@oneuptime/common 12.0.11 → 12.0.13

package/Tests/Server/API/BaseAPIApiKeyAuth.test.ts

@@ -12,7 +12,6 @@ import {
 } from "../../../Server/Utils/Express";
 import Response from "../../../Server/Utils/Response";
 import { mockRouter } from "./Helpers";
-import ApiKeyPermission from "../../../Models/DatabaseModels/ApiKeyPermission";
 import LogPipeline from "../../../Models/DatabaseModels/LogPipeline";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import BadDataException from "../../../Types/Exception/BadDataException";
@@ -25,6 +24,19 @@ import UserType from "../../../Types/UserType";
 import { getJestSpyOn } from "../../Spy";
 import { beforeEach, describe, expect, it, jest } from "@jest/globals";
 
+/*
+ * PasswordHash has a known, pre-existing TS5.9 compile failure under ts-jest
+ * (Buffer vs BinaryLike) that breaks every suite whose import graph reaches
+ * it. Nothing here touches password hashing; stub the module before the
+ * service import graph drags it into compilation.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
 jest.mock("../../../Server/Utils/Express", () => {
   return {
     getRouter: () => {
@@ -225,12 +237,13 @@ describe("BaseAPI CRUD auth contract for the ApiKey header (issue #3004)", () =>
   ): void => {
     findApiKey.mockResolvedValue({ id: API_KEY_ID, projectId: PROJECT_ID });
 
-    const apiKeyPermission: ApiKeyPermission = new ApiKeyPermission();
-    apiKeyPermission.permission = permission;
-    apiKeyPermission.labels = [];
-    apiKeyPermission.isBlockPermission = false;
-
-    findApiKeyPermissions.mockResolvedValue([apiKeyPermission]);
+    findApiKeyPermissions.mockResolvedValue([
+      {
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      },
+    ]);
   };
 
   beforeEach(() => {
@@ -250,7 +263,7 @@ describe("BaseAPI CRUD auth contract for the ApiKey header (issue #3004)", () =>
     );
     findApiKeyPermissions = getJestSpyOn(
       ApiKeyPermissionService,
-      "findBy",
+      "findPermissionsByApiKeyId",
     ).mockResolvedValue([]);
     getJestSpyOn(GlobalConfigService, "findOneBy").mockResolvedValue(null);
 

package/Tests/Server/API/CommonAPIAuthGuard.test.ts

@@ -479,3 +479,293 @@ describe("CommonAPI.assertTenantScoped", () => {
     }).not.toThrow();
   });
 });
+
+/*
+ * Tests for CommonAPI.assertPermittedInProject — the third guard in the set.
+ *
+ * assertAuthenticatedProjectMember answers "are you in this project?" and
+ * assertResourceBelongsToProject answers "is this row in that project?".
+ * Neither answers "are you allowed to read this KIND of thing?", which is the
+ * question a CRUD read answers from the model's own access control lists and
+ * a custom route reading with `isRoot: true` skips entirely.
+ *
+ * The subtle part, and the reason this has its own tests: models routinely
+ * list Permission.Public as a reader (LlmProvider does, so the shared global
+ * providers stay visible), while getUserPermissions merges Public into EVERY
+ * caller's permission set — anonymous ones included. Intersecting the two
+ * lists as they come would therefore admit anybody. The guard first narrows
+ * the model's list to the permissions a team can actually grant inside a
+ * project.
+ */
+function buildPermittedProps(data: {
+  projectId: ObjectID;
+  granted: Array<Permission>;
+  blocked?: Array<Permission> | undefined;
+  isMasterAdmin?: boolean | undefined;
+}): DatabaseCommonInteractionProps {
+  const permissions: Array<UserPermission> = data.granted.map(
+    (permission: Permission) => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      } as UserPermission;
+    },
+  );
+
+  for (const blocked of data.blocked || []) {
+    permissions.push({
+      _type: "UserPermission",
+      permission: blocked,
+      labelIds: [],
+      isBlockPermission: true,
+    } as UserPermission);
+  }
+
+  const tenantPermission: UserTenantAccessPermission = {
+    _type: "UserTenantAccessPermission",
+    projectId: data.projectId,
+    permissions: permissions,
+  } as UserTenantAccessPermission;
+
+  const dictionary: Dictionary<UserTenantAccessPermission> = {};
+  dictionary[data.projectId.toString()] = tenantPermission;
+
+  return {
+    tenantId: data.projectId,
+    userId: ObjectID.generate(),
+    userTenantAccessPermission: dictionary,
+    isMasterAdmin: data.isMasterAdmin,
+  };
+}
+
+describe("CommonAPI.assertPermittedInProject", () => {
+  test("admits a caller holding one of the allowed permissions", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ProjectMember],
+        }),
+        allowedPermissions: [Permission.ProjectOwner, Permission.ProjectMember],
+      });
+    }).not.toThrow();
+  });
+
+  test("admits a caller holding any one of several allowed permissions", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ReadProjectIncident, Permission.SettingsViewer],
+        }),
+        allowedPermissions: [
+          Permission.ProjectOwner,
+          Permission.SettingsViewer,
+        ],
+      });
+    }).not.toThrow();
+  });
+
+  test("refuses a member of the project who holds none of them", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    const thrown: unknown = captureThrown(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ReadProjectIncident],
+        }),
+        allowedPermissions: [Permission.ProjectOwner, Permission.ProjectAdmin],
+      });
+    });
+
+    expect(thrown).toBeInstanceOf(NotAuthorizedException);
+    expect((thrown as Exception).message).toBe(
+      "You do not have permission to access this project's data.",
+    );
+  });
+
+  test("uses the caller-supplied message when one is given", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    const thrown: unknown = captureThrown(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [],
+        }),
+        allowedPermissions: [Permission.ProjectOwner],
+        errorMessage:
+          "You do not have permission to read this project's AI providers.",
+      });
+    });
+
+    expect((thrown as Exception).message).toBe(
+      "You do not have permission to read this project's AI providers.",
+    );
+  });
+
+  /*
+   * The regression this guard exists to prevent. Public is in many models'
+   * read lists and in every caller's permission set, so a naive intersection
+   * would always succeed.
+   */
+  test("Permission.Public in the allowed list does not admit an ordinary member", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ReadProjectIncident],
+        }),
+        allowedPermissions: [Permission.Public, Permission.ProjectOwner],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  test("Permission.Public in the allowed list does not admit an anonymous caller", () => {
+    const props: DatabaseCommonInteractionProps = {
+      tenantId: ObjectID.generate(),
+    };
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: props,
+        allowedPermissions: [Permission.Public],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  test("Permission.CurrentUser, which every logged-in caller carries, does not admit them either", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ReadProjectIncident],
+        }),
+        allowedPermissions: [Permission.CurrentUser, Permission.ProjectOwner],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  test("an allowed list with nothing tenant-assignable in it denies everyone", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ProjectOwner],
+        }),
+        allowedPermissions: [Permission.Public, Permission.CurrentUser],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  test("an empty allowed list denies everyone", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ProjectOwner],
+        }),
+        allowedPermissions: [],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  /*
+   * userTenantAccessPermission holds grants AND denials in one array,
+   * discriminated only by isBlockPermission. Reading it raw would count a
+   * team's explicit block row as a grant.
+   */
+  test("a BLOCK row for an allowed permission is not counted as a grant of it", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [Permission.ReadProjectIncident],
+          blocked: [Permission.ProjectOwner, Permission.ProjectMember],
+        }),
+        allowedPermissions: [Permission.ProjectOwner, Permission.ProjectMember],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  test("permissions granted in ANOTHER project do not count", () => {
+    const callersProjectId: ObjectID = ObjectID.generate();
+    const targetProjectId: ObjectID = ObjectID.generate();
+
+    const props: DatabaseCommonInteractionProps = buildPermittedProps({
+      projectId: callersProjectId,
+      granted: [Permission.ProjectOwner],
+    });
+
+    // The header names the target project; the grants are for another one.
+    props.tenantId = targetProjectId;
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: props,
+        allowedPermissions: [Permission.ProjectOwner],
+      });
+    }).toThrow(NotAuthorizedException);
+  });
+
+  test("a master admin bypasses the permission check", () => {
+    const projectId: ObjectID = ObjectID.generate();
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: buildPermittedProps({
+          projectId: projectId,
+          granted: [],
+          isMasterAdmin: true,
+        }),
+        allowedPermissions: [Permission.ProjectOwner],
+      });
+    }).not.toThrow();
+  });
+
+  /*
+   * The guard answers one question only. Membership is assertAuthenticated-
+   * ProjectMember's job, and a route must call both — this test documents
+   * that calling only this one is not enough.
+   */
+  test("does not itself check membership — that stays with assertAuthenticatedProjectMember", () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const props: DatabaseCommonInteractionProps = buildPermittedProps({
+      projectId: projectId,
+      granted: [Permission.ProjectOwner],
+    });
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: props,
+        allowedPermissions: [Permission.ProjectOwner],
+      });
+    }).not.toThrow();
+
+    props.userId = undefined;
+
+    expect(() => {
+      CommonAPI.assertPermittedInProject({
+        databaseProps: props,
+        allowedPermissions: [Permission.ProjectOwner],
+      });
+    }).not.toThrow();
+  });
+});

package/Tests/Server/API/MicrosoftTeamsManifest.test.ts

@@ -127,7 +127,7 @@ describe("MicrosoftTeamsAPI.getTeamsAppManifest", () => {
       expect(names).not.toContain("ChatMessage.Send.Chat");
     });
 
-    test("declares exactly the five expected resource-specific permissions", () => {
+    test("declares exactly the six expected resource-specific permissions", () => {
       const permissions: Array<JSONObject> =
         getResourceSpecificPermissions(getManifest());
       const names: Array<string> = permissions.map((permission: JSONObject) => {
@@ -140,6 +140,12 @@ describe("MicrosoftTeamsAPI.getTeamsAppManifest", () => {
           "Channel.Create.Group",
           "ChatMessage.Read.Chat",
           "ChatMember.Read.Chat",
+          /*
+           * Lets OneUptime verify, per team, that the installed OneUptime app
+           * is the package built from this deployment before telling an admin
+           * their app is missing.
+           */
+          "TeamsAppInstallation.Read.Group",
         ].sort(),
       );
     });