@oneuptime/common 12.0.13 → 12.0.14

package/Tests/Server/Services/NotificationChannelCodeIssuance.test.ts

@@ -0,0 +1,401 @@
+import UserEmailService from "../../../Server/Services/UserEmailService";
+import MailService from "../../../Server/Services/MailService";
+import ChannelVerification, {
+  RESEND_COOLDOWN_SECONDS,
+} from "../../../Server/Utils/ChannelVerification";
+import VerificationCode from "../../../Server/Utils/VerificationCode";
+import ObjectID from "../../../Types/ObjectID";
+import Email from "../../../Types/Email";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import Exception from "../../../Types/Exception/Exception";
+import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import { beforeEach, describe, expect, it } from "@jest/globals";
+
+jest.mock("../../../Server/Services/MailService");
+jest.mock("../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+    getLogAttributesFromRequest: jest.fn().mockReturnValue({}),
+  };
+});
+
+/*
+ * GHSA-5cr8-vph4-3hrf, issuance side.
+ *
+ * The verify route is only half the story. The other half is what a code's
+ * life looks like: it must be minted fresh, stored as a digest, sent in
+ * plaintext exactly once, and NOT re-issuable on demand — because "spend the
+ * five attempts, ask for another code, repeat" is otherwise a free bypass of
+ * the attempt limit, paid for by whoever owns the address in unsolicited
+ * messages.
+ *
+ * UserEmailService stands in for all five channels here. The three that go
+ * over Twilio/WhatsApp wrap the identical calls in project balance checks; the
+ * shared behaviour lives in ChannelVerification and is what these exercise.
+ */
+
+const ITEM_ID: ObjectID = new ObjectID("2c4e6a80-1111-4111-8111-111111111111");
+const USER_ID: ObjectID = new ObjectID("2c4e6a80-2222-4222-8222-222222222222");
+const PROJECT_ID: ObjectID = new ObjectID(
+  "2c4e6a80-3333-4333-8333-333333333333",
+);
+
+type AnyRecord = Record<string, unknown>;
+
+const buildItem: (overrides?: Partial<UserEmail>) => UserEmail = (
+  overrides: Partial<UserEmail> = {},
+) => {
+  return {
+    _id: ITEM_ID.toString(),
+    id: ITEM_ID,
+    userId: USER_ID,
+    projectId: PROJECT_ID,
+    email: Email.fromString("responder@example.com"),
+    isVerified: false,
+    ...overrides,
+  } as UserEmail;
+};
+
+describe("notification channel verification code issuance", () => {
+  let updateOneById: jest.Mock;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    updateOneById = jest.fn().mockResolvedValue(1);
+    UserEmailService.updateOneById = updateOneById as never;
+
+    (MailService.sendMail as unknown as jest.Mock).mockResolvedValue(
+      undefined as never,
+    );
+  });
+
+  describe("issueAndSendVerificationCode", () => {
+    it("stores a digest and never the code itself", async () => {
+      await UserEmailService.issueAndSendVerificationCode(buildItem());
+
+      const written: AnyRecord = (
+        updateOneById.mock.calls[0]?.[0] as { data: AnyRecord }
+      ).data;
+
+      const sentCode: string = (
+        (MailService.sendMail as unknown as jest.Mock).mock.calls[0]?.[0] as {
+          vars: Record<string, string>;
+        }
+      ).vars["code"] as string;
+
+      expect(sentCode).toMatch(/^[0-9]{6}$/);
+      expect(written["verificationCode"]).not.toBe(sentCode);
+      expect(written["verificationCode"]).toMatch(/^[0-9a-f]{64}$/);
+    });
+
+    it("stores a digest the sent code actually verifies against", async () => {
+      await UserEmailService.issueAndSendVerificationCode(buildItem());
+
+      const written: AnyRecord = (
+        updateOneById.mock.calls[0]?.[0] as { data: AnyRecord }
+      ).data;
+
+      const sentCode: string = (
+        (MailService.sendMail as unknown as jest.Mock).mock.calls[0]?.[0] as {
+          vars: Record<string, string>;
+        }
+      ).vars["code"] as string;
+
+      expect(
+        VerificationCode.isHashEqual(
+          VerificationCode.hashCode({
+            code: sentCode,
+            channelId: ITEM_ID,
+          }),
+          written["verificationCode"] as string,
+        ),
+      ).toBe(true);
+    });
+
+    it("sets an expiry and zeroes the attempt counter", async () => {
+      await UserEmailService.issueAndSendVerificationCode(buildItem());
+
+      const written: AnyRecord = (
+        updateOneById.mock.calls[0]?.[0] as { data: AnyRecord }
+      ).data;
+
+      expect(written["verificationFailedAttempts"]).toBe(0);
+      expect(written["verificationCodeExpiresAt"]).toBeInstanceOf(Date);
+      expect(
+        (written["verificationCodeExpiresAt"] as Date).getTime(),
+      ).toBeGreaterThan(Date.now());
+      expect(written["verificationCodeSentAt"]).toBeInstanceOf(Date);
+    });
+
+    it("mints a different code every time", async () => {
+      const codes: Set<string> = new Set<string>();
+
+      for (let i: number = 0; i < 25; i++) {
+        await UserEmailService.issueAndSendVerificationCode(buildItem());
+      }
+
+      for (const call of (MailService.sendMail as unknown as jest.Mock).mock
+        .calls) {
+        codes.add(
+          ((call as Array<unknown>)[0] as { vars: Record<string, string> })
+            .vars["code"] as string,
+        );
+      }
+
+      expect(codes.size).toBeGreaterThan(20);
+    });
+
+    it("sends to the address on the row", async () => {
+      await UserEmailService.issueAndSendVerificationCode(buildItem());
+
+      const mail: AnyRecord = (MailService.sendMail as unknown as jest.Mock)
+        .mock.calls[0]?.[0] as AnyRecord;
+
+      expect(mail["toEmail"]?.toString()).toBe("responder@example.com");
+    });
+  });
+
+  describe("resendVerificationCode", () => {
+    const stubFind: (item: UserEmail | null) => void = (
+      item: UserEmail | null,
+    ) => {
+      UserEmailService.findOneById = jest
+        .fn()
+        .mockResolvedValue(item as never) as never;
+    };
+
+    it("refuses an unknown item", async () => {
+      stubFind(null);
+
+      await expect(
+        UserEmailService.resendVerificationCode(ITEM_ID),
+      ).rejects.toThrow("not found");
+    });
+
+    it("refuses a row that is already verified", async () => {
+      stubFind(buildItem({ isVerified: true }));
+
+      await expect(
+        UserEmailService.resendVerificationCode(ITEM_ID),
+      ).rejects.toThrow("already verified");
+
+      expect(MailService.sendMail).not.toHaveBeenCalled();
+    });
+
+    it("sends when no code has been sent before", async () => {
+      stubFind(buildItem());
+
+      await UserEmailService.resendVerificationCode(ITEM_ID);
+
+      expect(MailService.sendMail).toHaveBeenCalled();
+    });
+
+    /*
+     * The control on "burn the attempts, request a new code, repeat" — and on
+     * using the resend button to message somebody repeatedly.
+     */
+    it("refuses a resend inside the cooldown", async () => {
+      stubFind(
+        buildItem({
+          verificationCodeSentAt: new Date(Date.now() - 5000),
+        }),
+      );
+
+      let thrown: Exception | undefined = undefined;
+
+      try {
+        await UserEmailService.resendVerificationCode(ITEM_ID);
+      } catch (err) {
+        thrown = err as Exception;
+      }
+
+      expect(thrown?.code).toBe(ExceptionCode.TooManyRequestsException);
+      expect(thrown?.message).toContain("Please wait");
+      expect(MailService.sendMail).not.toHaveBeenCalled();
+    });
+
+    it("does not issue a new code when it refuses the resend", async () => {
+      stubFind(
+        buildItem({
+          verificationCodeSentAt: new Date(Date.now() - 1000),
+        }),
+      );
+
+      await expect(
+        UserEmailService.resendVerificationCode(ITEM_ID),
+      ).rejects.toThrow();
+
+      expect(updateOneById).not.toHaveBeenCalled();
+    });
+
+    it("allows a resend once the cooldown has elapsed", async () => {
+      stubFind(
+        buildItem({
+          verificationCodeSentAt: new Date(
+            Date.now() - (RESEND_COOLDOWN_SECONDS + 5) * 1000,
+          ),
+        }),
+      );
+
+      await UserEmailService.resendVerificationCode(ITEM_ID);
+
+      expect(MailService.sendMail).toHaveBeenCalled();
+    });
+
+    /*
+     * A resend must hand out a NEW code. Re-sending the same one would make
+     * the attempt counter worthless — the attacker resumes against the value
+     * they were already working on.
+     */
+    it("issues a fresh code rather than resending the old one", async () => {
+      const previousDigest: string = VerificationCode.hashCode({
+        code: "123456",
+        channelId: ITEM_ID,
+      });
+
+      stubFind(
+        buildItem({
+          verificationCode: previousDigest,
+          verificationCodeExpiresAt: ChannelVerification.getExpiresAt(),
+        }),
+      );
+
+      await UserEmailService.resendVerificationCode(ITEM_ID);
+
+      const written: AnyRecord = (
+        updateOneById.mock.calls[0]?.[0] as { data: AnyRecord }
+      ).data;
+
+      expect(written["verificationCode"]).not.toBe(previousDigest);
+      expect(written["verificationFailedAttempts"]).toBe(0);
+    });
+
+    /*
+     * The row is looked up without asking for the code column at all — the
+     * send no longer needs it, because the plaintext is produced at issue
+     * time and never read back.
+     */
+    it("does not read the stored code back in order to send it", async () => {
+      stubFind(buildItem());
+
+      await UserEmailService.resendVerificationCode(ITEM_ID);
+
+      const select: AnyRecord = (
+        (UserEmailService.findOneById as unknown as jest.Mock).mock
+          .calls[0]?.[0] as { select: AnyRecord }
+      ).select;
+
+      expect(select["verificationCode"]).toBeUndefined();
+    });
+  });
+
+  /*
+   * The create response must NOT carry the plaintext code unless the e2e-only
+   * env flag is exactly "true". This is the whole security boundary of the
+   * seam UserEmailService.onCreateSuccess adds for the end-to-end suite: an
+   * accidental default-on, or a loose truthy check, would hand every caller a
+   * just-issued code on the create response and reinstate the takeover the
+   * hashing/expiry/attempt controls exist to stop. Pinned in both directions.
+   */
+  describe("the e2e verification-code exposure seam (onCreateSuccess)", () => {
+    const FLAG: string = "EXPOSE_VERIFICATION_CODE_IN_API_RESPONSE_FOR_E2E";
+
+    type OnCreateSuccess = (
+      onCreate: unknown,
+      createdItem: UserEmail,
+    ) => Promise<UserEmail>;
+
+    const runOnCreateSuccess: (item: UserEmail) => Promise<UserEmail> = (
+      item: UserEmail,
+    ) => {
+      return (
+        UserEmailService as unknown as { onCreateSuccess: OnCreateSuccess }
+      ).onCreateSuccess({}, item);
+    };
+
+    const sentCode: () => string = () => {
+      return (
+        (MailService.sendMail as unknown as jest.Mock).mock.calls[0]?.[0] as {
+          vars: Record<string, string>;
+        }
+      ).vars["code"] as string;
+    };
+
+    let previousFlag: string | undefined;
+
+    beforeEach(() => {
+      previousFlag = process.env[FLAG];
+      delete process.env[FLAG];
+    });
+
+    afterEach(() => {
+      if (previousFlag === undefined) {
+        delete process.env[FLAG];
+      } else {
+        process.env[FLAG] = previousFlag;
+      }
+    });
+
+    it("with the flag unset, a code is issued and mailed but never returned", async () => {
+      const result: UserEmail = await runOnCreateSuccess(buildItem());
+
+      expect(sentCode()).toMatch(/^[0-9]{6}$/);
+      expect(result.verificationCode).toBeUndefined();
+    });
+
+    it('only an exact "true" opens the hatch - any other truthy value stays closed', async () => {
+      for (const value of ["1", "TRUE", "yes", "on", " true "]) {
+        jest.clearAllMocks();
+        updateOneById = jest.fn().mockResolvedValue(1);
+        UserEmailService.updateOneById = updateOneById as never;
+        (MailService.sendMail as unknown as jest.Mock).mockResolvedValue(
+          undefined as never,
+        );
+
+        process.env[FLAG] = value;
+        const result: UserEmail = await runOnCreateSuccess(buildItem());
+
+        expect(result.verificationCode).toBeUndefined();
+      }
+    });
+
+    it('with the flag exactly "true", the response carries the mailed plaintext', async () => {
+      process.env[FLAG] = "true";
+      const result: UserEmail = await runOnCreateSuccess(buildItem());
+
+      expect(result.verificationCode).toBe(sentCode());
+      expect(result.verificationCode).toMatch(/^[0-9]{6}$/);
+    });
+
+    it("even with the hatch open, storage is still the digest and never the code", async () => {
+      process.env[FLAG] = "true";
+      await runOnCreateSuccess(buildItem());
+
+      const written: AnyRecord = (
+        updateOneById.mock.calls[0]?.[0] as { data: AnyRecord }
+      ).data;
+
+      expect(written["verificationCode"]).toMatch(/^[0-9a-f]{64}$/);
+      expect(written["verificationCode"]).not.toBe(sentCode());
+    });
+
+    it("an already-verified row issues no code and exposes nothing, flag on or off", async () => {
+      process.env[FLAG] = "true";
+      const result: UserEmail = await runOnCreateSuccess(
+        buildItem({ isVerified: true }),
+      );
+
+      expect(
+        MailService.sendMail as unknown as jest.Mock,
+      ).not.toHaveBeenCalled();
+      expect(result.verificationCode).toBeUndefined();
+    });
+  });
+});

package/Tests/Server/Services/PushNotificationDeliveryOptions.test.ts

@@ -0,0 +1,204 @@
+import PushNotificationService, {
+  ExpoDeliveryOptions,
+} from "../../../Server/Services/PushNotificationService";
+import AndroidNotificationChannel from "../../../Types/PushNotification/AndroidNotificationChannel";
+import PushDeviceType from "../../../Types/PushNotification/PushDeviceType";
+import PushNotificationMessage from "../../../Types/PushNotification/PushNotificationMessage";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * getExpoDeliveryOptions is the single point that turns "this device opted into
+ * critical alerts" into the payload fields that actually make a handset ring
+ * through silent mode. It is the server's half of the three-way handshake
+ * documented on PushNotificationMessage.isCriticalAlert, so every branch of it
+ * is pinned here: a field quietly dropped from the critical branch is a page
+ * that arrives silently to a sleeping responder, and a field wrongly present on
+ * the non-critical branch is every ordinary notification screaming through Do
+ * Not Disturb.
+ */
+
+function messageWith(
+  overrides: Partial<PushNotificationMessage> = {},
+): PushNotificationMessage {
+  return {
+    title: "Alert",
+    body: "Something is on fire",
+    ...overrides,
+  };
+}
+
+describe("PushNotificationService.getExpoDeliveryOptions", () => {
+  describe("a normal (non-critical) push", () => {
+    test.each<[string, PushDeviceType]>([
+      ["iOS", PushDeviceType.iOS],
+      ["Android", PushDeviceType.Android],
+    ])(
+      "on %s uses a plain 'default' sound, never the critical sound object",
+      (_label: string, deviceType: PushDeviceType) => {
+        const options: ExpoDeliveryOptions =
+          PushNotificationService.getExpoDeliveryOptions(
+            messageWith({ isCriticalAlert: false }),
+            deviceType,
+          );
+
+        expect(options.sound).toBe("default");
+        expect(options.priority).toBe("high");
+      },
+    );
+
+    test("carries NO interruptionLevel - that field is the iOS critical lever", () => {
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: false }),
+          PushDeviceType.iOS,
+        );
+
+      expect(options.interruptionLevel).toBeUndefined();
+    });
+
+    test("an unset isCriticalAlert is treated exactly like false", () => {
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith(),
+          PushDeviceType.iOS,
+        );
+
+      expect(options.sound).toBe("default");
+      expect(options.interruptionLevel).toBeUndefined();
+    });
+
+    test("Android without the critical flag stays on the High channel", () => {
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: false }),
+          PushDeviceType.Android,
+        );
+
+      expect(options.channelId).toBe(AndroidNotificationChannel.High);
+    });
+
+    test("iOS names the payload-sound 'default' channel, not an Android channel", () => {
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: false }),
+          PushDeviceType.iOS,
+        );
+
+      expect(options.channelId).toBe("default");
+    });
+  });
+
+  describe("a critical push", () => {
+    test("iOS gets the critical sound object AND interruptionLevel 'critical'", () => {
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: true }),
+          PushDeviceType.iOS,
+        );
+
+      /*
+       * Both are required together: APNs ignores the ringer only when the
+       * sound object says critical AND the interruption level is critical.
+       */
+      expect(options.sound).toEqual({
+        critical: true,
+        name: "default",
+        volume: PushNotificationService.CRITICAL_ALERT_VOLUME,
+      });
+      expect(options.interruptionLevel).toBe("critical");
+      expect(options.priority).toBe("high");
+    });
+
+    test("the critical volume is pinned to the maximum (1)", () => {
+      /*
+       * A critical alert exists to wake somebody; a quieter volume would
+       * defeat the whole opt-in.
+       */
+      expect(PushNotificationService.CRITICAL_ALERT_VOLUME).toBe(1);
+
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: true }),
+          PushDeviceType.iOS,
+        );
+
+      expect((options.sound as { volume: number }).volume).toBe(1);
+    });
+
+    test("Android is moved to the Critical channel (its only lever for DND bypass)", () => {
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: true }),
+          PushDeviceType.Android,
+        );
+
+      expect(options.channelId).toBe(AndroidNotificationChannel.Critical);
+    });
+
+    test("the critical sound object is sent on Android too, one shape for both platforms", () => {
+      /*
+       * The comment in source is explicit that keeping one shape avoids a
+       * per-platform branch that could drop the iOS half; Android ignores it.
+       */
+      const options: ExpoDeliveryOptions =
+        PushNotificationService.getExpoDeliveryOptions(
+          messageWith({ isCriticalAlert: true }),
+          PushDeviceType.Android,
+        );
+
+      expect(options.sound).toEqual({
+        critical: true,
+        name: "default",
+        volume: PushNotificationService.CRITICAL_ALERT_VOLUME,
+      });
+      expect(options.interruptionLevel).toBe("critical");
+    });
+  });
+
+  describe("the critical flag is the ONLY thing that changes the sound", () => {
+    test.each<[PushDeviceType]>([
+      [PushDeviceType.iOS],
+      [PushDeviceType.Android],
+      [PushDeviceType.Web],
+    ])(
+      "flipping isCriticalAlert flips the sound between plain and critical (%s)",
+      (deviceType: PushDeviceType) => {
+        const normal: ExpoDeliveryOptions =
+          PushNotificationService.getExpoDeliveryOptions(
+            messageWith({ isCriticalAlert: false }),
+            deviceType,
+          );
+        const critical: ExpoDeliveryOptions =
+          PushNotificationService.getExpoDeliveryOptions(
+            messageWith({ isCriticalAlert: true }),
+            deviceType,
+          );
+
+        expect(normal.sound).toBe("default");
+        expect(critical.sound).not.toBe("default");
+        expect(normal.interruptionLevel).toBeUndefined();
+        expect(critical.interruptionLevel).toBe("critical");
+      },
+    );
+  });
+
+  describe("priority is always high", () => {
+    test.each<[string, PushDeviceType, boolean]>([
+      ["iOS normal", PushDeviceType.iOS, false],
+      ["iOS critical", PushDeviceType.iOS, true],
+      ["Android normal", PushDeviceType.Android, false],
+      ["Android critical", PushDeviceType.Android, true],
+    ])(
+      "%s is delivered with priority 'high'",
+      (_label: string, deviceType: PushDeviceType, isCritical: boolean) => {
+        const options: ExpoDeliveryOptions =
+          PushNotificationService.getExpoDeliveryOptions(
+            messageWith({ isCriticalAlert: isCritical }),
+            deviceType,
+          );
+
+        expect(options.priority).toBe("high");
+      },
+    );
+  });
+});

package/Tests/Server/Services/TeamMemberAutoAcceptInvitation.test.ts

@@ -21,6 +21,7 @@ import BadDataException from "../../../Types/Exception/BadDataException";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
 import EmailMessage from "../../../Types/Email/EmailMessage";
+import HashedString from "../../../Types/HashedString";
 import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 
 /*
@@ -156,6 +157,20 @@ function verifiedUser(): User {
   return user;
 }
 
+/*
+ * The invitee in this file has already finished registering. The password is
+ * what says so: onBeforeCreate reads it to decide whether the invitation needs
+ * to carry a registration token, and an invitee without one sends it down the
+ * token-minting path these tests do not stub. Which link the mail carries is
+ * covered in TeamMemberInviteRegistrationToken.test.ts instead.
+ */
+function registeredUser(): User {
+  const user: User = verifiedUser();
+  user.password = new HashedString("already-registered", true);
+
+  return user;
+}
+
 let sendMailSpy: jest.SpyInstance;
 let addSettingsSpy: jest.SpyInstance;
 let addRuleSpy: jest.SpyInstance;
@@ -191,7 +206,12 @@ beforeEach(() => {
   findUserByIdSpy = jest
     .spyOn(UserService, "findOneById")
     .mockResolvedValue(verifiedUser());
-  jest.spyOn(UserService, "findByEmail").mockResolvedValue(verifiedUser());
+
+  /*
+   * onBeforeCreate looks the invitee up with findOneBy rather than findByEmail,
+   * because it needs the password column and findByEmail selects only the id.
+   */
+  jest.spyOn(UserService, "findOneBy").mockResolvedValue(registeredUser());
 
   addSettingsSpy = jest
     .spyOn(