@oneuptime/common 12.0.13 → 12.0.15

package/Tests/Server/Infrastructure/Postgres/SchemaMigrationsOrdering.test.ts

@@ -0,0 +1,227 @@
+import SchemaMigrations from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { MigrationInterface } from "typeorm";
+import fs from "fs";
+import path from "path";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The ordering guard for the migration registry.
+ *
+ * TypeORM runs migrations in the order this array lists them, and records each
+ * one by class name. Two things can go wrong when a migration is added, and
+ * neither one announces itself — the schema simply diverges on some
+ * installations and not others:
+ *
+ *   1. the new migration runs BEFORE one that is already deployed. Existing
+ *      installations have already recorded the older migration, so the new one
+ *      still runs last for them, while a fresh install runs it in the listed
+ *      position. The two databases end up different.
+ *   2. two migrations share a timestamp, so the file a class belongs to is
+ *      ambiguous and the pairing between name and file can silently swap.
+ *
+ * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
+ * recent migrations here use hand-picked round numbers that already run ahead
+ * of wall clock — so a freshly generated file lands BELOW several registered
+ * migrations unless somebody renumbers it. That is case 1, and it is the
+ * likely one.
+ *
+ * This guard is deliberately written against the registry as a whole rather
+ * than against whichever migration happens to be newest, so that adding a
+ * migration never requires editing (or hand-carrying) the guard itself.
+ *
+ * Note it does NOT assert the whole array is sorted. It is not: a handful of
+ * historical entries were registered out of timestamp order years ago and have
+ * long since run everywhere, so renumbering them now would re-run them. What
+ * is asserted is the part that is still live — the newest entry must sort
+ * above everything already registered.
+ */
+
+const MIGRATION_DIRECTORY: string = path.join(
+  __dirname,
+  "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
+);
+
+/*
+ * The very first migration predates the convention and carries no timestamp in
+ * its class name. It is first in the array and can never be last, so it is
+ * simply excluded rather than special-cased in every assertion below.
+ */
+const UNTIMESTAMPED_MIGRATION_NAME: string = "InitialMigration";
+
+const INITIAL_MIGRATION_TIMESTAMP: number = 1717605043663;
+
+const TIMESTAMPED_FILE: RegExp = new RegExp("^\\d+-");
+
+type MigrationClass = new () => MigrationInterface;
+
+type TimestampOfFunction = (migrationClass: MigrationClass) => number | null;
+
+const timestampOf: TimestampOfFunction = (
+  migrationClass: MigrationClass,
+): number | null => {
+  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
+  return match ? Number(match[1]) : null;
+};
+
+const registered: Array<MigrationClass> =
+  SchemaMigrations as Array<MigrationClass>;
+
+describe("the migration registry", () => {
+  /*
+   * Math.max() of an empty list is -Infinity and every assertion below would
+   * pass vacuously against one. Prove the import actually produced a registry
+   * before leaning on anything derived from it.
+   */
+  test("is actually populated, so nothing below passes vacuously", () => {
+    expect(registered.length).toBeGreaterThan(100);
+  });
+
+  test("names every migration after its timestamp, bar the first one", () => {
+    const untimestamped: Array<string> = registered
+      .filter((migrationClass: MigrationClass): boolean => {
+        return timestampOf(migrationClass) === null;
+      })
+      .map((migrationClass: MigrationClass): string => {
+        return migrationClass.name;
+      });
+
+    expect(untimestamped).toEqual([UNTIMESTAMPED_MIGRATION_NAME]);
+  });
+
+  describe("ordering", () => {
+    /*
+     * The guard that used to be hand-carried from one migration's test to the
+     * next. Whoever adds a migration adds it to the end of the array, and this
+     * is what says the timestamp has to match that position.
+     */
+    test("gives the last-registered migration the highest timestamp", () => {
+      const last: MigrationClass = registered[registered.length - 1]!;
+      const lastTimestamp: number | null = timestampOf(last);
+
+      expect(lastTimestamp).not.toBeNull();
+
+      const earlierTimestamps: Array<number> = registered
+        .slice(0, -1)
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        });
+
+      expect(earlierTimestamps.length).toBe(registered.length - 2);
+
+      /*
+       * If this fails, the migration at the end of SchemaMigrations/Index.ts
+       * carries a timestamp that sorts below one already registered — rename
+       * the new migration's file and class to a timestamp above the current
+       * maximum, rather than moving it up the array.
+       */
+      expect(lastTimestamp).toBeGreaterThan(Math.max(...earlierTimestamps));
+    });
+
+    test("never registers the same timestamp twice", () => {
+      const timestamps: Array<number> = registered
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        });
+
+      const duplicates: Array<number> = timestamps.filter(
+        (timestamp: number, index: number): boolean => {
+          return timestamps.indexOf(timestamp) !== index;
+        },
+      );
+
+      expect(duplicates).toEqual([]);
+    });
+
+    test("never registers the same migration class twice", () => {
+      const names: Array<string> = registered.map(
+        (migrationClass: MigrationClass): string => {
+          return migrationClass.name;
+        },
+      );
+
+      const duplicates: Array<string> = names.filter(
+        (name: string, index: number): boolean => {
+          return names.indexOf(name) !== index;
+        },
+      );
+
+      expect(duplicates).toEqual([]);
+    });
+  });
+
+  /*
+   * ...and the timestamps in the class names are the ones on disk. A class
+   * renamed without renaming its file — or two files landing on the same
+   * timestamp — leaves the ordering above asserting something that is not what
+   * actually runs.
+   */
+  test("backs every registered migration with exactly one file on disk", () => {
+    const files: Array<string> = fs.readdirSync(MIGRATION_DIRECTORY);
+
+    const unbacked: Array<string> = registered
+      .filter((migrationClass: MigrationClass): boolean => {
+        const timestamp: number | null = timestampOf(migrationClass);
+
+        if (timestamp === null) {
+          return false;
+        }
+
+        return (
+          files.filter((file: string): boolean => {
+            return file.startsWith(`${timestamp}-`);
+          }).length !== 1
+        );
+      })
+      .map((migrationClass: MigrationClass): string => {
+        return migrationClass.name;
+      });
+
+    expect(unbacked).toEqual([]);
+  });
+
+  /*
+   * The other direction: a migration file that nobody registered never runs at
+   * all. That is the failure mode with no symptom until a query hits a column
+   * that was never created.
+   *
+   * The registered side is read out of the exported array rather than out of
+   * Index.ts, so a file that is imported but never added to the array — which
+   * is exactly as inert as one that is not imported at all — still fails here.
+   */
+  test("registers every migration file that exists on disk", () => {
+    const registeredTimestamps: Set<number> = new Set(
+      registered
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        }),
+    );
+
+    /*
+     * The one file whose class name carries no timestamp, so it cannot be
+     * matched by the timestamps above.
+     */
+    registeredTimestamps.add(INITIAL_MIGRATION_TIMESTAMP);
+
+    const timestampsOnDisk: Array<string> = fs
+      .readdirSync(MIGRATION_DIRECTORY)
+      .filter((file: string): boolean => {
+        return file.endsWith(".ts") && TIMESTAMPED_FILE.test(file);
+      })
+      .map((file: string): string => {
+        return file.split("-")[0]!;
+      });
+
+    expect(timestampsOnDisk.length).toBeGreaterThan(100);
+
+    const unregistered: Array<string> = timestampsOnDisk.filter(
+      (timestamp: string): boolean => {
+        return !registeredTimestamps.has(Number(timestamp));
+      },
+    );
+
+    expect(unregistered).toEqual([]);
+  });
+});

package/Tests/Server/Middleware/SlackAuthorization.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, test, beforeEach } from "@jest/globals";
+import crypto from "crypto";
+import SlackAuthorization from "../../../Server/Middleware/SlackAuthorization";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import BadDataException from "../../../Types/Exception/BadDataException";
+
+const SIGNING_SECRET: string = "slack-app-signing-secret";
+
+/*
+ * Only the signing secret is overridden. Logger and CaptureSpan also read from
+ * EnvironmentConfig, so the rest of the module has to stay real.
+ */
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    __esModule: true,
+    ...jest.requireActual("../../../Server/EnvironmentConfig"),
+    SlackAppSigningSecret: "slack-app-signing-secret",
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    __esModule: true,
+    default: {
+      sendErrorResponse: jest.fn(),
+    },
+  };
+});
+
+/*
+ * Companion to WhatsAppAuthorization.test.ts. This middleware had the same
+ * unguarded crypto.timingSafeEqual: the value came off the attacker-controlled
+ * X-Slack-Signature header, and timingSafeEqual throws RangeError when the two
+ * buffers differ in byte length. A missing header was worse still - it reached
+ * Buffer.from(undefined) and threw a TypeError before the comparison. Both now
+ * have to come back as the intended 400.
+ */
+describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
+  const TIMESTAMP: string = "1700000000";
+  const RAW_BODY: string = "token=abc&team_id=T123&command=%2Foneuptime";
+
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+  let next: NextFunction;
+
+  type SignFunction = (timestamp: string, body: string) => string;
+
+  const sign: SignFunction = (timestamp: string, body: string): string => {
+    return `v0=${crypto
+      .createHmac("sha256", SIGNING_SECRET)
+      .update(`v0:${timestamp}:${body}`)
+      .digest("hex")}`;
+  };
+
+  type BuildRequestFunction = (
+    signature: string | undefined,
+    body?: string,
+  ) => OneUptimeRequest;
+
+  const buildRequest: BuildRequestFunction = (
+    signature: string | undefined,
+    body: string = RAW_BODY,
+  ): OneUptimeRequest => {
+    const headers: Record<string, string> = {
+      "x-slack-request-timestamp": TIMESTAMP,
+    };
+
+    if (signature !== undefined) {
+      headers["x-slack-signature"] = signature;
+    }
+
+    return { headers, rawBody: body } as unknown as OneUptimeRequest;
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    next = jest.fn();
+  });
+
+  test("calls next when the signature matches the timestamp and body", async () => {
+    const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("rejects a well-formed signature computed over a different body", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      sign(TIMESTAMP, `${RAW_BODY}&tampered=1`),
+      RAW_BODY,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+  });
+
+  /*
+   * Every one of these is a byte length other than the 67 of a real
+   * "v0=" + 64 hex header, which is exactly what used to reach
+   * timingSafeEqual and throw. The absent and empty cases used to throw
+   * even earlier, inside Buffer.from.
+   */
+  const malformedSignatures: Array<[string, string | undefined]> = [
+    ["absent", undefined],
+    ["an empty string", ""],
+    ["a bare word", "nope"],
+    ["the prefix with no digest", "v0="],
+    ["a short digest", "v0=abc123"],
+    ["a long digest", `v0=${"a".repeat(65)}`],
+    ["the right length but non-hex characters", `v0=${"z".repeat(64)}`],
+    ["64 hex characters with no prefix", "a".repeat(64)],
+    ["the wrong version prefix", `v1=${"a".repeat(64)}`],
+  ];
+
+  describe("rejects a malformed signature with 400 rather than throwing", () => {
+    test.each(malformedSignatures)(
+      "%s",
+      async (_label: string, signature: string | undefined) => {
+        const req: OneUptimeRequest = buildRequest(signature);
+
+        await expect(
+          SlackAuthorization.isAuthorizedSlackRequest(req, res, next),
+        ).resolves.toBeUndefined();
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException("Slack Signature Verification Failed."),
+        );
+      },
+    );
+  });
+});

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -677,9 +677,16 @@ describe("UserMiddleware", () => {
       ProjectService,
       "getRequireSsoWithSsoProviderId",
     );
-    const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
+    /*
+     * The enforcement entry point is `isSsoSatisfiedForProject`, not the
+     * stateless `doesSsoTokenForProjectExist`: a Global SSO token also has to
+     * clear the provider-trust and project-governance checks, which need the
+     * database. Spying here keeps these tests about the middleware's control
+     * flow rather than about SSO token internals.
+     */
+    const spyIsSsoSatisfiedForProject: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
-      "doesSsoTokenForProjectExist",
+      "isSsoSatisfiedForProject",
     );
     const spyGetGlobalRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
       GlobalConfigService,
@@ -717,7 +724,7 @@ describe("UserMiddleware", () => {
     test("should throw SsoAuthorizationException error, when sso login is required but sso token for the projectId does not exist", async () => {
       spyGetRequireSsoForLogin.mockResolvedValueOnce(true);
 
-      spyDoesSsoTokenForProjectExist.mockReturnValueOnce(false);
+      spyIsSsoSatisfiedForProject.mockResolvedValueOnce(false);
 
       await expect(
         UserMiddleware.getUserTenantAccessPermissionWithTenantId({
@@ -726,12 +733,12 @@ describe("UserMiddleware", () => {
           userId,
         }),
       ).rejects.toThrowError(new SsoAuthorizationException());
-      expect(spyDoesSsoTokenForProjectExist).toHaveBeenCalledWith(
+      expect(spyIsSsoSatisfiedForProject).toHaveBeenCalledWith({
         req,
         projectId,
         userId,
-        undefined,
-      );
+        requiredSsoProviderId: undefined,
+      });
     });
 
     test("should return null when getUserTenantAccessPermission returns null", async () => {
@@ -797,9 +804,16 @@ describe("UserMiddleware", () => {
       ProjectService,
       "getRequireSsoWithSsoProviderId",
     );
-    const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
+    /*
+     * The enforcement entry point is `isSsoSatisfiedForProject`, not the
+     * stateless `doesSsoTokenForProjectExist`: a Global SSO token also has to
+     * clear the provider-trust and project-governance checks, which need the
+     * database. Spying here keeps these tests about the middleware's control
+     * flow rather than about SSO token internals.
+     */
+    const spyIsSsoSatisfiedForProject: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
-      "doesSsoTokenForProjectExist",
+      "isSsoSatisfiedForProject",
     );
     const spyGetGlobalRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
       GlobalConfigService,
@@ -833,7 +847,7 @@ describe("UserMiddleware", () => {
     });
 
     test("should return default tenant access permission, when project for a projectId is found, sso is required for login, but sso token does not exist for that projectId", async () => {
-      spyDoesSsoTokenForProjectExist.mockReturnValueOnce(false);
+      spyIsSsoSatisfiedForProject.mockResolvedValueOnce(false);
       spyGetProjectRequireSsoForLogin.mockResolvedValueOnce(true);
 
       const spyGetDefaultUserTenantAccessPermission: jest.SpyInstance =
@@ -852,12 +866,12 @@ describe("UserMiddleware", () => {
       expect(result).toEqual({
         [projectId.toString()]: mockedUserTenantAccessPermission,
       });
-      expect(spyDoesSsoTokenForProjectExist).toHaveBeenCalledWith(
+      expect(spyIsSsoSatisfiedForProject).toHaveBeenCalledWith({
         req,
         projectId,
         userId,
-        undefined,
-      );
+        requiredSsoProviderId: undefined,
+      });
       expect(spyGetDefaultUserTenantAccessPermission).toHaveBeenCalledWith(
         projectId,
       );
@@ -879,7 +893,7 @@ describe("UserMiddleware", () => {
       expect(result).toEqual({
         [projectId.toString()]: mockedUserTenantAccessPermission,
       });
-      expect(spyDoesSsoTokenForProjectExist).not.toBeCalled();
+      expect(spyIsSsoSatisfiedForProject).not.toBeCalled();
       expect(spyGetUserTenantAccessPermission).toHaveBeenCalledWith(
         userId,
         projectId,