@oneuptime/common 12.0.14 → 12.0.15

package/Server/Middleware/UserAuthorization.ts

@@ -27,6 +27,11 @@ import JSONFunctions from "../../Types/JSONFunctions";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
 import ObjectID from "../../Types/ObjectID";
 import SsoProviderType from "../../Types/SSO/SsoProviderType";
+import GlobalSsoService from "../Services/GlobalSsoService";
+import { GlobalProviderTrust } from "../Utils/GlobalSsoAuthorization";
+import GlobalOidcService from "../Services/GlobalOidcService";
+import GlobalSsoProjectService from "../Services/GlobalSsoProjectService";
+import GlobalOidcProjectService from "../Services/GlobalOidcProjectService";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import Permission, {
   PermissionHelper,
@@ -234,8 +239,13 @@ export default class UserMiddleware {
     }
   }
 
+  /**
+   * Per-project SSO token check (Project SSO/OIDC login). Bound to one project,
+   * entirely stateless: signature, expiry, project, user, and the optional
+   * pinned-provider discriminator.
+   */
   @CaptureSpan()
-  public static doesSsoTokenForProjectExist(
+  public static doesProjectScopedSsoTokenExist(
     req: ExpressRequest,
     projectId: ObjectID,
     userId: ObjectID,
@@ -243,41 +253,241 @@ export default class UserMiddleware {
   ): boolean {
     const ssoTokens: Dictionary<string> = this.getSsoTokens(req);
 
-    /*
-     * 1) Per-project SSO token (Project SSO/OIDC login). Bound to one project.
-     */
-    if (ssoTokens && ssoTokens[projectId.toString()]) {
+    if (!ssoTokens || !ssoTokens[projectId.toString()]) {
+      return false;
+    }
+
+    try {
       const decodedData: JSONWebTokenData = JSONWebToken.decode(
         ssoTokens[projectId.toString()] as string,
       );
+
+      /*
+       * A Global-typed credential is NEVER accepted here, whichever slot it
+       * arrived in. Before the single-token redesign the Global SSO router
+       * minted one per-project token per project, typed GlobalSSO, signed for
+       * 30 days - and those are still sitting in browsers as `sso-<projectId>`
+       * cookies and in the mobile app's AsyncStorage, replayed on every
+       * request. Accepting them here would let a Global credential short-
+       * circuit past the provider-trust check, so disabling a provider would
+       * still not revoke them. Route every Global token through the stateful
+       * path instead.
+       */
       if (
+        decodedData.ssoProviderType === SsoProviderType.GlobalSSO ||
+        decodedData.ssoProviderType === SsoProviderType.GlobalOIDC
+      ) {
+        return false;
+      }
+
+      return (
         decodedData.projectId?.toString() === projectId.toString() &&
         decodedData.userId.toString() === userId.toString() &&
         this.isSsoProviderSatisfied(decodedData, requiredSsoProviderId)
-      ) {
-        return true;
-      }
+      );
+    } catch {
+      /*
+       * A token that expires between `getSsoTokens` decoding it and this call
+       * throws out of `decode`. Swallowing it here means the request falls
+       * through to the Global SSO token instead of 500-ing, which is what a
+       * user with both kinds would expect.
+       */
+      return false;
     }
+  }
 
-    /*
-     * 2) Global SSO token (Global SSO/OIDC login). Not bound to a project, so a
-     * single token satisfies enforcement for every project this user belongs to
-     * — including projects created after the login. The specific-provider
-     * discriminator still applies (a project pinned to a different provider is
-     * not satisfied by this token).
-     */
+  /**
+   * The Global SSO token, if one is present and stateless-valid for this user.
+   *
+   * "Stateless-valid" means signature, expiry, Global provider type, matching
+   * user, and the project's pinned-provider discriminator. It deliberately
+   * says nothing about whether the provider still exists, is still enabled, or
+   * governs the project in question - those need the database, and live in
+   * `isGlobalSsoTokenAuthorizedForProject`.
+   */
+  @CaptureSpan()
+  public static getStatelessValidGlobalSsoTokenData(
+    req: ExpressRequest,
+    userId: ObjectID,
+    requiredSsoProviderId?: ObjectID | undefined,
+  ): JSONWebTokenData | null {
     const globalSsoTokenData: JSONWebTokenData | null =
       this.getGlobalSsoTokenData(req);
 
+    if (!globalSsoTokenData) {
+      return null;
+    }
+
+    if (globalSsoTokenData.userId.toString() !== userId.toString()) {
+      return null;
+    }
+
+    if (
+      !this.isSsoProviderSatisfied(globalSsoTokenData, requiredSsoProviderId)
+    ) {
+      return null;
+    }
+
+    return globalSsoTokenData;
+  }
+
+  /**
+   * The stateless half of the whole decision, kept as one call because it is
+   * the part that can be reasoned about without a database.
+   *
+   * NOTE: this is NOT the enforcement entry point. A Global SSO token that
+   * passes here can still be refused by `isSsoSatisfiedForProject`, which also
+   * asks whether the provider is still trusted and whether it governs this
+   * project. Enforcement must call that.
+   */
+  @CaptureSpan()
+  public static doesSsoTokenForProjectExist(
+    req: ExpressRequest,
+    projectId: ObjectID,
+    userId: ObjectID,
+    requiredSsoProviderId?: ObjectID | undefined,
+  ): boolean {
+    if (
+      this.doesProjectScopedSsoTokenExist(
+        req,
+        projectId,
+        userId,
+        requiredSsoProviderId,
+      )
+    ) {
+      return true;
+    }
+
+    return Boolean(
+      this.getStatelessValidGlobalSsoTokenData(
+        req,
+        userId,
+        requiredSsoProviderId,
+      ),
+    );
+  }
+
+  /**
+   * Whether a stateless-valid Global SSO token is STILL authorized for this
+   * project right now.
+   *
+   * Two questions the token itself cannot answer:
+   *
+   *   1. IS THE PROVIDER STILL TRUSTED? Always checked. A Global SSO token
+   *      lives for 30 days and carries no revocation, so without this an admin
+   *      turning a provider off - or deleting it outright - changes nothing
+   *      for anyone already signed in, for up to a month.
+   *
+   *   2. DOES THE PROVIDER GOVERN THIS PROJECT? Only checked when the admin
+   *      turned on `restrictToAttachedProjects` for that provider. The
+   *      attachment rows are the PROVISIONING allow-list by default, and the
+   *      login routers grant a session on membership of ANY project - so
+   *      treating attachments as an access boundary unasked would deny users
+   *      projects they legitimately reach today, with nothing in the product
+   *      to recover with.
+   *
+   * Answers are cached in-process for 60s and concurrent misses share one
+   * query (Common/Server/Utils/GlobalSsoAuthorization.ts).
+   *
+   * THROWS rather than denying when the lookup itself fails. "This provider is
+   * not allowed here" and "we could not find out" are different answers, and
+   * conflating them lets a database blip look like a permission decision - on
+   * the multi-tenant path that would silently hand back a 200 with no
+   * permissions rather than an error anyone would notice.
+   */
+  @CaptureSpan()
+  public static async isGlobalSsoTokenAuthorizedForProject(data: {
+    globalSsoTokenData: JSONWebTokenData;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const { globalSsoTokenData, projectId } = data;
+
+    const providerIdValue: string | undefined =
+      globalSsoTokenData.ssoProviderId?.toString();
+
+    if (!providerIdValue) {
+      /*
+       * A Global-typed token with no provider id cannot be checked against
+       * either question, so it cannot be trusted for a project. This is a
+       * decision, not a failure - do not throw.
+       */
+      return false;
+    }
+
+    const providerId: ObjectID = new ObjectID(providerIdValue);
+
+    const isOidc: boolean =
+      globalSsoTokenData.ssoProviderType === SsoProviderType.GlobalOIDC;
+
+    const trust: GlobalProviderTrust = isOidc
+      ? await GlobalOidcService.getProviderTrust(providerId)
+      : await GlobalSsoService.getProviderTrust(providerId);
+
+    if (!trust.isUsable) {
+      return false;
+    }
+
+    if (!trust.restrictToAttachedProjects) {
+      /*
+       * The default, and what every existing installation gets: a global login
+       * satisfies enforcement for every project the user belongs to.
+       */
+      return true;
+    }
+
+    return isOidc
+      ? GlobalOidcProjectService.doesProviderGovernProject({
+          globalOidcId: providerId,
+          projectId,
+        })
+      : GlobalSsoProjectService.doesProviderGovernProject({
+          globalSsoId: providerId,
+          projectId,
+        });
+  }
+
+  /**
+   * THE enforcement entry point: is this request's SSO requirement satisfied
+   * for this project?
+   *
+   * A per-project token is decided statelessly. A Global SSO token additionally
+   * has to survive the provider-trust and project-governance checks above.
+   */
+  @CaptureSpan()
+  public static async isSsoSatisfiedForProject(data: {
+    req: ExpressRequest;
+    projectId: ObjectID;
+    userId: ObjectID;
+    requiredSsoProviderId?: ObjectID | undefined;
+  }): Promise<boolean> {
+    const { req, projectId, userId, requiredSsoProviderId } = data;
+
     if (
-      globalSsoTokenData &&
-      globalSsoTokenData.userId.toString() === userId.toString() &&
-      this.isSsoProviderSatisfied(globalSsoTokenData, requiredSsoProviderId)
+      this.doesProjectScopedSsoTokenExist(
+        req,
+        projectId,
+        userId,
+        requiredSsoProviderId,
+      )
     ) {
       return true;
     }
 
-    return false;
+    const globalSsoTokenData: JSONWebTokenData | null =
+      this.getStatelessValidGlobalSsoTokenData(
+        req,
+        userId,
+        requiredSsoProviderId,
+      );
+
+    if (!globalSsoTokenData) {
+      return false;
+    }
+
+    return this.isGlobalSsoTokenAuthorizedForProject({
+      globalSsoTokenData,
+      projectId,
+    });
   }
 
   @CaptureSpan()
@@ -646,12 +856,12 @@ export default class UserMiddleware {
         );
 
       if (
-        !UserMiddleware.doesSsoTokenForProjectExist(
+        !(await UserMiddleware.isSsoSatisfiedForProject({
           req,
-          tenantId,
+          projectId: tenantId,
           userId,
-          requiredSsoProviderId ?? undefined,
-        )
+          requiredSsoProviderId: requiredSsoProviderId ?? undefined,
+        }))
       ) {
         throw new SsoAuthorizationException();
       }
@@ -714,12 +924,12 @@ export default class UserMiddleware {
             });
 
           if (
-            !UserMiddleware.doesSsoTokenForProjectExist(
+            !(await UserMiddleware.isSsoSatisfiedForProject({
               req,
               projectId,
               userId,
-              requiredSsoProviderId ?? undefined,
-            )
+              requiredSsoProviderId: requiredSsoProviderId ?? undefined,
+            }))
           ) {
             return {
               projectId,

package/Server/Middleware/WhatsAppAuthorization.ts

@@ -12,6 +12,19 @@ import crypto from "crypto";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * Meta sends the digest as "sha256=" followed by the 64 hex characters of a
+ * SHA-256 HMAC. The header is attacker-controlled and the endpoint is
+ * unauthenticated by design - the signature IS the authentication - so the
+ * shape has to be checked before the value reaches crypto.timingSafeEqual,
+ * which throws RangeError on a length mismatch rather than returning false.
+ * Without the guard, any unauthenticated request carrying a signature header
+ * of some other length threw out of the middleware instead of getting the
+ * intended 400.
+ */
+const SIGNATURE_PREFIX: string = "sha256=";
+const HEX_DIGEST_REGEX: RegExp = /^[a-f0-9]{64}$/i;
+
 export default class WhatsAppAuthorization {
   @CaptureSpan()
   public static async isAuthorizedWhatsAppRequest(
@@ -40,6 +53,26 @@ export default class WhatsAppAuthorization {
       );
     }
 
+    /*
+     * Checked up front, before the config lookup: a request whose signature
+     * cannot possibly verify should not cost a database round trip.
+     */
+    const providedDigest: string = signature.startsWith(SIGNATURE_PREFIX)
+      ? signature.slice(SIGNATURE_PREFIX.length)
+      : "";
+
+    if (!HEX_DIGEST_REGEX.test(providedDigest)) {
+      logger.error(
+        "WhatsApp webhook request has a malformed X-Hub-Signature-256 header.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("WhatsApp webhook signature verification failed."),
+      );
+    }
+
     const globalConfig: GlobalConfig | null =
       await GlobalConfigService.findOneBy({
         query: {
@@ -70,12 +103,19 @@ export default class WhatsAppAuthorization {
 
     const rawBody: string = req.rawBody || "";
 
-    const expectedSignature: string = `sha256=${crypto.createHmac("sha256", appSecret).update(rawBody).digest("hex")}`;
+    const expectedDigest: string = crypto
+      .createHmac("sha256", appSecret)
+      .update(rawBody)
+      .digest("hex");
 
+    /*
+     * Both sides are decoded from 64 validated hex characters, so both
+     * buffers are 32 bytes and timingSafeEqual cannot throw here.
+     */
     if (
       !crypto.timingSafeEqual(
-        Buffer.from(expectedSignature) as Uint8Array,
-        Buffer.from(signature) as Uint8Array,
+        Buffer.from(expectedDigest, "hex") as Uint8Array,
+        Buffer.from(providedDigest, "hex") as Uint8Array,
       )
     ) {
       logger.error(

package/Server/Services/GlobalOidcProjectService.ts

@@ -4,18 +4,138 @@ import Team from "../../Models/DatabaseModels/Team";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import validateGlobalProviderProjectTeams, {
   resolveAttachmentProjectId,
 } from "../Utils/ValidateGlobalProviderProjectTeams";
+import {
+  GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+  GlobalProviderAttachments,
+  clearGlobalSsoAuthorizationCaches,
+  doAttachmentsGovernProject,
+  globalProviderCacheKey,
+  globalSsoAttachmentsCache,
+  loadAttachmentsOnce,
+} from "../Utils/GlobalSsoAuthorization";
+import DeleteBy from "../Types/Database/DeleteBy";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /**
+   * Whether this provider's attachments cover `projectId`.
+   *
+   * Only consulted when the provider has `restrictToAttachedProjects` on -
+   * attachments are the PROVISIONING allow-list by default, not an access
+   * boundary, and reading them as one without the admin asking would lock
+   * existing users out of projects they legitimately reach.
+   *
+   * "No attachment rows at all" means instance-wide, matching the login
+   * router's default-all mode. "Rows exist but none are enabled" is a
+   * different answer and denies - otherwise an admin disabling the last
+   * attachment would WIDEN the provider to every project.
+   *
+   * Cached for 60s, with concurrent misses sharing one query.
+   */
+  @CaptureSpan()
+  public async doesProviderGovernProject(data: {
+    globalOidcId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const key: string = globalProviderCacheKey("oidc", data.globalOidcId);
+
+    const cached: GlobalProviderAttachments | undefined =
+      globalSsoAttachmentsCache.get(key);
+
+    if (cached !== undefined) {
+      return doAttachmentsGovernProject(cached, data.projectId);
+    }
+
+    const attachments: GlobalProviderAttachments = await loadAttachmentsOnce(
+      key,
+      async (): Promise<GlobalProviderAttachments> => {
+        /*
+         * Fetched WITHOUT the isEnabled filter so a disabled row still counts
+         * as "this provider has attachments"; the enabled ones are selected
+         * out below.
+         */
+        const rows: Array<Model> = await this.findBy({
+          query: { globalOidcId: data.globalOidcId },
+          select: { _id: true, projectId: true, isEnabled: true },
+          limit: LIMIT_PER_PROJECT,
+          skip: 0,
+          props: { isRoot: true },
+        });
+
+        const loaded: GlobalProviderAttachments = {
+          hasAnyAttachmentRows: rows.length > 0,
+          enabledProjectIds: rows
+            .filter((row: Model) => {
+              return Boolean(row.isEnabled) && Boolean(row.projectId);
+            })
+            .map((row: Model) => {
+              return row.projectId!.toString();
+            }),
+        };
+
+        globalSsoAttachmentsCache.set(
+          key,
+          loaded,
+          GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+        );
+
+        return loaded;
+      },
+    );
+
+    return doAttachmentsGovernProject(attachments, data.projectId);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    // Detaching a project has to take effect now, not in 60s, on this node.
+    clearGlobalSsoAuthorizationCaches();
+    return { deleteBy, carryForward: null };
+  }
+
+  /*
+   * Cleared again AFTER the write commits. A clear that runs before the row
+   * lands can be immediately re-filled with the pre-change answer by a
+   * concurrent request, handing the old attachment set another full TTL.
+   */
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    _itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onDelete;
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    clearGlobalSsoAuthorizationCaches();
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    _updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onUpdate;
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
@@ -38,6 +158,9 @@ export class Service extends DatabaseService<Model> {
       projectId,
     });
 
+    // A new attachment narrows (or widens) which projects the provider governs.
+    clearGlobalSsoAuthorizationCaches();
+
     return { createBy, carryForward: null };
   }
 
@@ -78,6 +201,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    clearGlobalSsoAuthorizationCaches();
+
     return { updateBy, carryForward: null };
   }
 }

package/Server/Services/GlobalOidcService.ts

@@ -1,10 +1,142 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalOidc";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import {
+  GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+  GlobalProviderTrust,
+  clearGlobalSsoAuthorizationCaches,
+  globalProviderCacheKey,
+  globalSsoProviderTrustCache,
+  loadTrustOnce,
+} from "../Utils/GlobalSsoAuthorization";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /**
+   * What the SSO-enforcement middleware needs to know about this provider:
+   * whether it is still usable at all, and whether the admin opted it into
+   * attachment-scoped access.
+   *
+   * Called on every authenticated request against an SSO-enforced project, so
+   * the answer is cached for 60s and concurrent misses share one query.
+   * Without this lookup, turning a provider off leaves every token it ever
+   * issued working until each one expires - up to thirty days.
+   */
+  @CaptureSpan()
+  public async getProviderTrust(
+    providerId: ObjectID,
+  ): Promise<GlobalProviderTrust> {
+    const key: string = globalProviderCacheKey("oidc", providerId);
+
+    const cached: GlobalProviderTrust | undefined =
+      globalSsoProviderTrustCache.get(key);
+
+    if (cached !== undefined) {
+      return cached;
+    }
+
+    return loadTrustOnce(key, async (): Promise<GlobalProviderTrust> => {
+      const provider: Model | null = await this.findOneBy({
+        query: { _id: providerId.toString() },
+        select: {
+          _id: true,
+          isEnabled: true,
+          restrictToAttachedProjects: true,
+        },
+        props: { isRoot: true },
+      });
+
+      /*
+       * A deleted provider and a disabled one are the same answer: no. Both
+       * are cached, so a revoked provider does not cost a query per request.
+       */
+      const trust: GlobalProviderTrust = {
+        isUsable: Boolean(provider && provider.isEnabled),
+        restrictToAttachedProjects: Boolean(
+          provider && provider.restrictToAttachedProjects,
+        ),
+      };
+
+      globalSsoProviderTrustCache.set(
+        key,
+        trust,
+        GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+      );
+
+      return trust;
+    });
+  }
+
+  /*
+   * Cache invalidation runs in the SUCCESS hooks, not the before-hooks: a
+   * clear that happens before the row is written can be immediately re-filled
+   * with the pre-change answer by a concurrent request, which would hand a
+   * disabled provider another full TTL of life on the very node that served
+   * the disable. Clearing in both is deliberate - the before-hook narrows the
+   * window, the success hook closes it.
+   *
+   * These caches are per-process, so the hooks make a change immediate on the
+   * node that served it and the TTL bounds every other node.
+   */
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    _updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onUpdate;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return { deleteBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    _itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onDelete;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    clearGlobalSsoAuthorizationCaches();
+    return createdItem;
+  }
 }
 
 export default new Service();