@oneuptime/common 12.0.13 → 12.0.14

package/Tests/Server/Services/UserNotificationRuleExecuteItem.test.ts

@@ -619,6 +619,7 @@ describe("UserNotificationRuleService.executeNotificationRuleItem", () => {
           deviceType: true,
           isVerified: true,
           userId: true,
+          isCriticalAlertEnabled: true,
         },
       });
     });

package/Tests/Server/Services/UserPushCriticalAlertToggle.test.ts

@@ -0,0 +1,255 @@
+import UserPushService from "../../../Server/Services/UserPushService";
+import UserPush from "../../../Models/DatabaseModels/UserPush";
+import PushDeviceType from "../../../Types/PushNotification/PushDeviceType";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import { describe, expect, test, beforeEach, afterEach } from "@jest/globals";
+
+/*
+ * setCriticalAlertEnabledForDeviceToken is how a phone tells the server "wake
+ * me through Do Not Disturb". It is keyed on the push TOKEN rather than a row
+ * id because one handset owns one UserPush row per project it is registered
+ * against, and a responder who flips the switch means it for the phone, not
+ * for whichever project they happened to be looking at.
+ *
+ * The failure this shape exists to prevent is a responder who is loud for one
+ * project and silent for another - a distinction no screen offers to make, so
+ * nobody would think to check it.
+ */
+
+const USER_ID: ObjectID = new ObjectID("44444444-4444-4444-8444-444444444444");
+const OTHER_USER_ID: ObjectID = new ObjectID(
+  "45454545-4545-4545-8545-454545454545",
+);
+const DEVICE_TOKEN: string = "ExponentPushToken[handset]";
+
+const DEVICE_ONE_ID: string = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+const DEVICE_TWO_ID: string = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
+
+function device(id: string, deviceType: PushDeviceType): UserPush {
+  const userPush: UserPush = new UserPush();
+  userPush._id = id;
+  userPush.deviceType = deviceType;
+
+  return userPush;
+}
+
+interface UpdateCall {
+  id: string;
+  isCriticalAlertEnabled: boolean | undefined;
+  isRoot: boolean | undefined;
+}
+
+describe("UserPushService.setCriticalAlertEnabledForDeviceToken", () => {
+  let findSpy: jest.SpyInstance;
+  let updateSpy: jest.SpyInstance;
+  let updateCalls: Array<UpdateCall>;
+
+  beforeEach(() => {
+    updateCalls = [];
+
+    findSpy = jest.spyOn(UserPushService, "findBy");
+
+    updateSpy = jest.spyOn(UserPushService, "updateOneBy");
+    updateSpy.mockImplementation((updateBy: unknown): Promise<number> => {
+      const call: {
+        query: { _id: string };
+        data: { isCriticalAlertEnabled?: boolean };
+        props: { isRoot?: boolean };
+      } = updateBy as {
+        query: { _id: string };
+        data: { isCriticalAlertEnabled?: boolean };
+        props: { isRoot?: boolean };
+      };
+
+      updateCalls.push({
+        id: call.query._id,
+        isCriticalAlertEnabled: call.data.isCriticalAlertEnabled,
+        isRoot: call.props.isRoot,
+      });
+
+      return Promise.resolve(1);
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("turns the override on for every project the handset is registered against", async () => {
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.iOS),
+      device(DEVICE_TWO_ID, PushDeviceType.iOS),
+    ] as never);
+
+    const updated: number =
+      await UserPushService.setCriticalAlertEnabledForDeviceToken({
+        userId: USER_ID,
+        deviceToken: DEVICE_TOKEN,
+        isEnabled: true,
+      });
+
+    expect(updated).toBe(2);
+    expect(
+      updateCalls.map((call: UpdateCall) => {
+        return call.id;
+      }),
+    ).toEqual([DEVICE_ONE_ID, DEVICE_TWO_ID]);
+    expect(
+      updateCalls.every((call: UpdateCall) => {
+        return call.isCriticalAlertEnabled === true;
+      }),
+    ).toBe(true);
+  });
+
+  test("turns the override off again", async () => {
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.Android),
+    ] as never);
+
+    await UserPushService.setCriticalAlertEnabledForDeviceToken({
+      userId: USER_ID,
+      deviceToken: DEVICE_TOKEN,
+      isEnabled: false,
+    });
+
+    expect(updateCalls[0]?.isCriticalAlertEnabled).toBe(false);
+  });
+
+  test("looks the handset up scoped to its owner, so a token cannot reconfigure somebody else's phone", async () => {
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.iOS),
+    ] as never);
+
+    await UserPushService.setCriticalAlertEnabledForDeviceToken({
+      userId: USER_ID,
+      deviceToken: DEVICE_TOKEN,
+      isEnabled: true,
+    });
+
+    const query: { userId: ObjectID; deviceToken: string } = (
+      findSpy.mock.calls[0]![0] as {
+        query: { userId: ObjectID; deviceToken: string };
+      }
+    ).query;
+
+    expect(query.userId.toString()).toBe(USER_ID.toString());
+    expect(query.userId.toString()).not.toBe(OTHER_USER_ID.toString());
+    expect(query.deviceToken).toBe(DEVICE_TOKEN);
+  });
+
+  test("writes as root, because the column grants update to nobody", async () => {
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.iOS),
+    ] as never);
+
+    await UserPushService.setCriticalAlertEnabledForDeviceToken({
+      userId: USER_ID,
+      deviceToken: DEVICE_TOKEN,
+      isEnabled: true,
+    });
+
+    expect(updateCalls[0]?.isRoot).toBe(true);
+  });
+
+  test("refuses a token that matches no registered device", async () => {
+    findSpy.mockResolvedValue([] as never);
+
+    await expect(
+      UserPushService.setCriticalAlertEnabledForDeviceToken({
+        userId: USER_ID,
+        deviceToken: DEVICE_TOKEN,
+        isEnabled: true,
+      }),
+    ).rejects.toThrow(BadDataException);
+
+    expect(updateSpy).not.toHaveBeenCalled();
+  });
+
+  test("refuses a web device - a browser cannot override a phone's ringer", async () => {
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.Web),
+    ] as never);
+
+    await expect(
+      UserPushService.setCriticalAlertEnabledForDeviceToken({
+        userId: USER_ID,
+        deviceToken: DEVICE_TOKEN,
+        isEnabled: true,
+      }),
+    ).rejects.toThrow(
+      "Critical alerts are only available on iOS and Android devices.",
+    );
+
+    expect(updateSpy).not.toHaveBeenCalled();
+  });
+
+  test("updates only the mobile rows when a token somehow spans device types", async () => {
+    /*
+     * Not expected in practice - a web subscription blob and an Expo token do
+     * not collide - but storing the preference on a web row would read back
+     * later as though the browser would ring, which is worse than refusing it.
+     */
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.Web),
+      device(DEVICE_TWO_ID, PushDeviceType.Android),
+    ] as never);
+
+    const updated: number =
+      await UserPushService.setCriticalAlertEnabledForDeviceToken({
+        userId: USER_ID,
+        deviceToken: DEVICE_TOKEN,
+        isEnabled: true,
+      });
+
+    expect(updated).toBe(1);
+    expect(updateCalls).toHaveLength(1);
+    expect(updateCalls[0]?.id).toBe(DEVICE_TWO_ID);
+  });
+
+  test("reports how many rows were actually written", async () => {
+    /*
+     * The count is what tells a caller "this matched nothing" apart from "this
+     * saved". updateOneBy returns 0 when the row vanished between the lookup
+     * and the write.
+     */
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.iOS),
+      device(DEVICE_TWO_ID, PushDeviceType.iOS),
+    ] as never);
+
+    updateSpy.mockResolvedValueOnce(1 as never);
+    updateSpy.mockResolvedValueOnce(0 as never);
+
+    const updated: number =
+      await UserPushService.setCriticalAlertEnabledForDeviceToken({
+        userId: USER_ID,
+        deviceToken: DEVICE_TOKEN,
+        isEnabled: true,
+      });
+
+    expect(updated).toBe(1);
+  });
+
+  test("only ever writes the critical alert column", async () => {
+    /*
+     * A toggle that also carried, say, isVerified would let the settings
+     * screen re-verify a device the user had deliberately unverified.
+     */
+    findSpy.mockResolvedValue([
+      device(DEVICE_ONE_ID, PushDeviceType.iOS),
+    ] as never);
+
+    await UserPushService.setCriticalAlertEnabledForDeviceToken({
+      userId: USER_ID,
+      deviceToken: DEVICE_TOKEN,
+      isEnabled: true,
+    });
+
+    const data: Record<string, unknown> = (
+      updateSpy.mock.calls[0]![0] as { data: Record<string, unknown> }
+    ).data;
+
+    expect(Object.keys(data)).toEqual(["isCriticalAlertEnabled"]);
+  });
+});

package/Tests/Server/Services/UserTotpAuthEnrolment.test.ts

@@ -0,0 +1,218 @@
+import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
+import UserService from "../../../Server/Services/UserService";
+import TotpAuth from "../../../Server/Utils/TotpAuth";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import { OnCreate } from "../../../Server/Types/Database/Hooks";
+import Email from "../../../Types/Email";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import UserTotpAuth from "../../../Models/DatabaseModels/UserTotpAuth";
+import User from "../../../Models/DatabaseModels/User";
+import * as OTPAuth from "otpauth";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Enrolment — the moment a secret is minted and the QR code the user is about
+ * to scan is frozen into `twoFactorOtpUrl`.
+ *
+ * This is where issue #3275 was born. The URL written here is the ONLY thing
+ * the authenticator app ever sees; nothing downstream can renegotiate it. If
+ * it advertises an algorithm the app will not honour, the enrolment is dead on
+ * arrival and no amount of retrying at verification time can rescue it. So the
+ * property under test is not "a URL was produced" but "the code an app
+ * computes from this URL is the code the server will accept" — asserted by
+ * going through the round trip rather than by string-matching.
+ */
+
+jest.mock("../../../Server/Services/UserService");
+
+const USER_ID: ObjectID = new ObjectID("44444444-4444-4444-8444-444444444444");
+const USER_EMAIL: Email = new Email("enrolling.user@example.com");
+
+/*
+ * `signedInUserId: null` models a request that reached the service with no
+ * authenticated user on it.
+ */
+type BuildCreateByFunction = (options?: {
+  signedInUserId?: ObjectID | null;
+}) => CreateBy<UserTotpAuth>;
+
+const buildCreateBy: BuildCreateByFunction = (options?: {
+  signedInUserId?: ObjectID | null;
+}): CreateBy<UserTotpAuth> => {
+  const model: UserTotpAuth = new UserTotpAuth();
+  model.name = "Google Authenticator";
+
+  const signedInUserId: ObjectID | null =
+    options && "signedInUserId" in options
+      ? (options.signedInUserId as ObjectID | null)
+      : USER_ID;
+
+  return {
+    data: model,
+    props: {
+      userId: signedInUserId === null ? undefined : signedInUserId,
+    },
+  } as unknown as CreateBy<UserTotpAuth>;
+};
+
+type RunOnBeforeCreateFunction = (
+  createBy: CreateBy<UserTotpAuth>,
+) => Promise<OnCreate<UserTotpAuth>>;
+
+const runOnBeforeCreate: RunOnBeforeCreateFunction = async (
+  createBy: CreateBy<UserTotpAuth>,
+): Promise<OnCreate<UserTotpAuth>> => {
+  return (await (
+    UserTotpAuthService as unknown as {
+      onBeforeCreate: RunOnBeforeCreateFunction;
+    }
+  ).onBeforeCreate(createBy)) as OnCreate<UserTotpAuth>;
+};
+
+describe("UserTotpAuthService enrolment", () => {
+  beforeEach(() => {
+    const user: User = new User();
+    user.id = USER_ID;
+    user.email = USER_EMAIL;
+
+    UserService.findOneById = jest.fn().mockResolvedValue(user) as never;
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("the QR code it freezes into the row", () => {
+    test("advertises SHA1, so Google Authenticator computes what the server checks", async () => {
+      const result: OnCreate<UserTotpAuth> =
+        await runOnBeforeCreate(buildCreateBy());
+
+      const url: string = result.createBy.data.twoFactorOtpUrl!;
+
+      expect(url).toContain("algorithm=SHA1");
+      expect(url).not.toContain("SHA256");
+    });
+
+    /*
+     * The end-to-end property, and the one that actually matters: take the URL
+     * exactly as the phone would read it, produce a code from it, and hand
+     * that code to the same verifier the validate endpoint uses.
+     */
+    test("produces a QR code whose codes the verifier accepts", async () => {
+      const result: OnCreate<UserTotpAuth> =
+        await runOnBeforeCreate(buildCreateBy());
+
+      const scanned: OTPAuth.TOTP = OTPAuth.URI.parse(
+        result.createBy.data.twoFactorOtpUrl!,
+      ) as OTPAuth.TOTP;
+
+      expect(
+        TotpAuth.verifyToken({
+          secret: result.createBy.data.twoFactorSecret!,
+          token: scanned.generate(),
+          email: USER_EMAIL,
+        }),
+      ).toBe(true);
+    });
+
+    test("labels the entry with the enrolling user's email", async () => {
+      const result: OnCreate<UserTotpAuth> =
+        await runOnBeforeCreate(buildCreateBy());
+
+      expect(
+        decodeURIComponent(result.createBy.data.twoFactorOtpUrl!),
+      ).toContain("enrolling.user@example.com");
+    });
+
+    test("embeds the same secret it stores on the row", async () => {
+      const result: OnCreate<UserTotpAuth> =
+        await runOnBeforeCreate(buildCreateBy());
+
+      const scanned: OTPAuth.TOTP = OTPAuth.URI.parse(
+        result.createBy.data.twoFactorOtpUrl!,
+      ) as OTPAuth.TOTP;
+
+      expect(scanned.secret.base32).toBe(result.createBy.data.twoFactorSecret);
+    });
+  });
+
+  describe("the row it writes", () => {
+    test("mints a fresh secret rather than trusting anything from the client", async () => {
+      const createBy: CreateBy<UserTotpAuth> = buildCreateBy();
+
+      (createBy.data as UserTotpAuth).twoFactorSecret =
+        "ATTACKERCHOSENSECRETAAAAAAAAAAAA";
+
+      const result: OnCreate<UserTotpAuth> = await runOnBeforeCreate(createBy);
+
+      expect(result.createBy.data.twoFactorSecret).not.toBe(
+        "ATTACKERCHOSENSECRETAAAAAAAAAAAA",
+      );
+    });
+
+    test("issues a different secret to every enrolment", async () => {
+      const first: OnCreate<UserTotpAuth> =
+        await runOnBeforeCreate(buildCreateBy());
+      const second: OnCreate<UserTotpAuth> =
+        await runOnBeforeCreate(buildCreateBy());
+
+      expect(first.createBy.data.twoFactorSecret).not.toBe(
+        second.createBy.data.twoFactorSecret,
+      );
+    });
+
+    /*
+     * A newly created row is a claim, not a second factor. It only becomes one
+     * once the user proves they scanned it — otherwise anyone could create a
+     * row and count it as their 2FA method.
+     */
+    test("starts unverified no matter what the client asked for", async () => {
+      const createBy: CreateBy<UserTotpAuth> = buildCreateBy();
+      (createBy.data as UserTotpAuth).isVerified = true;
+
+      const result: OnCreate<UserTotpAuth> = await runOnBeforeCreate(createBy);
+
+      expect(result.createBy.data.isVerified).toBe(false);
+    });
+
+    test("binds the row to the signed-in user, not to a client-supplied id", async () => {
+      const createBy: CreateBy<UserTotpAuth> = buildCreateBy();
+
+      (createBy.data as UserTotpAuth).userId = new ObjectID(
+        "55555555-5555-4555-8555-555555555555",
+      );
+
+      const result: OnCreate<UserTotpAuth> = await runOnBeforeCreate(createBy);
+
+      expect(result.createBy.data.userId).toBe(USER_ID);
+    });
+  });
+
+  describe("when it cannot enrol", () => {
+    test("refuses without a signed-in user", async () => {
+      await expect(
+        runOnBeforeCreate(buildCreateBy({ signedInUserId: null })),
+      ).rejects.toThrow(BadDataException);
+    });
+
+    test("refuses when the user record has gone", async () => {
+      UserService.findOneById = jest.fn().mockResolvedValue(null) as never;
+
+      await expect(runOnBeforeCreate(buildCreateBy())).rejects.toThrow(
+        BadDataException,
+      );
+    });
+
+    test("refuses when the user has no email to label the entry with", async () => {
+      const emailless: User = new User();
+      emailless.id = USER_ID;
+
+      UserService.findOneById = jest.fn().mockResolvedValue(emailless) as never;
+
+      await expect(runOnBeforeCreate(buildCreateBy())).rejects.toThrow(
+        BadDataException,
+      );
+    });
+  });
+});