@oneuptime/common 12.0.14 → 12.0.15

package/Tests/Server/API/StatusPageCustomizationOrigin.test.ts

@@ -0,0 +1,348 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPageDomain from "../../../Models/DatabaseModels/StatusPageDomain";
+import StatusPageAPI from "../../../Server/API/StatusPageAPI";
+import StatusPageDomainService from "../../../Server/Services/StatusPageDomainService";
+import StatusPageFooterLinkService from "../../../Server/Services/StatusPageFooterLinkService";
+import StatusPageHeaderLinkService from "../../../Server/Services/StatusPageHeaderLinkService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPageSsoService from "../../../Server/Services/StatusPageSsoService";
+import Select from "../../../Server/Types/Database/Select";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+  };
+});
+
+const MASTER_PAGE_ROUTE: string = "/status-page/master-page/:statusPageId";
+
+const CUSTOM_CSS: string = "body { background: url(https://evil.example); }";
+const CUSTOM_JAVASCRIPT: string =
+  "fetch('/api/project/get-list', { credentials: 'include' });";
+const HEADER_HTML: string =
+  '<img src="x" onerror="window.headerExecuted = true">';
+const FOOTER_HTML: string = '<svg onload="window.footerExecuted = true"></svg>';
+
+type InvocationResult = {
+  payload: JSONObject;
+  request: ExpressRequest;
+  response: ExpressResponse;
+  next: NextFunction;
+};
+
+describe("StatusPageAPI master-page customization origin boundary", () => {
+  const originalHost: string | undefined = process.env["HOST"];
+  let statusPageId: ObjectID;
+  let statusPage: StatusPage;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new StatusPageAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env["HOST"] = "app.example.com";
+
+    statusPageId = ObjectID.generate();
+    statusPage = new StatusPage();
+    statusPage.id = statusPageId;
+    statusPage.pageTitle = "Customer Status";
+    statusPage.pageDescription = "Everything is operational.";
+    statusPage.customCSS = CUSTOM_CSS;
+    statusPage.customJavaScript = CUSTOM_JAVASCRIPT;
+    statusPage.headerHTML = HEADER_HTML;
+    statusPage.footerHTML = FOOTER_HTML;
+
+    jest.spyOn(StatusPageService, "findOneById").mockResolvedValue(statusPage);
+    jest
+      .spyOn(StatusPageSsoService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    jest.spyOn(StatusPageFooterLinkService, "findBy").mockResolvedValue([]);
+    jest.spyOn(StatusPageHeaderLinkService, "findBy").mockResolvedValue([]);
+    jest.spyOn(StatusPageDomainService, "findOneBy").mockResolvedValue(null);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+
+    if (originalHost === undefined) {
+      delete process.env["HOST"];
+    } else {
+      process.env["HOST"] = originalHost;
+    }
+  });
+
+  const invokeMasterPage: (data: {
+    host?: string | undefined;
+    forwardedHost?: string | undefined;
+    origin?: string | undefined;
+    referer?: string | undefined;
+    bodyDomain?: string | undefined;
+  }) => Promise<InvocationResult> = async (data: {
+    host?: string | undefined;
+    forwardedHost?: string | undefined;
+    origin?: string | undefined;
+    referer?: string | undefined;
+    bodyDomain?: string | undefined;
+  }): Promise<InvocationResult> => {
+    const headers: Record<string, string> = {};
+
+    if (data.host !== undefined) {
+      headers["host"] = data.host;
+    }
+
+    if (data.forwardedHost !== undefined) {
+      headers["x-forwarded-host"] = data.forwardedHost;
+    }
+
+    if (data.origin !== undefined) {
+      headers["origin"] = data.origin;
+    }
+
+    if (data.referer !== undefined) {
+      headers["referer"] = data.referer;
+    }
+
+    const request: ExpressRequest = {
+      params: {
+        statusPageId: statusPageId.toString(),
+      },
+      body: data.bodyDomain ? { domain: data.bodyDomain } : {},
+      query: {},
+      cookies: {},
+      headers,
+      get: (name: string): string | undefined => {
+        return headers[name.toLowerCase()];
+      },
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    const response: ExpressResponse = {
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+    const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+    await mockRouter
+      .match("post", MASTER_PAGE_ROUTE)
+      .handlerFunction(request, response, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(Response.sendJsonObjectResponse).toHaveBeenCalledTimes(1);
+
+    const responseCall: Array<unknown> = (
+      Response.sendJsonObjectResponse as jest.Mock
+    ).mock.calls[0] as Array<unknown>;
+
+    return {
+      payload: responseCall[2] as JSONObject,
+      request,
+      response,
+      next,
+    };
+  };
+
+  const expectCustomizationsDenied: (payload: JSONObject) => void = (
+    payload: JSONObject,
+  ): void => {
+    expect(payload["allowStatusPageCustomizations"]).toBe(false);
+
+    const serializedStatusPage: JSONObject = payload[
+      "statusPage"
+    ] as JSONObject;
+
+    expect(serializedStatusPage).not.toHaveProperty("customCSS");
+    expect(serializedStatusPage).not.toHaveProperty("customJavaScript");
+    expect(serializedStatusPage).not.toHaveProperty("headerHTML");
+    expect(serializedStatusPage).not.toHaveProperty("footerHTML");
+  };
+
+  it.each([
+    ["the configured primary host", "app.example.com"],
+    ["a normalized primary host", " APP.EXAMPLE.COM.:443 "],
+    ["localhost", "localhost:3000"],
+    ["the internal ingress name", "ingress"],
+    ["a missing Host", undefined],
+    ["a malformed Host", "app.example.com/path"],
+    ["an unknown custom host", "unknown.customer.example"],
+  ])(
+    "omits executable customization fields for %s",
+    async (_label: string, host: string | undefined) => {
+      const result: InvocationResult = await invokeMasterPage({ host });
+
+      expectCustomizationsDenied(result.payload);
+
+      const findPageCall: Array<unknown> = (
+        StatusPageService.findOneById as jest.Mock
+      ).mock.calls[0] as Array<unknown>;
+      const select: Select<StatusPage> = (
+        findPageCall[0] as { select: Select<StatusPage> }
+      ).select;
+
+      expect(select).not.toHaveProperty("customCSS");
+      expect(select).not.toHaveProperty("customJavaScript");
+      expect(select).not.toHaveProperty("headerHTML");
+      expect(select).not.toHaveProperty("footerHTML");
+    },
+  );
+
+  it("returns all customization fields for a verified domain bound to this status page", async () => {
+    const statusPageDomain: StatusPageDomain = new StatusPageDomain();
+    statusPageDomain.id = ObjectID.generate();
+    (StatusPageDomainService.findOneBy as jest.Mock).mockResolvedValue(
+      statusPageDomain as never,
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "STATUS.Customer.Example.:443",
+    });
+
+    expect(result.payload["allowStatusPageCustomizations"]).toBe(true);
+    expect(result.payload["statusPage"]).toMatchObject({
+      customCSS: CUSTOM_CSS,
+      customJavaScript: CUSTOM_JAVASCRIPT,
+      headerHTML: HEADER_HTML,
+      footerHTML: FOOTER_HTML,
+    });
+
+    const findPageCall: Array<unknown> = (
+      StatusPageService.findOneById as jest.Mock
+    ).mock.calls[0] as Array<unknown>;
+    const select: Select<StatusPage> = (
+      findPageCall[0] as { select: Select<StatusPage> }
+    ).select;
+
+    expect(select).toEqual(
+      expect.objectContaining({
+        customCSS: true,
+        customJavaScript: true,
+        headerHTML: true,
+        footerHTML: true,
+      }),
+    );
+
+    expect(StatusPageDomainService.findOneBy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: {
+          fullDomain: "status.customer.example",
+          statusPageId,
+          isCnameVerified: true,
+          domain: {
+            isVerified: true,
+          },
+        },
+      }),
+    );
+  });
+
+  it("denies a domain record bound to a different status page", async () => {
+    const otherStatusPageId: ObjectID = ObjectID.generate();
+    const statusPageDomain: StatusPageDomain = new StatusPageDomain();
+    statusPageDomain.id = ObjectID.generate();
+
+    (StatusPageDomainService.findOneBy as jest.Mock).mockImplementation(
+      (args: unknown) => {
+        const queryStatusPageId: ObjectID = (
+          args as { query: { statusPageId: ObjectID } }
+        ).query.statusPageId;
+
+        return Promise.resolve(
+          queryStatusPageId.toString() === otherStatusPageId.toString()
+            ? statusPageDomain
+            : null,
+        );
+      },
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "status.customer.example",
+    });
+
+    expectCustomizationsDenied(result.payload);
+  });
+
+  it("ignores forwarded-host, origin, referer, and body attempts to opt in", async () => {
+    const statusPageDomain: StatusPageDomain = new StatusPageDomain();
+    statusPageDomain.id = ObjectID.generate();
+    (StatusPageDomainService.findOneBy as jest.Mock).mockResolvedValue(
+      statusPageDomain as never,
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "app.example.com",
+      forwardedHost: "status.customer.example",
+      origin: "https://status.customer.example",
+      referer: "https://status.customer.example/",
+      bodyDomain: "status.customer.example",
+    });
+
+    expectCustomizationsDenied(result.payload);
+    expect(StatusPageDomainService.findOneBy).not.toHaveBeenCalled();
+  });
+
+  it("fails closed but still serves safe master-page data when domain lookup fails", async () => {
+    (StatusPageDomainService.findOneBy as jest.Mock).mockRejectedValue(
+      new Error("database unavailable") as never,
+    );
+
+    const result: InvocationResult = await invokeMasterPage({
+      host: "status.customer.example",
+    });
+
+    expectCustomizationsDenied(result.payload);
+    expect(result.payload["statusPage"]).toMatchObject({
+      _id: statusPageId.toString(),
+      pageTitle: "Customer Status",
+      pageDescription: "Everything is operational.",
+    });
+    expect(result.payload["footerLinks"]).toEqual([]);
+    expect(result.payload["headerLinks"]).toEqual([]);
+    expect(result.payload["hasEnabledSSO"]).toBe(0);
+  });
+
+  it("explicitly redacts over-populated service results on denied origins", async () => {
+    const result: InvocationResult = await invokeMasterPage({
+      host: "app.example.com",
+    });
+
+    expectCustomizationsDenied(result.payload);
+    expect(statusPage.customCSS).toBeUndefined();
+    expect(statusPage.customJavaScript).toBeUndefined();
+    expect(statusPage.headerHTML).toBeUndefined();
+    expect(statusPage.footerHTML).toBeUndefined();
+  });
+});

package/Tests/Server/Infrastructure/Postgres/FixTotpOtpUrlAlgorithmMigration.test.ts

@@ -31,14 +31,12 @@ import { beforeEach, describe, expect, test } from "@jest/globals";
  * without a database, and what can go wrong here is the WHERE clause, not
  * Postgres' REPLACE().
  *
- * This file also carries the ORDERING guard, handed on from
- * AddNetworkDeviceReachabilityColumnsMigration.test.ts: this is the newest
- * registered migration, so its timestamp must sort above every other one.
- * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
- * recent migrations here use hand-picked round numbers that already run ahead
- * of it — so a generated file lands BELOW several registered migrations
- * unless somebody renumbers it, and runs out of order without anything saying
- * so. Whoever adds the next migration should move this block to theirs.
+ * The ordering of this migration against the others is no longer asserted
+ * here. It used to be — as a guard hand-carried from one migration's test to
+ * the next, which broke the moment a migration was added without moving it.
+ * It now lives in SchemaMigrationsOrdering.test.ts, written against the
+ * registry as a whole so that it covers whichever migration is newest without
+ * anybody having to remember it.
  */
 
 const MIGRATION_TIMESTAMP: string = "1787700000000";
@@ -48,15 +46,6 @@ const MIGRATION_DIRECTORY: string = path.join(
   "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
 );
 
-interface MigrationClass {
-  name: string;
-}
-
-function timestampOf(migrationClass: MigrationClass): number | null {
-  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
-  return match ? Number(match[1]) : null;
-}
-
 type CapturedQueryRunner = {
   runner: QueryRunner;
   queries: Array<string>;
@@ -104,46 +93,7 @@ describe("FixTotpOtpUrlAlgorithm migration", () => {
     expect(SchemaMigrations).toContain(FixTotpOtpUrlAlgorithm1787700000000);
   });
 
-  // The guard described in the header. Hand it to the next migration.
-  describe("ordering", () => {
-    test("its timestamp sorts after every other registered migration", () => {
-      const ourTimestamp: number | null = timestampOf(
-        FixTotpOtpUrlAlgorithm1787700000000,
-      );
-
-      expect(ourTimestamp).not.toBeNull();
-
-      const otherTimestamps: Array<number> = [];
-
-      for (const migrationClass of SchemaMigrations) {
-        if (migrationClass === FixTotpOtpUrlAlgorithm1787700000000) {
-          continue;
-        }
-
-        const timestamp: number | null = timestampOf(
-          migrationClass as MigrationClass,
-        );
-
-        if (timestamp !== null) {
-          otherTimestamps.push(timestamp);
-        }
-      }
-
-      /*
-       * Math.max() of an empty list is -Infinity, which every timestamp beats.
-       * Prove the list was actually enumerated before leaning on the maximum.
-       */
-      expect(otherTimestamps.length).toBeGreaterThan(100);
-
-      expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
-    });
-
-    test("it is registered last, matching that timestamp", () => {
-      expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
-        FixTotpOtpUrlAlgorithm1787700000000,
-      );
-    });
-
+  describe("registration", () => {
     test("it is registered exactly once", () => {
       const occurrences: number = SchemaMigrations.filter(
         (migration: new () => MigrationInterface): boolean => {
@@ -157,8 +107,8 @@ describe("FixTotpOtpUrlAlgorithm migration", () => {
     /*
      * ...and the timestamp in the class name is the one on disk. A class
      * renamed without renaming its file (or two migrations landing on the
-     * same timestamp) leaves the ordering above asserting something that is
-     * not what actually runs.
+     * same timestamp) leaves the registry pointing at a different file from
+     * the one this test read.
      */
     test("exactly one file on disk carries its timestamp, and it is this one", () => {
       const matching: Array<string> = fs

package/Tests/Server/Infrastructure/Postgres/SchemaMigrationsOrdering.test.ts

@@ -0,0 +1,227 @@
+import SchemaMigrations from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { MigrationInterface } from "typeorm";
+import fs from "fs";
+import path from "path";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The ordering guard for the migration registry.
+ *
+ * TypeORM runs migrations in the order this array lists them, and records each
+ * one by class name. Two things can go wrong when a migration is added, and
+ * neither one announces itself — the schema simply diverges on some
+ * installations and not others:
+ *
+ *   1. the new migration runs BEFORE one that is already deployed. Existing
+ *      installations have already recorded the older migration, so the new one
+ *      still runs last for them, while a fresh install runs it in the listed
+ *      position. The two databases end up different.
+ *   2. two migrations share a timestamp, so the file a class belongs to is
+ *      ambiguous and the pairing between name and file can silently swap.
+ *
+ * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
+ * recent migrations here use hand-picked round numbers that already run ahead
+ * of wall clock — so a freshly generated file lands BELOW several registered
+ * migrations unless somebody renumbers it. That is case 1, and it is the
+ * likely one.
+ *
+ * This guard is deliberately written against the registry as a whole rather
+ * than against whichever migration happens to be newest, so that adding a
+ * migration never requires editing (or hand-carrying) the guard itself.
+ *
+ * Note it does NOT assert the whole array is sorted. It is not: a handful of
+ * historical entries were registered out of timestamp order years ago and have
+ * long since run everywhere, so renumbering them now would re-run them. What
+ * is asserted is the part that is still live — the newest entry must sort
+ * above everything already registered.
+ */
+
+const MIGRATION_DIRECTORY: string = path.join(
+  __dirname,
+  "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
+);
+
+/*
+ * The very first migration predates the convention and carries no timestamp in
+ * its class name. It is first in the array and can never be last, so it is
+ * simply excluded rather than special-cased in every assertion below.
+ */
+const UNTIMESTAMPED_MIGRATION_NAME: string = "InitialMigration";
+
+const INITIAL_MIGRATION_TIMESTAMP: number = 1717605043663;
+
+const TIMESTAMPED_FILE: RegExp = new RegExp("^\\d+-");
+
+type MigrationClass = new () => MigrationInterface;
+
+type TimestampOfFunction = (migrationClass: MigrationClass) => number | null;
+
+const timestampOf: TimestampOfFunction = (
+  migrationClass: MigrationClass,
+): number | null => {
+  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
+  return match ? Number(match[1]) : null;
+};
+
+const registered: Array<MigrationClass> =
+  SchemaMigrations as Array<MigrationClass>;
+
+describe("the migration registry", () => {
+  /*
+   * Math.max() of an empty list is -Infinity and every assertion below would
+   * pass vacuously against one. Prove the import actually produced a registry
+   * before leaning on anything derived from it.
+   */
+  test("is actually populated, so nothing below passes vacuously", () => {
+    expect(registered.length).toBeGreaterThan(100);
+  });
+
+  test("names every migration after its timestamp, bar the first one", () => {
+    const untimestamped: Array<string> = registered
+      .filter((migrationClass: MigrationClass): boolean => {
+        return timestampOf(migrationClass) === null;
+      })
+      .map((migrationClass: MigrationClass): string => {
+        return migrationClass.name;
+      });
+
+    expect(untimestamped).toEqual([UNTIMESTAMPED_MIGRATION_NAME]);
+  });
+
+  describe("ordering", () => {
+    /*
+     * The guard that used to be hand-carried from one migration's test to the
+     * next. Whoever adds a migration adds it to the end of the array, and this
+     * is what says the timestamp has to match that position.
+     */
+    test("gives the last-registered migration the highest timestamp", () => {
+      const last: MigrationClass = registered[registered.length - 1]!;
+      const lastTimestamp: number | null = timestampOf(last);
+
+      expect(lastTimestamp).not.toBeNull();
+
+      const earlierTimestamps: Array<number> = registered
+        .slice(0, -1)
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        });
+
+      expect(earlierTimestamps.length).toBe(registered.length - 2);
+
+      /*
+       * If this fails, the migration at the end of SchemaMigrations/Index.ts
+       * carries a timestamp that sorts below one already registered — rename
+       * the new migration's file and class to a timestamp above the current
+       * maximum, rather than moving it up the array.
+       */
+      expect(lastTimestamp).toBeGreaterThan(Math.max(...earlierTimestamps));
+    });
+
+    test("never registers the same timestamp twice", () => {
+      const timestamps: Array<number> = registered
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        });
+
+      const duplicates: Array<number> = timestamps.filter(
+        (timestamp: number, index: number): boolean => {
+          return timestamps.indexOf(timestamp) !== index;
+        },
+      );
+
+      expect(duplicates).toEqual([]);
+    });
+
+    test("never registers the same migration class twice", () => {
+      const names: Array<string> = registered.map(
+        (migrationClass: MigrationClass): string => {
+          return migrationClass.name;
+        },
+      );
+
+      const duplicates: Array<string> = names.filter(
+        (name: string, index: number): boolean => {
+          return names.indexOf(name) !== index;
+        },
+      );
+
+      expect(duplicates).toEqual([]);
+    });
+  });
+
+  /*
+   * ...and the timestamps in the class names are the ones on disk. A class
+   * renamed without renaming its file — or two files landing on the same
+   * timestamp — leaves the ordering above asserting something that is not what
+   * actually runs.
+   */
+  test("backs every registered migration with exactly one file on disk", () => {
+    const files: Array<string> = fs.readdirSync(MIGRATION_DIRECTORY);
+
+    const unbacked: Array<string> = registered
+      .filter((migrationClass: MigrationClass): boolean => {
+        const timestamp: number | null = timestampOf(migrationClass);
+
+        if (timestamp === null) {
+          return false;
+        }
+
+        return (
+          files.filter((file: string): boolean => {
+            return file.startsWith(`${timestamp}-`);
+          }).length !== 1
+        );
+      })
+      .map((migrationClass: MigrationClass): string => {
+        return migrationClass.name;
+      });
+
+    expect(unbacked).toEqual([]);
+  });
+
+  /*
+   * The other direction: a migration file that nobody registered never runs at
+   * all. That is the failure mode with no symptom until a query hits a column
+   * that was never created.
+   *
+   * The registered side is read out of the exported array rather than out of
+   * Index.ts, so a file that is imported but never added to the array — which
+   * is exactly as inert as one that is not imported at all — still fails here.
+   */
+  test("registers every migration file that exists on disk", () => {
+    const registeredTimestamps: Set<number> = new Set(
+      registered
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        }),
+    );
+
+    /*
+     * The one file whose class name carries no timestamp, so it cannot be
+     * matched by the timestamps above.
+     */
+    registeredTimestamps.add(INITIAL_MIGRATION_TIMESTAMP);
+
+    const timestampsOnDisk: Array<string> = fs
+      .readdirSync(MIGRATION_DIRECTORY)
+      .filter((file: string): boolean => {
+        return file.endsWith(".ts") && TIMESTAMPED_FILE.test(file);
+      })
+      .map((file: string): string => {
+        return file.split("-")[0]!;
+      });
+
+    expect(timestampsOnDisk.length).toBeGreaterThan(100);
+
+    const unregistered: Array<string> = timestampsOnDisk.filter(
+      (timestamp: string): boolean => {
+        return !registeredTimestamps.has(Number(timestamp));
+      },
+    );
+
+    expect(unregistered).toEqual([]);
+  });
+});