@oneuptime/common 12.0.13 → 12.0.14

package/Tests/Server/API/UserPushCriticalAlertsApi.test.ts

@@ -0,0 +1,114 @@
+import {
+  parseCriticalAlertFlag,
+  parseCriticalAlertFlagStrict,
+} from "../../../Server/API/UserPushAPI";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Two parsers, deliberately different, for the two ways this flag arrives.
+ *
+ * REGISTRATION is a bulk operation the app performs on its own - once per
+ * project, on login, on every token refresh - and the field is frequently
+ * absent (an older app build, a web client, a hand-rolled integration).
+ * Absent has to mean "off", because a device registration is not a place a
+ * person decides to be woken through Do Not Disturb.
+ *
+ * The TOGGLE is a person moving a switch. There, an unrecognised value is a
+ * bug in the caller, and reading it as "off" would tell that person their
+ * phone will not wake them - or worse, quietly disable an override they had
+ * working. It is refused instead.
+ */
+
+describe("parseCriticalAlertFlag - device registration", () => {
+  test.each([
+    ["a JSON boolean true", true],
+    ['the string "true", as form posts send it', "true"],
+  ])("treats %s as opted in", (_label: string, raw: unknown) => {
+    expect(parseCriticalAlertFlag(raw)).toBe(true);
+  });
+
+  test.each([
+    ["undefined - the field was not sent at all", undefined],
+    ["null", null],
+    ["a JSON boolean false", false],
+    ['the string "false"', "false"],
+    ["an empty string", ""],
+  ])("treats %s as not opted in", (_label: string, raw: unknown) => {
+    expect(parseCriticalAlertFlag(raw)).toBe(false);
+  });
+
+  test.each([
+    ['the string "TRUE"', "TRUE"],
+    ['the string "yes"', "yes"],
+    ['the string "1"', "1"],
+    ["the number 1", 1],
+    ["an object", { enabled: true }],
+    ["an array", [true]],
+  ])(
+    "does not let %s turn the override on by accident",
+    (_label: string, raw: unknown) => {
+      /*
+       * Every one of these is truthy in JavaScript. A `Boolean(raw)` here
+       * would silently opt devices in from junk input, which is the wrong
+       * direction for a setting that defeats a phone's silent mode.
+       */
+      expect(parseCriticalAlertFlag(raw)).toBe(false);
+    },
+  );
+
+  test("always returns a real boolean, never a truthy value", () => {
+    expect(typeof parseCriticalAlertFlag("true")).toBe("boolean");
+    expect(typeof parseCriticalAlertFlag(undefined)).toBe("boolean");
+  });
+});
+
+describe("parseCriticalAlertFlagStrict - the settings toggle", () => {
+  test.each([
+    ["a JSON boolean true", true],
+    ['the string "true"', "true"],
+  ])("accepts %s as on", (_label: string, raw: unknown) => {
+    expect(parseCriticalAlertFlagStrict(raw)).toBe(true);
+  });
+
+  test.each([
+    ["a JSON boolean false", false],
+    ['the string "false"', "false"],
+  ])("accepts %s as off", (_label: string, raw: unknown) => {
+    expect(parseCriticalAlertFlagStrict(raw)).toBe(false);
+  });
+
+  test.each([
+    ["undefined", undefined],
+    ["null", null],
+    ['"yes"', "yes"],
+    ['"TRUE"', "TRUE"],
+    ["1", 1],
+    ["0", 0],
+    ["an object", {}],
+    ["an array", []],
+    ["an empty string", ""],
+  ])("refuses %s rather than guessing", (_label: string, raw: unknown) => {
+    expect(() => {
+      return parseCriticalAlertFlagStrict(raw);
+    }).toThrow(BadDataException);
+  });
+
+  test("the refusal says what a valid value looks like", () => {
+    expect(() => {
+      return parseCriticalAlertFlagStrict("maybe");
+    }).toThrow("isEnabled must be either true or false.");
+  });
+
+  test("turning the setting OFF is never mistaken for a malformed request", () => {
+    /*
+     * `false` is falsy, so any guard written as `if (!isEnabled) throw` would
+     * make the switch impossible to turn off - it would appear to work in the
+     * UI and revert on the next screen load.
+     */
+    expect(parseCriticalAlertFlagStrict(false)).toBe(false);
+    expect(() => {
+      return parseCriticalAlertFlagStrict(false);
+    }).not.toThrow();
+  });
+});

package/Tests/Server/API/UserSmsApi.test.ts

@@ -1,5 +1,7 @@
 import UserSmsAPI from "../../../Server/API/UserSmsAPI";
 import UserSmsService from "../../../Server/Services/UserSmsService";
+import ChannelVerification from "../../../Server/Utils/ChannelVerification";
+import VerificationCode from "../../../Server/Utils/VerificationCode";
 import {
   NextFunction,
   OneUptimeRequest,
@@ -41,6 +43,8 @@ jest.mock("../../../Server/Utils/Response", () => {
 
 jest.mock("../../../Server/Services/UserSmsService");
 
+const ITEM_ID: string = "7b1c2d3e-1111-4111-8111-111111111111";
+
 describe("UserSmsAPI", () => {
   let mockRequest: OneUptimeRequest;
   let mockResponse: OneUptimeResponse;
@@ -49,6 +53,13 @@ describe("UserSmsAPI", () => {
   beforeEach(() => {
     new UserSmsAPI();
     mockRequest = {} as OneUptimeRequest;
+    UserSmsService.updateOneById = jest.fn().mockResolvedValue(1);
+    UserSmsService.atomicIncrementColumnValueByOneAndGetValue = jest
+      .fn()
+      .mockResolvedValue(1);
+    UserSmsService.getModel = jest
+      .fn()
+      .mockReturnValue({ tableName: "UserSMS" });
     mockResponse = {
       send: jest.fn(),
       json: jest.fn(),
@@ -98,6 +109,14 @@ describe("UserSmsAPI", () => {
         itemId: "item1",
         code: 123456,
       };
+      /*
+       * The route sits behind UserMiddleware, so a session is always present
+       * by the time the handler runs — and the handler now refuses outright
+       * without one rather than reaching the row lookup.
+       */
+      mockRequest.userAuthorization = {
+        userId: new ObjectID("user123"),
+      } as JSONWebTokenData;
       UserSmsService.findOneById = jest.fn().mockResolvedValue(null);
 
       await mockRouter
@@ -139,21 +158,66 @@ describe("UserSmsAPI", () => {
       expect(response).toHaveBeenCalledWith(mockRequest, mockResponse, error);
     });
 
+    /*
+     * GHSA-5cr8-vph4-3hrf: the stored column is a keyed digest now, not the
+     * code, and it only counts while it is inside its expiry. buildLiveItem
+     * produces the state a freshly sent code leaves behind.
+     */
+    const buildLiveItem: (overrides?: Partial<UserSMS>) => UserSMS = (
+      overrides: Partial<UserSMS> = {},
+    ) => {
+      return {
+        _id: ITEM_ID,
+        userId: new ObjectID("user123"),
+        projectId: new ObjectID("project1"),
+        isVerified: false,
+        verificationCode: VerificationCode.hashCode({
+          code: "123456",
+          channelId: new ObjectID(ITEM_ID),
+        }),
+        verificationCodeExpiresAt: ChannelVerification.getExpiresAt(),
+        verificationFailedAttempts: 0,
+        ...overrides,
+      } as UserSMS;
+    };
+
     it("should handle Invalid code", async () => {
       const error: BadDataException = new BadDataException("Invalid code");
       mockRequest.body = {
-        itemId: "item1",
-        code: "123456",
+        itemId: ITEM_ID,
+        code: "123457",
       };
       mockRequest.userAuthorization = {
         userId: new ObjectID("user123"),
       } as JSONWebTokenData;
 
-      const item: UserSMS = {
-        _id: "123",
+      UserSmsService.findOneById = jest.fn().mockResolvedValue(buildLiveItem());
+
+      await mockRouter
+        .match("post", "/user-sms/verify")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      const response: jest.SpyInstance = jest.spyOn(
+        Response,
+        "sendErrorResponse",
+      );
+      expect(response).toHaveBeenCalledWith(mockRequest, mockResponse, error);
+    });
+
+    /*
+     * The stored value must not be replayable as the code. This is the case
+     * that fails if `item.verificationCode === req.body.code` ever comes back.
+     */
+    it("should reject the stored verification column replayed as a code", async () => {
+      const item: UserSMS = buildLiveItem();
+
+      mockRequest.body = {
+        itemId: ITEM_ID,
+        code: item.verificationCode,
+      };
+      mockRequest.userAuthorization = {
         userId: new ObjectID("user123"),
-        verificationCode: "123457",
-      } as UserSMS;
+      } as JSONWebTokenData;
 
       UserSmsService.findOneById = jest.fn().mockResolvedValue(item);
 
@@ -165,25 +229,54 @@ describe("UserSmsAPI", () => {
         Response,
         "sendErrorResponse",
       );
-      expect(response).toHaveBeenCalledWith(mockRequest, mockResponse, error);
+      expect(response).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+        new BadDataException("Invalid code"),
+      );
     });
 
-    it("should handle valid response on verify", async () => {
+    it("should reject a code that has expired", async () => {
       mockRequest.body = {
-        itemId: "item1",
+        itemId: ITEM_ID,
         code: "123456",
       };
       mockRequest.userAuthorization = {
         userId: new ObjectID("user123"),
       } as JSONWebTokenData;
 
-      const item: UserSMS = {
-        _id: "123",
+      UserSmsService.findOneById = jest.fn().mockResolvedValue(
+        buildLiveItem({
+          verificationCodeExpiresAt: new Date(Date.now() - 1000),
+        }),
+      );
+
+      await mockRouter
+        .match("post", "/user-sms/verify")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      const response: jest.SpyInstance = jest.spyOn(
+        Response,
+        "sendErrorResponse",
+      );
+      expect(response).toHaveBeenCalled();
+      expect(UserSmsService.updateOneById).not.toHaveBeenCalledWith(
+        expect.objectContaining({
+          data: expect.objectContaining({ isVerified: true }),
+        }),
+      );
+    });
+
+    it("should handle valid response on verify", async () => {
+      mockRequest.body = {
+        itemId: ITEM_ID,
+        code: "123456",
+      };
+      mockRequest.userAuthorization = {
         userId: new ObjectID("user123"),
-        verificationCode: "123456",
-      } as UserSMS;
+      } as JSONWebTokenData;
 
-      UserSmsService.findOneById = jest.fn().mockResolvedValue(item);
+      UserSmsService.findOneById = jest.fn().mockResolvedValue(buildLiveItem());
 
       await mockRouter
         .match("post", "/user-sms/verify")