@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Server/API/UserTotpAuthAPI.test.ts

@@ -0,0 +1,427 @@
+import UserTotpAuthAPI from "../../../Server/API/UserTotpAuthAPI";
+import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
+import UserService from "../../../Server/Services/UserService";
+import TotpAuth from "../../../Server/Utils/TotpAuth";
+import {
+  NextFunction,
+  OneUptimeRequest,
+  OneUptimeResponse,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import Email from "../../../Types/Email";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ObjectID from "../../../Types/ObjectID";
+import UserTotpAuth from "../../../Models/DatabaseModels/UserTotpAuth";
+import User from "../../../Models/DatabaseModels/User";
+import * as OTPAuth from "otpauth";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * POST /user-totp-auth/validate — the endpoint that turns a scanned QR code
+ * into a working second factor.
+ *
+ * TotpAuth itself is deliberately NOT mocked here. The bug this endpoint
+ * failed on (issue #3275) lived precisely in the seam between what the QR code
+ * told the authenticator app and what the server recomputed, so a test that
+ * stubs the verifier proves nothing about it. The secret is generated by the
+ * real service path, the code is produced by parsing the stored otpauth:// URI
+ * exactly as an authenticator app would, and the endpoint gets the real thing.
+ *
+ * The second concern is ownership. `id` comes from the request body, so
+ * without the userId comparison any signed-in user could mark a stranger's
+ * pending TOTP row as verified using a code from their own phone — a second
+ * factor the victim does not hold. That check is asserted directly, and the
+ * assertion that matters is that isVerified is never written.
+ */
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+    setNoCacheHeaders: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/Services/UserTotpAuthService");
+jest.mock("../../../Server/Services/UserService");
+
+const VALIDATE_ROUTE: string = "/user-totp-auth/validate";
+
+const TOTP_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OWNER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const ATTACKER_ID: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+
+const OWNER_EMAIL: Email = new Email("owner@example.com");
+
+type CallValidateResult = {
+  thrown: unknown;
+  nextCallCount: number;
+};
+
+type CallValidateFunction = (data: {
+  body: Record<string, unknown>;
+  signedInUserId?: ObjectID | undefined;
+}) => Promise<CallValidateResult>;
+
+const callValidate: CallValidateFunction = async (data: {
+  body: Record<string, unknown>;
+  signedInUserId?: ObjectID | undefined;
+}): Promise<CallValidateResult> => {
+  const req: OneUptimeRequest = {
+    body: data.body,
+    params: {},
+    query: {},
+    headers: {},
+    userAuthorization: {
+      userId: data.signedInUserId || OWNER_ID,
+    },
+  } as unknown as OneUptimeRequest;
+
+  const res: OneUptimeResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    setHeader: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+  } as unknown as OneUptimeResponse;
+
+  const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+  await mockRouter
+    .match("post", VALIDATE_ROUTE)
+    .handlerFunction(req, res, next);
+
+  const nextMock: jest.Mock = next as unknown as jest.Mock;
+
+  return {
+    thrown: nextMock.mock.calls[0]?.[0],
+    nextCallCount: nextMock.mock.calls.length,
+  };
+};
+
+/*
+ * A pending enrolment, built the way the service builds one: a real secret and
+ * the real otpauth:// URI derived from it.
+ */
+type PendingEnrolmentFunction = (options?: { ownerId?: ObjectID }) => {
+  row: UserTotpAuth;
+  secret: string;
+  codeFromTheAuthenticatorApp: () => string;
+};
+
+const pendingEnrolment: PendingEnrolmentFunction = (options?: {
+  ownerId?: ObjectID;
+}) => {
+  const secret: string = TotpAuth.generateSecret();
+
+  const otpUrl: string = TotpAuth.generateUri({
+    secret: secret,
+    userEmail: OWNER_EMAIL,
+  });
+
+  const row: UserTotpAuth = new UserTotpAuth();
+  row.id = TOTP_ID;
+  row.userId = options?.ownerId || OWNER_ID;
+  row.twoFactorSecret = secret;
+  row.twoFactorOtpUrl = otpUrl;
+  row.isVerified = false;
+
+  return {
+    row: row,
+    secret: secret,
+    codeFromTheAuthenticatorApp: (): string => {
+      return (OTPAuth.URI.parse(otpUrl) as OTPAuth.TOTP).generate();
+    },
+  };
+};
+
+let findTotpById: jest.Mock;
+let updateTotpById: jest.Mock;
+let findUserById: jest.Mock;
+
+describe("POST /user-totp-auth/validate", () => {
+  beforeEach(() => {
+    mockRouter.routes.length = 0;
+
+    findTotpById = jest.fn();
+    updateTotpById = jest.fn(async () => {
+      return undefined;
+    });
+    findUserById = jest.fn();
+
+    UserTotpAuthService.findOneById = findTotpById as never;
+    UserTotpAuthService.updateOneById = updateTotpById as never;
+    UserTotpAuthService.getModel = jest
+      .fn()
+      .mockReturnValue({ tableName: "UserTotpAuth" }) as never;
+
+    UserService.findOneById = findUserById as never;
+
+    const owner: User = new User();
+    owner.id = OWNER_ID;
+    owner.email = OWNER_EMAIL;
+    findUserById.mockResolvedValue(owner as never);
+
+    new UserTotpAuthAPI();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("the route itself", () => {
+    test("is registered as a POST", () => {
+      expect(() => {
+        return mockRouter.match("post", VALIDATE_ROUTE);
+      }).not.toThrow();
+    });
+
+    /*
+     * Without an authentication middleware the handler would read
+     * `userAuthorization` off an unauthenticated request, the ownership
+     * comparison below would compare against `undefined`, and anybody could
+     * verify anybody's TOTP row.
+     */
+    test("is behind an authentication middleware", () => {
+      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares.length).toBe(
+        1,
+      );
+    });
+  });
+
+  describe("when the code is the one the user's app is showing", () => {
+    test("marks the enrolment verified", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeUndefined();
+
+      expect(updateTotpById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: TOTP_ID,
+          data: { isVerified: true },
+        }),
+      );
+
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalled();
+    });
+
+    /*
+     * Google Authenticator renders the code as "123 456" and the phone
+     * clipboard keeps the space. This is the same enrolment, pasted.
+     */
+    test("accepts the code as the phone's clipboard hands it over", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const code: string = enrolment.codeFromTheAuthenticatorApp();
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: `${code.slice(0, 3)} ${code.slice(3)}`,
+        },
+      });
+
+      expect(result.thrown).toBeUndefined();
+      expect(updateTotpById).toHaveBeenCalled();
+    });
+
+    test("reads the secret with root privileges, since the column is unreadable otherwise", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(findTotpById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          select: expect.objectContaining({ twoFactorSecret: true }),
+          props: { isRoot: true },
+        }),
+      );
+    });
+  });
+
+  describe("when the code is wrong", () => {
+    test("fails with Invalid code and leaves the enrolment unverified", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "000000" },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect((result.thrown as Exception).message).toBe("Invalid code");
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test.each([
+      ["a missing code", undefined],
+      ["an empty code", ""],
+      ["a truncated code", "1234"],
+    ])(
+      "rejects %s without verifying anything",
+      async (_name: string, code: string | undefined) => {
+        const enrolment: ReturnType<PendingEnrolmentFunction> =
+          pendingEnrolment();
+
+        findTotpById.mockResolvedValue(enrolment.row as never);
+
+        const result: CallValidateResult = await callValidate({
+          body: { id: TOTP_ID.toString(), code: code },
+        });
+
+        expect(result.thrown).toBeInstanceOf(BadDataException);
+        expect(updateTotpById).not.toHaveBeenCalled();
+      },
+    );
+
+    /*
+     * A code that is valid for a DIFFERENT enrolment. This is what an attacker
+     * with their own authenticator would submit.
+     */
+    test("rejects a code that is valid for somebody else's secret", async () => {
+      const victim: ReturnType<PendingEnrolmentFunction> = pendingEnrolment();
+      const attacker: ReturnType<PendingEnrolmentFunction> = pendingEnrolment();
+
+      findTotpById.mockResolvedValue(victim.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: attacker.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("ownership", () => {
+    /*
+     * `id` is attacker-controlled. If the handler stopped comparing userId, a
+     * signed-in attacker could point this endpoint at any pending enrolment in
+     * the database and verify it with a code from their own phone.
+     */
+    test("refuses to verify an enrolment belonging to another user", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> = pendingEnrolment({
+        ownerId: OWNER_ID,
+      });
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+        signedInUserId: ATTACKER_ID,
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("does not reveal that the enrolment exists", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> = pendingEnrolment({
+        ownerId: OWNER_ID,
+      });
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+        signedInUserId: ATTACKER_ID,
+      });
+
+      expect((result.thrown as Exception).message).toBe(
+        "Two factor auth not found",
+      );
+    });
+  });
+
+  describe("when the record is not usable", () => {
+    test("fails when no such enrolment exists", async () => {
+      findTotpById.mockResolvedValue(null as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "123456" },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("fails when the owning user has no email to label the entry with", async () => {
+      const enrolment: ReturnType<PendingEnrolmentFunction> =
+        pendingEnrolment();
+
+      findTotpById.mockResolvedValue(enrolment.row as never);
+
+      const emailless: User = new User();
+      emailless.id = OWNER_ID;
+      findUserById.mockResolvedValue(emailless as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: {
+          id: TOTP_ID.toString(),
+          code: enrolment.codeFromTheAuthenticatorApp(),
+        },
+      });
+
+      expect(result.thrown).toBeInstanceOf(BadDataException);
+      expect(updateTotpById).not.toHaveBeenCalled();
+    });
+
+    test("surfaces the failure through next() rather than crashing the request", async () => {
+      findTotpById.mockRejectedValue(new Error("database is on fire") as never);
+
+      const result: CallValidateResult = await callValidate({
+        body: { id: TOTP_ID.toString(), code: "123456" },
+      });
+
+      expect(result.nextCallCount).toBe(1);
+      expect(result.thrown).toBeInstanceOf(Error);
+    });
+  });
+});

package/Tests/Server/Infrastructure/InMemoryTTLCache.test.ts

@@ -0,0 +1,158 @@
+import InMemoryTTLCache from "../../../Server/Infrastructure/InMemoryTTLCache";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * Contract under test — the bounded TTL cache the telemetry ingest rule
+ * caches (log/trace pipelines, drop filters, scrub rules, metric rules)
+ * sit on. Two properties matter for those callers:
+ *
+ * 1. Expiry physically deletes: a read past the TTL must both miss AND
+ *    shrink the store, or per-project entries accumulate for every tenant
+ *    ever seen by a long-lived ingest process.
+ * 2. Capacity is a hard cap with oldest-write eviction, so the cache can
+ *    never grow past maxEntries no matter how many distinct keys arrive.
+ */
+
+/*
+ * Minimal structural view of a jest spy — the @jest/globals and @types/jest
+ * spy types disagree in this repo, so annotate with just the surface these
+ * tests use.
+ */
+type NowSpyLike = {
+  mockReturnValue: (value: number) => unknown;
+  mockRestore: () => void;
+};
+
+function spyNow(value: number): NowSpyLike {
+  const spy: NowSpyLike = jest.spyOn(Date, "now") as unknown as NowSpyLike;
+  spy.mockReturnValue(value);
+  return spy;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("InMemoryTTLCache TTL behavior", () => {
+  test("get returns the value within its TTL", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+
+    expect(cache.get("a")).toBe("value-a");
+    expect(cache.has("a")).toBe(true);
+    expect(cache.size()).toBe(1);
+  });
+
+  test("get past the TTL misses AND physically deletes the entry", () => {
+    const t0: number = 1_000_000;
+    const nowSpy: NowSpyLike = spyNow(t0);
+
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+    cache.set("a", "value-a", 1_000);
+    expect(cache.size()).toBe(1);
+
+    // Boundary: at exactly expiresAt the entry is still valid (strict >).
+    nowSpy.mockReturnValue(t0 + 1_000);
+    expect(cache.get("a")).toBe("value-a");
+    expect(cache.size()).toBe(1);
+
+    nowSpy.mockReturnValue(t0 + 1_001);
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.size()).toBe(0);
+  });
+
+  test("has() reports false for an expired entry and deletes it", () => {
+    const t0: number = 1_000_000;
+    const nowSpy: NowSpyLike = spyNow(t0);
+
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+    cache.set("a", "value-a", 1_000);
+
+    nowSpy.mockReturnValue(t0 + 5_000);
+    expect(cache.has("a")).toBe(false);
+    expect(cache.size()).toBe(0);
+  });
+});
+
+describe("InMemoryTTLCache capacity eviction", () => {
+  test("insert beyond capacity evicts the oldest key", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.set("b", "value-b", 60_000);
+    cache.set("c", "value-c", 60_000);
+    cache.set("d", "value-d", 60_000);
+
+    expect(cache.size()).toBe(3);
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.get("b")).toBe("value-b");
+    expect(cache.get("c")).toBe("value-c");
+    expect(cache.get("d")).toBe("value-d");
+  });
+
+  test("re-setting an existing key refreshes insertion order so it is not the eviction victim", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.set("b", "value-b", 60_000);
+    cache.set("c", "value-c", 60_000);
+
+    // Overwrite at capacity: no eviction, "a" moves to newest position.
+    cache.set("a", "value-a2", 60_000);
+    expect(cache.size()).toBe(3);
+    expect(cache.get("b")).toBe("value-b");
+    expect(cache.get("c")).toBe("value-c");
+
+    // Next new key evicts "b" (now the oldest), not the refreshed "a".
+    cache.set("d", "value-d", 60_000);
+    expect(cache.size()).toBe(3);
+    expect(cache.get("a")).toBe("value-a2");
+    expect(cache.get("b")).toBeUndefined();
+    expect(cache.get("c")).toBe("value-c");
+    expect(cache.get("d")).toBe("value-d");
+  });
+});
+
+describe("InMemoryTTLCache basics", () => {
+  test("values are stored by reference", () => {
+    const cache: InMemoryTTLCache<Array<string>> = new InMemoryTTLCache<
+      Array<string>
+    >(3);
+
+    const value: Array<string> = [];
+    cache.set("a", value, 60_000);
+
+    expect(cache.get("a")).toBe(value);
+  });
+
+  test("delete removes an entry", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.delete("a");
+
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.has("a")).toBe(false);
+    expect(cache.size()).toBe(0);
+  });
+
+  test("clear empties the cache", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    cache.set("a", "value-a", 60_000);
+    cache.set("b", "value-b", 60_000);
+    cache.clear();
+
+    expect(cache.size()).toBe(0);
+    expect(cache.get("a")).toBeUndefined();
+    expect(cache.get("b")).toBeUndefined();
+  });
+
+  test("has returns false for a key that was never set", () => {
+    const cache: InMemoryTTLCache<string> = new InMemoryTTLCache<string>(3);
+
+    expect(cache.has("missing")).toBe(false);
+    expect(cache.get("missing")).toBeUndefined();
+  });
+});

package/Tests/Server/Infrastructure/Postgres/DeviceRoleAndDeclaredLinkParentMigration.test.ts

@@ -20,16 +20,14 @@ import { AddDeviceRoleAndDeclaredLinkParent1787400000000 } from "../../../../Ser
  * either would silently restate every device and every link in every
  * project as something an operator had chosen.
  *
- * The second is ORDERING. This is the newest registered migration, so it
- * inherits the guard that used to live in
- * EpisodeMemberNotifyIndexesMigration.test.ts: its timestamp must sort
- * above every other. A migration generated with `generate-postgres-
- * migration` carries a WALL-CLOCK timestamp, and the recent migrations in
- * this repo use hand-picked round numbers that run ahead of it — so the
- * generated file lands below several already-registered migrations unless
- * somebody renumbers it. That is exactly what happened to this one.
- * Whoever adds the next migration should move this test's ordering block
- * to theirs.
+ * The second is REGISTRATION: an import that never reaches the default
+ * export array leaves the migration unregistered, and it silently never
+ * runs.
+ *
+ * The ordering guard this file used to carry — "this is the newest
+ * migration, so its timestamp must sort above every other" — has moved on
+ * to AddNetworkDeviceReachabilityColumnsMigration.test.ts, which is now the
+ * newest. Whoever adds the next migration should move it again.
  */
 
 const MIGRATION_PATH: string = path.join(
@@ -39,15 +37,6 @@ const MIGRATION_PATH: string = path.join(
 
 const SOURCE: string = fs.readFileSync(MIGRATION_PATH, "utf8");
 
-interface MigrationClass {
-  name: string;
-}
-
-function timestampOf(migrationClass: MigrationClass): number | null {
-  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
-  return match ? Number(match[1]) : null;
-}
-
 describe("the columns it adds", () => {
   test("NetworkDevice gains deviceRole", () => {
     expect(SOURCE).toContain(
@@ -190,50 +179,10 @@ describe("the migration runs", () => {
     );
   });
 
-  // The guard described in the header. Hand it to the next migration.
-  test("its timestamp sorts after every other registered migration", () => {
-    const ourTimestamp: number | null = timestampOf(
-      AddDeviceRoleAndDeclaredLinkParent1787400000000,
-    );
-
-    expect(ourTimestamp).not.toBeNull();
-
-    const otherTimestamps: Array<number> = [];
-
-    for (const migrationClass of SchemaMigrations) {
-      if (migrationClass === AddDeviceRoleAndDeclaredLinkParent1787400000000) {
-        continue;
-      }
-
-      const timestamp: number | null = timestampOf(
-        migrationClass as MigrationClass,
-      );
-
-      if (timestamp !== null) {
-        otherTimestamps.push(timestamp);
-      }
-    }
-
-    /*
-     * Math.max() of an empty list is -Infinity, which every timestamp beats.
-     * Prove the list was actually enumerated before leaning on the maximum.
-     */
-    expect(otherTimestamps.length).toBeGreaterThan(100);
-
-    expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
-  });
-
-  test("it is registered last, matching that timestamp", () => {
-    expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
-      AddDeviceRoleAndDeclaredLinkParent1787400000000,
-    );
-  });
-
   /*
    * ...and the timestamp in the class name is the one on disk. A class
    * renamed without renaming its file (or two migrations landing on the
-   * same timestamp) leaves the ordering above asserting something that is
-   * not what actually runs.
+   * same timestamp) runs in an order nobody declared.
    */
   test("exactly one file on disk carries its timestamp, and it is this one", () => {
     const directory: string = path.dirname(MIGRATION_PATH);