@oneuptime/common 12.0.13 → 12.0.15

package/Server/API/UserEmailAPI.ts

@@ -1,21 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserEmailService, {
   Service as UserEmailServiceType,
 } from "../Services/UserEmailService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserEmail from "../../Models/DatabaseModels/UserEmail";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserEmailAPI extends BaseAPI<
   UserEmail,
   UserEmailServiceType
@@ -26,6 +49,9 @@ export default class UserEmailAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -46,33 +72,10 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the email.
-          const item: UserEmail | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -80,32 +83,30 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified email
+          /* Create default notification rules for this verified email */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userEmailId: item.id!,
+                  userEmailId: result.itemId!,
                 },
               },
             );
@@ -128,6 +129,9 @@ export default class UserEmailAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -158,6 +162,11 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/API/UserIncomingCallNumberAPI.ts

@@ -1,4 +1,7 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserIncomingCallNumberService, {
   Service as UserIncomingCallNumberServiceType,
 } from "../Services/UserIncomingCallNumberService";
@@ -8,11 +11,32 @@ import {
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
 import UserIncomingCallNumber from "../../Models/DatabaseModels/UserIncomingCallNumber";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserIncomingCallNumberAPI extends BaseAPI<
   UserIncomingCallNumber,
   UserIncomingCallNumberServiceType
@@ -23,6 +47,9 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -43,32 +70,10 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the phone number
-          const item: UserIncomingCallNumber | null =
-            await this.service.findOneById({
-              id: req.body["itemId"],
-              props: {
-                isRoot: true,
-              },
-              select: {
-                userId: true,
-                verificationCode: true,
-              },
-            });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          // Check user ID
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -76,24 +81,22 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
           return Response.sendEmptySuccessResponse(req, res);
         } catch (err) {
           return next(err);
@@ -104,6 +107,9 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -135,7 +141,11 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          // Check user ID
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()