@oneuptime/common 12.0.14 → 12.0.15

package/Tests/Server/Middleware/UserAuthorizationSSOProvider.test.ts

@@ -33,20 +33,29 @@ describe("UserMiddleware.doesSsoTokenForProjectExist - requiredSsoProviderId", (
     return u;
   };
 
-  // Build a request whose cookies carry a real `sso-<projectId>` token.
+  /*
+   * Build a request whose cookies carry a real `sso-<projectId>` token.
+   *
+   * The type defaults to ProjectSSO because that is what a PROJECT SSO login
+   * actually mints, and the project-scoped slot now refuses Global-typed
+   * credentials outright - see the "legacy Global-typed token" block below for
+   * why, and for the tests that pin it.
+   */
   const buildRequestWithSsoToken: (data: {
     tokenProjectId: ObjectID;
     discriminatorProviderId?: ObjectID | undefined;
+    ssoProviderType?: SsoProviderType | undefined;
   }) => ExpressRequest = (data: {
     tokenProjectId: ObjectID;
     discriminatorProviderId?: ObjectID | undefined;
+    ssoProviderType?: SsoProviderType | undefined;
   }): ExpressRequest => {
     const token: string = CookieUtil.getSSOToken({
       user: buildUser(),
       projectId: data.tokenProjectId,
       ssoProviderId: data.discriminatorProviderId,
       ssoProviderType: data.discriminatorProviderId
-        ? SsoProviderType.GlobalSSO
+        ? data.ssoProviderType || SsoProviderType.ProjectSSO
         : undefined,
     });
 
@@ -170,6 +179,86 @@ describe("UserMiddleware.doesSsoTokenForProjectExist - requiredSsoProviderId", (
  * a matching token. The token is sourced from the `global-sso-token` cookie
  * (web) or the `x-global-sso-token` header (mobile).
  */
+/*
+ * A Global-typed credential must never be accepted from the per-project slot.
+ *
+ * Before the single-token redesign, the Global SSO router fanned out one
+ * per-project `sso-<projectId>` cookie per project the user belonged to, typed
+ * GlobalSSO and signed for 30 days. Those are still in browsers, and the
+ * mobile app still replays every non-expired stored token as `x-sso-tokens`.
+ * If the project slot accepted them, they would short-circuit past the
+ * provider-trust check - so disabling a provider would still not revoke them,
+ * for up to a month. They are refused here instead, which sends the user
+ * through a fresh global login that mints a properly-typed token.
+ */
+describe("UserMiddleware.doesSsoTokenForProjectExist - legacy Global-typed token in the project slot", () => {
+  const legacyProjectId: ObjectID = ObjectID.generate();
+  const legacyUserId: ObjectID = ObjectID.generate();
+  const legacyProviderId: ObjectID = ObjectID.generate();
+
+  const buildLegacyRequest: (
+    ssoProviderType: SsoProviderType,
+  ) => ExpressRequest = (ssoProviderType: SsoProviderType): ExpressRequest => {
+    const user: User = new User();
+    user.id = legacyUserId;
+    user.email = new Email("legacy-sso-user@oneuptime.com");
+
+    const token: string = CookieUtil.getSSOToken({
+      user,
+      projectId: legacyProjectId,
+      ssoProviderId: legacyProviderId,
+      ssoProviderType,
+    });
+
+    return {
+      cookies: {
+        [CookieUtil.getUserSSOKey(legacyProjectId)]: token,
+      },
+      headers: {},
+    } as unknown as ExpressRequest;
+  };
+
+  test("a GlobalSSO-typed token in the project slot is refused", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.GlobalSSO),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(false);
+  });
+
+  test("a GlobalOIDC-typed token in the project slot is refused", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.GlobalOIDC),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(false);
+  });
+
+  test("the SAME token typed ProjectSSO is accepted, so the refusal is about the type and nothing else", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.ProjectSSO),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(true);
+  });
+
+  test("a ProjectOIDC-typed token in the project slot is accepted", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.ProjectOIDC),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(true);
+  });
+});
+
 describe("UserMiddleware.doesSsoTokenForProjectExist - global SSO token", () => {
   const projectId: ObjectID = ObjectID.generate();
   const otherProjectId: ObjectID = ObjectID.generate();

package/Tests/Server/Middleware/WhatsAppAuthorization.test.ts

@@ -0,0 +1,233 @@
+import { describe, expect, test, beforeEach } from "@jest/globals";
+import crypto from "crypto";
+import WhatsAppAuthorization from "../../../Server/Middleware/WhatsAppAuthorization";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import BadDataException from "../../../Types/Exception/BadDataException";
+
+/*
+ * The config lookup is mocked so the signature branches can be exercised
+ * without Postgres; the middleware under test must never need a database.
+ */
+jest.mock("../../../Server/Services/GlobalConfigService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findOneBy: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    __esModule: true,
+    default: {
+      sendErrorResponse: jest.fn(),
+    },
+  };
+});
+
+/*
+ * Regression cover for the unguarded crypto.timingSafeEqual in
+ * isAuthorizedWhatsAppRequest. timingSafeEqual throws RangeError when the two
+ * buffers differ in byte length, and the compared value came straight off the
+ * attacker-controlled X-Hub-Signature-256 header with no try/catch anywhere
+ * above it. The endpoint is unauthenticated by design - the signature IS the
+ * authentication - so anyone could send `x-hub-signature-256: nope` and throw
+ * the middleware instead of receiving the intended 400.
+ */
+describe("WhatsAppAuthorization.isAuthorizedWhatsAppRequest", () => {
+  const APP_SECRET: string = "meta-whatsapp-app-secret";
+  const RAW_BODY: string = JSON.stringify({
+    object: "whatsapp_business_account",
+  });
+
+  const findOneBy: jest.Mock =
+    GlobalConfigService.findOneBy as unknown as jest.Mock;
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+  let next: NextFunction;
+
+  type SignFunction = (body: string) => string;
+
+  const sign: SignFunction = (body: string): string => {
+    return `sha256=${crypto
+      .createHmac("sha256", APP_SECRET)
+      .update(body)
+      .digest("hex")}`;
+  };
+
+  type BuildRequestFunction = (
+    signature: string | undefined,
+    body?: string,
+  ) => OneUptimeRequest;
+
+  const buildRequest: BuildRequestFunction = (
+    signature: string | undefined,
+    body: string = RAW_BODY,
+  ): OneUptimeRequest => {
+    return {
+      headers:
+        signature === undefined ? {} : { "x-hub-signature-256": signature },
+      rawBody: body,
+    } as unknown as OneUptimeRequest;
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    next = jest.fn();
+    findOneBy.mockResolvedValue({ metaWhatsAppAppSecret: APP_SECRET });
+  });
+
+  test("calls next when the signature matches the body", async () => {
+    const req: OneUptimeRequest = buildRequest(sign(RAW_BODY));
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("calls next when the signature matches but the digest is upper-case", async () => {
+    const signature: string = sign(RAW_BODY);
+    const req: OneUptimeRequest = buildRequest(
+      `sha256=${signature.slice("sha256=".length).toUpperCase()}`,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("rejects a well-formed signature computed over a different body", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      sign(`${RAW_BODY} tampered`),
+      RAW_BODY,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("WhatsApp webhook signature verification failed."),
+    );
+  });
+
+  test("rejects a well-formed signature computed with a different secret", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      `sha256=${crypto
+        .createHmac("sha256", "some-other-secret")
+        .update(RAW_BODY)
+        .digest("hex")}`,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("WhatsApp webhook signature verification failed."),
+    );
+  });
+
+  /*
+   * An empty header value is indistinguishable from an absent one, so both
+   * take the missing-header branch rather than the malformed-digest one.
+   */
+  test.each([
+    ["absent", undefined],
+    ["empty", ""],
+  ])(
+    "rejects an %s signature header",
+    async (_label: string, signature: string | undefined) => {
+      const req: OneUptimeRequest = buildRequest(signature);
+
+      await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+      expect(next).not.toHaveBeenCalled();
+      expect(sendErrorResponse).toHaveBeenCalledWith(
+        req,
+        res,
+        new BadDataException("Missing X-Hub-Signature-256 header."),
+      );
+    },
+  );
+
+  /*
+   * Every one of these is a byte length other than the 71 of a real
+   * "sha256=" + 64 hex header, which is exactly what used to reach
+   * timingSafeEqual and throw.
+   */
+  const malformedSignatures: Array<[string, string]> = [
+    ["a bare word", "nope"],
+    ["the prefix with no digest", "sha256="],
+    ["a short digest", "sha256=abc123"],
+    ["a long digest", `sha256=${"a".repeat(65)}`],
+    ["the right length but non-hex characters", `sha256=${"z".repeat(64)}`],
+    ["64 hex characters with no prefix", "a".repeat(64)],
+    ["the wrong prefix", `sha1=${"a".repeat(64)}`],
+    ["a whitespace-padded digest", ` sha256=${"a".repeat(64)}`],
+  ];
+
+  describe("rejects a malformed signature with 400 rather than throwing", () => {
+    test.each(malformedSignatures)(
+      "%s",
+      async (_label: string, signature: string) => {
+        const req: OneUptimeRequest = buildRequest(signature);
+
+        await expect(
+          WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next),
+        ).resolves.toBeUndefined();
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException(
+            "WhatsApp webhook signature verification failed.",
+          ),
+        );
+      },
+    );
+  });
+
+  /*
+   * The shape check sits in front of the config lookup, so an unauthenticated
+   * flood of garbage signatures costs no database round trips.
+   */
+  test("does not query the global config for a malformed signature", async () => {
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(
+      buildRequest("nope"),
+      res,
+      next,
+    );
+
+    expect(findOneBy).not.toHaveBeenCalled();
+  });
+
+  test("rejects when the app secret is not configured", async () => {
+    findOneBy.mockResolvedValue({ metaWhatsAppAppSecret: "   " });
+
+    const req: OneUptimeRequest = buildRequest(sign(RAW_BODY));
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Meta WhatsApp App Secret is not configured."),
+    );
+  });
+});

package/Tests/Server/Services/DiscoveryScanClaimHookFreeSafety.test.ts

@@ -8,7 +8,8 @@ import { describe, expect, test } from "@jest/globals";
 /*
  * The /probe-ingest/probe/discovery-scan/list route hands the requesting
  * probe its pending subnet scans and claims them (status "In Progress" +
- * startedAt) via DatabaseService.updateColumnsByIdWithoutHooks — one raw
+ * startedAt, and a cleared statusMessage) via
+ * DatabaseService.updateColumnsByIdWithoutHooks — one raw
  * parameterized UPDATE that skips ALL on-update hooks: workflow HTTP
  * triggers, audit-log inserts, realtime events, service
  * onBeforeUpdate/onUpdateSuccess. The probe synchronously waits on this
@@ -18,8 +19,8 @@ import { describe, expect, test } from "@jest/globals";
  * pre-fetch SELECT + row re-fetch + save() transaction).
  *
  *   - App/FeatureSet/Telemetry/API/ProbeIngest/DiscoveryScan.ts
- *       NetworkDeviceDiscoveryScan.status/startedAt when a probe claims a
- *       Pending scan
+ *       NetworkDeviceDiscoveryScan.status/startedAt/statusMessage when a
+ *       probe claims a Pending scan
  *
  * The conversion dropped NOTHING: the model declares no update workflow, no
  * audit logging and no realtime events. But the fast path skips hooks
@@ -36,8 +37,8 @@ import { describe, expect, test } from "@jest/globals";
  * be written by a root caller that bypasses the create-time check. That hook
  * is deliberately safe to skip here, and the assertions below pin exactly
  * why rather than merely restating that it exists: the claim write stamps
- * only `status` and `startedAt`, which the hook does not look at, and the
- * hook is a pass-through for that payload. If the hook ever grows to
+ * only `status`, `startedAt` and `statusMessage`, none of which the hook
+ * looks at, and the hook is a pass-through for that payload. If the hook ever grows to
  * validate a column the claim write touches — or the claim write grows to
  * touch `cidr` — these fail.
  *
@@ -79,7 +80,11 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
      */
     test("NetworkDeviceDiscoveryScan has every column the claim write stamps", () => {
       const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
-      const fastPathColumns: Array<string> = ["status", "startedAt"];
+      const fastPathColumns: Array<string> = [
+        "status",
+        "startedAt",
+        "statusMessage",
+      ];
       for (const column of fastPathColumns) {
         expect(scan.isTableColumn(column)).toBe(true);
       }
@@ -130,7 +135,11 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
      * overlap shows up here.
      */
     test("the claim write's columns are disjoint from what onBeforeUpdate validates", () => {
-      const claimWriteColumns: Array<string> = ["status", "startedAt"];
+      const claimWriteColumns: Array<string> = [
+        "status",
+        "startedAt",
+        "statusMessage",
+      ];
       const columnsValidatedByHook: Array<string> = ["cidr"];
 
       for (const column of claimWriteColumns) {
@@ -146,7 +155,11 @@ describe("discovery-scan claim hookless write safety preconditions", () => {
     test("onBeforeUpdate is a pass-through for the exact claim payload", async () => {
       const claimUpdateBy: unknown = {
         query: { _id: "some-scan-id" },
-        data: { status: "In Progress", startedAt: new Date(0) },
+        data: {
+          status: "In Progress",
+          startedAt: new Date(0),
+          statusMessage: null,
+        },
         props: { isRoot: true },
         limit: 1,
         skip: 0,