@oneuptime/common 11.0.2 → 11.0.4

package/Tests/Server/Middleware/UserAuthorizationSSOProvider.test.ts

@@ -0,0 +1,163 @@
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import { ExpressRequest } from "../../../Server/Utils/Express";
+import Email from "../../../Types/Email";
+import ObjectID from "../../../Types/ObjectID";
+import SsoProviderType from "../../../Types/SSO/SsoProviderType";
+import User from "../../../Models/DatabaseModels/User";
+import { describe, expect, test, jest } from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Logger");
+
+/*
+ * Tests for UserMiddleware.doesSsoTokenForProjectExist's `requiredSsoProviderId`
+ * param. When provided, an SSO token only satisfies the project if it ALSO
+ * carries a matching `ssoProviderId` discriminator. Legacy tokens (no
+ * discriminator) must pass when no provider is required but fail a
+ * specific-provider requirement.
+ *
+ * These use REAL tokens minted by CookieUtil.getSSOToken and the REAL
+ * JSONWebToken.decode() path (no mocking) so they verify the full production
+ * wiring end to end — including that decode() surfaces ssoProviderId.
+ */
+describe("UserMiddleware.doesSsoTokenForProjectExist - requiredSsoProviderId", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const ssoProviderId: ObjectID = ObjectID.generate();
+  const otherProviderId: ObjectID = ObjectID.generate();
+
+  const buildUser: () => User = (): User => {
+    const u: User = new User();
+    u.id = userId;
+    u.email = new Email("sso-user@oneuptime.com");
+    return u;
+  };
+
+  // Build a request whose cookies carry a real `sso-<projectId>` token.
+  const buildRequestWithSsoToken: (data: {
+    tokenProjectId: ObjectID;
+    discriminatorProviderId?: ObjectID | undefined;
+  }) => ExpressRequest = (data: {
+    tokenProjectId: ObjectID;
+    discriminatorProviderId?: ObjectID | undefined;
+  }): ExpressRequest => {
+    const token: string = CookieUtil.getSSOToken({
+      user: buildUser(),
+      projectId: data.tokenProjectId,
+      ssoProviderId: data.discriminatorProviderId,
+      ssoProviderType: data.discriminatorProviderId
+        ? SsoProviderType.GlobalSSO
+        : undefined,
+    });
+
+    return {
+      cookies: {
+        [CookieUtil.getUserSSOKey(data.tokenProjectId)]: token,
+      },
+      headers: {},
+    } as unknown as ExpressRequest;
+  };
+
+  test("matching project+user, NO requiredProviderId -> true", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(req, projectId, userId),
+    ).toBe(true);
+  });
+
+  test("matching project+user, requiredProviderId EQUALS token's ssoProviderId -> true", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        ssoProviderId,
+      ),
+    ).toBe(true);
+  });
+
+  test("matching project+user, requiredProviderId DIFFERENT from token's ssoProviderId -> false", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        otherProviderId,
+      ),
+    ).toBe(false);
+  });
+
+  test("legacy token (NO discriminator) + requiredProviderId given -> false", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      // no discriminatorProviderId -> legacy token shape
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        ssoProviderId,
+      ),
+    ).toBe(false);
+  });
+
+  test("legacy token (NO discriminator) + NO requiredProviderId -> true (backwards compatible)", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(req, projectId, userId),
+    ).toBe(true);
+  });
+
+  test("wrong userId -> false (even with matching provider)", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    const differentUserId: ObjectID = ObjectID.generate();
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        differentUserId,
+        ssoProviderId,
+      ),
+    ).toBe(false);
+  });
+
+  test("no sso cookie for the project -> false", () => {
+    const req: ExpressRequest = {
+      cookies: {},
+      headers: {},
+    } as unknown as ExpressRequest;
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        ssoProviderId,
+      ),
+    ).toBe(false);
+  });
+});

package/Tests/Server/Utils/CookieSSOToken.test.ts

@@ -0,0 +1,130 @@
+import CookieUtil from "../../../Server/Utils/Cookie";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import { JSONObject } from "../../../Types/JSON";
+import JSONWebTokenData from "../../../Types/JsonWebTokenData";
+import Email from "../../../Types/Email";
+import Name from "../../../Types/Name";
+import ObjectID from "../../../Types/ObjectID";
+import SsoProviderType from "../../../Types/SSO/SsoProviderType";
+import User from "../../../Models/DatabaseModels/User";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Tests for the SSO-provider discriminator that CookieUtil.getSSOToken stamps
+ * onto a per-project SSO token. These run real JWT signing (no mocks): the JWT
+ * secret falls back to EncryptionSecret = "secret" when ENCRYPTION_SECRET is
+ * unset (see Common/Server/EnvironmentConfig.ts), so no env setup is required.
+ */
+describe("CookieUtil.getSSOToken - SSO provider discriminator", () => {
+  const buildUser: () => User = (): User => {
+    const user: User = new User();
+    user.id = ObjectID.generate();
+    user.name = new Name("Test User");
+    user.email = new Email("test@oneuptime.com");
+    return user;
+  };
+
+  test("token carries userId and projectId (round-trips through JSONWebToken.decode)", () => {
+    const user: User = buildUser();
+    const projectId: ObjectID = ObjectID.generate();
+
+    const token: string = CookieUtil.getSSOToken({
+      user,
+      projectId,
+    });
+
+    expect(typeof token).toBe("string");
+    expect(token.length).toBeGreaterThan(0);
+
+    const decoded: JSONWebTokenData = JSONWebToken.decode(token);
+
+    expect(decoded.userId?.toString()).toBe(user.id!.toString());
+    expect(decoded.projectId?.toString()).toBe(projectId.toString());
+  });
+
+  test("token carries the ssoProviderId + ssoProviderType discriminator when provided", () => {
+    const user: User = buildUser();
+    const projectId: ObjectID = ObjectID.generate();
+    const ssoProviderId: ObjectID = ObjectID.generate();
+
+    const token: string = CookieUtil.getSSOToken({
+      user,
+      projectId,
+      ssoProviderId,
+      ssoProviderType: SsoProviderType.GlobalSSO,
+    });
+
+    /*
+     * The discriminator lives on the raw JWT payload. JSONWebToken.decode()
+     * intentionally re-shapes the payload into JSONWebTokenData and does not
+     * surface ssoProviderId / ssoProviderType, so we assert the round-trip on
+     * the raw payload (decodeJsonPayload), which is the actual transport layer.
+     */
+    const payload: JSONObject = JSONWebToken.decodeJsonPayload(token);
+
+    expect(payload["userId"]).toBe(user.id!.toString());
+    expect(payload["projectId"]).toBe(projectId.toString());
+    expect(payload["ssoProviderId"]).toBe(ssoProviderId.toString());
+    expect(payload["ssoProviderType"]).toBe(SsoProviderType.GlobalSSO);
+  });
+
+  test("each SsoProviderType enum value round-trips on the token", () => {
+    const user: User = buildUser();
+    const projectId: ObjectID = ObjectID.generate();
+    const ssoProviderId: ObjectID = ObjectID.generate();
+
+    const providerTypes: Array<SsoProviderType> = [
+      SsoProviderType.ProjectSSO,
+      SsoProviderType.ProjectOIDC,
+      SsoProviderType.GlobalSSO,
+      SsoProviderType.GlobalOIDC,
+    ];
+
+    for (const providerType of providerTypes) {
+      const token: string = CookieUtil.getSSOToken({
+        user,
+        projectId,
+        ssoProviderId,
+        ssoProviderType: providerType,
+      });
+
+      const payload: JSONObject = JSONWebToken.decodeJsonPayload(token);
+
+      expect(payload["ssoProviderId"]).toBe(ssoProviderId.toString());
+      expect(payload["ssoProviderType"]).toBe(providerType);
+    }
+  });
+
+  test("ssoProviderId / ssoProviderType are absent (undefined) when not provided (legacy token shape)", () => {
+    const user: User = buildUser();
+    const projectId: ObjectID = ObjectID.generate();
+
+    const token: string = CookieUtil.getSSOToken({
+      user,
+      projectId,
+    });
+
+    const payload: JSONObject = JSONWebToken.decodeJsonPayload(token);
+
+    // No discriminator was provided, so neither field should carry a value.
+    expect(payload["ssoProviderId"]).toBeUndefined();
+    expect(payload["ssoProviderType"]).toBeUndefined();
+  });
+
+  test("ssoProviderId without ssoProviderType still records the provider id", () => {
+    const user: User = buildUser();
+    const projectId: ObjectID = ObjectID.generate();
+    const ssoProviderId: ObjectID = ObjectID.generate();
+
+    const token: string = CookieUtil.getSSOToken({
+      user,
+      projectId,
+      ssoProviderId,
+    });
+
+    const payload: JSONObject = JSONWebToken.decodeJsonPayload(token);
+
+    expect(payload["ssoProviderId"]).toBe(ssoProviderId.toString());
+    expect(payload["ssoProviderType"]).toBeUndefined();
+  });
+});

package/Tests/Server/Utils/Monitor/MonitorMaintenanceSuppression.test.ts

@@ -11,6 +11,7 @@ function emptyMaintained(): MaintainedResourceKeys {
   return {
     hosts: { ids: new Set<string>(), names: new Set<string>() },
     dockerHosts: { ids: new Set<string>(), names: new Set<string>() },
+    podmanHosts: { ids: new Set<string>(), names: new Set<string>() },
     kubernetesClusters: { ids: new Set<string>(), names: new Set<string>() },
     proxmoxClusters: { ids: new Set<string>(), names: new Set<string>() },
     cephClusters: { ids: new Set<string>(), names: new Set<string>() },