mutations / adapters with no direct coverage.

Ports the engine suite from the upstream engine (adapted to vitest) and groups all
protect tests under tests/protect/:
- engine.test.ts (54)  — match types incl. internal_host, evaluate, inclusive/OR,
  whitelist, nested rules, ctype value-inversion, array parameters, fail-open, safeRegExp
- request.test.ts (38) — resolver: get/post/request/cookie/server/files/raw/all +
  response.*/egress.* + wildcards + mutations
- normalizer.test.ts (63) — normalize pipeline + _rawBody prototype-pollution serialization
- fetch.test.ts (6) / node.test.ts (5) — the fetch + node request adapters
- middleware.test.ts (16) — the Express middleware + rule client (mocked fetch)
- runtime.test.ts (11) — createProtection integration (moved from tests/protect.test.ts):
  request/response-redact/response-block/egress, dry-run/block, Supabase + server-fn guards

Full suite 333 pass; typecheck + build green. Engine source unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(protect): deep Tier-3 coverage (response, egress, options, invalid rules)

The ported suite covered the engine well but the Tier-3 protect-layer features only had
happy-path coverage. Adds tests/protect/tier3.test.ts (17):

- response redaction: every default secret type; multiple spans in one body; maskWith
  (string + per-category fn); contains-literal redaction; redact-with-no-maskable-pattern
  falls back to withholding; response.header.* rules
- response gating/robustness: non-text content-type skipped; oversized (content-length)
  skipped; malformed rule (no rule_v2 array) skipped; invalid regex never matches / no crash
- egress: every internal range blocked via the guard (127/10/192.168/172.16/localhost/::1/
  metadata) + external allowed; allowHosts exemption; onEgressBlock payload; uninstallEgress
  restores global fetch
- options/phases: default dry-run; responseRules replaces defaults; rules split by phase
  (a phase:response rule screens responses, NOT requests)

protect coverage 193 → 210; full suite 350 pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(protect): runtime node()/express() guards, token+cache path, egressRules override

- runtime .node() (body buffering + block/allow) and .express() guards
- rule source: token path caches the fetched bundle, then falls back to last-known-good
  when the API fails; no-token/no-cache → empty request ruleset (allows)
- egressRules override replaces the default SSRF rule

Notes a pre-existing gap: runtime.node() consumes the body to screen it but doesn't
re-expose req.body downstream (follow-up on the feature branch). Full suite 355 pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: patchstackdave

tests/protect/engine.test.ts

@@ -0,0 +1,98 @@
+import { describe, it } from 'vitest';
+import assert from 'node:assert';
+import { createFetchMiddleware, wrapFetchHandler, fromFetchRequest } from '../../src/protect/engine/fetch.js';
+
+const rules = {
+  firewall: [
+    {
+      id: 1,
+      title: 'block path traversal',
+      rule_v2: [
+        {
+          parameter: 'get.file',
+          mutations: ['urldecode'],
+          match: { type: 'contains', value: '..' }
+        }
+      ]
+    }
+  ],
+  whitelists: [],
+  whitelist_keys: {}
+};
+
+describe('fetch adapter', () => {
+  it('fromFetchRequest parses query (repeats), headers, JSON body, ip, and verbatim _rawBody', async () => {
+    const req = await fromFetchRequest(
+      new Request('https://app.dev/api?q=1&q=2', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', 'x-forwarded-for': '1.2.3.4, 5.6.7.8' },
+        body: JSON.stringify({ a: 1 })
+      })
+    );
+    assert.deepStrictEqual(req.query.q, ['1', '2']);
+    assert.strictEqual(req.body.a, 1);
+    assert.strictEqual(req.ip, '1.2.3.4');
+    assert.strictEqual(req.headers['content-type'], 'application/json');
+    assert.strictEqual(req._rawBody, JSON.stringify({ a: 1 }));
+    assert.strictEqual(req.originalUrl, '/api?q=1&q=2');
+  });
+
+  it('guard blocks a malicious request with a 403 Response', async () => {
+    const guard = createFetchMiddleware(rules);
+    const res = await guard(new Request('https://app.dev/read?file=..%2f..%2fetc%2fpasswd'));
+    assert.ok(res instanceof Response);
+    assert.strictEqual(res.status, 403);
+    const body = await res.json();
+    assert.strictEqual(body.error, 'Blocked by Patchstack WAF');
+  });
+
+  it('guard returns null (allow) for a benign request', async () => {
+    const guard = createFetchMiddleware(rules);
+    const res = await guard(new Request('https://app.dev/read?file=notes.txt'));
+    assert.strictEqual(res, null);
+  });
+
+  it('wrapFetchHandler calls through on allow and short-circuits on block', async () => {
+    const handler = async () => new Response('ok', { status: 200 });
+    const wrapped = wrapFetchHandler(handler, rules);
+
+    const allowed = await wrapped(new Request('https://app.dev/read?file=ok.txt'));
+    assert.strictEqual(allowed.status, 200);
+    assert.strictEqual(await allowed.text(), 'ok');
+
+    const blocked = await wrapped(new Request('https://app.dev/read?file=../secret'));
+    assert.strictEqual(blocked.status, 403);
+  });
+
+  it('matches a __proto__ prototype-pollution payload via verbatim `raw` body', async () => {
+    const ppRules = {
+      firewall: [
+        {
+          id: 2,
+          title: 'prototype pollution',
+          rule_v2: [{ parameter: 'raw', match: { type: 'contains', value: '__proto__' } }]
+        }
+      ],
+      whitelists: [],
+      whitelist_keys: {}
+    };
+    const guard = createFetchMiddleware(ppRules);
+    const res = await guard(
+      new Request('https://app.dev/settings', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: '{"__proto__":{"polluted":"yes"}}'
+      })
+    );
+    assert.strictEqual(res?.status, 403, '__proto__ in the verbatim body should be caught');
+  });
+
+  it('fails open when a rule throws (never blocks on engine error)', async () => {
+    const badEngine = { evaluate() { throw new Error('boom'); } };
+    let captured = null;
+    const guard = createFetchMiddleware(badEngine, { onError: (e) => (captured = e) });
+    const res = await guard(new Request('https://app.dev/x'));
+    assert.strictEqual(res, null);
+    assert.ok(captured instanceof Error);
+  });
+});

tests/protect/fetch.test.ts

@@ -0,0 +1,114 @@
+{
+  "firewall": [
+    {
+      "id": 101,
+      "title": "Block SQL Injection in search",
+      "rule_v2": [
+        {
+          "parameter": "get.search",
+          "match": { "type": "regex", "value": "/union\\s+select/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 102,
+      "title": "Block XSS in comment field",
+      "rule_v2": [
+        {
+          "parameter": "post.comment",
+          "match": { "type": "regex", "value": "/<script[^>]*>/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 103,
+      "title": "Block admin action exploitation",
+      "rule_v2": [
+        {
+          "parameter": "post.action",
+          "match": { "type": "equals", "value": "delete_all_users" },
+          "inclusive": true
+        },
+        {
+          "parameter": "server.REQUEST_METHOD",
+          "match": { "type": "equals", "value": "POST" },
+          "inclusive": true
+        }
+      ]
+    },
+    {
+      "id": 104,
+      "title": "Block path traversal",
+      "rule_v2": [
+        {
+          "parameter": "server.REQUEST_URI",
+          "match": { "type": "regex", "value": "/\\.\\.[\\/\\\\]/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 105,
+      "title": "Block prototype pollution",
+      "rule_v2": [
+        {
+          "parameter": "raw",
+          "match": { "type": "contains", "value": "__proto__" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 106,
+      "title": "Block SSRF to internal IPs",
+      "rule_v2": [
+        {
+          "parameter": "post.url",
+          "match": { "type": "regex", "value": "/(localhost|127\\.0\\.0\\.1|0\\.0\\.0\\.0|::1|10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.)/i" },
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 107,
+      "title": "Block base64-encoded payloads",
+      "rule_v2": [
+        {
+          "parameter": "post.data",
+          "match": { "type": "contains", "value": "<script>" },
+          "mutations": ["base64_decode"],
+          "inclusive": false
+        }
+      ]
+    },
+    {
+      "id": 108,
+      "title": "Block user agent bot",
+      "rule_v2": [
+        {
+          "parameter": "server.HTTP_USER_AGENT",
+          "match": { "type": "contains", "value": "sqlmap" },
+          "inclusive": false
+        }
+      ]
+    }
+  ],
+  "whitelists": [
+    {
+      "rule_id": 101,
+      "rule_v2": [
+        {
+          "parameter": "server.REMOTE_ADDR",
+          "match": { "type": "equals", "value": "10.0.0.1" },
+          "inclusive": false
+        }
+      ]
+    }
+  ],
+  "whitelist_keys": {
+    "POST": ["_token", "csrf"],
+    "GET": ["page", "limit"]
+  }
+}