@oneuptime/common 10.8.2 → 11.0.1

package/Tests/Server/Types/Database/Permissions/BasePermission.test.ts

@@ -0,0 +1,118 @@
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import AccessControlPermission from "../../../../../Server/Types/Database/Permissions/AccessControlPermission";
+import BasePermission from "../../../../../Server/Types/Database/Permissions/BasePermission";
+import OwnedScopePermission from "../../../../../Server/Types/Database/Permissions/OwnedScopePermission";
+import PublicPermission from "../../../../../Server/Types/Database/Permissions/PublicPermission";
+import QueryPermission from "../../../../../Server/Types/Database/Permissions/QueryPermission";
+import TablePermission from "../../../../../Server/Types/Database/Permissions/TablePermission";
+import TenantPermission from "../../../../../Server/Types/Database/Permissions/TenantPermission";
+import UserPermissions from "../../../../../Server/Types/Database/Permissions/UserPermission";
+import IncidentInternalNote from "../../../../../Models/DatabaseModels/IncidentInternalNote";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../../../Types/ObjectID";
+
+/*
+ * Exercises the @CanAccessIfCanReadOn handling in
+ * BasePermission.checkPermissions: the access-control relation query it
+ * builds (e.g. `incident: { labels: [...] }`) must merge with — not
+ * overwrite — a caller-supplied filter on the same relation key.
+ */
+describe("BasePermission canAccessIfCanReadOn relation query", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const permittedLabel: ObjectID = ObjectID.generate();
+
+  function makeProps(): DatabaseCommonInteractionProps {
+    return {
+      userId,
+      tenantId: projectId,
+      userTenantAccessPermission: {},
+    };
+  }
+
+  beforeEach(() => {
+    jest
+      .spyOn(PublicPermission, "checkIfUserIsLoggedIn")
+      .mockImplementation(() => {});
+    jest
+      .spyOn(TenantPermission, "addTenantScopeToQuery")
+      .mockImplementation(async (_modelType: any, query: any) => {
+        return query;
+      });
+    jest
+      .spyOn(UserPermissions, "addUserScopeToQuery")
+      .mockImplementation(async (_modelType: any, query: any) => {
+        return query;
+      });
+    jest
+      .spyOn(TablePermission, "checkTableLevelPermissions")
+      .mockImplementation(() => {});
+    jest
+      .spyOn(QueryPermission, "checkQueryPermission")
+      .mockImplementation(() => {});
+    jest
+      .spyOn(AccessControlPermission, "addAccessControlIdsToQuery")
+      .mockImplementation(async (_modelType: any, query: any) => {
+        return query;
+      });
+    jest
+      .spyOn(OwnedScopePermission, "addOwnedScopeToQuery")
+      .mockImplementation(async (_modelType: any, query: any) => {
+        return query;
+      });
+    // Permitted labels resolved for the related model (Incident).
+    jest
+      .spyOn(AccessControlPermission, "getAccessControlIdsForQuery")
+      .mockReturnValue([permittedLabel]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  async function checkPermissions(query: any): Promise<any> {
+    const result: { query: any } = await BasePermission.checkPermissions(
+      IncidentInternalNote,
+      query,
+      null,
+      makeProps(),
+      DatabaseRequestType.Read,
+    );
+    return result.query;
+  }
+
+  it("merges the access-control query with an existing relation object filter", async () => {
+    const query: any = await checkPermissions({
+      incident: { projectId: projectId },
+    });
+
+    /*
+     * Regression: the access-control relation query used to overwrite the
+     * caller's relation filter entirely.
+     */
+    expect(query.incident).toEqual({
+      projectId: projectId,
+      labels: [permittedLabel],
+    });
+  });
+
+  it("folds a scalar relation filter into the relation _id", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    const query: any = await checkPermissions({
+      incident: incidentId,
+    });
+
+    expect(query.incident).toEqual({
+      _id: incidentId.toString(),
+      labels: [permittedLabel],
+    });
+  });
+
+  it("applies only the access-control query when there is no relation filter", async () => {
+    const query: any = await checkPermissions({ projectId });
+
+    expect(query.incident).toEqual({
+      labels: [permittedLabel],
+    });
+  });
+});

package/Tests/Server/Types/Database/Permissions/OwnedScopePermission.test.ts

@@ -0,0 +1,159 @@
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import OwnedScopePermission from "../../../../../Server/Types/Database/Permissions/OwnedScopePermission";
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import IncidentInternalNote from "../../../../../Models/DatabaseModels/IncidentInternalNote";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import PermissionScope from "../../../../../Types/Database/AccessControl/PermissionScope";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+import { FindOperator } from "typeorm";
+
+describe("OwnedScopePermission.addOwnedScopeToQuery", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const ownedIdA: ObjectID = ObjectID.generate();
+  const ownedIdB: ObjectID = ObjectID.generate();
+
+  function makeOwnedScopedMemberProps(): DatabaseCommonInteractionProps {
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions: [
+        {
+          _type: "UserPermission",
+          permission: Permission.ProjectMember,
+          labelIds: [],
+          isBlockPermission: false,
+          scope: PermissionScope.Owned,
+        },
+      ],
+    };
+
+    return {
+      userId,
+      tenantId: projectId,
+      userTenantAccessPermission: {
+        [projectId.toString()]: tenantPermission,
+      },
+    };
+  }
+
+  beforeEach(() => {
+    jest
+      .spyOn(OwnedScopePermission as any, "getAllowedResourceIds")
+      .mockResolvedValue([ownedIdA, ownedIdB]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("preserves a caller-supplied FK filter on @OwnedThrough models", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    const query: any = { incidentId, projectId };
+
+    const result: any = await OwnedScopePermission.addOwnedScopeToQuery(
+      IncidentInternalNote,
+      query,
+      makeOwnedScopedMemberProps(),
+      DatabaseRequestType.Read,
+    );
+
+    /*
+     * Regression: the Owned scope used to overwrite incidentId with
+     * IN(<all owned incidents>), widening per-incident child queries
+     * (notes/feed/owners) to every owned incident.
+     */
+    expect(result.incidentId).toBeInstanceOf(FindOperator);
+    expect(result.incidentId.type).toBe("and");
+    expect(result.incidentId.value[0].type).toBe("equal");
+    expect(result.incidentId.value[0].value).toBe(incidentId.toString());
+    expect(result.incidentId.value[1].type).toBe("raw");
+  });
+
+  it("applies only the owned-ids filter when the caller has no FK filter", async () => {
+    const result: any = await OwnedScopePermission.addOwnedScopeToQuery(
+      IncidentInternalNote,
+      { projectId } as any,
+      makeOwnedScopedMemberProps(),
+      DatabaseRequestType.Read,
+    );
+
+    expect(result.incidentId).toBeInstanceOf(FindOperator);
+    expect(result.incidentId.type).toBe("raw");
+  });
+
+  it("preserves a caller-supplied _id on top-level operational resources", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    const query: any = { _id: incidentId.toString(), projectId };
+
+    const result: any = await OwnedScopePermission.addOwnedScopeToQuery(
+      Incident,
+      query,
+      makeOwnedScopedMemberProps(),
+      DatabaseRequestType.Update,
+    );
+
+    /*
+     * Regression: the Owned scope used to overwrite _id with
+     * IN(<all owned ids>), so "get/update record X" could resolve
+     * against a different owned record.
+     */
+    expect(result._id).toBeInstanceOf(FindOperator);
+    expect(result._id.type).toBe("and");
+    expect(result._id.value[0].type).toBe("equal");
+    expect(result._id.value[0].value).toBe(incidentId.toString());
+    expect(result._id.value[1].type).toBe("raw");
+  });
+
+  it("still matches nothing when the user owns no resources", async () => {
+    jest
+      .spyOn(OwnedScopePermission as any, "getAllowedResourceIds")
+      .mockResolvedValue([]);
+
+    const result: any = await OwnedScopePermission.addOwnedScopeToQuery(
+      Incident,
+      { _id: ObjectID.generate().toString() } as any,
+      makeOwnedScopedMemberProps(),
+      DatabaseRequestType.Read,
+    );
+
+    // Fail-closed: _id is forced to the zero ObjectID, matching no rows.
+    expect(result._id).toBeInstanceOf(FindOperator);
+    expect(result._id.type).toBe("raw");
+  });
+
+  it("does not restrict users that also hold a non-Owned grant", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions: [
+        {
+          _type: "UserPermission",
+          permission: Permission.ProjectMember,
+          labelIds: [],
+          isBlockPermission: false,
+          scope: PermissionScope.All,
+        },
+      ],
+    };
+
+    const result: any = await OwnedScopePermission.addOwnedScopeToQuery(
+      IncidentInternalNote,
+      { incidentId } as any,
+      {
+        userId,
+        tenantId: projectId,
+        userTenantAccessPermission: {
+          [projectId.toString()]: tenantPermission,
+        },
+      },
+      DatabaseRequestType.Read,
+    );
+
+    expect(result.incidentId).toBe(incidentId);
+  });
+});

package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts

@@ -175,7 +175,7 @@ describe("StatementGenerator", () => {
 
       const statement: Statement = generator.toWhereStatement({
         _id: "<value>",
-        updatedAt: date,
+        createdAt: date,
       });
       expect(statement.query).toBe(
         "AND {p0:Identifier} = {p1:String} AND {p2:Identifier} = {p3:DateTime}",
@@ -183,7 +183,7 @@ describe("StatementGenerator", () => {
       expect(statement.query_params).toStrictEqual({
         p0: "_id",
         p1: "<value>",
-        p2: "updatedAt",
+        p2: "createdAt",
         p3: OneUptimeDate.toClickhouseDateTime(date),
       });
     });
@@ -360,6 +360,277 @@ describe("StatementGenerator", () => {
         expect(statement.query_params).toStrictEqual({});
       });
     });
+
+    describe("ArrayText columns", () => {
+      class ArrayModel extends AnalyticsBaseModel {
+        public constructor() {
+          super({
+            tableName: "<array-table>",
+            singularName: "<singular>",
+            pluralName: "<plural>",
+            tableColumns: [
+              new AnalyticsTableColumn({
+                key: "_id",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                type: TableColumnType.ObjectID,
+              }),
+              new AnalyticsTableColumn({
+                key: "entityKeys",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                defaultValue: [],
+                type: TableColumnType.ArrayText,
+              }),
+            ],
+            crudApiPath: new Route("route"),
+            primaryKeys: ["_id"],
+            sortKeys: ["_id"],
+            partitionKey: "_id",
+            tableEngine: AnalyticsTableEngine.MergeTree,
+          });
+        }
+      }
+
+      let arrayGenerator: StatementGenerator<ArrayModel>;
+      beforeEach(() => {
+        arrayGenerator = new StatementGenerator<ArrayModel>({
+          modelType: ArrayModel,
+          database: ClickhouseAppInstance,
+        });
+      });
+
+      test("emits hasAny(...) for Includes on an Array(String) column", () => {
+        const statement: Statement = arrayGenerator.toWhereStatement({
+          entityKeys: new Includes(["210dac24142f1baa", "8a238f41aaf2c179"]),
+        } as any);
+        /*
+         * Entity-membership reads (`has any of these entity keys`) compile
+         * to `hasAny(col, [...])` so the bloom_filter skip index on the
+         * Array(String) column can prune granules — not the scalar
+         * `col IN (...)` form, which is invalid for an array column.
+         */
+        expect(statement.query).toBe(
+          "AND hasAny({p0:Identifier}, {p1:Array(String)})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "entityKeys",
+          p1: ["210dac24142f1baa", "8a238f41aaf2c179"],
+        });
+      });
+
+      test("drops empty Includes instead of hasAny(col, [])", () => {
+        const statement: Statement = arrayGenerator.toWhereStatement({
+          entityKeys: new Includes([]),
+        } as any);
+        expect(statement.query).toBe("");
+        expect(statement.query_params).toStrictEqual({});
+      });
+    });
+
+    describe("entityScope synthetic key", () => {
+      class EntityScopeModel extends AnalyticsBaseModel {
+        public constructor() {
+          super({
+            tableName: "<entity-scope-table>",
+            singularName: "<singular>",
+            pluralName: "<plural>",
+            tableColumns: [
+              new AnalyticsTableColumn({
+                key: "_id",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                type: TableColumnType.ObjectID,
+              }),
+              new AnalyticsTableColumn({
+                key: "entityKeys",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                defaultValue: [],
+                type: TableColumnType.ArrayText,
+              }),
+              new AnalyticsTableColumn({
+                key: "attributes",
+                title: "<title>",
+                description: "<description>",
+                required: true,
+                defaultValue: {},
+                type: TableColumnType.MapStringString,
+              }),
+            ],
+            crudApiPath: new Route("route"),
+            primaryKeys: ["_id"],
+            sortKeys: ["_id"],
+            partitionKey: "_id",
+            tableEngine: AnalyticsTableEngine.MergeTree,
+          });
+        }
+      }
+
+      let scopeGenerator: StatementGenerator<EntityScopeModel>;
+      beforeEach(() => {
+        scopeGenerator = new StatementGenerator<EntityScopeModel>({
+          modelType: EntityScopeModel,
+          database: ClickhouseAppInstance,
+        });
+      });
+
+      test("compiles to (hasAny(...) OR attributes[...] = ...) with bound params", () => {
+        const statement: Statement = scopeGenerator.toWhereStatement({
+          entityScope: {
+            entityKeys: ["210dac24142f1baa"],
+            attributeKey: "resource.host.name",
+            attributeValue: "web-1",
+          },
+        } as any);
+        /*
+         * The phase-4 read-switch: new rows match via the bloom-indexed
+         * `entityKeys` membership column, old (pre-column, no-backfill)
+         * rows via the resource attribute — same results either way, so
+         * the OR keeps the swap behavior-identical until the fallback is
+         * dropped post-retention.
+         */
+        expect(statement.query).toBe(
+          "AND (hasAny({p0:Identifier}, {p1:Array(String)}) OR {p2:Identifier}[{p3:String}] = {p4:String})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "entityKeys",
+          p1: ["210dac24142f1baa"],
+          p2: "attributes",
+          p3: "resource.host.name",
+          p4: "web-1",
+        });
+      });
+
+      test("composes with regular column predicates", () => {
+        const statement: Statement = scopeGenerator.toWhereStatement({
+          _id: "<value>",
+          entityScope: {
+            entityKeys: ["210dac24142f1baa"],
+            attributeKey: "resource.host.name",
+            attributeValue: "web-1",
+          },
+        } as any);
+        expect(statement.query).toBe(
+          "AND {p0:Identifier} = {p1:String} AND (hasAny({p2:Identifier}, {p3:Array(String)}) OR {p4:Identifier}[{p5:String}] = {p6:String})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "_id",
+          p1: "<value>",
+          p2: "entityKeys",
+          p3: ["210dac24142f1baa"],
+          p4: "attributes",
+          p5: "resource.host.name",
+          p6: "web-1",
+        });
+      });
+
+      test("falls back to the attribute equality alone when entityKeys is empty", () => {
+        const statement: Statement = scopeGenerator.toWhereStatement({
+          entityScope: {
+            entityKeys: [],
+            attributeKey: "resource.host.name",
+            attributeValue: "web-1",
+          },
+        } as any);
+        expect(statement.query).toBe(
+          "AND {p0:Identifier}[{p1:String}] = {p2:String}",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "attributes",
+          p1: "resource.host.name",
+          p2: "web-1",
+        });
+      });
+
+      test("is a no-op for models without an entityKeys column", () => {
+        // TestModel (outer generator) has no entityKeys column.
+        const statement: Statement = generator.toWhereStatement({
+          entityScope: {
+            entityKeys: ["210dac24142f1baa"],
+            attributeKey: "resource.host.name",
+            attributeValue: "web-1",
+          },
+        } as any);
+        expect(statement.query).toBe("");
+        expect(statement.query_params).toStrictEqual({});
+      });
+
+      test("no-op entityScope does not break separators for later predicates", () => {
+        const statement: Statement = generator.toWhereStatement({
+          entityScope: {
+            entityKeys: ["210dac24142f1baa"],
+            attributeKey: "resource.host.name",
+            attributeValue: "web-1",
+          },
+          _id: "<value>",
+        } as any);
+        expect(statement.query).toBe("AND {p0:Identifier} = {p1:String}");
+        expect(statement.query_params).toStrictEqual({
+          p0: "_id",
+          p1: "<value>",
+        });
+      });
+
+      test("emits hasAny alone when the model has no attributes map column", () => {
+        class NoAttributesModel extends AnalyticsBaseModel {
+          public constructor() {
+            super({
+              tableName: "<no-attributes-table>",
+              singularName: "<singular>",
+              pluralName: "<plural>",
+              tableColumns: [
+                new AnalyticsTableColumn({
+                  key: "_id",
+                  title: "<title>",
+                  description: "<description>",
+                  required: true,
+                  type: TableColumnType.ObjectID,
+                }),
+                new AnalyticsTableColumn({
+                  key: "entityKeys",
+                  title: "<title>",
+                  description: "<description>",
+                  required: true,
+                  defaultValue: [],
+                  type: TableColumnType.ArrayText,
+                }),
+              ],
+              crudApiPath: new Route("route"),
+              primaryKeys: ["_id"],
+              sortKeys: ["_id"],
+              partitionKey: "_id",
+              tableEngine: AnalyticsTableEngine.MergeTree,
+            });
+          }
+        }
+
+        const noAttributesGenerator: StatementGenerator<NoAttributesModel> =
+          new StatementGenerator<NoAttributesModel>({
+            modelType: NoAttributesModel,
+            database: ClickhouseAppInstance,
+          });
+
+        const statement: Statement = noAttributesGenerator.toWhereStatement({
+          entityScope: {
+            entityKeys: ["210dac24142f1baa"],
+            attributeKey: "resource.host.name",
+            attributeValue: "web-1",
+          },
+        } as any);
+        expect(statement.query).toBe(
+          "AND hasAny({p0:Identifier}, {p1:Array(String)})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "entityKeys",
+          p1: ["210dac24142f1baa"],
+        });
+      });
+    });
   });
 
   describe("toSelectStatement", () => {
@@ -378,17 +649,13 @@ describe("StatementGenerator", () => {
       const { statement, columns } = generator.toSelectStatement({
         _id: true,
         createdAt: true,
-        updatedAt: true,
       });
-      expect(statement.query).toBe(
-        "{p0:Identifier}, {p1:Identifier}, {p2:Identifier}",
-      );
+      expect(statement.query).toBe("{p0:Identifier}, {p1:Identifier}");
       expect(statement.query_params).toStrictEqual({
         p0: "_id",
         p1: "createdAt",
-        p2: "updatedAt",
       });
-      expect(columns).toStrictEqual(["_id", "createdAt", "updatedAt"]);
+      expect(columns).toStrictEqual(["_id", "createdAt"]);
     });
   });