@oneuptime/common 12.0.14 → 12.0.16

package/Tests/Models/DatabaseModels/DomainRoleTierCoverage.test.ts

@@ -0,0 +1,323 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import Permission, {
+  PermissionHelper,
+  PermissionProps,
+} from "../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The per-domain role tiers (MonitorAdmin/Member/Viewer and the ten families
+ * beside it) were rolled out family by family: one commit renamed the legacy
+ * "Manager" role inside each model's own access lists, and nothing ever asked
+ * which models a role holder also needs. Every gap that produced issue #3305 is
+ * of that shape - a model filed under the wrong family, or under none.
+ *
+ * The gaps are invisible to review because they are gaps: the list looks
+ * perfectly ordinary, it simply omits three entries that its sibling two files
+ * over has. StatusPageOwnerTeam carried the StatusPage tiers while
+ * StatusPageOwnerRule did not; nothing in either file hinted at the difference.
+ *
+ * So this sweeps every model whose name puts it in a domain and asks whether
+ * its read list admits that domain's roles. Anything that legitimately does not
+ * is listed below with the reason, and that list may only shrink.
+ */
+
+type ModelType = { new (): BaseModel };
+
+const MODEL_TYPES: Array<ModelType> = AllModelTypes as Array<ModelType>;
+
+/*
+ * Model-name prefix -> role family, matched first-wins, so the order is part of
+ * the mapping and not decoration. Two prefixes have to sit where they are:
+ * IncomingCallPolicy* belongs to the on-call family rather than to a family of
+ * its own, and ScheduledMaintenance* has to be tried before any shorter prefix
+ * that is a prefix of it. Adding a family means thinking about where it goes in
+ * this list, not appending to the end.
+ */
+const DOMAIN_PREFIXES: Array<[string, string]> = [
+  ["ScheduledMaintenance", "ScheduledMaintenance"],
+  ["IncomingCallPolicy", "OnCall"],
+  ["OnCallDutyPolicy", "OnCall"],
+  ["StatusPage", "StatusPage"],
+  ["Telemetry", "Telemetry"],
+  ["Incident", "Incident"],
+  ["Alert", "Alert"],
+  ["Monitor", "Monitor"],
+  ["Workflow", "Workflow"],
+  ["Runbook", "Runbook"],
+];
+
+/*
+ * Models that belong to a domain but are not named for it, so no prefix will
+ * ever reach them. A per-user saved view of logs, metrics or traces is a
+ * telemetry object whatever its class is called - and all three were readable
+ * only by the project-wide roles, so a Telemetry Admin could not open a view
+ * they had saved themselves.
+ *
+ * This is the sweep's blind spot written down. A name-based sweep cannot find
+ * these on its own; the only defence is naming them.
+ */
+const DOMAIN_BY_MODEL: Record<string, string> = {
+  LogSavedView: "Telemetry",
+  MetricSavedView: "Telemetry",
+  TraceSavedView: "Telemetry",
+};
+
+/*
+ * Models in a domain whose read list deliberately does not admit that domain's
+ * roles, and why. Every entry here is a table a domain role holder is meant to
+ * be kept out of, not a table nobody got round to.
+ *
+ * This list may only shrink. A new entry means either a real omission of the
+ * #3305 kind, or a new table that has to justify itself here.
+ */
+const NOT_READABLE_BY_THEIR_DOMAIN_ROLES: Array<string> = [
+  /*
+   * The telemetry ingestion key is the credential a collector authenticates
+   * with, and usage billing is billing. Neither is telemetry data.
+   */
+  "TelemetryIngestionKey",
+  "TelemetryUsageBilling",
+
+  /*
+   * Secrets and credentials. These hold the values a monitor or runbook step
+   * authenticates with; the whole point of them is that the people who
+   * configure the resource cannot read them back.
+   */
+  "MonitorSecret",
+  "RunbookCredential",
+  "RunbookSecret",
+
+  /*
+   * Identity configuration for a status page, and the audit trail of the
+   * directory syncs against it. Administering who may sign in to a status page
+   * is a project-administration job, not a status-page-authoring one, which is
+   * why these sit on the Settings tiers instead.
+   */
+  "StatusPageOIDC",
+  "StatusPageSCIM",
+  "StatusPageSCIMLog",
+  "StatusPageSSO",
+
+  /*
+   * Session rows for status page visitors. Nobody reads this table through the
+   * API at all - its access lists are empty and the service reaches it as root.
+   */
+  "StatusPagePrivateUserSession",
+
+  /*
+   * The inbound call policy and its escalation rules are configured under
+   * Settings -> Calls rather than alongside on-call schedules, so they follow
+   * the Settings tiers. Their label and owner rules follow their owner models,
+   * which are on-call.
+   */
+  "IncomingCallPolicy",
+  "IncomingCallPolicyEscalationRule",
+];
+
+type ModelNameFunction = (modelType: ModelType) => string;
+
+const modelName: ModelNameFunction = (modelType: ModelType): string => {
+  return new modelType().tableName || modelType.name;
+};
+
+type DomainOfFunction = (name: string) => string | null;
+
+const domainOf: DomainOfFunction = (name: string): string | null => {
+  if (DOMAIN_BY_MODEL[name]) {
+    return DOMAIN_BY_MODEL[name] as string;
+  }
+
+  for (const [prefix, family] of DOMAIN_PREFIXES) {
+    if (name.startsWith(prefix)) {
+      return family;
+    }
+  }
+
+  return null;
+};
+
+type TiersOfFunction = (family: string) => Array<Permission>;
+
+const tiersOf: TiersOfFunction = (family: string): Array<Permission> => {
+  return [
+    `${family}Admin` as Permission,
+    `${family}Member` as Permission,
+    `${family}Viewer` as Permission,
+  ];
+};
+
+describe("Domain role tier coverage", () => {
+  /*
+   * Guards the table above: every family it names has to be a real set of role
+   * permissions. A typo would silently make the whole sweep vacuous for that
+   * family, and the sweep would keep passing while covering nothing.
+   */
+  test("every family named here really has three role tiers", () => {
+    const rolePermissions: Set<string> = new Set(
+      PermissionHelper.getRolePermissionProps().map(
+        (props: PermissionProps) => {
+          return props.permission.toString();
+        },
+      ),
+    );
+
+    const unknown: Array<string> = [];
+
+    const families: Array<string> = [
+      ...DOMAIN_PREFIXES.map(([, family]: [string, string]) => {
+        return family;
+      }),
+      ...Object.values(DOMAIN_BY_MODEL),
+    ];
+
+    for (const family of families) {
+      for (const tier of tiersOf(family)) {
+        if (!rolePermissions.has(tier.toString())) {
+          unknown.push(tier.toString());
+        }
+      }
+    }
+
+    expect(unknown.sort()).toEqual([]);
+  });
+
+  test("a model in a domain is readable by that domain's roles", () => {
+    const missing: Array<string> = [];
+    let checked: number = 0;
+
+    for (const modelType of MODEL_TYPES) {
+      const name: string = modelName(modelType);
+      const family: string | null = domainOf(name);
+
+      if (!family) {
+        continue;
+      }
+
+      checked++;
+
+      const read: Array<Permission> =
+        new modelType().readRecordPermissions || [];
+
+      const absent: Array<Permission> = tiersOf(family).filter(
+        (tier: Permission) => {
+          return !read.includes(tier);
+        },
+      );
+
+      if (absent.length > 0) {
+        missing.push(name);
+      }
+    }
+
+    expect(missing.sort()).toEqual(
+      NOT_READABLE_BY_THEIR_DOMAIN_ROLES.slice().sort(),
+    );
+
+    /*
+     * A sweep that stops matching anything passes just as quietly as one that
+     * finds nothing wrong. Renaming a model family, or reordering
+     * DOMAIN_PREFIXES so a longer prefix hides behind a shorter one, would do
+     * exactly that.
+     */
+    expect(checked).toBeGreaterThan(100);
+  });
+
+  /*
+   * The exemptions have to stay honest. If somebody gives one of these tables
+   * its domain's roles, the entry must go with it - otherwise it sits there
+   * excusing a model that no longer needs excusing, and the next real omission
+   * hides behind a list nobody trusts any more.
+   */
+  test("no exemption is stale", () => {
+    const modelsByName: Map<string, ModelType> = new Map(
+      MODEL_TYPES.map((modelType: ModelType): [string, ModelType] => {
+        return [modelName(modelType), modelType];
+      }),
+    );
+
+    const stale: Array<string> = [];
+
+    for (const name of NOT_READABLE_BY_THEIR_DOMAIN_ROLES) {
+      const modelType: ModelType | undefined = modelsByName.get(name);
+
+      if (!modelType) {
+        stale.push(`${name} (no such model)`);
+        continue;
+      }
+
+      const family: string | null = domainOf(name);
+
+      if (!family) {
+        stale.push(`${name} (no longer resolves to a domain)`);
+        continue;
+      }
+
+      const read: Array<Permission> =
+        new modelType().readRecordPermissions || [];
+
+      if (
+        tiersOf(family).every((tier: Permission) => {
+          return read.includes(tier);
+        })
+      ) {
+        stale.push(`${name} (now readable by ${family} roles)`);
+      }
+    }
+
+    expect(stale.sort()).toEqual([]);
+  });
+
+  /*
+   * Same reason as the shared-resource sweep: the table gate is the first of
+   * two. A column that an ordinary project member can read but the domain's own
+   * roles cannot turns a working list request into a permission error on
+   * whichever field the page selects.
+   */
+  test("columns follow their table into the domain's roles", () => {
+    const missing: Array<string> = [];
+    let checked: number = 0;
+
+    for (const modelType of MODEL_TYPES) {
+      const name: string = modelName(modelType);
+      const family: string | null = domainOf(name);
+
+      if (!family) {
+        continue;
+      }
+
+      const model: BaseModel = new modelType();
+      const tiers: Array<Permission> = tiersOf(family);
+
+      const tableIsInDomain: boolean = tiers.every((tier: Permission) => {
+        return (model.readRecordPermissions || []).includes(tier);
+      });
+
+      if (!tableIsInDomain) {
+        continue;
+      }
+
+      for (const column of model.getTableColumns().columns) {
+        const accessControl: ColumnAccessControl | null =
+          model.getColumnAccessControlFor(column);
+
+        if (!accessControl?.read?.includes(Permission.ProjectMember)) {
+          continue;
+        }
+
+        checked++;
+
+        for (const tier of tiers) {
+          if (!accessControl.read.includes(tier)) {
+            missing.push(`${name}.${column} is missing ${tier}`);
+          }
+        }
+      }
+    }
+
+    expect(missing.sort()).toEqual([]);
+    expect(checked).toBeGreaterThan(500);
+  });
+});

package/Tests/Models/DatabaseModels/ProjectSharedResources.test.ts

@@ -0,0 +1,386 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import Permission from "../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Permission.ProjectUser is held by every member of a project — see
+ * AccessTokenService, which adds it once the user's membership is resolved.
+ * A model that names it in a read list is therefore saying "anyone in this
+ * project may read this", which is right for the furniture of the dashboard
+ * (saved views, labels, teams, member rows) and wrong for anything else.
+ *
+ * That makes the permission unusually easy to misuse: pasting it into one more
+ * read list is a one-line change that opens a table to the whole project, and
+ * nothing about it looks different from adding any other permission. These
+ * sweeps are the review gate.
+ *
+ * They run over every model rather than over a list, because the failure mode
+ * that produced issue #3305 was precisely a model nobody was looking at.
+ */
+
+type ModelType = { new (): BaseModel };
+
+const MODEL_TYPES: Array<ModelType> = AllModelTypes as Array<ModelType>;
+
+/*
+ * Shared workspace furniture. Every ModelTable in the dashboard mounts its
+ * saved views, its label filter and its owner picker, on every domain page —
+ * so these four have to be readable by a member whatever their teams grant.
+ * They are why issue #3305 happened: a member scoped to one domain got a
+ * permission error over the page their role was supposed to give them.
+ *
+ * Growing this list is a deliberate act. It opens a table, and every column of
+ * it an ordinary member can read, to everybody in the project.
+ */
+const PROJECT_SHARED_MODELS: Array<string> = [
+  "Label",
+  "TableView",
+  "Team",
+  "TeamMember",
+];
+
+/*
+ * Models that named ProjectUser before it was granted to anyone, so these read
+ * lists were dead branches until now. Each is load-bearing at sign-in or at app
+ * boot: the SSO providers a member is redirected through, and the project
+ * record itself.
+ *
+ * They are held apart from the list above because their columns are a mixed
+ * bag - billing figures, SSO secrets and feature flags sit next to the name and
+ * the sign-on URL - so the whole-model column rule does not apply to them.
+ * Whatever ProjectUser reaches on one of these is what it already declared,
+ * column by column.
+ *
+ * All five reach every member another way already: Project, ProjectSSO and
+ * ProjectOIDC name UnAuthorizedSsoUser, which every principal in a project
+ * holds, and the two status page providers name Public. Making the grant real
+ * changed nothing about who can read them. The test below pins that, because
+ * it is the only reason this list is safe to have.
+ */
+const LEGACY_PROJECT_USER_MODELS: Array<string> = [
+  "Project",
+  "ProjectOIDC",
+  "ProjectSSO",
+  "StatusPageOIDC",
+  "StatusPageSSO",
+];
+
+/*
+ * BillingPaymentMethod is the one model where ProjectUser really does open
+ * something, and it is deliberate and minimal.
+ *
+ * The dashboard shell counts this project's payment methods on boot to decide
+ * whether to warn that billing is unconfigured; a refusal there is not a
+ * missing warning but a PageError in place of the whole app, for exactly the
+ * domain-scoped members #3305 is about. A count needs the table and the column
+ * it filters on. ProjectUser reaches those two and nothing else - not the card,
+ * not the provider ids, not who added it.
+ */
+const BILLING_COUNT_MODEL: string = "BillingPaymentMethod";
+const BILLING_COUNT_COLUMNS: Array<string> = ["projectId"];
+
+/*
+ * getColumnAccessControlForAllColumns mirrors the table's own lists onto these
+ * four, and ColumnPermissions exempts them from the select check anyway, so
+ * they carry whatever the table carries and say nothing about a model.
+ */
+const COLUMNS_THAT_MIRROR_THE_TABLE: Array<string> = [
+  "_id",
+  "createdAt",
+  "deletedAt",
+  "updatedAt",
+];
+
+type ModelNameFunction = (modelType: ModelType) => string;
+
+const modelName: ModelNameFunction = (modelType: ModelType): string => {
+  return new modelType().tableName || modelType.name;
+};
+
+type ColumnAccessControlEntry = {
+  column: string;
+  accessControl: ColumnAccessControl;
+};
+
+type ColumnAccessControlsFunction = (
+  model: BaseModel,
+) => Array<ColumnAccessControlEntry>;
+
+const columnAccessControls: ColumnAccessControlsFunction = (
+  model: BaseModel,
+): Array<ColumnAccessControlEntry> => {
+  const entries: Array<ColumnAccessControlEntry> = [];
+
+  for (const column of model.getTableColumns().columns) {
+    const accessControl: ColumnAccessControl | null =
+      model.getColumnAccessControlFor(column);
+
+    if (accessControl) {
+      entries.push({ column, accessControl });
+    }
+  }
+
+  return entries;
+};
+
+type HasFunction = (
+  permissions: Array<Permission> | undefined,
+  permission: Permission,
+) => boolean;
+
+const has: HasFunction = (
+  permissions: Array<Permission> | undefined,
+  permission: Permission,
+): boolean => {
+  return (permissions || []).includes(permission);
+};
+
+describe("Project-shared resources", () => {
+  test("the set of models readable by every project member is the reviewed one", () => {
+    const shared: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      if (has(model.readRecordPermissions, Permission.ProjectUser)) {
+        shared.push(modelName(modelType));
+      }
+    }
+
+    expect(shared.sort()).toEqual(
+      [
+        ...PROJECT_SHARED_MODELS,
+        ...LEGACY_PROJECT_USER_MODELS,
+        BILLING_COUNT_MODEL,
+      ].sort(),
+    );
+  });
+
+  /*
+   * The legacy list earns its place by not mattering: every model on it is
+   * already readable by any principal in the project through Public or
+   * UnAuthorizedSsoUser, so ProjectUser changed nothing there. If one of them
+   * ever loses that, it is no longer legacy - it is a new grant, and it belongs
+   * in the reviewed list above with the column rule applied to it.
+   */
+  test("the legacy models were already readable by every member anyway", () => {
+    const modelsByName: Map<string, ModelType> = new Map(
+      MODEL_TYPES.map((modelType: ModelType): [string, ModelType] => {
+        return [modelName(modelType), modelType];
+      }),
+    );
+
+    const noLongerLegacy: Array<string> = [];
+
+    for (const name of LEGACY_PROJECT_USER_MODELS) {
+      const modelType: ModelType | undefined = modelsByName.get(name);
+
+      if (!modelType) {
+        noLongerLegacy.push(`${name} (no such model)`);
+        continue;
+      }
+
+      const read: Array<Permission> =
+        new modelType().readRecordPermissions || [];
+
+      if (
+        !read.includes(Permission.Public) &&
+        !read.includes(Permission.UnAuthorizedSsoUser)
+      ) {
+        noLongerLegacy.push(name);
+      }
+    }
+
+    expect(noLongerLegacy.sort()).toEqual([]);
+  });
+
+  test("ProjectUser reaches the payment-method count and nothing else", () => {
+    const modelType: ModelType | undefined = MODEL_TYPES.find(
+      (candidate: ModelType) => {
+        return modelName(candidate) === BILLING_COUNT_MODEL;
+      },
+    );
+
+    expect(modelType).toBeDefined();
+
+    const model: BaseModel = new modelType!();
+
+    expect(has(model.readRecordPermissions, Permission.ProjectUser)).toBe(true);
+
+    const reachable: Array<string> = columnAccessControls(model)
+      .filter(({ column, accessControl }: ColumnAccessControlEntry) => {
+        return (
+          !COLUMNS_THAT_MIRROR_THE_TABLE.includes(column) &&
+          has(accessControl.read, Permission.ProjectUser)
+        );
+      })
+      .map(({ column }: ColumnAccessControlEntry) => {
+        return column;
+      });
+
+    expect(reachable.sort()).toEqual(BILLING_COUNT_COLUMNS.slice().sort());
+  });
+
+  /*
+   * ProjectUser is a read grant and nothing else. If it ever reaches a create,
+   * update or delete list, every member of the project can write that table —
+   * roles included, since the permission is added on top of whatever the user's
+   * teams grant rather than instead of it.
+   */
+  test("ProjectUser never appears in a create, update or delete list", () => {
+    const offenders: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      for (const [operation, permissions] of [
+        ["create", model.createRecordPermissions],
+        ["update", model.updateRecordPermissions],
+        ["delete", model.deleteRecordPermissions],
+      ] as Array<[string, Array<Permission> | undefined]>) {
+        if (has(permissions, Permission.ProjectUser)) {
+          offenders.push(`${modelName(modelType)} ${operation}`);
+        }
+      }
+
+      for (const { column, accessControl } of columnAccessControls(model)) {
+        for (const [operation, permissions] of [
+          ["create", accessControl.create],
+          ["update", accessControl.update],
+        ] as Array<[string, Array<Permission> | undefined]>) {
+          if (has(permissions, Permission.ProjectUser)) {
+            offenders.push(`${modelName(modelType)}.${column} ${operation}`);
+          }
+        }
+      }
+    }
+
+    expect(offenders.sort()).toEqual([]);
+  });
+
+  /*
+   * ProjectUser must never be the permission that makes a column readable. It
+   * rides alongside ProjectMember, which means it shows domain-scoped members
+   * exactly what an ordinary project member could already see and nothing more.
+   *
+   * This is the invariant a bulk edit gets wrong: adding the permission to
+   * every read list on a model also opens the columns that were deliberately
+   * left to administrators (TeamMember.invitationAcceptedAt) or to nobody at
+   * all (the deletion audit columns, whose read list is empty on purpose).
+   */
+  test("ProjectUser only ever accompanies ProjectMember on a read list", () => {
+    const offenders: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      if (
+        has(model.readRecordPermissions, Permission.ProjectUser) &&
+        !has(model.readRecordPermissions, Permission.ProjectMember) &&
+        !has(model.readRecordPermissions, Permission.Public)
+      ) {
+        offenders.push(modelName(modelType));
+      }
+
+      for (const { column, accessControl } of columnAccessControls(model)) {
+        if (
+          has(accessControl.read, Permission.ProjectUser) &&
+          !has(accessControl.read, Permission.ProjectMember) &&
+          !has(accessControl.read, Permission.Public)
+        ) {
+          offenders.push(`${modelName(modelType)}.${column}`);
+        }
+      }
+    }
+
+    expect(offenders.sort()).toEqual([]);
+  });
+
+  /*
+   * Passing the table gate is only half of a read. SelectPermission checks the
+   * columns the caller asked for against their own read lists, so a shared
+   * model whose columns were not brought along returns a permission error on
+   * whichever field the page selects — the same failure, one layer down.
+   *
+   * The check is phrased as "every column an ordinary member can read", so a
+   * column added to one of these models later fails here rather than in the
+   * dashboard.
+   */
+  test("every column an ordinary member can read on a shared model is shared too", () => {
+    const offenders: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      if (!PROJECT_SHARED_MODELS.includes(modelName(modelType))) {
+        continue;
+      }
+
+      for (const { column, accessControl } of columnAccessControls(model)) {
+        if (!has(accessControl.read, Permission.ProjectMember)) {
+          continue;
+        }
+
+        if (!has(accessControl.read, Permission.ProjectUser)) {
+          offenders.push(`${modelName(modelType)}.${column}`);
+        }
+      }
+    }
+
+    expect(offenders.sort()).toEqual([]);
+  });
+
+  /*
+   * A member's ProjectUser row carries no labels, and AccessControlPermission
+   * treats any unrestricted row matching a model's read list as "this caller is
+   * not label-restricted here" and drops the label filter entirely. On a table
+   * that narrows by label that would hand every member every record, so a
+   * shared model must not be one.
+   */
+  test("no shared model narrows access by label", () => {
+    const offenders: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      if (!has(model.readRecordPermissions, Permission.ProjectUser)) {
+        continue;
+      }
+
+      if (model.getAccessControlColumn()) {
+        offenders.push(
+          `${modelName(modelType)} narrows by ${model.getAccessControlColumn()}`,
+        );
+      }
+    }
+
+    expect(offenders.sort()).toEqual([]);
+  });
+
+  /*
+   * The dashboard decides whether to offer an affordance from the same declared
+   * lists the API enforces (PermissionGate -> hasReadPermissions). Expanding the
+   * grant only inside the server's permission check would leave the two
+   * disagreeing: the request would succeed while the UI kept the control
+   * hidden, which is the failure 836ea41f40 set out to end.
+   */
+  test("the client's permission gate agrees that a member can read them", () => {
+    const disagreements: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      if (!has(model.readRecordPermissions, Permission.ProjectUser)) {
+        continue;
+      }
+
+      if (!model.hasReadPermissions([Permission.ProjectUser])) {
+        disagreements.push(modelName(modelType));
+      }
+    }
+
+    expect(disagreements.sort()).toEqual([]);
+  });
+});