Merge pull request #4874 from Infisical/dynamic-import-nock

Move nock to dev deps and include the route only for dev/test builds

backend/src/lib/config/env.ts

@@ -400,7 +400,7 @@ const envSchema = z
     isAcmeDevelopmentMode: data.NODE_ENV === "development" && data.ACME_DEVELOPMENT_MODE,
     isProductionMode: data.NODE_ENV === "production" || IS_PACKAGED,
     isRedisSentinelMode: Boolean(data.REDIS_SENTINEL_HOSTS),
-    isBddNockApiEnabled: data.NODE_ENV === "development" && data.BDD_NOCK_API_ENABLED,
+    isBddNockApiEnabled: data.NODE_ENV !== "production" && data.BDD_NOCK_API_ENABLED,
     REDIS_SENTINEL_HOSTS: data.REDIS_SENTINEL_HOSTS?.trim()
       ?.split(",")
       .map((el) => {

backend/src/server/routes/bdd/bdd-nock-router.dev.ts

@@ -0,0 +1,104 @@
+import type { Definition } from "nock";
+import { z } from "zod";
+
+import { getConfig } from "@app/lib/config/env";
+import { ForbiddenRequestError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+// When running in production, we don't want to even import nock, because it's not needed and it increases memory usage a lots.
+// It once caused an outage in the production environment.
+// This is why we would rather to crash the app if it's not in development mode (in that case, Kubernetes should stop it from rolling out).
+if (process.env.NODE_ENV === "production") {
+  throw new Error("BDD Nock API can only be enabled in development or test mode");
+}
+
+export const registerBddNockRouter = async (server: FastifyZodProvider) => {
+  const appCfg = getConfig();
+  const importNock = async () => {
+    // eslint-disable-next-line import/no-extraneous-dependencies
+    const { default: nock } = await import("nock");
+    return nock;
+  };
+
+  const checkIfBddNockApiEnabled = () => {
+    // Note: Please note that this API is only available in development mode and only for BDD tests.
+    // This endpoint should NEVER BE ENABLED IN PRODUCTION!
+    if (appCfg.NODE_ENV === "production" || !appCfg.isBddNockApiEnabled) {
+      throw new ForbiddenRequestError({ message: "BDD Nock API is not enabled" });
+    }
+  };
+
+  server.route({
+    method: "POST",
+    url: "/define",
+    schema: {
+      body: z.object({ definitions: z.unknown().array() }),
+      response: {
+        200: z.object({ status: z.string() })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      checkIfBddNockApiEnabled();
+      const { body } = req;
+      const { definitions } = body;
+      logger.info(definitions, "Defining nock");
+      const processedDefinitions = definitions.map((definition: unknown) => {
+        const { path, ...rest } = definition as Definition;
+        return {
+          ...rest,
+          path:
+            path !== undefined && typeof path === "string"
+              ? path
+              : new RegExp((path as unknown as { regex: string }).regex ?? "")
+        } as Definition;
+      });
+
+      const nock = await importNock();
+      nock.define(processedDefinitions);
+      // Ensure we are activating the nocks, because we could have called `nock.restore()` before this call.
+      if (!nock.isActive()) {
+        nock.activate();
+      }
+      return { status: "ok" };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/clean-all",
+    schema: {
+      response: {
+        200: z.object({ status: z.string() })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async () => {
+      checkIfBddNockApiEnabled();
+      logger.info("Cleaning all nocks");
+      const nock = await importNock();
+      nock.cleanAll();
+      return { status: "ok" };
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/restore",
+    schema: {
+      response: {
+        200: z.object({ status: z.string() })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async () => {
+      checkIfBddNockApiEnabled();
+      logger.info("Restore network requests from nock");
+      const nock = await importNock();
+      nock.restore();
+      return { status: "ok" };
+    }
+  });
+};

backend/src/server/routes/bdd/bdd-nock-router.ts

@@ -0,0 +1,6 @@
+export const registerBddNockRouter = async () => {
+  // This route is only available in development or test mode.
+  // The actual implementation is in the dev.ts file and will be aliased to that file in development or test mode.
+  // And if somehow we try to enable it in production, we will throw an error.
+  throw new Error("BDD Nock should not be enabled in production");
+};

backend/src/server/routes/index.ts

@@ -1,3 +1,4 @@
+import { registerBddNockRouter } from "@bdd_routes/bdd-nock-router";
 import { CronJob } from "cron";
 import { Knex } from "knex";
 import { monitorEventLoopDelay } from "perf_hooks";
@@ -2698,6 +2699,12 @@ export const registerRoutes = async (
   await server.register(registerV3Routes, { prefix: "/api/v3" });
   await server.register(registerV4Routes, { prefix: "/api/v4" });
 
+  // Note: This is a special route for BDD tests. It's only available in development mode and only for BDD tests.
+  // This route should NEVER BE ENABLED IN PRODUCTION!
+  if (getConfig().isBddNockApiEnabled) {
+    await server.register(registerBddNockRouter, { prefix: "/api/__bdd_nock__" });
+  }
+
   server.addHook("onClose", async () => {
     cronJobs.forEach((job) => job.stop());
     await telemetryService.flushAll();

backend/src/server/routes/v1/bdd-nock-router.ts

@@ -1,87 +0,0 @@
-// import { z } from "zod";
-
-// import { getConfig } from "@app/lib/config/env";
-// import { ForbiddenRequestError } from "@app/lib/errors";
-// import { logger } from "@app/lib/logger";
-// import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-// import { AuthMode } from "@app/services/auth/auth-type";
-
-// export const registerBddNockRouter = async (server: FastifyZodProvider) => {
-//   const checkIfBddNockApiEnabled = () => {
-//     const appCfg = getConfig();
-//     // Note: Please note that this API is only available in development mode and only for BDD tests.
-//     // This endpoint should NEVER BE ENABLED IN PRODUCTION!
-//     if (appCfg.NODE_ENV !== "development" || !appCfg.isBddNockApiEnabled) {
-//       throw new ForbiddenRequestError({ message: "BDD Nock API is not enabled" });
-//     }
-//   };
-
-//   server.route({
-//     method: "POST",
-//     url: "/define",
-//     schema: {
-//       body: z.object({ definitions: z.unknown().array() }),
-//       response: {
-//         200: z.object({ status: z.string() })
-//       }
-//     },
-//     onRequest: verifyAuth([AuthMode.JWT]),
-//     handler: async (req) => {
-//       checkIfBddNockApiEnabled();
-//       const { body } = req;
-//       const { definitions } = body;
-//       logger.info(definitions, "Defining nock");
-//       const processedDefinitions = definitions.map((definition: unknown) => {
-//         const { path, ...rest } = definition as Definition;
-//         return {
-//           ...rest,
-//           path:
-//             path !== undefined && typeof path === "string"
-//               ? path
-//               : new RegExp((path as unknown as { regex: string }).regex ?? "")
-//         } as Definition;
-//       });
-
-//       nock.define(processedDefinitions);
-//       // Ensure we are activating the nocks, because we could have called `nock.restore()` before this call.
-//       if (!nock.isActive()) {
-//         nock.activate();
-//       }
-//       return { status: "ok" };
-//     }
-//   });
-
-//   server.route({
-//     method: "POST",
-//     url: "/clean-all",
-//     schema: {
-//       response: {
-//         200: z.object({ status: z.string() })
-//       }
-//     },
-//     onRequest: verifyAuth([AuthMode.JWT]),
-//     handler: async () => {
-//       checkIfBddNockApiEnabled();
-//       logger.info("Cleaning all nocks");
-//       nock.cleanAll();
-//       return { status: "ok" };
-//     }
-//   });
-
-//   server.route({
-//     method: "POST",
-//     url: "/restore",
-//     schema: {
-//       response: {
-//         200: z.object({ status: z.string() })
-//       }
-//     },
-//     onRequest: verifyAuth([AuthMode.JWT]),
-//     handler: async () => {
-//       checkIfBddNockApiEnabled();
-//       logger.info("Restore network requests from nock");
-//       nock.restore();
-//       return { status: "ok" };
-//     }
-//   });
-// };

backend/src/server/routes/v1/index.ts

@@ -8,7 +8,6 @@ import { registerSecretSyncRouter, SECRET_SYNC_REGISTER_ROUTER_MAP } from "@app/
 
 import { registerAdminRouter } from "./admin-router";
 import { registerAuthRoutes } from "./auth-router";
-// import { registerBddNockRouter } from "./bdd-nock-router";
 import { registerProjectBotRouter } from "./bot-router";
 import { registerCaRouter } from "./certificate-authority-router";
 import { CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP } from "./certificate-authority-routers";
@@ -238,10 +237,4 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
 
   await server.register(registerEventRouter, { prefix: "/events" });
   await server.register(registerUpgradePathRouter, { prefix: "/upgrade-path" });
-
-  // Note: This is a special route for BDD tests. It's only available in development mode and only for BDD tests.
-  // This route should NEVER BE ENABLED IN PRODUCTION!
-  // if (getConfig().isBddNockApiEnabled) {
-  //   await server.register(registerBddNockRouter, { prefix: "/bdd-nock" });
-  // }
 };

backend/src/services/certificate-profile/certificate-profile-service.test.ts

@@ -428,7 +428,13 @@ describe("CertificateProfileService", () => {
         service.createProfile({
           ...mockActor,
           projectId: "project-123",
-          data: validProfileData
+          data: {
+            ...validProfileData,
+            enrollmentType: EnrollmentType.ACME,
+            acmeConfig: {},
+            apiConfig: undefined,
+            estConfig: undefined
+          }
         })
       ).rejects.toThrowError(
         new BadRequestError({