@oneuptime/common 12.0.13 → 12.0.15

package/Tests/Server/Middleware/WhatsAppAuthorization.test.ts

@@ -0,0 +1,233 @@
+import { describe, expect, test, beforeEach } from "@jest/globals";
+import crypto from "crypto";
+import WhatsAppAuthorization from "../../../Server/Middleware/WhatsAppAuthorization";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import BadDataException from "../../../Types/Exception/BadDataException";
+
+/*
+ * The config lookup is mocked so the signature branches can be exercised
+ * without Postgres; the middleware under test must never need a database.
+ */
+jest.mock("../../../Server/Services/GlobalConfigService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findOneBy: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    __esModule: true,
+    default: {
+      sendErrorResponse: jest.fn(),
+    },
+  };
+});
+
+/*
+ * Regression cover for the unguarded crypto.timingSafeEqual in
+ * isAuthorizedWhatsAppRequest. timingSafeEqual throws RangeError when the two
+ * buffers differ in byte length, and the compared value came straight off the
+ * attacker-controlled X-Hub-Signature-256 header with no try/catch anywhere
+ * above it. The endpoint is unauthenticated by design - the signature IS the
+ * authentication - so anyone could send `x-hub-signature-256: nope` and throw
+ * the middleware instead of receiving the intended 400.
+ */
+describe("WhatsAppAuthorization.isAuthorizedWhatsAppRequest", () => {
+  const APP_SECRET: string = "meta-whatsapp-app-secret";
+  const RAW_BODY: string = JSON.stringify({
+    object: "whatsapp_business_account",
+  });
+
+  const findOneBy: jest.Mock =
+    GlobalConfigService.findOneBy as unknown as jest.Mock;
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+  let next: NextFunction;
+
+  type SignFunction = (body: string) => string;
+
+  const sign: SignFunction = (body: string): string => {
+    return `sha256=${crypto
+      .createHmac("sha256", APP_SECRET)
+      .update(body)
+      .digest("hex")}`;
+  };
+
+  type BuildRequestFunction = (
+    signature: string | undefined,
+    body?: string,
+  ) => OneUptimeRequest;
+
+  const buildRequest: BuildRequestFunction = (
+    signature: string | undefined,
+    body: string = RAW_BODY,
+  ): OneUptimeRequest => {
+    return {
+      headers:
+        signature === undefined ? {} : { "x-hub-signature-256": signature },
+      rawBody: body,
+    } as unknown as OneUptimeRequest;
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    next = jest.fn();
+    findOneBy.mockResolvedValue({ metaWhatsAppAppSecret: APP_SECRET });
+  });
+
+  test("calls next when the signature matches the body", async () => {
+    const req: OneUptimeRequest = buildRequest(sign(RAW_BODY));
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("calls next when the signature matches but the digest is upper-case", async () => {
+    const signature: string = sign(RAW_BODY);
+    const req: OneUptimeRequest = buildRequest(
+      `sha256=${signature.slice("sha256=".length).toUpperCase()}`,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("rejects a well-formed signature computed over a different body", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      sign(`${RAW_BODY} tampered`),
+      RAW_BODY,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("WhatsApp webhook signature verification failed."),
+    );
+  });
+
+  test("rejects a well-formed signature computed with a different secret", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      `sha256=${crypto
+        .createHmac("sha256", "some-other-secret")
+        .update(RAW_BODY)
+        .digest("hex")}`,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("WhatsApp webhook signature verification failed."),
+    );
+  });
+
+  /*
+   * An empty header value is indistinguishable from an absent one, so both
+   * take the missing-header branch rather than the malformed-digest one.
+   */
+  test.each([
+    ["absent", undefined],
+    ["empty", ""],
+  ])(
+    "rejects an %s signature header",
+    async (_label: string, signature: string | undefined) => {
+      const req: OneUptimeRequest = buildRequest(signature);
+
+      await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+      expect(next).not.toHaveBeenCalled();
+      expect(sendErrorResponse).toHaveBeenCalledWith(
+        req,
+        res,
+        new BadDataException("Missing X-Hub-Signature-256 header."),
+      );
+    },
+  );
+
+  /*
+   * Every one of these is a byte length other than the 71 of a real
+   * "sha256=" + 64 hex header, which is exactly what used to reach
+   * timingSafeEqual and throw.
+   */
+  const malformedSignatures: Array<[string, string]> = [
+    ["a bare word", "nope"],
+    ["the prefix with no digest", "sha256="],
+    ["a short digest", "sha256=abc123"],
+    ["a long digest", `sha256=${"a".repeat(65)}`],
+    ["the right length but non-hex characters", `sha256=${"z".repeat(64)}`],
+    ["64 hex characters with no prefix", "a".repeat(64)],
+    ["the wrong prefix", `sha1=${"a".repeat(64)}`],
+    ["a whitespace-padded digest", ` sha256=${"a".repeat(64)}`],
+  ];
+
+  describe("rejects a malformed signature with 400 rather than throwing", () => {
+    test.each(malformedSignatures)(
+      "%s",
+      async (_label: string, signature: string) => {
+        const req: OneUptimeRequest = buildRequest(signature);
+
+        await expect(
+          WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next),
+        ).resolves.toBeUndefined();
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException(
+            "WhatsApp webhook signature verification failed.",
+          ),
+        );
+      },
+    );
+  });
+
+  /*
+   * The shape check sits in front of the config lookup, so an unauthenticated
+   * flood of garbage signatures costs no database round trips.
+   */
+  test("does not query the global config for a malformed signature", async () => {
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(
+      buildRequest("nope"),
+      res,
+      next,
+    );
+
+    expect(findOneBy).not.toHaveBeenCalled();
+  });
+
+  test("rejects when the app secret is not configured", async () => {
+    findOneBy.mockResolvedValue({ metaWhatsAppAppSecret: "   " });
+
+    const req: OneUptimeRequest = buildRequest(sign(RAW_BODY));
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Meta WhatsApp App Secret is not configured."),
+    );
+  });
+});

package/Tests/Server/Services/AddNetworkDeviceReachabilityColumnsMigration.test.ts

@@ -27,15 +27,11 @@ import { describe, expect, test } from "@jest/globals";
  *
  * Pure SQL-contract assertions against a fake QueryRunner. No Postgres.
  *
- * This file also carries the ORDERING guard, handed on from
- * DeviceRoleAndDeclaredLinkParentMigration.test.ts: this is the newest
- * registered migration, so its timestamp must sort above every other one.
- * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
- * recent migrations here use hand-picked round numbers that already run
- * ahead of it — so a generated file lands BELOW several registered
- * migrations unless somebody renumbers it, and runs out of order without
- * anything saying so. Whoever adds the next migration should move this
- * block to theirs.
+ * This file used to carry the ORDERING guard. It has moved on to
+ * FixTotpOtpUrlAlgorithmMigration.test.ts, which is the newest registered
+ * migration — the guard only says anything while it sits on the newest one.
+ * What stays here is the file-on-disk check, which is about THIS migration
+ * and stays true forever.
  */
 
 const MIGRATION_DIRECTORY: string = path.join(
@@ -45,15 +41,6 @@ const MIGRATION_DIRECTORY: string = path.join(
 
 const MIGRATION_TIMESTAMP: string = "1787600000000";
 
-interface MigrationClass {
-  name: string;
-}
-
-function timestampOf(migrationClass: MigrationClass): number | null {
-  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
-  return match ? Number(match[1]) : null;
-}
-
 type MakeQueryRunnerResult = {
   runner: QueryRunner;
   statements: Array<string>;
@@ -237,51 +224,12 @@ describe("registration", () => {
   });
 });
 
-// The guard described in the header. Hand it to the next migration.
-describe("ordering", () => {
-  test("its timestamp sorts after every other registered migration", () => {
-    const ourTimestamp: number | null = timestampOf(
-      AddNetworkDeviceReachabilityColumns1787600000000,
-    );
-
-    expect(ourTimestamp).not.toBeNull();
-
-    const otherTimestamps: Array<number> = [];
-
-    for (const migrationClass of SchemaMigrations) {
-      if (migrationClass === AddNetworkDeviceReachabilityColumns1787600000000) {
-        continue;
-      }
-
-      const timestamp: number | null = timestampOf(
-        migrationClass as MigrationClass,
-      );
-
-      if (timestamp !== null) {
-        otherTimestamps.push(timestamp);
-      }
-    }
-
-    /*
-     * Math.max() of an empty list is -Infinity, which every timestamp beats.
-     * Prove the list was actually enumerated before leaning on the maximum.
-     */
-    expect(otherTimestamps.length).toBeGreaterThan(100);
-
-    expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
-  });
-
-  test("it is registered last, matching that timestamp", () => {
-    expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
-      AddNetworkDeviceReachabilityColumns1787600000000,
-    );
-  });
-
+describe("identity on disk", () => {
   /*
-   * ...and the timestamp in the class name is the one on disk. A class
-   * renamed without renaming its file (or two migrations landing on the
-   * same timestamp) leaves the ordering above asserting something that is
-   * not what actually runs.
+   * The timestamp in the class name is the one on disk. A class renamed
+   * without renaming its file — or two migrations landing on the same
+   * timestamp — makes the registered ordering describe something that is not
+   * what actually runs.
    */
   test("exactly one file on disk carries its timestamp, and it is this one", () => {
     const matching: Array<string> = fs

package/Tests/Server/Services/AnalyticsDatabasePaginationStability.test.ts

@@ -314,6 +314,35 @@ describe("AnalyticsDatabaseService pagination stability", () => {
       jest.restoreAllMocks();
     });
 
+    /*
+     * The sort-key boundary filter (toSortKeyBoundaryFilter) puts its own
+     * `ORDER BY <key> LIMIT n` in a subquery inside the WHERE, so the
+     * statement now carries two. The tiebreaker lives on the LAST one —
+     * the outer sort that actually orders the page.
+     */
+    const outerOrderBy: (query: string) => string = (query: string): string => {
+      return query
+        .slice(query.lastIndexOf("ORDER BY "))
+        .replace("ORDER BY ", "")
+        .split(" LIMIT")[0]!;
+    };
+
+    /*
+     * Resolves the rendered `{pN:Identifier}` terms of an ORDER BY back to
+     * the column names they are bound to, so the assertions do not depend
+     * on parameter numbering.
+     */
+    const orderByColumns: (statement: Statement) => Array<string> = (
+      statement: Statement,
+    ): Array<string> => {
+      return outerOrderBy(statement.query)
+        .split(", ")
+        .map((term: string): string => {
+          const param: string = term.split(":")[0]!.replace("{", "");
+          return statement.query_params[param] as string;
+        });
+    };
+
     /*
      * The generator is NOT mocked here, so this asserts the real ORDER BY
      * text — the separator fix and the tiebreaker together.
@@ -328,13 +357,10 @@ describe("AnalyticsDatabaseService pagination stability", () => {
         skip: 100,
       } as never);
 
-      expect(statement.query).toContain(
-        "ORDER BY {p2:Identifier} DESC, {p3:Identifier} DESC",
+      expect(outerOrderBy(statement.query)).toMatch(
+        /^\{p\d+:Identifier\} DESC, \{p\d+:Identifier\} DESC$/,
       );
-      expect(statement.query_params).toMatchObject({
-        p2: TIME_COLUMN,
-        p3: "_id",
-      });
+      expect(orderByColumns(statement)).toStrictEqual([TIME_COLUMN, "_id"]);
     });
 
     test("the ORDER BY ends with _id, immediately before LIMIT", () => {
@@ -347,13 +373,7 @@ describe("AnalyticsDatabaseService pagination stability", () => {
         skip: 0,
       } as never);
 
-      const orderBy: string = statement.query
-        .split("ORDER BY ")[1]!
-        .split(" LIMIT")[0]!;
-      const lastTerm: string = orderBy.split(", ").pop()!;
-      const lastParam: string = lastTerm.split(":")[0]!.replace("{", "");
-
-      expect(statement.query_params[lastParam]).toBe("_id");
+      expect(orderByColumns(statement).pop()).toBe("_id");
     });
   });