@oneuptime/common 12.0.14 → 12.0.16

package/Tests/Server/Infrastructure/LocalCache.test.ts

@@ -0,0 +1,149 @@
+import LocalCache from "../../../Server/Infrastructure/LocalCache";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * LocalCache is a process-local, namespaced key/value store used for cheap
+ * in-memory memoization (feature flags, small config lookups) where a
+ * round-trip to Redis would be wasteful. It is a single shared static map,
+ * so:
+ *
+ *   - the namespace has to actually isolate keys — two callers using the
+ *     same key in different namespaces must not read each other's values;
+ *   - `hasValue` is a Boolean() coercion, so a stored falsy value (0, "")
+ *     reads as absent. That is a real edge every caller of getOrSet-style
+ *     logic inherits, so it is pinned here rather than left implicit.
+ *
+ * Every test below uses a unique namespace so the shared map cannot leak
+ * state between cases.
+ */
+
+describe("LocalCache string/number/JSON round-trips", () => {
+  it("stores and returns a string", () => {
+    LocalCache.setString("ns-str", "k", "hello");
+    expect(LocalCache.getString("ns-str", "k")).toBe("hello");
+  });
+
+  it("stores and returns a number, including zero", () => {
+    LocalCache.setNumber("ns-num", "k", 42);
+    expect(LocalCache.getNumber("ns-num", "k")).toBe(42);
+
+    LocalCache.setNumber("ns-num-zero", "k", 0);
+    expect(LocalCache.getNumber("ns-num-zero", "k")).toBe(0);
+  });
+
+  it("stores and returns a JSON object", () => {
+    const value: JSONObject = { a: 1, b: ["x", "y"] };
+    LocalCache.setJSON("ns-json", "k", value);
+    expect(LocalCache.getJSON("ns-json", "k")).toEqual(value);
+  });
+
+  it("overwrites an existing value on a repeated set", () => {
+    LocalCache.setString("ns-overwrite", "k", "first");
+    LocalCache.setString("ns-overwrite", "k", "second");
+    expect(LocalCache.getString("ns-overwrite", "k")).toBe("second");
+  });
+});
+
+describe("LocalCache namespacing", () => {
+  it("isolates the same key across different namespaces", () => {
+    LocalCache.setString("ns-a", "shared-key", "from-a");
+    LocalCache.setString("ns-b", "shared-key", "from-b");
+
+    expect(LocalCache.getString("ns-a", "shared-key")).toBe("from-a");
+    expect(LocalCache.getString("ns-b", "shared-key")).toBe("from-b");
+  });
+
+  it("collides when namespace/key pairs concatenate to the same string", () => {
+    /*
+     * Known limitation, pinned deliberately: the map key is
+     * `namespace + "." + key` with no escaping, so ("team", "member.count")
+     * and ("team.member", "count") both resolve to "team.member.count" and
+     * share one slot. Callers must not choose namespaces/keys whose dotted
+     * concatenation can coincide. If this is ever hardened (e.g. an escaped
+     * delimiter), this test is the tripwire that will flag the change.
+     */
+    LocalCache.setString("team", "member.count", "written-first");
+    expect(LocalCache.getString("team.member", "count")).toBe("written-first");
+  });
+});
+
+describe("LocalCache.hasValue", () => {
+  it("is false for a key that was never set", () => {
+    expect(LocalCache.hasValue("ns-missing", "nope")).toBe(false);
+  });
+
+  it("is true after a truthy value is set", () => {
+    LocalCache.setString("ns-has", "k", "present");
+    expect(LocalCache.hasValue("ns-has", "k")).toBe(true);
+  });
+
+  it("reads a stored falsy value as absent (Boolean coercion)", () => {
+    // Documented edge: 0 and "" are stored but hasValue coerces to false.
+    LocalCache.setNumber("ns-falsy", "zero", 0);
+    LocalCache.setString("ns-falsy", "empty", "");
+    expect(LocalCache.hasValue("ns-falsy", "zero")).toBe(false);
+    expect(LocalCache.hasValue("ns-falsy", "empty")).toBe(false);
+  });
+});
+
+describe("LocalCache.getOrSetString", () => {
+  it("invokes the producer and caches its result when absent", async () => {
+    let calls: number = 0;
+    const produce: () => Promise<string> = async (): Promise<string> => {
+      calls++;
+      return "computed";
+    };
+
+    const first: string = await LocalCache.getOrSetString(
+      "ns-getset",
+      "k",
+      produce,
+    );
+    expect(first).toBe("computed");
+    expect(calls).toBe(1);
+    // The value is now in the cache.
+    expect(LocalCache.getString("ns-getset", "k")).toBe("computed");
+  });
+
+  it("does not invoke the producer again once a value is cached", async () => {
+    let calls: number = 0;
+    const produce: () => Promise<string> = async (): Promise<string> => {
+      calls++;
+      return `value-${calls}`;
+    };
+
+    const first: string = await LocalCache.getOrSetString(
+      "ns-getset-2",
+      "k",
+      produce,
+    );
+    const second: string = await LocalCache.getOrSetString(
+      "ns-getset-2",
+      "k",
+      produce,
+    );
+
+    expect(first).toBe("value-1");
+    // Second call short-circuits on the cached value; producer not re-run.
+    expect(second).toBe("value-1");
+    expect(calls).toBe(1);
+  });
+
+  it("re-invokes the producer when the previously produced value was empty", async () => {
+    /*
+     * getOrSetString gates on getString() being falsy, so an empty-string
+     * result is treated as "not cached" and the producer runs every time.
+     * This mirrors the hasValue Boolean-coercion edge above.
+     */
+    let calls: number = 0;
+    const produce: () => Promise<string> = async (): Promise<string> => {
+      calls++;
+      return "";
+    };
+
+    await LocalCache.getOrSetString("ns-getset-empty", "k", produce);
+    await LocalCache.getOrSetString("ns-getset-empty", "k", produce);
+    expect(calls).toBe(2);
+  });
+});

package/Tests/Server/Infrastructure/Postgres/FixTotpOtpUrlAlgorithmMigration.test.ts

@@ -31,14 +31,12 @@ import { beforeEach, describe, expect, test } from "@jest/globals";
  * without a database, and what can go wrong here is the WHERE clause, not
  * Postgres' REPLACE().
  *
- * This file also carries the ORDERING guard, handed on from
- * AddNetworkDeviceReachabilityColumnsMigration.test.ts: this is the newest
- * registered migration, so its timestamp must sort above every other one.
- * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
- * recent migrations here use hand-picked round numbers that already run ahead
- * of it — so a generated file lands BELOW several registered migrations
- * unless somebody renumbers it, and runs out of order without anything saying
- * so. Whoever adds the next migration should move this block to theirs.
+ * The ordering of this migration against the others is no longer asserted
+ * here. It used to be — as a guard hand-carried from one migration's test to
+ * the next, which broke the moment a migration was added without moving it.
+ * It now lives in SchemaMigrationsOrdering.test.ts, written against the
+ * registry as a whole so that it covers whichever migration is newest without
+ * anybody having to remember it.
  */
 
 const MIGRATION_TIMESTAMP: string = "1787700000000";
@@ -48,15 +46,6 @@ const MIGRATION_DIRECTORY: string = path.join(
   "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
 );
 
-interface MigrationClass {
-  name: string;
-}
-
-function timestampOf(migrationClass: MigrationClass): number | null {
-  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
-  return match ? Number(match[1]) : null;
-}
-
 type CapturedQueryRunner = {
   runner: QueryRunner;
   queries: Array<string>;
@@ -104,46 +93,7 @@ describe("FixTotpOtpUrlAlgorithm migration", () => {
     expect(SchemaMigrations).toContain(FixTotpOtpUrlAlgorithm1787700000000);
   });
 
-  // The guard described in the header. Hand it to the next migration.
-  describe("ordering", () => {
-    test("its timestamp sorts after every other registered migration", () => {
-      const ourTimestamp: number | null = timestampOf(
-        FixTotpOtpUrlAlgorithm1787700000000,
-      );
-
-      expect(ourTimestamp).not.toBeNull();
-
-      const otherTimestamps: Array<number> = [];
-
-      for (const migrationClass of SchemaMigrations) {
-        if (migrationClass === FixTotpOtpUrlAlgorithm1787700000000) {
-          continue;
-        }
-
-        const timestamp: number | null = timestampOf(
-          migrationClass as MigrationClass,
-        );
-
-        if (timestamp !== null) {
-          otherTimestamps.push(timestamp);
-        }
-      }
-
-      /*
-       * Math.max() of an empty list is -Infinity, which every timestamp beats.
-       * Prove the list was actually enumerated before leaning on the maximum.
-       */
-      expect(otherTimestamps.length).toBeGreaterThan(100);
-
-      expect(ourTimestamp).toBeGreaterThan(Math.max(...otherTimestamps));
-    });
-
-    test("it is registered last, matching that timestamp", () => {
-      expect(SchemaMigrations[SchemaMigrations.length - 1]).toBe(
-        FixTotpOtpUrlAlgorithm1787700000000,
-      );
-    });
-
+  describe("registration", () => {
     test("it is registered exactly once", () => {
       const occurrences: number = SchemaMigrations.filter(
         (migration: new () => MigrationInterface): boolean => {
@@ -157,8 +107,8 @@ describe("FixTotpOtpUrlAlgorithm migration", () => {
     /*
      * ...and the timestamp in the class name is the one on disk. A class
      * renamed without renaming its file (or two migrations landing on the
-     * same timestamp) leaves the ordering above asserting something that is
-     * not what actually runs.
+     * same timestamp) leaves the registry pointing at a different file from
+     * the one this test read.
      */
     test("exactly one file on disk carries its timestamp, and it is this one", () => {
       const matching: Array<string> = fs

package/Tests/Server/Infrastructure/Postgres/SchemaMigrationsOrdering.test.ts

@@ -0,0 +1,227 @@
+import SchemaMigrations from "../../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { MigrationInterface } from "typeorm";
+import fs from "fs";
+import path from "path";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The ordering guard for the migration registry.
+ *
+ * TypeORM runs migrations in the order this array lists them, and records each
+ * one by class name. Two things can go wrong when a migration is added, and
+ * neither one announces itself — the schema simply diverges on some
+ * installations and not others:
+ *
+ *   1. the new migration runs BEFORE one that is already deployed. Existing
+ *      installations have already recorded the older migration, so the new one
+ *      still runs last for them, while a fresh install runs it in the listed
+ *      position. The two databases end up different.
+ *   2. two migrations share a timestamp, so the file a class belongs to is
+ *      ambiguous and the pairing between name and file can silently swap.
+ *
+ * `generate-postgres-migration` stamps a WALL-CLOCK timestamp, while the
+ * recent migrations here use hand-picked round numbers that already run ahead
+ * of wall clock — so a freshly generated file lands BELOW several registered
+ * migrations unless somebody renumbers it. That is case 1, and it is the
+ * likely one.
+ *
+ * This guard is deliberately written against the registry as a whole rather
+ * than against whichever migration happens to be newest, so that adding a
+ * migration never requires editing (or hand-carrying) the guard itself.
+ *
+ * Note it does NOT assert the whole array is sorted. It is not: a handful of
+ * historical entries were registered out of timestamp order years ago and have
+ * long since run everywhere, so renumbering them now would re-run them. What
+ * is asserted is the part that is still live — the newest entry must sort
+ * above everything already registered.
+ */
+
+const MIGRATION_DIRECTORY: string = path.join(
+  __dirname,
+  "../../../../Server/Infrastructure/Postgres/SchemaMigrations",
+);
+
+/*
+ * The very first migration predates the convention and carries no timestamp in
+ * its class name. It is first in the array and can never be last, so it is
+ * simply excluded rather than special-cased in every assertion below.
+ */
+const UNTIMESTAMPED_MIGRATION_NAME: string = "InitialMigration";
+
+const INITIAL_MIGRATION_TIMESTAMP: number = 1717605043663;
+
+const TIMESTAMPED_FILE: RegExp = new RegExp("^\\d+-");
+
+type MigrationClass = new () => MigrationInterface;
+
+type TimestampOfFunction = (migrationClass: MigrationClass) => number | null;
+
+const timestampOf: TimestampOfFunction = (
+  migrationClass: MigrationClass,
+): number | null => {
+  const match: RegExpMatchArray | null = migrationClass.name.match(/(\d+)$/);
+  return match ? Number(match[1]) : null;
+};
+
+const registered: Array<MigrationClass> =
+  SchemaMigrations as Array<MigrationClass>;
+
+describe("the migration registry", () => {
+  /*
+   * Math.max() of an empty list is -Infinity and every assertion below would
+   * pass vacuously against one. Prove the import actually produced a registry
+   * before leaning on anything derived from it.
+   */
+  test("is actually populated, so nothing below passes vacuously", () => {
+    expect(registered.length).toBeGreaterThan(100);
+  });
+
+  test("names every migration after its timestamp, bar the first one", () => {
+    const untimestamped: Array<string> = registered
+      .filter((migrationClass: MigrationClass): boolean => {
+        return timestampOf(migrationClass) === null;
+      })
+      .map((migrationClass: MigrationClass): string => {
+        return migrationClass.name;
+      });
+
+    expect(untimestamped).toEqual([UNTIMESTAMPED_MIGRATION_NAME]);
+  });
+
+  describe("ordering", () => {
+    /*
+     * The guard that used to be hand-carried from one migration's test to the
+     * next. Whoever adds a migration adds it to the end of the array, and this
+     * is what says the timestamp has to match that position.
+     */
+    test("gives the last-registered migration the highest timestamp", () => {
+      const last: MigrationClass = registered[registered.length - 1]!;
+      const lastTimestamp: number | null = timestampOf(last);
+
+      expect(lastTimestamp).not.toBeNull();
+
+      const earlierTimestamps: Array<number> = registered
+        .slice(0, -1)
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        });
+
+      expect(earlierTimestamps.length).toBe(registered.length - 2);
+
+      /*
+       * If this fails, the migration at the end of SchemaMigrations/Index.ts
+       * carries a timestamp that sorts below one already registered — rename
+       * the new migration's file and class to a timestamp above the current
+       * maximum, rather than moving it up the array.
+       */
+      expect(lastTimestamp).toBeGreaterThan(Math.max(...earlierTimestamps));
+    });
+
+    test("never registers the same timestamp twice", () => {
+      const timestamps: Array<number> = registered
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        });
+
+      const duplicates: Array<number> = timestamps.filter(
+        (timestamp: number, index: number): boolean => {
+          return timestamps.indexOf(timestamp) !== index;
+        },
+      );
+
+      expect(duplicates).toEqual([]);
+    });
+
+    test("never registers the same migration class twice", () => {
+      const names: Array<string> = registered.map(
+        (migrationClass: MigrationClass): string => {
+          return migrationClass.name;
+        },
+      );
+
+      const duplicates: Array<string> = names.filter(
+        (name: string, index: number): boolean => {
+          return names.indexOf(name) !== index;
+        },
+      );
+
+      expect(duplicates).toEqual([]);
+    });
+  });
+
+  /*
+   * ...and the timestamps in the class names are the ones on disk. A class
+   * renamed without renaming its file — or two files landing on the same
+   * timestamp — leaves the ordering above asserting something that is not what
+   * actually runs.
+   */
+  test("backs every registered migration with exactly one file on disk", () => {
+    const files: Array<string> = fs.readdirSync(MIGRATION_DIRECTORY);
+
+    const unbacked: Array<string> = registered
+      .filter((migrationClass: MigrationClass): boolean => {
+        const timestamp: number | null = timestampOf(migrationClass);
+
+        if (timestamp === null) {
+          return false;
+        }
+
+        return (
+          files.filter((file: string): boolean => {
+            return file.startsWith(`${timestamp}-`);
+          }).length !== 1
+        );
+      })
+      .map((migrationClass: MigrationClass): string => {
+        return migrationClass.name;
+      });
+
+    expect(unbacked).toEqual([]);
+  });
+
+  /*
+   * The other direction: a migration file that nobody registered never runs at
+   * all. That is the failure mode with no symptom until a query hits a column
+   * that was never created.
+   *
+   * The registered side is read out of the exported array rather than out of
+   * Index.ts, so a file that is imported but never added to the array — which
+   * is exactly as inert as one that is not imported at all — still fails here.
+   */
+  test("registers every migration file that exists on disk", () => {
+    const registeredTimestamps: Set<number> = new Set(
+      registered
+        .map(timestampOf)
+        .filter((timestamp: number | null): timestamp is number => {
+          return timestamp !== null;
+        }),
+    );
+
+    /*
+     * The one file whose class name carries no timestamp, so it cannot be
+     * matched by the timestamps above.
+     */
+    registeredTimestamps.add(INITIAL_MIGRATION_TIMESTAMP);
+
+    const timestampsOnDisk: Array<string> = fs
+      .readdirSync(MIGRATION_DIRECTORY)
+      .filter((file: string): boolean => {
+        return file.endsWith(".ts") && TIMESTAMPED_FILE.test(file);
+      })
+      .map((file: string): string => {
+        return file.split("-")[0]!;
+      });
+
+    expect(timestampsOnDisk.length).toBeGreaterThan(100);
+
+    const unregistered: Array<string> = timestampsOnDisk.filter(
+      (timestamp: string): boolean => {
+        return !registeredTimestamps.has(Number(timestamp));
+      },
+    );
+
+    expect(unregistered).toEqual([]);
+  });
+});

package/Tests/Server/Middleware/SlackAuthorization.test.ts

@@ -0,0 +1,149 @@
+import { describe, expect, test, beforeEach } from "@jest/globals";
+import crypto from "crypto";
+import SlackAuthorization from "../../../Server/Middleware/SlackAuthorization";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import BadDataException from "../../../Types/Exception/BadDataException";
+
+const SIGNING_SECRET: string = "slack-app-signing-secret";
+
+/*
+ * Only the signing secret is overridden. Logger and CaptureSpan also read from
+ * EnvironmentConfig, so the rest of the module has to stay real.
+ */
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    __esModule: true,
+    ...jest.requireActual("../../../Server/EnvironmentConfig"),
+    SlackAppSigningSecret: "slack-app-signing-secret",
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    __esModule: true,
+    default: {
+      sendErrorResponse: jest.fn(),
+    },
+  };
+});
+
+/*
+ * Companion to WhatsAppAuthorization.test.ts. This middleware had the same
+ * unguarded crypto.timingSafeEqual: the value came off the attacker-controlled
+ * X-Slack-Signature header, and timingSafeEqual throws RangeError when the two
+ * buffers differ in byte length. A missing header was worse still - it reached
+ * Buffer.from(undefined) and threw a TypeError before the comparison. Both now
+ * have to come back as the intended 400.
+ */
+describe("SlackAuthorization.isAuthorizedSlackRequest", () => {
+  const TIMESTAMP: string = "1700000000";
+  const RAW_BODY: string = "token=abc&team_id=T123&command=%2Foneuptime";
+
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+  let next: NextFunction;
+
+  type SignFunction = (timestamp: string, body: string) => string;
+
+  const sign: SignFunction = (timestamp: string, body: string): string => {
+    return `v0=${crypto
+      .createHmac("sha256", SIGNING_SECRET)
+      .update(`v0:${timestamp}:${body}`)
+      .digest("hex")}`;
+  };
+
+  type BuildRequestFunction = (
+    signature: string | undefined,
+    body?: string,
+  ) => OneUptimeRequest;
+
+  const buildRequest: BuildRequestFunction = (
+    signature: string | undefined,
+    body: string = RAW_BODY,
+  ): OneUptimeRequest => {
+    const headers: Record<string, string> = {
+      "x-slack-request-timestamp": TIMESTAMP,
+    };
+
+    if (signature !== undefined) {
+      headers["x-slack-signature"] = signature;
+    }
+
+    return { headers, rawBody: body } as unknown as OneUptimeRequest;
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    next = jest.fn();
+  });
+
+  test("calls next when the signature matches the timestamp and body", async () => {
+    const req: OneUptimeRequest = buildRequest(sign(TIMESTAMP, RAW_BODY));
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("rejects a well-formed signature computed over a different body", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      sign(TIMESTAMP, `${RAW_BODY}&tampered=1`),
+      RAW_BODY,
+    );
+
+    await SlackAuthorization.isAuthorizedSlackRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Slack Signature Verification Failed."),
+    );
+  });
+
+  /*
+   * Every one of these is a byte length other than the 67 of a real
+   * "v0=" + 64 hex header, which is exactly what used to reach
+   * timingSafeEqual and throw. The absent and empty cases used to throw
+   * even earlier, inside Buffer.from.
+   */
+  const malformedSignatures: Array<[string, string | undefined]> = [
+    ["absent", undefined],
+    ["an empty string", ""],
+    ["a bare word", "nope"],
+    ["the prefix with no digest", "v0="],
+    ["a short digest", "v0=abc123"],
+    ["a long digest", `v0=${"a".repeat(65)}`],
+    ["the right length but non-hex characters", `v0=${"z".repeat(64)}`],
+    ["64 hex characters with no prefix", "a".repeat(64)],
+    ["the wrong version prefix", `v1=${"a".repeat(64)}`],
+  ];
+
+  describe("rejects a malformed signature with 400 rather than throwing", () => {
+    test.each(malformedSignatures)(
+      "%s",
+      async (_label: string, signature: string | undefined) => {
+        const req: OneUptimeRequest = buildRequest(signature);
+
+        await expect(
+          SlackAuthorization.isAuthorizedSlackRequest(req, res, next),
+        ).resolves.toBeUndefined();
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException("Slack Signature Verification Failed."),
+        );
+      },
+    );
+  });
+});