@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Server/Infrastructure/Postgres/FixTotpOtpUrlAlgorithmMigration.test.ts

@@ -0,0 +1,315 @@
+import { FixTotpOtpUrlAlgorithm1787700000000 } from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/1787700000000-FixTotpOtpUrlAlgorithm";
+import SchemaMigrations from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import TotpAuth from "../../../../Server/Utils/TotpAuth";
+import Email from "../../../../Types/Email";
+import * as OTPAuth from "otpauth";
+import { MigrationInterface, QueryRunner } from "typeorm";
+import fs from "fs";
+import path from "path";
+import { beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The data repair behind the code fix.
+ *
+ * A row created before the fix still has `algorithm=SHA256` in the URL its QR
+ * code is rendered from. That no longer locks anyone out — verification tries
+ * SHA1 first, which is what those phones were emitting all along, and the tests
+ * below prove both a phone and a conforming app get in either way. What the
+ * rewrite buys is a stored URL that stops lying, which matters for the apps
+ * that DO honour the parameter and have no SHA256.
+ *
+ * Two properties are load-bearing and both are asserted here:
+ *
+ *   1. the secret is untouched, so an app that already scanned the old QR code
+ *      keeps working (verification accepts SHA1 and legacy SHA256 either way);
+ *   2. verified rows are left alone. Their QR is never displayed again — the
+ *      Verify action only exists for unverified entries — so the stored URL is
+ *      a record of what the user's authenticator actually holds, and rewriting
+ *      it would falsify that record for no benefit.
+ *
+ * The statements are inspected rather than executed: these tests must run
+ * without a database, and what can go wrong here is the WHERE clause, not
+ * Postgres' REPLACE().
+ *
+ * This file also carries the ORDERING guard, handed on from
+ * AddNetworkDeviceReachabilityColumnsMigration.test.ts: this is the newest
+ * registered migration, so its timestamp must sort above every other one.
+ * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
+ * recent migrations here use hand-picked round numbers that already run ahead
+ * of it — so a generated file lands BELOW several registered migrations
+ * unless somebody renumbers it, and runs out of order without anything saying
+ * so. Whoever adds the next migration should move this block to theirs.
+ */
+
+const MIGRATION_TIMESTAMP: string = "1787700000000";
+
+const MIGRATION_DIRECTORY: string = path.join(
+  __dirname,
+  "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
+);
+
+interface MigrationClass {
+  name: string;
+}
+
+function timestampOf(migrationClass: MigrationClass): number | null {
+  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
+  return match ? Number(match[1]) : null;
+}
+
+type CapturedQueryRunner = {
+  runner: QueryRunner;
+  queries: Array<string>;
+};
+
+type MockQueryRunnerFunction = () => CapturedQueryRunner;
+
+const mockQueryRunner: MockQueryRunnerFunction = (): CapturedQueryRunner => {
+  const queries: Array<string> = [];
+
+  return {
+    queries: queries,
+    runner: {
+      query: async (sql: string): Promise<void> => {
+        queries.push(sql);
+      },
+    } as unknown as QueryRunner,
+  };
+};
+
+const migration: FixTotpOtpUrlAlgorithm1787700000000 =
+  new FixTotpOtpUrlAlgorithm1787700000000();
+
+let up: CapturedQueryRunner;
+let down: CapturedQueryRunner;
+
+describe("FixTotpOtpUrlAlgorithm migration", () => {
+  beforeEach(async () => {
+    up = mockQueryRunner();
+    down = mockQueryRunner();
+
+    await migration.up(up.runner);
+    await migration.down(down.runner);
+  });
+
+  /*
+   * TypeORM matches migrations by this name. A mismatch between the class name
+   * and the `name` property makes the migration run again on every boot.
+   */
+  test("names itself consistently so it is recorded as run", () => {
+    expect(migration.name).toBe("FixTotpOtpUrlAlgorithm1787700000000");
+  });
+
+  test("is registered in SchemaMigrations/Index.ts, or it never runs", () => {
+    expect(SchemaMigrations).toContain(FixTotpOtpUrlAlgorithm1787700000000);
+  });
+
+  // The guard described in the header. Hand it to the next migration.
+  describe("ordering", () => {
+    test("its timestamp sorts after every other registered migration", () => {
+      const ourTimestamp: number | null = timestampOf(
+        FixTotpOtpUrlAlgorithm1787700000000,
+      );
+
+      expect(ourTimestamp).not.toBeNull();
+
+      const otherTimestamps: Array<number> = [];
+
+      for (const migrationClass of SchemaMigrations) {
+        if (migrationClass === FixTotpOtpUrlAlgorithm1787700000000) {
+          continue;
+        }
+
+        const timestamp: number | null = timestampOf(
+          migrationClass as MigrationClass,
+        );
+
+        if (timestamp !== null) {
+          otherTimestamps.push(timestamp);
+        }
+      }
+
+      /*
+       * Math.max() of an empty list is -Infinity, which every timestamp beats.
+       * Prove the list was actually enumerated before leaning on the maximum.
+       */
+      expect(otherTimestamps.length).toBeGreaterThan(100);
+
+      expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
+    });
+
+    test("it is registered last, matching that timestamp", () => {
+      expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
+        FixTotpOtpUrlAlgorithm1787700000000,
+      );
+    });
+
+    test("it is registered exactly once", () => {
+      const occurrences: number = SchemaMigrations.filter(
+        (migration: new () => MigrationInterface): boolean => {
+          return migration.name === "FixTotpOtpUrlAlgorithm1787700000000";
+        },
+      ).length;
+
+      expect(occurrences).toBe(1);
+    });
+
+    /*
+     * ...and the timestamp in the class name is the one on disk. A class
+     * renamed without renaming its file (or two migrations landing on the
+     * same timestamp) leaves the ordering above asserting something that is
+     * not what actually runs.
+     */
+    test("exactly one file on disk carries its timestamp, and it is this one", () => {
+      const matching: Array<string> = fs
+        .readdirSync(MIGRATION_DIRECTORY)
+        .filter((file: string): boolean => {
+          return file.startsWith(`${MIGRATION_TIMESTAMP}-`);
+        });
+
+      expect(matching).toEqual([
+        `${MIGRATION_TIMESTAMP}-FixTotpOtpUrlAlgorithm.ts`,
+      ]);
+    });
+  });
+
+  describe("up", () => {
+    test("rewrites the algorithm in the stored otpauth URL", () => {
+      expect(up.queries).toHaveLength(1);
+      expect(up.queries[0]).toContain(`UPDATE "UserTotpAuth"`);
+      expect(up.queries[0]).toContain(
+        `REPLACE("twoFactorOtpUrl", 'algorithm=SHA256', 'algorithm=SHA1')`,
+      );
+    });
+
+    /*
+     * The secret is the only irreplaceable thing on the row. A migration that
+     * regenerated it would invalidate every authenticator entry in existence.
+     */
+    test("never touches the secret", () => {
+      expect(up.queries[0]).not.toContain("twoFactorSecret");
+    });
+
+    test("only touches enrolments that are still pending", () => {
+      expect(up.queries[0]).toContain(`"isVerified" = false`);
+    });
+
+    test("only touches rows that actually carry the broken algorithm", () => {
+      expect(up.queries[0]).toContain(
+        `"twoFactorOtpUrl" LIKE '%algorithm=SHA256%'`,
+      );
+    });
+
+    test("does not delete anything", () => {
+      expect(up.queries[0]).not.toMatch(/\bDELETE\b|\bDROP\b|\bTRUNCATE\b/i);
+    });
+  });
+
+  describe("down", () => {
+    test("is the exact inverse of up", () => {
+      expect(down.queries).toHaveLength(1);
+      expect(down.queries[0]).toContain(
+        `REPLACE("twoFactorOtpUrl", 'algorithm=SHA1', 'algorithm=SHA256')`,
+      );
+      expect(down.queries[0]).toContain(`"isVerified" = false`);
+    });
+
+    test("never touches the secret either", () => {
+      expect(down.queries[0]).not.toContain("twoFactorSecret");
+    });
+  });
+
+  /*
+   * What the SQL means, applied to a real URL. Postgres' REPLACE is a plain
+   * substring substitution, so doing it here in JavaScript is a faithful model
+   * of the statement above — and it lets the result be handed to the real
+   * parser and the real verifier.
+   */
+  describe("the effect on a row written before the fix", () => {
+    const EMAIL: Email = new Email("stuck.user@example.com");
+
+    type ApplyUpFunction = (url: string) => string;
+
+    const applyUp: ApplyUpFunction = (url: string): string => {
+      return url.split("algorithm=SHA256").join("algorithm=SHA1");
+    };
+
+    type LegacyUrlFunction = (secret: string) => string;
+
+    /*
+     * What the old code wrote: everything as today, but SHA256.
+     */
+    const legacyUrl: LegacyUrlFunction = (secret: string): string => {
+      return new OTPAuth.TOTP({
+        issuer: "OneUptime",
+        label: EMAIL.toString(),
+        algorithm: "SHA256",
+        digits: 6,
+        period: 30,
+        secret: secret,
+      }).toString();
+    };
+
+    test("the repaired QR code produces codes the server accepts", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const repaired: OTPAuth.TOTP = OTPAuth.URI.parse(
+        applyUp(legacyUrl(secret)),
+      ) as OTPAuth.TOTP;
+
+      expect(repaired.algorithm).toBe("SHA1");
+
+      expect(
+        TotpAuth.verifyToken({
+          secret: secret,
+          token: repaired.generate(),
+          email: EMAIL,
+        }),
+      ).toBe(true);
+    });
+
+    test("the secret survives the rewrite unchanged", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const repaired: OTPAuth.TOTP = OTPAuth.URI.parse(
+        applyUp(legacyUrl(secret)),
+      ) as OTPAuth.TOTP;
+
+      expect(repaired.secret.base32).toBe(secret);
+    });
+
+    /*
+     * Somebody mid-enrolment may already have scanned the old SHA256 QR with
+     * an app that honours the parameter. Rewriting the URL must not strand
+     * them: their app still emits SHA256 codes, and those still verify.
+     */
+    test("an app that already scanned the old SHA256 QR still verifies", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const alreadyScanned: OTPAuth.TOTP = OTPAuth.URI.parse(
+        legacyUrl(secret),
+      ) as OTPAuth.TOTP;
+
+      expect(alreadyScanned.algorithm).toBe("SHA256");
+
+      expect(
+        TotpAuth.verifyToken({
+          secret: secret,
+          token: alreadyScanned.generate(),
+          email: EMAIL,
+        }),
+      ).toBe(true);
+    });
+
+    test("a URL that is already SHA1 is left exactly as it was", () => {
+      const secret: string = TotpAuth.generateSecret();
+
+      const current: string = TotpAuth.generateUri({
+        secret: secret,
+        userEmail: EMAIL,
+      });
+
+      expect(applyUp(current)).toBe(current);
+    });
+  });
+});

package/Tests/Server/Middleware/ProjectAuthorizationApiKeyMiddleware.test.ts

@@ -1,4 +1,3 @@
-import APIKeyPermission from "../../../Models/DatabaseModels/ApiKeyPermission";
 import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
 import User from "../../../Models/DatabaseModels/User";
 import ProjectMiddleware from "../../../Server/Middleware/ProjectAuthorization";
@@ -37,6 +36,19 @@ import {
   test,
 } from "@jest/globals";
 
+/*
+ * PasswordHash has a known, pre-existing TS5.9 compile failure under ts-jest
+ * (Buffer vs BinaryLike) that breaks every suite whose import graph reaches
+ * it. Nothing here touches password hashing; stub the module before the
+ * service import graph drags it into compilation.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
 /*
  * ProjectAuthorization.isValidProjectIdAndApiKeyMiddleware is the single door
  * every API-key request in the product walks through, and it had no test at all.
@@ -67,9 +79,9 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
     ApiKeyService,
     "findApiKey",
   );
-  const spyApiKeyPermissionFindBy: jest.SpyInstance = getJestSpyOn(
+  const spyFindApiKeyPermissions: jest.SpyInstance = getJestSpyOn(
     ApiKeyPermissionService,
-    "findBy",
+    "findPermissionsByApiKeyId",
   );
   const spyGlobalConfigFindOneBy: jest.SpyInstance = getJestSpyOn(
     GlobalConfigService,
@@ -89,7 +101,7 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
     jest.clearAllMocks();
     next = getJestMockFunction();
     spyFindApiKey.mockResolvedValue(null);
-    spyApiKeyPermissionFindBy.mockResolvedValue([]);
+    spyFindApiKeyPermissions.mockResolvedValue([]);
     spyGlobalConfigFindOneBy.mockResolvedValue(null);
     spyUserFindOneBy.mockResolvedValue(null);
   });
@@ -129,16 +141,17 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
     type MockResolvedApiKeyFunction = () => void;
 
     const mockResolvedApiKey: MockResolvedApiKeyFunction = (): void => {
-      const apiKeyPermission: APIKeyPermission = new APIKeyPermission();
-      apiKeyPermission.permission = Permission.ProjectMember;
-      apiKeyPermission.labels = [];
-      apiKeyPermission.isBlockPermission = false;
-
       spyFindApiKey.mockResolvedValue({
         id: apiKeyId,
         projectId: keyProjectId,
       });
-      spyApiKeyPermissionFindBy.mockResolvedValue([apiKeyPermission]);
+      spyFindApiKeyPermissions.mockResolvedValue([
+        {
+          permission: Permission.ProjectMember,
+          labelIds: [],
+          isBlockPermission: false,
+        },
+      ]);
     };
 
     test("should call next with no argument and stamp API identity, tenant and permissions on the request", async () => {
@@ -211,11 +224,7 @@ describe("ProjectMiddleware.isValidProjectIdAndApiKeyMiddleware", () => {
 
       await runMiddleware(req);
 
-      expect(spyApiKeyPermissionFindBy).toHaveBeenCalledWith(
-        expect.objectContaining({
-          query: { apiKeyId: apiKeyId },
-        }),
-      );
+      expect(spyFindApiKeyPermissions).toHaveBeenCalledWith(apiKeyId);
 
       const permissions: Array<UserPermission> =
         (req as OneUptimeRequest).userTenantAccessPermission?.[

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -50,6 +50,25 @@ jest.mock("../../../Server/Services/ProjectService");
 jest.mock("../../../Server/Services/TeamMemberService");
 jest.mock("../../../Types/HashedString");
 jest.mock("../../../Types/JSONFunctions");
+/*
+ * PasswordHash carries a pre-existing TS5.9 diagnostic that fails any suite
+ * whose runtime require graph reaches it (DatabaseService, the base class of
+ * every concrete service, imports it). Nothing password-related is under
+ * test here, so the module is replaced WITH A FACTORY — an automock would
+ * still require (and type-check) the real file.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: {
+      hash: jest.fn(),
+      verify: jest.fn(),
+      generateSalt: jest.fn(),
+      needsUpgrade: jest.fn(),
+      applyPepper: jest.fn(),
+    },
+  };
+});
 
 type StringOrUndefined = string | undefined;
 
@@ -409,6 +428,66 @@ describe("UserMiddleware", () => {
       expect(spyGetUserGlobalAccessPermission).toHaveBeenCalledWith(userId);
     });
 
+    test("should not set global-permissions and global-permissions-hash in the response header, when the global-permissions-hash set in the request header equals the globalPermissionsHash computed from userGlobalAccessPermission", async () => {
+      const mockedRequest: Partial<ExpressRequest> = {
+        headers: { "global-permissions-hash": hashValue },
+      };
+
+      getJestSpyOn(ProjectMiddleware, "getProjectId").mockReturnValueOnce(null);
+      getJestSpyOn(JSONFunctions, "serialize").mockReturnValueOnce({});
+      const spyGetUserGlobalAccessPermission: jest.SpyInstance = getJestSpyOn(
+        AccessTokenService,
+        "getUserGlobalAccessPermission",
+      ).mockResolvedValueOnce(mockedGlobalAccessPermission);
+
+      await UserMiddleware.getUserMiddleware(
+        mockedRequest as ExpressRequest,
+        res,
+        next,
+      );
+
+      expect(res.set).not.toHaveBeenCalledWith(
+        "global-permissions",
+        expect.anything(),
+      );
+      expect(res.set).not.toHaveBeenCalledWith(
+        "global-permissions-hash",
+        expect.anything(),
+      );
+      expect(next).toHaveBeenCalled();
+      expect(spyGetUserGlobalAccessPermission).toHaveBeenCalledWith(userId);
+    });
+
+    test("should set global-permissions and global-permissions-hash in the response header, when the global-permissions-hash set in the request header does not equal the globalPermissionsHash computed from userGlobalAccessPermission", async () => {
+      const mockedRequest: Partial<ExpressRequest> = {
+        headers: { "global-permissions-hash": "different-hash" },
+      };
+
+      getJestSpyOn(ProjectMiddleware, "getProjectId").mockReturnValueOnce(null);
+      getJestSpyOn(JSONFunctions, "serialize").mockReturnValueOnce({});
+      const spyGetUserGlobalAccessPermission: jest.SpyInstance = getJestSpyOn(
+        AccessTokenService,
+        "getUserGlobalAccessPermission",
+      ).mockResolvedValueOnce(mockedGlobalAccessPermission);
+
+      await UserMiddleware.getUserMiddleware(
+        mockedRequest as ExpressRequest,
+        res,
+        next,
+      );
+
+      expect(res.set).toHaveBeenCalledWith(
+        "global-permissions",
+        JSON.stringify({}),
+      );
+      expect(res.set).toHaveBeenCalledWith(
+        "global-permissions-hash",
+        hashValue,
+      );
+      expect(next).toHaveBeenCalled();
+      expect(spyGetUserGlobalAccessPermission).toHaveBeenCalledWith(userId);
+    });
+
     test("should call Response.sendErrorResponse, when tenantId is passed in the header and getUserTenantAccessPermissionWithTenantId throws an exception", async () => {
       const spyGetUserTenantAccessPermissionWithTenantId: jest.SpyInstance =
         getJestSpyOn(