@oneuptime/common 12.0.1 → 12.0.3

package/Tests/Server/Utils/APIKey/AccessPermission.test.ts

@@ -0,0 +1,267 @@
+import {
+  afterAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+import APIKeyAccessPermission from "../../../../Server/Utils/APIKey/AccessPermission";
+import ApiKeyPermissionService from "../../../../Server/Services/ApiKeyPermissionService";
+import APIKeyPermission from "../../../../Models/DatabaseModels/ApiKeyPermission";
+import Label from "../../../../Models/DatabaseModels/Label";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserGlobalAccessPermission,
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { getJestSpyOn } from "../../../Spy";
+
+/*
+ * This class turns an API key into the permission set a request runs under, so
+ * every method here is a privilege-granting decision. The security invariant
+ * that must hold across all of them: a *default* (ordinary) API key is never
+ * silently handed ProjectOwner, while a *master* key deliberately is. A
+ * regression that leaks ProjectOwner into the default path would give every API
+ * key full control of the project; one that dropped it from the master path
+ * would break trusted internal automation. Both directions are pinned below.
+ *
+ * getApiTenantAccessPermission also reshapes stored permission rows into the
+ * runtime UserPermission shape (labels -> labelIds, block flag preserved). That
+ * mapping is where a dropped label would quietly widen a scoped permission, so
+ * it is tested against a spied service rather than a live database.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const apiKeyId: ObjectID = ObjectID.generate();
+
+const permissionValues: (
+  permissions: Array<UserPermission>,
+) => Array<Permission> = (
+  permissions: Array<UserPermission>,
+): Array<Permission> => {
+  return permissions.map((p: UserPermission) => {
+    return p.permission;
+  });
+};
+
+describe("APIKeyAccessPermission.getDefaultApiGlobalPermission", () => {
+  it("grants Public, User and CurrentUser for the project", async () => {
+    const perm: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    expect(perm._type).toBe("UserGlobalAccessPermission");
+    expect(
+      perm.projectIds.map((p: ObjectID) => {
+        return p.toString();
+      }),
+    ).toEqual([projectId.toString()]);
+    expect(perm.globalPermissions).toEqual([
+      Permission.Public,
+      Permission.User,
+      Permission.CurrentUser,
+    ]);
+  });
+
+  it("does NOT grant ProjectOwner to an ordinary key", async () => {
+    // The core boundary: a default key must never be an owner.
+    const perm: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+    expect(perm.globalPermissions).not.toContain(Permission.ProjectOwner);
+  });
+});
+
+describe("APIKeyAccessPermission.getMasterKeyApiGlobalPermission", () => {
+  it("grants everything the default key has, plus ProjectOwner", async () => {
+    const master: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getMasterKeyApiGlobalPermission(projectId);
+    const def: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    // Superset: no default grant is lost when elevating to master.
+    for (const p of def.globalPermissions) {
+      expect(master.globalPermissions).toContain(p);
+    }
+    // The one deliberate elevation.
+    expect(master.globalPermissions).toContain(Permission.ProjectOwner);
+  });
+
+  it("scopes to exactly the one project", async () => {
+    const master: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getMasterKeyApiGlobalPermission(projectId);
+    expect(
+      master.projectIds.map((p: ObjectID) => {
+        return p.toString();
+      }),
+    ).toEqual([projectId.toString()]);
+  });
+});
+
+describe("APIKeyAccessPermission.getMasterApiTenantAccessPermission", () => {
+  it("elevates the default tenant permission with ProjectOwner", async () => {
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getMasterApiTenantAccessPermission(
+        projectId,
+      );
+
+    expect(perm._type).toBe("UserTenantAccessPermission");
+    expect(perm.projectId.toString()).toBe(projectId.toString());
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.ProjectOwner,
+    );
+    // The default tenant baseline is retained alongside the elevation.
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.CurrentUser,
+    );
+  });
+});
+
+describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
+  const spyFindBy: jest.SpyInstance = getJestSpyOn(
+    ApiKeyPermissionService,
+    "findBy",
+  );
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    jest.restoreAllMocks();
+  });
+
+  const makeRow: (data: {
+    permission: Permission;
+    labelIds?: Array<ObjectID>;
+    isBlockPermission?: boolean;
+  }) => APIKeyPermission = (data: {
+    permission: Permission;
+    labelIds?: Array<ObjectID>;
+    isBlockPermission?: boolean;
+  }): APIKeyPermission => {
+    const row: APIKeyPermission = new APIKeyPermission();
+    row.permission = data.permission;
+    if (data.labelIds) {
+      row.labels = data.labelIds.map((id: ObjectID) => {
+        const label: Label = new Label();
+        label.id = id;
+        return label;
+      });
+    }
+    row.isBlockPermission = data.isBlockPermission ?? false;
+    return row;
+  };
+
+  it("queries the permissions for exactly this api key", async () => {
+    spyFindBy.mockResolvedValue([] as never);
+
+    await APIKeyAccessPermission.getApiTenantAccessPermission(
+      projectId,
+      apiKeyId,
+    );
+
+    expect(spyFindBy).toHaveBeenCalledTimes(1);
+    const arg: { query: { apiKeyId: ObjectID } } = spyFindBy.mock
+      .calls[0]![0] as { query: { apiKeyId: ObjectID } };
+    expect(arg.query.apiKeyId.toString()).toBe(apiKeyId.toString());
+  });
+
+  it("returns just the default baseline when the key has no permissions", async () => {
+    spyFindBy.mockResolvedValue([] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    // No stored rows -> no ProjectOwner. An empty key is not an owner.
+    expect(permissionValues(perm.permissions)).not.toContain(
+      Permission.ProjectOwner,
+    );
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.CurrentUser,
+    );
+  });
+
+  it("maps each stored permission row onto the tenant permission", async () => {
+    const labelId: ObjectID = ObjectID.generate();
+    spyFindBy.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [labelId],
+        isBlockPermission: false,
+      }),
+    ] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    expect(mapped).toBeDefined();
+    /*
+     * The label scope must survive the mapping, or the permission silently
+     * widens from "these labels" to "all".
+     */
+    expect(
+      mapped!.labelIds.map((l: ObjectID) => {
+        return l.toString();
+      }),
+    ).toEqual([labelId.toString()]);
+  });
+
+  it("preserves the block flag so a deny row stays a deny row", async () => {
+    spyFindBy.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [],
+        isBlockPermission: true,
+      }),
+    ] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    // Flipping a block permission to an allow would invert an admin's intent.
+    expect(mapped!.isBlockPermission).toBe(true);
+  });
+
+  it("treats a row with no labels as an empty (unscoped) label set", async () => {
+    const row: APIKeyPermission = new APIKeyPermission();
+    row.permission = Permission.CreateProjectIncident;
+    // labels intentionally left undefined.
+    row.isBlockPermission = false;
+    spyFindBy.mockResolvedValue([row] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    expect(mapped).toBeDefined();
+    // No crash on undefined labels, and it becomes [] rather than undefined.
+    expect(mapped!.labelIds).toEqual([]);
+  });
+});

package/Tests/Server/Utils/Database/ProjectScopedReferenceValidator.test.ts

@@ -1,25 +1,36 @@
 import ProjectScopedReferenceValidator from "../../../../Server/Utils/Database/ProjectScopedReferenceValidator";
+import DatabaseService from "../../../../Server/Services/DatabaseService";
 import IncidentSeverityService from "../../../../Server/Services/IncidentSeverityService";
 import IncidentStateService from "../../../../Server/Services/IncidentStateService";
 import MonitorStatusService from "../../../../Server/Services/MonitorStatusService";
+import UserService from "../../../../Server/Services/UserService";
+import DatabaseBaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import IncidentSeverity from "../../../../Models/DatabaseModels/IncidentSeverity";
 import IncidentState from "../../../../Models/DatabaseModels/IncidentState";
 import MonitorStatus from "../../../../Models/DatabaseModels/MonitorStatus";
+import User from "../../../../Models/DatabaseModels/User";
 import BadDataException from "../../../../Types/Exception/BadDataException";
+import Name from "../../../../Types/Name";
 import ObjectID from "../../../../Types/ObjectID";
 import { afterEach, describe, expect, it, jest } from "@jest/globals";
 
 /*
  * Contract under test: an incident (or alert, or scheduled maintenance event)
  * stores the id of its state, its severity and the monitor status it switches
- * monitors to. Saving one that belongs to a *different* project is what leaves
- * the referenced project undeletable — deleting that project cascades into the
- * record, the row here still points at it, and the ON DELETE NO ACTION foreign
- * key refuses the delete with 23503.
+ * monitors to. Two things can be wrong with one of those ids, and the guard
+ * refuses both.
  *
- * The check has to stay narrow in the same way MonitorStepsProjectValidator
- * is: an id that matches no row at all must keep saving, otherwise a record
- * that already points at something deleted can never be saved back into shape.
+ * An id belonging to a *different* project is what leaves the referenced
+ * project undeletable — deleting that project cascades into the record, the row
+ * here still points at it, and the ON DELETE NO ACTION foreign key refuses the
+ * delete with 23503.
+ *
+ * An id that exists NOWHERE is issue #3039: the REST API took any uuid for
+ * these, and the write then failed as a raw foreign key violation deep in
+ * Postgres — or, for ids stored in a JSON blob with no foreign key behind them,
+ * saved fine and blew up much later inside the probe worker. Rejecting it here
+ * names the id instead. Callers whose reference is allowed to dangle opt out
+ * per reference with `mustExist: false`.
  */
 
 const PROJECT_ID: ObjectID = new ObjectID(
@@ -34,6 +45,7 @@ const FOREIGN_SEVERITY_ID: string = "cfc2f04f-79cb-4344-8c54-dafe5e3a290c";
 const FOREIGN_STATE_ID: string = "a2eb67d4-bd2e-4186-9187-dad799c9316c";
 const FOREIGN_STATUS_ID: string = "1a1cf3f2-0e35-4a1e-98a1-3f0f8b5f7f9e";
 const UNKNOWN_ID: string = "9c0ba0b3-2f8e-4c02-a8d5-6a4d2f5b9c11";
+const OWN_USER_ID: string = "7c2f6b40-6a1b-4f18-9d0e-2c5ba2d3f0a7";
 
 const incidentSeverity: (
   id: string,
@@ -172,17 +184,200 @@ describe("ProjectScopedReferenceValidator", () => {
     ).resolves.toBeUndefined();
   });
 
-  it("leaves an id that matches no record alone", async () => {
+  it("rejects an id that matches no record at all", async () => {
+    /*
+     * Issue #3039. This used to be allowed through on purpose, and the write
+     * then either came back as an opaque foreign key violation from Postgres or
+     * — in a JSON column with no foreign key — saved and failed later, at run
+     * time, with nothing reported to whoever supplied the id.
+     */
+    mockLookups({ incidentSeverities: [] });
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        subject: "incident",
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID,
+            service: IncidentSeverityService,
+          },
+        ],
+      }),
+    ).rejects.toThrow(BadDataException);
+  });
+
+  it("accepts an UPPERCASE uuid for a record Postgres reads back lower-cased", async () => {
+    /*
+     * ObjectID keeps whatever case it was handed — its validation regex is
+     * case-insensitive — and Postgres compares `uuid` by parsed value, so an
+     * uppercase id in the payload selects the row fine but reads back
+     * lower-cased. Comparing the two verbatim reported a record that plainly
+     * exists as missing, and the API answered "does not exist" for an id the
+     * caller had just read out of a GET response.
+     */
+    mockLookups({
+      incidentSeverities: [incidentSeverity(OWN_SEVERITY_ID, PROJECT_ID)],
+    });
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: OWN_SEVERITY_ID.toUpperCase(),
+            service: IncidentSeverityService,
+          },
+        ],
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("echoes the id as the caller wrote it when reporting it missing", async () => {
+    mockLookups({ incidentSeverities: [] });
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID.toUpperCase(),
+            service: IncidentSeverityService,
+          },
+        ],
+      }),
+    ).rejects.toThrow(`Incident Severity "${UNKNOWN_ID.toUpperCase()}"`);
+  });
+
+  it("names the missing id in the rejection so the caller can find it", async () => {
+    mockLookups({ incidentSeverities: [] });
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        subject: "incident",
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID,
+            service: IncidentSeverityService,
+          },
+        ],
+      }),
+    ).rejects.toThrow(
+      `This incident references records that do not exist: Incident Severity "${UNKNOWN_ID}". Please pick values that exist in this project and try again.`,
+    );
+  });
+
+  it("leaves a missing id alone when the caller opts out with mustExist false", async () => {
+    /*
+     * The opt-out exists for references with no foreign key behind them, where
+     * a stored id really can dangle (deleting a monitor status does not rewrite
+     * the monitor criteria that name it). Refusing those would stop a user
+     * saving their way out of a record that was already broken.
+     */
+    mockLookups({ incidentSeverities: [] });
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID,
+            service: IncidentSeverityService,
+            mustExist: false,
+          },
+        ],
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("keeps the strictest requirement when the same id arrives twice", async () => {
     /*
-     * A record that already points at something deleted must stay saveable —
-     * refusing unknown ids would trap the user. The not-null and foreign key
-     * checks report that case on their own.
+     * Two monitor criteria can name the same status, one operative and one not.
+     * They collapse to a single lookup, and the one that requires the record to
+     * exist must not be dropped by the one that does not.
      */
     mockLookups({ incidentSeverities: [] });
 
     await expect(
       ProjectScopedReferenceValidator.validateReferencesBelongToProject({
         projectId: PROJECT_ID,
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID,
+            service: IncidentSeverityService,
+            mustExist: false,
+          },
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID,
+            service: IncidentSeverityService,
+            mustExist: true,
+          },
+        ],
+      }),
+    ).rejects.toThrow("do not exist");
+  });
+
+  it("reports a foreign reference and a missing one in the same message", async () => {
+    /*
+     * A payload with several bad ids should not have to be fixed one
+     * round-trip at a time.
+     */
+    mockLookups({
+      incidentSeverities: [
+        incidentSeverity(FOREIGN_SEVERITY_ID, OTHER_PROJECT_ID),
+      ],
+    });
+
+    let message: string = "";
+
+    try {
+      await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        subject: "incident",
+        references: [
+          {
+            modelName: "Incident Severity",
+            id: FOREIGN_SEVERITY_ID,
+            service: IncidentSeverityService,
+          },
+          {
+            modelName: "Incident Severity",
+            id: UNKNOWN_ID,
+            service: IncidentSeverityService,
+          },
+        ],
+      });
+    } catch (error) {
+      message = (error as BadDataException).message;
+    }
+
+    expect(message).toContain(
+      'belong to a different project: Incident Severity "Critical"',
+    );
+    expect(message).toContain(
+      `do not exist: Incident Severity "${UNKNOWN_ID}"`,
+    );
+  });
+
+  it("does not require a record to exist when its project is unknown", async () => {
+    /*
+     * Same reason the cross-project half is skipped: root and internal writes
+     * do not always carry a project, and the guard must stay out of the way
+     * rather than guess.
+     */
+    const { severityFindBy } = mockLookups({ incidentSeverities: [] });
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: undefined,
         references: [
           {
             modelName: "Incident Severity",
@@ -192,6 +387,52 @@ describe("ProjectScopedReferenceValidator", () => {
         ],
       }),
     ).resolves.toBeUndefined();
+
+    expect(severityFindBy).not.toHaveBeenCalled();
+  });
+
+  it("checks existence against a model that has no project of its own", async () => {
+    /*
+     * Monitor criteria can name owner *users*, and User has no tenant column.
+     * The cross-project comparison has to be skipped for those — comparing an
+     * absent projectId against the write's project would report every user as
+     * belonging to a different project — while the existence check still runs.
+     */
+    const user: User = new User();
+    user._id = OWN_USER_ID;
+    user.name = new Name("Alice");
+
+    jest.spyOn(UserService, "findBy").mockResolvedValue([user] as never);
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        references: [
+          {
+            modelName: "User",
+            id: OWN_USER_ID,
+            service:
+              UserService as unknown as DatabaseService<DatabaseBaseModel>,
+          },
+        ],
+      }),
+    ).resolves.toBeUndefined();
+
+    jest.spyOn(UserService, "findBy").mockResolvedValue([] as never);
+
+    await expect(
+      ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: PROJECT_ID,
+        references: [
+          {
+            modelName: "User",
+            id: UNKNOWN_ID,
+            service:
+              UserService as unknown as DatabaseService<DatabaseBaseModel>,
+          },
+        ],
+      }),
+    ).rejects.toThrow(`User "${UNKNOWN_ID}"`);
   });
 
   it("reports every foreign reference in a single message", async () => {
@@ -272,9 +513,15 @@ describe("ProjectScopedReferenceValidator", () => {
   it("looks each model up once, with every id it was asked about", async () => {
     /*
      * These run on the incident create path, so three references must not mean
-     * three round trips per model.
+     * three round trips per model. Both ids are returned so the existence check
+     * has nothing to complain about and the call reaches its end.
      */
-    const { severityFindBy } = mockLookups({ incidentSeverities: [] });
+    const { severityFindBy } = mockLookups({
+      incidentSeverities: [
+        incidentSeverity(OWN_SEVERITY_ID, PROJECT_ID),
+        incidentSeverity(FOREIGN_SEVERITY_ID, PROJECT_ID),
+      ],
+    });
 
     await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
       projectId: PROJECT_ID,