@oneuptime/common 11.0.3 → 11.0.5

package/Server/Services/ServerlessFunctionService.ts

@@ -170,21 +170,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Utils/Cookie.ts

@@ -8,6 +8,7 @@ import StatusPagePrivateUser from "../../Models/DatabaseModels/StatusPagePrivate
 import OneUptimeDate from "../../Types/Date";
 import PositiveNumber from "../../Types/PositiveNumber";
 import CookieName from "../../Types/CookieName";
+import SsoProviderType from "../../Types/SSO/SsoProviderType";
 import {
   MASTER_PASSWORD_COOKIE_IDENTIFIER,
   MASTER_PASSWORD_COOKIE_MAX_AGE_IN_DAYS,
@@ -38,15 +39,24 @@ export default class CookieUtil {
     return cookies;
   }
 
+  /*
+   * Builds a per-project SSO token. The optional `ssoProviderId` /
+   * `ssoProviderType` discriminator records WHICH identity provider issued the
+   * token, so a project that enforces SSO can require a specific provider
+   * (e.g. its own Project SSO, or an instance-wide Global SSO). Used by both
+   * the cookie flow (web) and the deep-link flow (mobile) so the token shape
+   * stays identical.
+   */
   @CaptureSpan()
-  public static setSSOCookie(data: {
+  public static getSSOToken(data: {
     user: User;
     projectId: ObjectID;
-    expressResponse: ExpressResponse;
-  }): void {
-    const { user, projectId, expressResponse: res } = data;
+    ssoProviderId?: ObjectID | undefined;
+    ssoProviderType?: SsoProviderType | undefined;
+  }): string {
+    const { user, projectId } = data;
 
-    const ssoToken: string = JSONWebToken.sign({
+    return JSONWebToken.sign({
       data: {
         userId: user.id!,
         projectId: projectId,
@@ -54,9 +64,33 @@ export default class CookieUtil {
         email: user.email,
         isMasterAdmin: false,
         isGeneralLogin: false,
+        ssoProviderId: data.ssoProviderId
+          ? data.ssoProviderId.toString()
+          : undefined,
+        ssoProviderType: data.ssoProviderType
+          ? data.ssoProviderType.toString()
+          : undefined,
       },
       expiresInSeconds: OneUptimeDate.getSecondsInDays(new PositiveNumber(30)),
     });
+  }
+
+  @CaptureSpan()
+  public static setSSOCookie(data: {
+    user: User;
+    projectId: ObjectID;
+    expressResponse: ExpressResponse;
+    ssoProviderId?: ObjectID | undefined;
+    ssoProviderType?: SsoProviderType | undefined;
+  }): void {
+    const { projectId, expressResponse: res } = data;
+
+    const ssoToken: string = CookieUtil.getSSOToken({
+      user: data.user,
+      projectId: projectId,
+      ssoProviderId: data.ssoProviderId,
+      ssoProviderType: data.ssoProviderType,
+    });
 
     CookieUtil.setCookie(res, CookieUtil.getUserSSOKey(projectId), ssoToken, {
       maxAge: OneUptimeDate.getMillisecondsInDays(new PositiveNumber(30)),

package/Server/Utils/JsonWebToken.ts

@@ -6,6 +6,7 @@ import JSONFunctions from "../../Types/JSONFunctions";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
 import Name from "../../Types/Name";
 import ObjectID from "../../Types/ObjectID";
+import SsoProviderType from "../../Types/SSO/SsoProviderType";
 import Timezone from "../../Types/Timezone";
 import StatusPagePrivateUser from "../../Models/DatabaseModels/StatusPagePrivateUser";
 import User from "../../Models/DatabaseModels/User";
@@ -139,6 +140,12 @@ class JSONWebToken {
         sessionId: decoded["sessionId"]
           ? new ObjectID(decoded["sessionId"] as string)
           : undefined,
+        ssoProviderId: decoded["ssoProviderId"]
+          ? new ObjectID(decoded["ssoProviderId"] as string)
+          : undefined,
+        ssoProviderType: decoded["ssoProviderType"]
+          ? (decoded["ssoProviderType"] as SsoProviderType)
+          : undefined,
       };
     } catch (e) {
       logger.error(e);

package/Server/Utils/ValidateGlobalProviderProjectTeams.ts

@@ -0,0 +1,119 @@
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import Project from "../../Models/DatabaseModels/Project";
+import Team from "../../Models/DatabaseModels/Team";
+import QueryHelper from "../Types/Database/QueryHelper";
+import TeamService from "../Services/TeamService";
+
+/*
+ * The Admin Dashboard attach form submits the chosen project via the `project`
+ * relation, not the `projectId` FK: the entity dropdown sets the related
+ * Project (as a model with only `_id`), so `createBy.data.projectId` is
+ * undefined at create-hook time. Resolve the FK from either shape so the hook
+ * can populate the NOT NULL `projectId` column and validate teams against it.
+ */
+export const resolveAttachmentProjectId: (data: {
+  projectId?: ObjectID | undefined;
+  project?: Project | undefined;
+}) => ObjectID | undefined = (data: {
+  projectId?: ObjectID | undefined;
+  project?: Project | undefined;
+}): ObjectID | undefined => {
+  if (data.projectId) {
+    return data.projectId;
+  }
+
+  const project: (Project & { _id?: string }) | undefined = data.project as
+    | (Project & { _id?: string })
+    | undefined;
+
+  if (!project) {
+    return undefined;
+  }
+
+  const idString: string | undefined =
+    project._id?.toString() || (project.id ? project.id.toString() : undefined);
+
+  return idString ? new ObjectID(idString) : undefined;
+};
+
+/*
+ * Guards a Global SSO / Global OIDC project-attachment: every default team
+ * selected for the attachment MUST belong to the same project the attachment
+ * targets.
+ *
+ * Without this guard, an admin (or a direct API call) could attach a team that
+ * lives in project B to an attachment that targets project A. The SSO/OIDC
+ * login fan-out (see App/FeatureSet/Identity/API/GlobalSSO.ts) provisions a
+ * TeamMember with `projectId = attachment.projectId` but `teamId = team.id`,
+ * and because that path runs with `ignoreHooks: true` no service-level
+ * validation would catch the mismatch — producing a corrupt, cross-project
+ * membership row. This is the server-side backstop for the project-scoped team
+ * picker in the Admin Dashboard.
+ */
+type ValidateGlobalProviderProjectTeamsFunction = (data: {
+  teams: Array<Team> | undefined;
+  projectId: ObjectID | undefined;
+}) => Promise<void>;
+
+const validateGlobalProviderProjectTeams: ValidateGlobalProviderProjectTeamsFunction =
+  async (data: {
+    teams: Array<Team> | undefined;
+    projectId: ObjectID | undefined;
+  }): Promise<void> => {
+    const teams: Array<Team> | undefined = data.teams;
+
+    if (!teams || teams.length === 0) {
+      // No default teams selected: nothing to validate.
+      return;
+    }
+
+    if (!data.projectId) {
+      throw new BadDataException(
+        "A project must be selected before choosing default teams.",
+      );
+    }
+
+    const projectId: string = data.projectId.toString();
+
+    const teamIds: Array<string> = teams
+      .map((team: Team) => {
+        return (
+          team.id?.toString() ||
+          (team as { _id?: string })._id?.toString() ||
+          undefined
+        );
+      })
+      .filter((id: string | undefined): id is string => {
+        return Boolean(id);
+      });
+
+    if (teamIds.length === 0) {
+      return;
+    }
+
+    const foundTeams: Array<Team> = await TeamService.findBy({
+      query: { _id: QueryHelper.any(teamIds) },
+      select: { _id: true, projectId: true },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: { isRoot: true },
+    });
+
+    if (foundTeams.length !== teamIds.length) {
+      throw new BadDataException(
+        "One or more selected teams could not be found.",
+      );
+    }
+
+    for (const team of foundTeams) {
+      if (team.projectId?.toString() !== projectId) {
+        throw new BadDataException(
+          "All selected teams must belong to the project this provider is attached to.",
+        );
+      }
+    }
+  };
+
+export default validateGlobalProviderProjectTeams;

package/Tests/Server/Infrastructure/GlobalCache.test.ts

@@ -17,6 +17,7 @@ type MockClient = {
   set: jest.Mock;
   expire: jest.Mock;
   get: jest.Mock;
+  del: jest.Mock;
 };
 
 describe("GlobalCache.setString", () => {
@@ -27,6 +28,7 @@ describe("GlobalCache.setString", () => {
       set: jest.fn().mockResolvedValue("OK"),
       expire: jest.fn().mockResolvedValue(1),
       get: jest.fn(),
+      del: jest.fn().mockResolvedValue(1),
     };
     (Redis.getClient as jest.Mock).mockReturnValue(client);
     (Redis.isConnected as jest.Mock).mockReturnValue(true);
@@ -98,3 +100,44 @@ describe("GlobalCache.setString", () => {
     expect(client.expire).not.toHaveBeenCalled();
   });
 });
+
+describe("GlobalCache.deleteKey", () => {
+  let client: MockClient;
+
+  beforeEach(() => {
+    client = {
+      set: jest.fn().mockResolvedValue("OK"),
+      expire: jest.fn().mockResolvedValue(1),
+      get: jest.fn(),
+      del: jest.fn().mockResolvedValue(1),
+    };
+    (Redis.getClient as jest.Mock).mockReturnValue(client);
+    (Redis.isConnected as jest.Mock).mockReturnValue(true);
+  });
+
+  afterEach(() => {
+    jest.clearAllMocks();
+  });
+
+  /*
+   * deleteKey backs clearMaintenanceFence (OtelIngestBaseService): when
+   * the fenced maintenance work (updateLastSeen) fails, the fence is
+   * released so the next ingest batch retries instead of leaving the
+   * resource stranded as "disconnected" for the whole TTL window.
+   */
+  test("deletes the namespaced key", async () => {
+    await GlobalCache.deleteKey("ns", "key");
+
+    expect(client.del).toHaveBeenCalledTimes(1);
+    expect(client.del).toHaveBeenCalledWith("ns-key");
+  });
+
+  test("throws when the cache is not connected", async () => {
+    (Redis.isConnected as jest.Mock).mockReturnValue(false);
+
+    await expect(GlobalCache.deleteKey("ns", "key")).rejects.toThrow(
+      DatabaseNotConnectedException,
+    );
+    expect(client.del).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -1,6 +1,7 @@
 import ProjectMiddleware from "../../../Server/Middleware/ProjectAuthorization";
 import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import AccessTokenService from "../../../Server/Services/AccessTokenService";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
 import ProjectService from "../../../Server/Services/ProjectService";
 import TeamMemberService from "../../../Server/Services/TeamMemberService";
 import UserService from "../../../Server/Services/UserService";
@@ -26,7 +27,6 @@ import {
   UserGlobalAccessPermission,
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
-import Project from "../../../Models/DatabaseModels/Project";
 import {
   describe,
   expect,
@@ -44,6 +44,7 @@ jest.mock("../../../Server/Middleware/ProjectAuthorization");
 jest.mock("../../../Server/Utils/JsonWebToken");
 jest.mock("../../../Server/Services/UserService");
 jest.mock("../../../Server/Services/AccessTokenService");
+jest.mock("../../../Server/Services/GlobalConfigService");
 jest.mock("../../../Server/Utils/Response");
 jest.mock("../../../Server/Services/ProjectService");
 jest.mock("../../../Server/Services/TeamMemberService");
@@ -56,7 +57,6 @@ describe("UserMiddleware", () => {
   const mockedAccessToken: string = ObjectID.generate().toString();
   const projectId: ObjectID = ObjectID.generate();
   const userId: ObjectID = ObjectID.generate();
-  const mockedProject: Project = { _id: projectId.toString() } as Project;
 
   beforeEach(() => {
     jest.clearAllMocks();
@@ -590,15 +590,32 @@ describe("UserMiddleware", () => {
       ProjectService,
       "getRequireSsoForLogin",
     );
+    const spyGetRequireSsoWithSsoProviderId: jest.SpyInstance = getJestSpyOn(
+      ProjectService,
+      "getRequireSsoWithSsoProviderId",
+    );
     const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
       "doesSsoTokenForProjectExist",
     );
+    const spyGetGlobalRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
+      GlobalConfigService,
+      "getRequireSsoForLogin",
+    );
 
     afterEach(() => {
       jest.clearAllMocks();
     });
 
+    /*
+     * By default no project requires a specific SSO provider (discriminator),
+     * and the instance-wide "Require SSO for Login" flag is off.
+     */
+    beforeEach(() => {
+      spyGetRequireSsoWithSsoProviderId.mockResolvedValue(null);
+      spyGetGlobalRequireSsoForLogin.mockResolvedValue(false);
+    });
+
     test("should throw 'Invalid tenantId' error, when project is not found for the tenantId", async () => {
       spyGetRequireSsoForLogin.mockRejectedValueOnce(
         new BadDataException("Project not found"),
@@ -630,6 +647,7 @@ describe("UserMiddleware", () => {
         req,
         projectId,
         userId,
+        undefined,
       );
     });
 
@@ -688,16 +706,37 @@ describe("UserMiddleware", () => {
       projectId,
     } as UserTenantAccessPermission;
 
-    const spyFindBy: jest.SpyInstance = getJestSpyOn(ProjectService, "findBy");
+    const spyGetProjectRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
+      ProjectService,
+      "getRequireSsoForLogin",
+    );
+    const spyGetRequireSsoWithSsoProviderId: jest.SpyInstance = getJestSpyOn(
+      ProjectService,
+      "getRequireSsoWithSsoProviderId",
+    );
     const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
       "doesSsoTokenForProjectExist",
     );
+    const spyGetGlobalRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
+      GlobalConfigService,
+      "getRequireSsoForLogin",
+    );
 
     afterEach(() => {
       jest.clearAllMocks();
     });
 
+    /*
+     * By default neither a project's own nor the instance-wide "Require SSO for
+     * Login" flag is on, and no project requires a specific SSO provider.
+     */
+    beforeEach(() => {
+      spyGetProjectRequireSsoForLogin.mockResolvedValue(false);
+      spyGetRequireSsoWithSsoProviderId.mockResolvedValue(null);
+      spyGetGlobalRequireSsoForLogin.mockResolvedValue(false);
+    });
+
     test("should return null, when projectIds length is zero", async () => {
       const result: Dictionary<UserTenantAccessPermission> | null =
         await UserMiddleware.getUserTenantAccessPermissionForMultiTenant(
@@ -707,14 +746,12 @@ describe("UserMiddleware", () => {
         );
 
       expect(result).toBeNull();
-      expect(spyFindBy).not.toBeCalled();
+      expect(spyGetProjectRequireSsoForLogin).not.toBeCalled();
     });
 
     test("should return default tenant access permission, when project for a projectId is found, sso is required for login, but sso token does not exist for that projectId", async () => {
       spyDoesSsoTokenForProjectExist.mockReturnValueOnce(false);
-      spyFindBy.mockResolvedValueOnce([
-        { ...mockedProject, requireSsoForLogin: true },
-      ]);
+      spyGetProjectRequireSsoForLogin.mockResolvedValueOnce(true);
 
       const spyGetDefaultUserTenantAccessPermission: jest.SpyInstance =
         getJestSpyOn(
@@ -736,6 +773,7 @@ describe("UserMiddleware", () => {
         req,
         projectId,
         userId,
+        undefined,
       );
       expect(spyGetDefaultUserTenantAccessPermission).toHaveBeenCalledWith(
         projectId,
@@ -743,8 +781,6 @@ describe("UserMiddleware", () => {
     });
 
     test("should return user tenant access permission, when project for a projectId is found, sso is not required for login and project level permission exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([mockedProject]);
-
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,
         "getUserTenantAccessPermission",
@@ -768,8 +804,6 @@ describe("UserMiddleware", () => {
     });
 
     test("should return null, when project for a projectId is found, sso is not required for login but project level permission does not exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([mockedProject]);
-
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,
         "getUserTenantAccessPermission",
@@ -790,7 +824,9 @@ describe("UserMiddleware", () => {
     });
 
     test("should return user tenant access permission, when project for a projectId is not found, but project level permission exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([]);
+      spyGetProjectRequireSsoForLogin.mockRejectedValueOnce(
+        new BadDataException("Project not found"),
+      );
 
       getJestSpyOn(
         AccessTokenService,
@@ -810,7 +846,9 @@ describe("UserMiddleware", () => {
     });
 
     test("should return null, when project for a projectId is not found, and project level permission does not exist for the projectId", async () => {
-      spyFindBy.mockResolvedValueOnce([]);
+      spyGetProjectRequireSsoForLogin.mockRejectedValueOnce(
+        new BadDataException("Project not found"),
+      );
 
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,

package/Tests/Server/Middleware/UserAuthorizationSSOProvider.test.ts

@@ -0,0 +1,163 @@
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import { ExpressRequest } from "../../../Server/Utils/Express";
+import Email from "../../../Types/Email";
+import ObjectID from "../../../Types/ObjectID";
+import SsoProviderType from "../../../Types/SSO/SsoProviderType";
+import User from "../../../Models/DatabaseModels/User";
+import { describe, expect, test, jest } from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Logger");
+
+/*
+ * Tests for UserMiddleware.doesSsoTokenForProjectExist's `requiredSsoProviderId`
+ * param. When provided, an SSO token only satisfies the project if it ALSO
+ * carries a matching `ssoProviderId` discriminator. Legacy tokens (no
+ * discriminator) must pass when no provider is required but fail a
+ * specific-provider requirement.
+ *
+ * These use REAL tokens minted by CookieUtil.getSSOToken and the REAL
+ * JSONWebToken.decode() path (no mocking) so they verify the full production
+ * wiring end to end — including that decode() surfaces ssoProviderId.
+ */
+describe("UserMiddleware.doesSsoTokenForProjectExist - requiredSsoProviderId", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const ssoProviderId: ObjectID = ObjectID.generate();
+  const otherProviderId: ObjectID = ObjectID.generate();
+
+  const buildUser: () => User = (): User => {
+    const u: User = new User();
+    u.id = userId;
+    u.email = new Email("sso-user@oneuptime.com");
+    return u;
+  };
+
+  // Build a request whose cookies carry a real `sso-<projectId>` token.
+  const buildRequestWithSsoToken: (data: {
+    tokenProjectId: ObjectID;
+    discriminatorProviderId?: ObjectID | undefined;
+  }) => ExpressRequest = (data: {
+    tokenProjectId: ObjectID;
+    discriminatorProviderId?: ObjectID | undefined;
+  }): ExpressRequest => {
+    const token: string = CookieUtil.getSSOToken({
+      user: buildUser(),
+      projectId: data.tokenProjectId,
+      ssoProviderId: data.discriminatorProviderId,
+      ssoProviderType: data.discriminatorProviderId
+        ? SsoProviderType.GlobalSSO
+        : undefined,
+    });
+
+    return {
+      cookies: {
+        [CookieUtil.getUserSSOKey(data.tokenProjectId)]: token,
+      },
+      headers: {},
+    } as unknown as ExpressRequest;
+  };
+
+  test("matching project+user, NO requiredProviderId -> true", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(req, projectId, userId),
+    ).toBe(true);
+  });
+
+  test("matching project+user, requiredProviderId EQUALS token's ssoProviderId -> true", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        ssoProviderId,
+      ),
+    ).toBe(true);
+  });
+
+  test("matching project+user, requiredProviderId DIFFERENT from token's ssoProviderId -> false", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        otherProviderId,
+      ),
+    ).toBe(false);
+  });
+
+  test("legacy token (NO discriminator) + requiredProviderId given -> false", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      // no discriminatorProviderId -> legacy token shape
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        ssoProviderId,
+      ),
+    ).toBe(false);
+  });
+
+  test("legacy token (NO discriminator) + NO requiredProviderId -> true (backwards compatible)", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+    });
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(req, projectId, userId),
+    ).toBe(true);
+  });
+
+  test("wrong userId -> false (even with matching provider)", () => {
+    const req: ExpressRequest = buildRequestWithSsoToken({
+      tokenProjectId: projectId,
+      discriminatorProviderId: ssoProviderId,
+    });
+
+    const differentUserId: ObjectID = ObjectID.generate();
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        differentUserId,
+        ssoProviderId,
+      ),
+    ).toBe(false);
+  });
+
+  test("no sso cookie for the project -> false", () => {
+    const req: ExpressRequest = {
+      cookies: {},
+      headers: {},
+    } as unknown as ExpressRequest;
+
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        req,
+        projectId,
+        userId,
+        ssoProviderId,
+      ),
+    ).toBe(false);
+  });
+});