@oneuptime/common 12.0.14 → 12.0.16

package/Tests/Server/Middleware/UserAuthorizationSSOProvider.test.ts

@@ -33,20 +33,29 @@ describe("UserMiddleware.doesSsoTokenForProjectExist - requiredSsoProviderId", (
     return u;
   };
 
-  // Build a request whose cookies carry a real `sso-<projectId>` token.
+  /*
+   * Build a request whose cookies carry a real `sso-<projectId>` token.
+   *
+   * The type defaults to ProjectSSO because that is what a PROJECT SSO login
+   * actually mints, and the project-scoped slot now refuses Global-typed
+   * credentials outright - see the "legacy Global-typed token" block below for
+   * why, and for the tests that pin it.
+   */
   const buildRequestWithSsoToken: (data: {
     tokenProjectId: ObjectID;
     discriminatorProviderId?: ObjectID | undefined;
+    ssoProviderType?: SsoProviderType | undefined;
   }) => ExpressRequest = (data: {
     tokenProjectId: ObjectID;
     discriminatorProviderId?: ObjectID | undefined;
+    ssoProviderType?: SsoProviderType | undefined;
   }): ExpressRequest => {
     const token: string = CookieUtil.getSSOToken({
       user: buildUser(),
       projectId: data.tokenProjectId,
       ssoProviderId: data.discriminatorProviderId,
       ssoProviderType: data.discriminatorProviderId
-        ? SsoProviderType.GlobalSSO
+        ? data.ssoProviderType || SsoProviderType.ProjectSSO
         : undefined,
     });
 
@@ -170,6 +179,86 @@ describe("UserMiddleware.doesSsoTokenForProjectExist - requiredSsoProviderId", (
  * a matching token. The token is sourced from the `global-sso-token` cookie
  * (web) or the `x-global-sso-token` header (mobile).
  */
+/*
+ * A Global-typed credential must never be accepted from the per-project slot.
+ *
+ * Before the single-token redesign, the Global SSO router fanned out one
+ * per-project `sso-<projectId>` cookie per project the user belonged to, typed
+ * GlobalSSO and signed for 30 days. Those are still in browsers, and the
+ * mobile app still replays every non-expired stored token as `x-sso-tokens`.
+ * If the project slot accepted them, they would short-circuit past the
+ * provider-trust check - so disabling a provider would still not revoke them,
+ * for up to a month. They are refused here instead, which sends the user
+ * through a fresh global login that mints a properly-typed token.
+ */
+describe("UserMiddleware.doesSsoTokenForProjectExist - legacy Global-typed token in the project slot", () => {
+  const legacyProjectId: ObjectID = ObjectID.generate();
+  const legacyUserId: ObjectID = ObjectID.generate();
+  const legacyProviderId: ObjectID = ObjectID.generate();
+
+  const buildLegacyRequest: (
+    ssoProviderType: SsoProviderType,
+  ) => ExpressRequest = (ssoProviderType: SsoProviderType): ExpressRequest => {
+    const user: User = new User();
+    user.id = legacyUserId;
+    user.email = new Email("legacy-sso-user@oneuptime.com");
+
+    const token: string = CookieUtil.getSSOToken({
+      user,
+      projectId: legacyProjectId,
+      ssoProviderId: legacyProviderId,
+      ssoProviderType,
+    });
+
+    return {
+      cookies: {
+        [CookieUtil.getUserSSOKey(legacyProjectId)]: token,
+      },
+      headers: {},
+    } as unknown as ExpressRequest;
+  };
+
+  test("a GlobalSSO-typed token in the project slot is refused", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.GlobalSSO),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(false);
+  });
+
+  test("a GlobalOIDC-typed token in the project slot is refused", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.GlobalOIDC),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(false);
+  });
+
+  test("the SAME token typed ProjectSSO is accepted, so the refusal is about the type and nothing else", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.ProjectSSO),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(true);
+  });
+
+  test("a ProjectOIDC-typed token in the project slot is accepted", () => {
+    expect(
+      UserMiddleware.doesSsoTokenForProjectExist(
+        buildLegacyRequest(SsoProviderType.ProjectOIDC),
+        legacyProjectId,
+        legacyUserId,
+      ),
+    ).toBe(true);
+  });
+});
+
 describe("UserMiddleware.doesSsoTokenForProjectExist - global SSO token", () => {
   const projectId: ObjectID = ObjectID.generate();
   const otherProjectId: ObjectID = ObjectID.generate();

package/Tests/Server/Middleware/WhatsAppAuthorization.test.ts

@@ -0,0 +1,233 @@
+import { describe, expect, test, beforeEach } from "@jest/globals";
+import crypto from "crypto";
+import WhatsAppAuthorization from "../../../Server/Middleware/WhatsAppAuthorization";
+import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import BadDataException from "../../../Types/Exception/BadDataException";
+
+/*
+ * The config lookup is mocked so the signature branches can be exercised
+ * without Postgres; the middleware under test must never need a database.
+ */
+jest.mock("../../../Server/Services/GlobalConfigService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findOneBy: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    __esModule: true,
+    default: {
+      sendErrorResponse: jest.fn(),
+    },
+  };
+});
+
+/*
+ * Regression cover for the unguarded crypto.timingSafeEqual in
+ * isAuthorizedWhatsAppRequest. timingSafeEqual throws RangeError when the two
+ * buffers differ in byte length, and the compared value came straight off the
+ * attacker-controlled X-Hub-Signature-256 header with no try/catch anywhere
+ * above it. The endpoint is unauthenticated by design - the signature IS the
+ * authentication - so anyone could send `x-hub-signature-256: nope` and throw
+ * the middleware instead of receiving the intended 400.
+ */
+describe("WhatsAppAuthorization.isAuthorizedWhatsAppRequest", () => {
+  const APP_SECRET: string = "meta-whatsapp-app-secret";
+  const RAW_BODY: string = JSON.stringify({
+    object: "whatsapp_business_account",
+  });
+
+  const findOneBy: jest.Mock =
+    GlobalConfigService.findOneBy as unknown as jest.Mock;
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+  let next: NextFunction;
+
+  type SignFunction = (body: string) => string;
+
+  const sign: SignFunction = (body: string): string => {
+    return `sha256=${crypto
+      .createHmac("sha256", APP_SECRET)
+      .update(body)
+      .digest("hex")}`;
+  };
+
+  type BuildRequestFunction = (
+    signature: string | undefined,
+    body?: string,
+  ) => OneUptimeRequest;
+
+  const buildRequest: BuildRequestFunction = (
+    signature: string | undefined,
+    body: string = RAW_BODY,
+  ): OneUptimeRequest => {
+    return {
+      headers:
+        signature === undefined ? {} : { "x-hub-signature-256": signature },
+      rawBody: body,
+    } as unknown as OneUptimeRequest;
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    next = jest.fn();
+    findOneBy.mockResolvedValue({ metaWhatsAppAppSecret: APP_SECRET });
+  });
+
+  test("calls next when the signature matches the body", async () => {
+    const req: OneUptimeRequest = buildRequest(sign(RAW_BODY));
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("calls next when the signature matches but the digest is upper-case", async () => {
+    const signature: string = sign(RAW_BODY);
+    const req: OneUptimeRequest = buildRequest(
+      `sha256=${signature.slice("sha256=".length).toUpperCase()}`,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).toHaveBeenCalled();
+    expect(sendErrorResponse).not.toHaveBeenCalled();
+  });
+
+  test("rejects a well-formed signature computed over a different body", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      sign(`${RAW_BODY} tampered`),
+      RAW_BODY,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("WhatsApp webhook signature verification failed."),
+    );
+  });
+
+  test("rejects a well-formed signature computed with a different secret", async () => {
+    const req: OneUptimeRequest = buildRequest(
+      `sha256=${crypto
+        .createHmac("sha256", "some-other-secret")
+        .update(RAW_BODY)
+        .digest("hex")}`,
+    );
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("WhatsApp webhook signature verification failed."),
+    );
+  });
+
+  /*
+   * An empty header value is indistinguishable from an absent one, so both
+   * take the missing-header branch rather than the malformed-digest one.
+   */
+  test.each([
+    ["absent", undefined],
+    ["empty", ""],
+  ])(
+    "rejects an %s signature header",
+    async (_label: string, signature: string | undefined) => {
+      const req: OneUptimeRequest = buildRequest(signature);
+
+      await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+      expect(next).not.toHaveBeenCalled();
+      expect(sendErrorResponse).toHaveBeenCalledWith(
+        req,
+        res,
+        new BadDataException("Missing X-Hub-Signature-256 header."),
+      );
+    },
+  );
+
+  /*
+   * Every one of these is a byte length other than the 71 of a real
+   * "sha256=" + 64 hex header, which is exactly what used to reach
+   * timingSafeEqual and throw.
+   */
+  const malformedSignatures: Array<[string, string]> = [
+    ["a bare word", "nope"],
+    ["the prefix with no digest", "sha256="],
+    ["a short digest", "sha256=abc123"],
+    ["a long digest", `sha256=${"a".repeat(65)}`],
+    ["the right length but non-hex characters", `sha256=${"z".repeat(64)}`],
+    ["64 hex characters with no prefix", "a".repeat(64)],
+    ["the wrong prefix", `sha1=${"a".repeat(64)}`],
+    ["a whitespace-padded digest", ` sha256=${"a".repeat(64)}`],
+  ];
+
+  describe("rejects a malformed signature with 400 rather than throwing", () => {
+    test.each(malformedSignatures)(
+      "%s",
+      async (_label: string, signature: string) => {
+        const req: OneUptimeRequest = buildRequest(signature);
+
+        await expect(
+          WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next),
+        ).resolves.toBeUndefined();
+
+        expect(next).not.toHaveBeenCalled();
+        expect(sendErrorResponse).toHaveBeenCalledWith(
+          req,
+          res,
+          new BadDataException(
+            "WhatsApp webhook signature verification failed.",
+          ),
+        );
+      },
+    );
+  });
+
+  /*
+   * The shape check sits in front of the config lookup, so an unauthenticated
+   * flood of garbage signatures costs no database round trips.
+   */
+  test("does not query the global config for a malformed signature", async () => {
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(
+      buildRequest("nope"),
+      res,
+      next,
+    );
+
+    expect(findOneBy).not.toHaveBeenCalled();
+  });
+
+  test("rejects when the app secret is not configured", async () => {
+    findOneBy.mockResolvedValue({ metaWhatsAppAppSecret: "   " });
+
+    const req: OneUptimeRequest = buildRequest(sign(RAW_BODY));
+
+    await WhatsAppAuthorization.isAuthorizedWhatsAppRequest(req, res, next);
+
+    expect(next).not.toHaveBeenCalled();
+    expect(sendErrorResponse).toHaveBeenCalledWith(
+      req,
+      res,
+      new BadDataException("Meta WhatsApp App Secret is not configured."),
+    );
+  });
+});

package/Tests/Server/Services/AccessTokenProjectUserGrant.test.ts

@@ -0,0 +1,249 @@
+import Label from "../../../Models/DatabaseModels/Label";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import TeamPermission from "../../../Models/DatabaseModels/TeamPermission";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The grant site itself: AccessTokenService.refreshUserTenantAccessPermission
+ * is where a signed-in member's permission set is built from their teams, and
+ * it is the only place Permission.ProjectUser enters that set.
+ *
+ * Pinning the helper alone is not enough. The helper could keep passing while
+ * the call to it is deleted, and the symptom would be issue #3305 all over
+ * again - every table in the dashboard refusing a domain-scoped member, with
+ * every unit test still green. So this drives the real service and asserts on
+ * what it hands back and on what it writes to the cache.
+ *
+ * The database and Redis are mocked at the module boundary; the permission
+ * logic under test is real.
+ */
+
+const mockSetJSON: jest.Mock = jest.fn();
+const mockGetJSONObject: jest.Mock = jest.fn();
+const mockTeamMemberFindBy: jest.Mock = jest.fn();
+const mockTeamPermissionFindBy: jest.Mock = jest.fn();
+
+/*
+ * The arrow wrappers are load bearing: jest.mock is hoisted above the compiled
+ * requires, so naming the mocks directly would capture them before their
+ * initializers have run.
+ */
+jest.mock("../../../Server/Infrastructure/GlobalCache", () => {
+  return {
+    __esModule: true,
+    default: {
+      setJSON: (...args: Array<unknown>) => {
+        return mockSetJSON(...args);
+      },
+      getJSONObject: (...args: Array<unknown>) => {
+        return mockGetJSONObject(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../Server/Services/TeamMemberService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findBy: (...args: Array<unknown>) => {
+        return mockTeamMemberFindBy(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../Server/Services/TeamPermissionService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findBy: (...args: Array<unknown>) => {
+        return mockTeamPermissionFindBy(...args);
+      },
+    },
+  };
+});
+
+import AccessTokenService from "../../../Server/Services/AccessTokenService";
+
+const userId: ObjectID = ObjectID.generate();
+const projectId: ObjectID = ObjectID.generate();
+const teamId: ObjectID = ObjectID.generate();
+
+type MakeTeamMemberFunction = () => TeamMember;
+
+const makeTeamMember: MakeTeamMemberFunction = (): TeamMember => {
+  const teamMember: TeamMember = new TeamMember();
+  teamMember.teamId = teamId;
+  teamMember.projectId = projectId;
+  teamMember.userId = userId;
+  return teamMember;
+};
+
+type MakeTeamPermissionFunction = (
+  permission: Permission,
+  labels?: Array<Label>,
+) => TeamPermission;
+
+const makeTeamPermission: MakeTeamPermissionFunction = (
+  permission: Permission,
+  labels: Array<Label> = [],
+): TeamPermission => {
+  const teamPermission: TeamPermission = new TeamPermission();
+  teamPermission.permission = permission;
+  teamPermission.labels = labels;
+  teamPermission.isBlockPermission = false;
+  return teamPermission;
+};
+
+type PermissionNamesFunction = (
+  permission: UserTenantAccessPermission | null,
+) => Array<Permission>;
+
+const permissionNames: PermissionNamesFunction = (
+  permission: UserTenantAccessPermission | null,
+): Array<Permission> => {
+  return (permission?.permissions || []).map((row: UserPermission) => {
+    return row.permission;
+  });
+};
+
+describe("AccessTokenService.refreshUserTenantAccessPermission", () => {
+  beforeEach(() => {
+    mockSetJSON.mockReset();
+    mockGetJSONObject.mockReset();
+    mockTeamMemberFindBy.mockReset();
+    mockTeamPermissionFindBy.mockReset();
+    mockSetJSON.mockResolvedValue(undefined as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a member whose only role is Monitor Viewer comes back with ProjectUser", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.MonitorViewer),
+    ] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    expect(permissionNames(permission)).toEqual([
+      Permission.CurrentUser,
+      Permission.UnAuthorizedSsoUser,
+      Permission.MonitorViewer,
+      Permission.ProjectUser,
+    ]);
+  });
+
+  /*
+   * The cached copy has to carry it too, or the grant lasts exactly one request
+   * and every later one is served the snapshot without it.
+   */
+  test("the snapshot written to the cache carries it as well", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.IncidentViewer),
+    ] as never);
+
+    await AccessTokenService.refreshUserTenantAccessPermission(
+      userId,
+      projectId,
+    );
+
+    expect(mockSetJSON).toHaveBeenCalledTimes(1);
+
+    const cached: UserTenantAccessPermission = mockSetJSON.mock
+      .calls[0]![2] as UserTenantAccessPermission;
+
+    expect(permissionNames(cached)).toContain(Permission.ProjectUser);
+    expect(mockSetJSON.mock.calls[0]![0]).toBe("project-permissions");
+    expect(mockSetJSON.mock.calls[0]![1]).toBe(
+      `${userId.toString()}:${projectId.toString()}`,
+    );
+  });
+
+  /*
+   * Membership is the whole condition. A user who belongs to no team of this
+   * project never reaches the grant - the service returns null before it, and
+   * nothing is cached for them.
+   */
+  test("a user who is in no team of this project gets nothing at all", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    expect(permission).toBeNull();
+    expect(mockSetJSON).not.toHaveBeenCalled();
+    expect(mockTeamPermissionFindBy).not.toHaveBeenCalled();
+  });
+
+  /*
+   * The team's own rows are untouched by the grant, labels and all - a
+   * label-scoped role must not come back unrestricted.
+   */
+  test("a label-scoped role keeps its labels", async () => {
+    const label: Label = new Label();
+    label._id = ObjectID.generate().toString();
+
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.MonitorViewer, [label]),
+    ] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    const monitorViewer: UserPermission | undefined =
+      permission?.permissions.find((row: UserPermission) => {
+        return row.permission === Permission.MonitorViewer;
+      });
+
+    expect(monitorViewer?.labelIds).toHaveLength(1);
+    expect(monitorViewer?.labelIds[0]?.toString()).toBe(label._id);
+
+    const projectUser: UserPermission | undefined =
+      permission?.permissions.find((row: UserPermission) => {
+        return row.permission === Permission.ProjectUser;
+      });
+
+    expect(projectUser?.labelIds).toEqual([]);
+  });
+
+  test("an administrator does not end up with it twice", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.ProjectAdmin),
+      makeTeamPermission(Permission.ProjectUser),
+    ] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    expect(
+      permissionNames(permission).filter((name: Permission) => {
+        return name === Permission.ProjectUser;
+      }),
+    ).toHaveLength(1);
+  });
+});