@oneuptime/common 12.0.15 → 12.0.16

package/Tests/Server/Infrastructure/LocalCache.test.ts

@@ -0,0 +1,149 @@
+import LocalCache from "../../../Server/Infrastructure/LocalCache";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * LocalCache is a process-local, namespaced key/value store used for cheap
+ * in-memory memoization (feature flags, small config lookups) where a
+ * round-trip to Redis would be wasteful. It is a single shared static map,
+ * so:
+ *
+ *   - the namespace has to actually isolate keys — two callers using the
+ *     same key in different namespaces must not read each other's values;
+ *   - `hasValue` is a Boolean() coercion, so a stored falsy value (0, "")
+ *     reads as absent. That is a real edge every caller of getOrSet-style
+ *     logic inherits, so it is pinned here rather than left implicit.
+ *
+ * Every test below uses a unique namespace so the shared map cannot leak
+ * state between cases.
+ */
+
+describe("LocalCache string/number/JSON round-trips", () => {
+  it("stores and returns a string", () => {
+    LocalCache.setString("ns-str", "k", "hello");
+    expect(LocalCache.getString("ns-str", "k")).toBe("hello");
+  });
+
+  it("stores and returns a number, including zero", () => {
+    LocalCache.setNumber("ns-num", "k", 42);
+    expect(LocalCache.getNumber("ns-num", "k")).toBe(42);
+
+    LocalCache.setNumber("ns-num-zero", "k", 0);
+    expect(LocalCache.getNumber("ns-num-zero", "k")).toBe(0);
+  });
+
+  it("stores and returns a JSON object", () => {
+    const value: JSONObject = { a: 1, b: ["x", "y"] };
+    LocalCache.setJSON("ns-json", "k", value);
+    expect(LocalCache.getJSON("ns-json", "k")).toEqual(value);
+  });
+
+  it("overwrites an existing value on a repeated set", () => {
+    LocalCache.setString("ns-overwrite", "k", "first");
+    LocalCache.setString("ns-overwrite", "k", "second");
+    expect(LocalCache.getString("ns-overwrite", "k")).toBe("second");
+  });
+});
+
+describe("LocalCache namespacing", () => {
+  it("isolates the same key across different namespaces", () => {
+    LocalCache.setString("ns-a", "shared-key", "from-a");
+    LocalCache.setString("ns-b", "shared-key", "from-b");
+
+    expect(LocalCache.getString("ns-a", "shared-key")).toBe("from-a");
+    expect(LocalCache.getString("ns-b", "shared-key")).toBe("from-b");
+  });
+
+  it("collides when namespace/key pairs concatenate to the same string", () => {
+    /*
+     * Known limitation, pinned deliberately: the map key is
+     * `namespace + "." + key` with no escaping, so ("team", "member.count")
+     * and ("team.member", "count") both resolve to "team.member.count" and
+     * share one slot. Callers must not choose namespaces/keys whose dotted
+     * concatenation can coincide. If this is ever hardened (e.g. an escaped
+     * delimiter), this test is the tripwire that will flag the change.
+     */
+    LocalCache.setString("team", "member.count", "written-first");
+    expect(LocalCache.getString("team.member", "count")).toBe("written-first");
+  });
+});
+
+describe("LocalCache.hasValue", () => {
+  it("is false for a key that was never set", () => {
+    expect(LocalCache.hasValue("ns-missing", "nope")).toBe(false);
+  });
+
+  it("is true after a truthy value is set", () => {
+    LocalCache.setString("ns-has", "k", "present");
+    expect(LocalCache.hasValue("ns-has", "k")).toBe(true);
+  });
+
+  it("reads a stored falsy value as absent (Boolean coercion)", () => {
+    // Documented edge: 0 and "" are stored but hasValue coerces to false.
+    LocalCache.setNumber("ns-falsy", "zero", 0);
+    LocalCache.setString("ns-falsy", "empty", "");
+    expect(LocalCache.hasValue("ns-falsy", "zero")).toBe(false);
+    expect(LocalCache.hasValue("ns-falsy", "empty")).toBe(false);
+  });
+});
+
+describe("LocalCache.getOrSetString", () => {
+  it("invokes the producer and caches its result when absent", async () => {
+    let calls: number = 0;
+    const produce: () => Promise<string> = async (): Promise<string> => {
+      calls++;
+      return "computed";
+    };
+
+    const first: string = await LocalCache.getOrSetString(
+      "ns-getset",
+      "k",
+      produce,
+    );
+    expect(first).toBe("computed");
+    expect(calls).toBe(1);
+    // The value is now in the cache.
+    expect(LocalCache.getString("ns-getset", "k")).toBe("computed");
+  });
+
+  it("does not invoke the producer again once a value is cached", async () => {
+    let calls: number = 0;
+    const produce: () => Promise<string> = async (): Promise<string> => {
+      calls++;
+      return `value-${calls}`;
+    };
+
+    const first: string = await LocalCache.getOrSetString(
+      "ns-getset-2",
+      "k",
+      produce,
+    );
+    const second: string = await LocalCache.getOrSetString(
+      "ns-getset-2",
+      "k",
+      produce,
+    );
+
+    expect(first).toBe("value-1");
+    // Second call short-circuits on the cached value; producer not re-run.
+    expect(second).toBe("value-1");
+    expect(calls).toBe(1);
+  });
+
+  it("re-invokes the producer when the previously produced value was empty", async () => {
+    /*
+     * getOrSetString gates on getString() being falsy, so an empty-string
+     * result is treated as "not cached" and the producer runs every time.
+     * This mirrors the hasValue Boolean-coercion edge above.
+     */
+    let calls: number = 0;
+    const produce: () => Promise<string> = async (): Promise<string> => {
+      calls++;
+      return "";
+    };
+
+    await LocalCache.getOrSetString("ns-getset-empty", "k", produce);
+    await LocalCache.getOrSetString("ns-getset-empty", "k", produce);
+    expect(calls).toBe(2);
+  });
+});

package/Tests/Server/Services/AccessTokenProjectUserGrant.test.ts

@@ -0,0 +1,249 @@
+import Label from "../../../Models/DatabaseModels/Label";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import TeamPermission from "../../../Models/DatabaseModels/TeamPermission";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * The grant site itself: AccessTokenService.refreshUserTenantAccessPermission
+ * is where a signed-in member's permission set is built from their teams, and
+ * it is the only place Permission.ProjectUser enters that set.
+ *
+ * Pinning the helper alone is not enough. The helper could keep passing while
+ * the call to it is deleted, and the symptom would be issue #3305 all over
+ * again - every table in the dashboard refusing a domain-scoped member, with
+ * every unit test still green. So this drives the real service and asserts on
+ * what it hands back and on what it writes to the cache.
+ *
+ * The database and Redis are mocked at the module boundary; the permission
+ * logic under test is real.
+ */
+
+const mockSetJSON: jest.Mock = jest.fn();
+const mockGetJSONObject: jest.Mock = jest.fn();
+const mockTeamMemberFindBy: jest.Mock = jest.fn();
+const mockTeamPermissionFindBy: jest.Mock = jest.fn();
+
+/*
+ * The arrow wrappers are load bearing: jest.mock is hoisted above the compiled
+ * requires, so naming the mocks directly would capture them before their
+ * initializers have run.
+ */
+jest.mock("../../../Server/Infrastructure/GlobalCache", () => {
+  return {
+    __esModule: true,
+    default: {
+      setJSON: (...args: Array<unknown>) => {
+        return mockSetJSON(...args);
+      },
+      getJSONObject: (...args: Array<unknown>) => {
+        return mockGetJSONObject(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../Server/Services/TeamMemberService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findBy: (...args: Array<unknown>) => {
+        return mockTeamMemberFindBy(...args);
+      },
+    },
+  };
+});
+
+jest.mock("../../../Server/Services/TeamPermissionService", () => {
+  return {
+    __esModule: true,
+    default: {
+      findBy: (...args: Array<unknown>) => {
+        return mockTeamPermissionFindBy(...args);
+      },
+    },
+  };
+});
+
+import AccessTokenService from "../../../Server/Services/AccessTokenService";
+
+const userId: ObjectID = ObjectID.generate();
+const projectId: ObjectID = ObjectID.generate();
+const teamId: ObjectID = ObjectID.generate();
+
+type MakeTeamMemberFunction = () => TeamMember;
+
+const makeTeamMember: MakeTeamMemberFunction = (): TeamMember => {
+  const teamMember: TeamMember = new TeamMember();
+  teamMember.teamId = teamId;
+  teamMember.projectId = projectId;
+  teamMember.userId = userId;
+  return teamMember;
+};
+
+type MakeTeamPermissionFunction = (
+  permission: Permission,
+  labels?: Array<Label>,
+) => TeamPermission;
+
+const makeTeamPermission: MakeTeamPermissionFunction = (
+  permission: Permission,
+  labels: Array<Label> = [],
+): TeamPermission => {
+  const teamPermission: TeamPermission = new TeamPermission();
+  teamPermission.permission = permission;
+  teamPermission.labels = labels;
+  teamPermission.isBlockPermission = false;
+  return teamPermission;
+};
+
+type PermissionNamesFunction = (
+  permission: UserTenantAccessPermission | null,
+) => Array<Permission>;
+
+const permissionNames: PermissionNamesFunction = (
+  permission: UserTenantAccessPermission | null,
+): Array<Permission> => {
+  return (permission?.permissions || []).map((row: UserPermission) => {
+    return row.permission;
+  });
+};
+
+describe("AccessTokenService.refreshUserTenantAccessPermission", () => {
+  beforeEach(() => {
+    mockSetJSON.mockReset();
+    mockGetJSONObject.mockReset();
+    mockTeamMemberFindBy.mockReset();
+    mockTeamPermissionFindBy.mockReset();
+    mockSetJSON.mockResolvedValue(undefined as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("a member whose only role is Monitor Viewer comes back with ProjectUser", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.MonitorViewer),
+    ] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    expect(permissionNames(permission)).toEqual([
+      Permission.CurrentUser,
+      Permission.UnAuthorizedSsoUser,
+      Permission.MonitorViewer,
+      Permission.ProjectUser,
+    ]);
+  });
+
+  /*
+   * The cached copy has to carry it too, or the grant lasts exactly one request
+   * and every later one is served the snapshot without it.
+   */
+  test("the snapshot written to the cache carries it as well", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.IncidentViewer),
+    ] as never);
+
+    await AccessTokenService.refreshUserTenantAccessPermission(
+      userId,
+      projectId,
+    );
+
+    expect(mockSetJSON).toHaveBeenCalledTimes(1);
+
+    const cached: UserTenantAccessPermission = mockSetJSON.mock
+      .calls[0]![2] as UserTenantAccessPermission;
+
+    expect(permissionNames(cached)).toContain(Permission.ProjectUser);
+    expect(mockSetJSON.mock.calls[0]![0]).toBe("project-permissions");
+    expect(mockSetJSON.mock.calls[0]![1]).toBe(
+      `${userId.toString()}:${projectId.toString()}`,
+    );
+  });
+
+  /*
+   * Membership is the whole condition. A user who belongs to no team of this
+   * project never reaches the grant - the service returns null before it, and
+   * nothing is cached for them.
+   */
+  test("a user who is in no team of this project gets nothing at all", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    expect(permission).toBeNull();
+    expect(mockSetJSON).not.toHaveBeenCalled();
+    expect(mockTeamPermissionFindBy).not.toHaveBeenCalled();
+  });
+
+  /*
+   * The team's own rows are untouched by the grant, labels and all - a
+   * label-scoped role must not come back unrestricted.
+   */
+  test("a label-scoped role keeps its labels", async () => {
+    const label: Label = new Label();
+    label._id = ObjectID.generate().toString();
+
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.MonitorViewer, [label]),
+    ] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    const monitorViewer: UserPermission | undefined =
+      permission?.permissions.find((row: UserPermission) => {
+        return row.permission === Permission.MonitorViewer;
+      });
+
+    expect(monitorViewer?.labelIds).toHaveLength(1);
+    expect(monitorViewer?.labelIds[0]?.toString()).toBe(label._id);
+
+    const projectUser: UserPermission | undefined =
+      permission?.permissions.find((row: UserPermission) => {
+        return row.permission === Permission.ProjectUser;
+      });
+
+    expect(projectUser?.labelIds).toEqual([]);
+  });
+
+  test("an administrator does not end up with it twice", async () => {
+    mockTeamMemberFindBy.mockResolvedValue([makeTeamMember()] as never);
+    mockTeamPermissionFindBy.mockResolvedValue([
+      makeTeamPermission(Permission.ProjectAdmin),
+      makeTeamPermission(Permission.ProjectUser),
+    ] as never);
+
+    const permission: UserTenantAccessPermission | null =
+      await AccessTokenService.refreshUserTenantAccessPermission(
+        userId,
+        projectId,
+      );
+
+    expect(
+      permissionNames(permission).filter((name: Permission) => {
+        return name === Permission.ProjectUser;
+      }),
+    ).toHaveLength(1);
+  });
+});