@oneuptime/common 11.5.3 → 11.5.5

package/Tests/Server/API/DashboardMasterPasswordAPI.test.ts

@@ -0,0 +1,225 @@
+import Dashboard from "../../../Models/DatabaseModels/Dashboard";
+import DashboardAPI from "../../../Server/API/DashboardAPI";
+import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
+import DashboardService from "../../../Server/Services/DashboardService";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import {
+  DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE,
+  DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+} from "../../../Types/Dashboard/MasterPassword";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import MasterPasswordRequiredException from "../../../Types/Exception/MasterPasswordRequiredException";
+import HashedString from "../../../Types/HashedString";
+import ObjectID from "../../../Types/ObjectID";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+  };
+});
+
+describe("DashboardAPI master password", () => {
+  const password: string = "correct horse battery staple";
+
+  let dashboardId: ObjectID;
+  let dashboard: Dashboard;
+  let mockRequest: ExpressRequest;
+  let mockResponse: ExpressResponse;
+  let nextFunction: NextFunction;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new DashboardAPI();
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+
+    dashboardId = ObjectID.generate();
+    dashboard = new Dashboard();
+    dashboard.id = dashboardId;
+    dashboard.isPublicDashboard = true;
+    dashboard.enableMasterPassword = true;
+    dashboard.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+
+    jest.spyOn(DashboardService, "findOneById").mockResolvedValue(dashboard);
+
+    mockRequest = {
+      params: {
+        dashboardId: dashboardId.toString(),
+      },
+      body: {
+        password,
+      },
+      cookies: {},
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    mockResponse = {
+      cookie: jest.fn(),
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    nextFunction = jest.fn();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("denies a protected public dashboard when no master-password cookie is present", async () => {
+    const result: Awaited<ReturnType<typeof DashboardService.hasReadAccess>> =
+      await DashboardService.hasReadAccess({
+        dashboardId,
+        req: mockRequest,
+      });
+
+    expect(result.hasReadAccess).toBe(false);
+    expect(result.error).toBeInstanceOf(MasterPasswordRequiredException);
+    expect(result.error?.message).toBe(
+      DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+    );
+  });
+
+  it("fails closed when master-password protection is enabled without a stored password", async () => {
+    delete dashboard.masterPassword;
+
+    const result: Awaited<ReturnType<typeof DashboardService.hasReadAccess>> =
+      await DashboardService.hasReadAccess({
+        dashboardId,
+        req: mockRequest,
+      });
+
+    expect(result.hasReadAccess).toBe(false);
+    expect(result.error).toBeInstanceOf(MasterPasswordRequiredException);
+    expect(result.error?.message).toBe(
+      DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+    );
+  });
+
+  it("issues a dashboard-scoped cookie for the correct password and unlocks only that dashboard", async () => {
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      mockRequest,
+      mockResponse,
+    );
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+
+    const cookieCall: Array<unknown> = (mockResponse.cookie as jest.Mock).mock
+      .calls[0] as Array<unknown>;
+    const cookieName: string = cookieCall[0] as string;
+    const cookieToken: string = cookieCall[1] as string;
+
+    expect(cookieName).toBe(
+      CookieUtil.getDashboardMasterPasswordKey(dashboardId),
+    );
+    expect(cookieToken).toEqual(expect.any(String));
+
+    const unlockedRequest: ExpressRequest = {
+      cookies: {
+        [cookieName]: cookieToken,
+      },
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    const unlockedResult: Awaited<
+      ReturnType<typeof DashboardService.hasReadAccess>
+    > = await DashboardService.hasReadAccess({
+      dashboardId,
+      req: unlockedRequest,
+    });
+
+    expect(unlockedResult.hasReadAccess).toBe(true);
+    expect(unlockedResult.error).toBeUndefined();
+
+    const otherDashboardId: ObjectID = ObjectID.generate();
+    const copiedCookieRequest: ExpressRequest = {
+      cookies: {
+        [CookieUtil.getDashboardMasterPasswordKey(otherDashboardId)]:
+          cookieToken,
+      },
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    const isolatedResult: Awaited<
+      ReturnType<typeof DashboardService.hasReadAccess>
+    > = await DashboardService.hasReadAccess({
+      dashboardId: otherDashboardId,
+      req: copiedCookieRequest,
+    });
+
+    expect(isolatedResult.hasReadAccess).toBe(false);
+    expect(isolatedResult.error).toBeInstanceOf(
+      MasterPasswordRequiredException,
+    );
+  });
+
+  it("rejects an incorrect password without issuing a cookie", async () => {
+    mockRequest.body["password"] = "incorrect password";
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+
+    const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+    expect(error).toBeInstanceOf(BadDataException);
+    expect((error as BadDataException).message).toBe(
+      DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE,
+    );
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+    expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Infrastructure/Queue.test.ts

@@ -0,0 +1,227 @@
+import Queue, { QueueName } from "../../../Server/Infrastructure/Queue";
+import { RepeatableJob } from "bullmq";
+
+jest.mock("../../../Server/Infrastructure/Redis", () => {
+  return {
+    __esModule: true,
+    default: {
+      getRedisOptions: jest.fn().mockReturnValue({}),
+    },
+  };
+});
+
+type MockBullQueue = {
+  getRepeatableJobs: jest.Mock;
+  removeRepeatableByKey: jest.Mock;
+  getJob: jest.Mock;
+  clean: jest.Mock;
+  add: jest.Mock;
+  client: Promise<{ on: jest.Mock }>;
+};
+
+/*
+ * Must be prefixed with "mock" — jest.mock() factories are hoisted and may not
+ * reference out-of-scope variables that aren't so named.
+ */
+const mockBullQueueInstances: Array<MockBullQueue> = [];
+
+jest.mock("bullmq", () => {
+  return {
+    __esModule: true,
+    Queue: jest.fn().mockImplementation(() => {
+      const instance: MockBullQueue = {
+        getRepeatableJobs: jest.fn().mockResolvedValue([]),
+        removeRepeatableByKey: jest.fn().mockResolvedValue(true),
+        getJob: jest.fn().mockResolvedValue(undefined),
+        clean: jest.fn().mockResolvedValue([]),
+        add: jest.fn().mockResolvedValue({}),
+        client: Promise.resolve({ on: jest.fn() }),
+      };
+      mockBullQueueInstances.push(instance);
+      return instance;
+    }),
+  };
+});
+
+/*
+ * Builds a RepeatableJob as BullMQ returns it: `key` is the opaque md5 zset
+ * member, and is the ONLY thing removeRepeatableByKey() accepts.
+ */
+const repeatable: (name: string, key: string) => RepeatableJob = (
+  name: string,
+  key: string,
+): RepeatableJob => {
+  return {
+    key: key,
+    name: name,
+    id: null,
+    endDate: null,
+    tz: null,
+    pattern: "*/15 * * * *",
+  };
+};
+
+describe("Queue.removeRepeatableByName", () => {
+  let queue: MockBullQueue;
+
+  beforeAll(() => {
+    // Force the (cached) BullQueue for the Worker queue to be constructed.
+    Queue.getQueue(QueueName.Worker);
+    queue = mockBullQueueInstances[0] as MockBullQueue;
+  });
+
+  beforeEach(() => {
+    queue.getRepeatableJobs.mockReset().mockResolvedValue([]);
+    queue.removeRepeatableByKey.mockReset().mockResolvedValue(true);
+  });
+
+  /*
+   * The whole point of the method: go from a job NAME to the opaque repeat KEY.
+   * A renamed cron (e.g. SentinelInsight:ScanForInsights ->
+   * AIInsight:ScanForInsights) leaves its old repeatable behind in Redis,
+   * firing forever, and the name is all we have to find it by.
+   */
+  it("removes a repeatable whose name matches, using its key", async () => {
+    queue.getRepeatableJobs.mockResolvedValue([
+      repeatable("AIInsight:ScanForInsights", "aaaaaaaaaaaaaaaa"),
+      repeatable("SentinelInsight:ScanForInsights", "86b9a73a59ccbe97264b573"),
+    ]);
+
+    const removedCount: number = await Queue.removeRepeatableByName(
+      QueueName.Worker,
+      "SentinelInsight:ScanForInsights",
+    );
+
+    expect(removedCount).toBe(1);
+    expect(queue.removeRepeatableByKey).toHaveBeenCalledTimes(1);
+    expect(queue.removeRepeatableByKey).toHaveBeenCalledWith(
+      "86b9a73a59ccbe97264b573",
+    );
+  });
+
+  /*
+   * Regression guard for the trap this method exists to avoid: BullMQ's
+   * removeRepeatableByKey() ZREMs the exact member it is given, so passing a
+   * job NAME (or a job id derived from it) matches nothing and silently
+   * no-ops. The key must be the one from getRepeatableJobs().
+   */
+  it("never passes the job name to removeRepeatableByKey", async () => {
+    queue.getRepeatableJobs.mockResolvedValue([
+      repeatable("SentinelInsight:ScanForInsights", "86b9a73a59ccbe97264b573"),
+    ]);
+
+    await Queue.removeRepeatableByName(
+      QueueName.Worker,
+      "SentinelInsight:ScanForInsights",
+    );
+
+    expect(queue.removeRepeatableByKey).not.toHaveBeenCalledWith(
+      "SentinelInsight:ScanForInsights",
+    );
+    // ...nor the ":"-sanitized form that Queue.removeJob() would have used.
+    expect(queue.removeRepeatableByKey).not.toHaveBeenCalledWith(
+      "SentinelInsight-ScanForInsights",
+    );
+  });
+
+  it("removes every repeatable sharing the name and returns the count", async () => {
+    queue.getRepeatableJobs.mockResolvedValue([
+      repeatable("SentinelInsight:ScanForInsights", "key-one"),
+      repeatable("SomeOther:Job", "key-two"),
+      repeatable("SentinelInsight:ScanForInsights", "key-three"),
+    ]);
+
+    const removedCount: number = await Queue.removeRepeatableByName(
+      QueueName.Worker,
+      "SentinelInsight:ScanForInsights",
+    );
+
+    expect(removedCount).toBe(2);
+    expect(
+      queue.removeRepeatableByKey.mock.calls.map((c: Array<string>) => {
+        return c[0];
+      }),
+    ).toEqual(["key-one", "key-three"]);
+  });
+
+  /*
+   * Idempotence is what lets this run on EVERY worker boot: once the legacy
+   * repeatable is gone (or on a fresh install that never had it), the sweep
+   * must be a cheap no-op rather than an error.
+   */
+  it("is a no-op when no repeatable has that name", async () => {
+    queue.getRepeatableJobs.mockResolvedValue([
+      repeatable("AIInsight:ScanForInsights", "aaaaaaaaaaaaaaaa"),
+    ]);
+
+    const removedCount: number = await Queue.removeRepeatableByName(
+      QueueName.Worker,
+      "SentinelInsight:ScanForInsights",
+    );
+
+    expect(removedCount).toBe(0);
+    expect(queue.removeRepeatableByKey).not.toHaveBeenCalled();
+  });
+
+  it("does not count a repeatable BullMQ reported as not removed", async () => {
+    queue.getRepeatableJobs.mockResolvedValue([
+      repeatable("SentinelInsight:ScanForInsights", "key-one"),
+    ]);
+    // BullMQ returns false when the key was already gone from the repeat zset.
+    queue.removeRepeatableByKey.mockResolvedValue(false);
+
+    const removedCount: number = await Queue.removeRepeatableByName(
+      QueueName.Worker,
+      "SentinelInsight:ScanForInsights",
+    );
+
+    expect(removedCount).toBe(0);
+  });
+
+  it("skips the Redis round trip when the name is empty", async () => {
+    const removedCount: number = await Queue.removeRepeatableByName(
+      QueueName.Worker,
+      "",
+    );
+
+    expect(removedCount).toBe(0);
+    expect(queue.getRepeatableJobs).not.toHaveBeenCalled();
+  });
+});
+
+describe("Queue.removeJob", () => {
+  let queue: MockBullQueue;
+
+  beforeAll(() => {
+    Queue.getQueue(QueueName.Worker);
+    queue = mockBullQueueInstances[0] as MockBullQueue;
+  });
+
+  beforeEach(() => {
+    queue.getJob.mockReset().mockResolvedValue(undefined);
+    queue.removeRepeatableByKey.mockReset().mockResolvedValue(true);
+  });
+
+  /*
+   * The repeat key is NOT a job id: it is either an md5 or a legacy
+   * "name:id:endDate:tz:pattern" string. Sanitizing ":" -> "-" (which the job
+   * id lookup must do, since BullMQ rejects colons in custom ids) would mangle
+   * the legacy form into a zset member that does not exist, and the removal
+   * would silently no-op. QueueWorkflow passes job.repeatJobKey straight in
+   * here, so the raw value has to survive.
+   */
+  it("passes the repeat key through unsanitized", async () => {
+    await Queue.removeJob(QueueName.Worker, "myjob:someid:0::*/5 * * * *");
+
+    expect(queue.removeRepeatableByKey).toHaveBeenCalledWith(
+      "myjob:someid:0::*/5 * * * *",
+    );
+  });
+
+  // The job-id lookup, by contrast, must use the sanitized id.
+  it("looks the one-off job up by its sanitized id", async () => {
+    await Queue.removeJob(QueueName.Worker, "myjob:someid");
+
+    expect(queue.getJob).toHaveBeenCalledWith("myjob-someid");
+  });
+});

package/Tests/Server/Infrastructure/SemaphorePermit.test.ts

@@ -0,0 +1,159 @@
+import Redis, { ClientType } from "../../../Server/Infrastructure/Redis";
+import Semaphore, {
+  SemaphorePermit,
+} from "../../../Server/Infrastructure/Semaphore";
+import { Semaphore as RedisSemaphore } from "redis-semaphore";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+interface MockPermit {
+  acquire: jest.Mock;
+  release: jest.Mock;
+}
+
+jest.mock("redis-semaphore", () => {
+  const actual: Record<string, unknown> = jest.requireActual(
+    "redis-semaphore",
+  ) as Record<string, unknown>;
+
+  return {
+    ...actual,
+    Semaphore: jest.fn().mockImplementation((): MockPermit => {
+      return {
+        acquire: jest.fn(async (): Promise<void> => {}),
+        release: jest.fn(async (): Promise<void> => {}),
+      };
+    }),
+  };
+});
+
+const redisSemaphoreConstructor: jest.MockedClass<typeof RedisSemaphore> =
+  RedisSemaphore as jest.MockedClass<typeof RedisSemaphore>;
+
+function mockRedisClient(): ClientType {
+  const client: ClientType = {} as ClientType;
+  jest.spyOn(Redis, "getClient").mockReturnValue(client);
+  return client;
+}
+
+function lastMockPermit(): MockPermit {
+  const result: unknown = redisSemaphoreConstructor.mock.results.at(-1)?.value;
+  return result as MockPermit;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  redisSemaphoreConstructor.mockClear();
+});
+
+describe("Semaphore distributed permits", () => {
+  test("constructs and acquires a fixed-size project pool with all options", async () => {
+    const client: ClientType = mockRedisClient();
+
+    const permit: SemaphorePermit = await Semaphore.acquirePermit({
+      key: "project-1",
+      namespace: "workflow-ai",
+      limit: 3,
+      lockTimeout: 65_000,
+      acquireTimeout: 250,
+      acquireAttemptsLimit: 1,
+      retryInterval: 50,
+    });
+
+    expect(redisSemaphoreConstructor).toHaveBeenCalledWith(
+      client,
+      "workflow-ai-project-1",
+      3,
+      {
+        lockTimeout: 65_000,
+        acquireTimeout: 250,
+        acquireAttemptsLimit: 1,
+        retryInterval: 50,
+      },
+    );
+    expect(lastMockPermit().acquire).toHaveBeenCalledTimes(1);
+    expect(permit).toBe(lastMockPermit());
+  });
+
+  test("uses the existing five-second lock default when none is supplied", async () => {
+    mockRedisClient();
+
+    await Semaphore.acquirePermit({
+      key: "project-1",
+      namespace: "workflow-ai",
+      limit: 3,
+    });
+
+    expect(redisSemaphoreConstructor).toHaveBeenCalledWith(
+      expect.anything(),
+      "workflow-ai-project-1",
+      3,
+      { lockTimeout: 5_000 },
+    );
+  });
+
+  test.each([0, -1, 1.5])(
+    "rejects invalid permit limit %p",
+    async (limit: number) => {
+      const getClient: jest.SpyInstance = jest.spyOn(Redis, "getClient");
+
+      await expect(
+        Semaphore.acquirePermit({
+          key: "project-1",
+          namespace: "workflow-ai",
+          limit,
+        }),
+      ).rejects.toThrow(/positive integer/i);
+
+      expect(getClient).not.toHaveBeenCalled();
+      expect(redisSemaphoreConstructor).not.toHaveBeenCalled();
+    },
+  );
+
+  test("rejects when Redis is not connected", async () => {
+    jest.spyOn(Redis, "getClient").mockReturnValue(null);
+
+    await expect(
+      Semaphore.acquirePermit({
+        key: "project-1",
+        namespace: "workflow-ai",
+        limit: 3,
+      }),
+    ).rejects.toThrow(/Redis client is not connected/i);
+
+    expect(redisSemaphoreConstructor).not.toHaveBeenCalled();
+  });
+
+  test("propagates acquisition failures without returning an unheld permit", async () => {
+    mockRedisClient();
+    const acquireError: Error = new Error("pool is full");
+    redisSemaphoreConstructor.mockImplementationOnce(() => {
+      return {
+        acquire: jest.fn(async (): Promise<void> => {
+          throw acquireError;
+        }),
+        release: jest.fn(async (): Promise<void> => {}),
+      } as unknown as RedisSemaphore;
+    });
+
+    await expect(
+      Semaphore.acquirePermit({
+        key: "project-1",
+        namespace: "workflow-ai",
+        limit: 3,
+      }),
+    ).rejects.toBe(acquireError);
+  });
+
+  test("releases the exact acquired permit", async () => {
+    mockRedisClient();
+    const permit: SemaphorePermit = await Semaphore.acquirePermit({
+      key: "project-1",
+      namespace: "workflow-ai",
+      limit: 3,
+    });
+
+    await Semaphore.releasePermit(permit);
+
+    expect(lastMockPermit().release).toHaveBeenCalledTimes(1);
+  });
+});