@oneuptime/common 12.0.2 → 12.0.4

package/Tests/Models/DatabaseModels/StatusPageMonitorRuleModel.test.ts

@@ -0,0 +1,190 @@
+import Models from "../../../Models/DatabaseModels/Index";
+import StatusPageMonitorRule from "../../../Models/DatabaseModels/StatusPageMonitorRule";
+import StatusPageResource from "../../../Models/DatabaseModels/StatusPageResource";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Migrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import Permission, {
+  PermissionGroup,
+  PermissionHelper,
+  PermissionProps,
+} from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Schema-level guarantees behind status page monitor rules. Each of these is
+ * something the engine's own tests cannot see: they pass just as happily
+ * against a model that is unreachable over the API or writable by the wrong
+ * person.
+ */
+
+describe("StatusPageMonitorRule model", () => {
+  const model: StatusPageMonitorRule = new StatusPageMonitorRule();
+
+  it("is registered in the model index, so its table is created and its API is mounted", () => {
+    const isRegistered: boolean = Models.some(
+      (registered: { new (): BaseModel }) => {
+        return registered === StatusPageMonitorRule;
+      },
+    );
+
+    expect(isRegistered).toBe(true);
+  });
+
+  it("is scoped to a project, so one tenant's rules cannot read another's", () => {
+    expect(model.getTenantColumn()).toBe("projectId");
+  });
+
+  it("is served from its own CRUD endpoint", () => {
+    expect(model.getCrudApiPath()?.toString()).toBe(
+      "/status-page-monitor-rule",
+    );
+  });
+
+  it("declares every field the rule form writes", () => {
+    const columns: Array<string> = model.getTableColumns().columns;
+
+    for (const column of [
+      "statusPageId",
+      "statusPageGroupId",
+      "isEnabled",
+      "monitorLabels",
+      "monitorNamePattern",
+      "monitorDescriptionPattern",
+      "showCurrentStatus",
+      "showUptimePercent",
+      "uptimePercentPrecision",
+      "showStatusHistoryChart",
+    ]) {
+      expect(columns).toContain(column);
+    }
+  });
+
+  /*
+   * The rule decides what shows up on a public page, so it is gated behind
+   * the status page permissions rather than the generic project ones.
+   */
+  it("requires a status page permission to create", () => {
+    const create: Array<Permission> = model.getCreatePermissions();
+
+    expect(create).toContain(Permission.CreateStatusPageMonitorRule);
+    expect(create).toContain(Permission.StatusPageAdmin);
+  });
+
+  it("requires a status page permission to delete", () => {
+    expect(model.getDeletePermissions()).toContain(
+      Permission.DeleteStatusPageMonitorRule,
+    );
+  });
+
+  it("does not let a plain viewer edit a rule", () => {
+    expect(model.getUpdatePermissions()).not.toContain(Permission.Viewer);
+  });
+
+  /*
+   * A saved rule must not be re-pointable at a different status page: the
+   * project-scope check runs on create, and letting statusPageId move
+   * afterwards would route a rule's monitors onto a page nobody re-validated.
+   * Create-only in the column ACL is what enforces it.
+   */
+  it("does not let a saved rule be re-pointed at another status page", () => {
+    const accessControl: Record<string, ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    expect(accessControl["statusPageId"]?.update).toEqual([]);
+    expect(accessControl["statusPageId"]?.create?.length).toBeGreaterThan(0);
+  });
+
+  it("lets the destination group be changed on a saved rule", () => {
+    const accessControl: Record<string, ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
+
+    expect(accessControl["statusPageGroupId"]?.update).toContain(
+      Permission.EditStatusPageMonitorRule,
+    );
+  });
+
+  it("is scoped by the status page it belongs to, like every other status page child", () => {
+    expect(model.canAccessIfCanReadOn).toBe("statusPage");
+  });
+});
+
+describe("Status page monitor rule migration", () => {
+  /*
+   * A migration that is not in this array never runs, so the table simply does
+   * not exist in a fresh database and the CI drift check fails. Cheaper to
+   * catch here than in the drift job.
+   */
+  it("is registered, so the table is actually created", () => {
+    // The array holds migration classes; `.name` is the class name.
+    const registeredNames: Array<string> = (
+      Migrations as unknown as Array<{ name: string }>
+    ).map((migration: { name: string }) => {
+      return migration.name;
+    });
+
+    expect(registeredNames).toContain("AddStatusPageMonitorRule1786005052769");
+  });
+});
+
+describe("StatusPageResource.statusPageMonitorRuleId - the ownership marker", () => {
+  const accessControl: Record<string, ColumnAccessControl> =
+    new StatusPageResource().getColumnAccessControlForAllColumns();
+
+  it("exists on the resource, so a rule can tell its own work apart from a human's", () => {
+    expect(new StatusPageResource().getTableColumns().columns).toContain(
+      "statusPageMonitorRuleId",
+    );
+  });
+
+  /*
+   * This is the load-bearing one. If the column were writable over the API,
+   * anyone could stamp a rule onto a hand-made resource and that resource
+   * would then be deleted the next time the rule stopped matching - silently
+   * losing configuration the rule never created. The engine writes it as
+   * root, which bypasses column ACLs, so an empty list costs nothing.
+   */
+  it("cannot be set through the API on create", () => {
+    expect(accessControl["statusPageMonitorRuleId"]?.create).toEqual([]);
+  });
+
+  it("cannot be reassigned through the API on update", () => {
+    expect(accessControl["statusPageMonitorRuleId"]?.update).toEqual([]);
+  });
+
+  it("is readable, so the dashboard can tell which resources a rule owns", () => {
+    expect(accessControl["statusPageMonitorRuleId"]?.read).toContain(
+      Permission.ReadStatusPageResource,
+    );
+  });
+});
+
+describe("Status page monitor rule permissions", () => {
+  const allProps: Array<PermissionProps> =
+    PermissionHelper.getAllPermissionProps();
+
+  /*
+   * A permission that is only in the enum cannot be granted: the roles UI is
+   * built from the catalogue, so an unlisted permission is one nobody can ever
+   * hold, and the feature is then unusable by anyone but a project admin.
+   */
+  it.each([
+    Permission.CreateStatusPageMonitorRule,
+    Permission.ReadStatusPageMonitorRule,
+    Permission.EditStatusPageMonitorRule,
+    Permission.DeleteStatusPageMonitorRule,
+  ])(
+    "describes %s in the catalogue so it can be granted",
+    (permission: Permission) => {
+      const props: PermissionProps | undefined = allProps.find(
+        (candidate: PermissionProps) => {
+          return candidate.permission === permission;
+        },
+      );
+
+      expect(props).toBeDefined();
+      expect(props!.isAssignableToTenant).toBe(true);
+      expect(props!.group).toBe(PermissionGroup.StatusPage);
+    },
+  );
+});

package/Tests/Server/API/AIAgentDataRepositoryToken.test.ts

@@ -0,0 +1,381 @@
+import AIAgentDataAPI from "../../../Server/API/AIAgentDataAPI";
+import CodeFixAgentAuth, {
+  CodeFixAgentSource,
+} from "../../../Server/Utils/AI/CodeFix/CodeFixAgentAuth";
+import CodeRepositoryService from "../../../Server/Services/CodeRepositoryService";
+import GitHubUtil from "../../../Server/Utils/CodeRepository/GitHub/GitHub";
+import GitHubInstallationBinding from "../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import OpenPullRequestCap from "../../../Server/Utils/AI/CodeFix/OpenPullRequestCap";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import { mockRouter } from "./Helpers";
+import CodeRepository from "../../../Models/DatabaseModels/CodeRepository";
+import CodeRepositoryType from "../../../Types/CodeRepository/CodeRepositoryType";
+import ObjectID from "../../../Types/ObjectID";
+import OneUptimeDate from "../../../Types/Date";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "@jest/globals";
+
+/*
+ * GHSA-xx95-gmcf-7q86 — the endpoint at the sharp end.
+ *
+ * This route hands back a live GitHub installation token with contents:write
+ * and pull_requests:write. It used to authorize by comparing the repository
+ * row's projectId against the calling agent's project — but an attacker
+ * controls BOTH sides of that comparison, because they can create their own
+ * project, issue themselves an agent key in it, and (before this fix) put a
+ * row in it carrying any installation ID they liked. The row being "in your
+ * project" says nothing about whether the INSTALLATION is.
+ *
+ * So the binding is re-derived from the project itself, immediately before
+ * minting.
+ */
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    redirect: jest.fn(),
+  };
+});
+
+const TOKEN_ROUTE: string = "/ai-agent-data/get-repository-token";
+
+function thrownError(): Error | undefined {
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  if (sendErrorResponse.mock.calls.length === 0) {
+    return undefined;
+  }
+
+  return sendErrorResponse.mock.calls[0]![2] as Error;
+}
+
+function jsonResponse(): JSONObject | undefined {
+  const sendJson: jest.Mock =
+    Response.sendJsonObjectResponse as unknown as jest.Mock;
+
+  if (sendJson.mock.calls.length === 0) {
+    return undefined;
+  }
+
+  return sendJson.mock.calls[0]![2] as JSONObject;
+}
+
+describe("POST /ai-agent-data/get-repository-token", () => {
+  let attackerProjectId: ObjectID;
+  let codeRepositoryId: ObjectID;
+  let victimInstallationId: string;
+  let ownInstallationId: string;
+
+  let mintTokenSpy: jest.SpyInstance;
+  let bindingSpy: jest.SpyInstance;
+  let findRepositorySpy: jest.SpyInstance;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new AIAgentDataAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    attackerProjectId = ObjectID.generate();
+    codeRepositoryId = ObjectID.generate();
+    victimInstallationId = "99999999";
+    ownInstallationId = "11111111";
+
+    // The agent key is project-scoped and self-issued in the attacker's project.
+    jest.spyOn(CodeFixAgentAuth, "resolveAgentIdentity").mockResolvedValue({
+      id: ObjectID.generate(),
+      projectId: attackerProjectId,
+      source: CodeFixAgentSource.AIAgent,
+    });
+
+    findRepositorySpy = jest.spyOn(CodeRepositoryService, "findOneById");
+
+    const capSpy: jest.SpyInstance = jest.spyOn(
+      OpenPullRequestCap,
+      "checkForRepository",
+    );
+    capSpy.mockResolvedValue({ allowed: true });
+
+    bindingSpy = jest.spyOn(
+      GitHubInstallationBinding,
+      "isInstallationBoundToProject",
+    );
+
+    mintTokenSpy = jest.spyOn(GitHubUtil, "getInstallationAccessToken");
+    mintTokenSpy.mockResolvedValue({
+      token: "ghs_live_token",
+      expiresAt: OneUptimeDate.getCurrentDate(),
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  /*
+   * The row IS in the attacker's own project — that check has always passed.
+   * The installation ID on it is what decides whose repositories the token
+   * opens.
+   */
+  function mockRepository(installationId: string | null): void {
+    const repository: CodeRepository = new CodeRepository();
+    repository.id = codeRepositoryId;
+    repository.projectId = attackerProjectId;
+    repository.repositoryHostedAt = CodeRepositoryType.GitHub;
+    repository.organizationName = "victim-org";
+    repository.repositoryName = "victim-private-repo";
+
+    if (installationId) {
+      repository.gitHubAppInstallationId = installationId;
+    }
+
+    findRepositorySpy.mockResolvedValue(repository);
+  }
+
+  async function callRoute(): Promise<void> {
+    const req: ExpressRequest = {
+      params: {},
+      query: {},
+      body: {
+        aiAgentId: ObjectID.generate().toString(),
+        aiAgentKey: "attacker-self-issued-key",
+        codeRepositoryId: codeRepositoryId.toString(),
+      },
+      headers: {},
+    } as unknown as ExpressRequest;
+
+    const res: ExpressResponse = {
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    const next: jest.Mock = jest.fn();
+
+    await mockRouter
+      .match("POST", TOKEN_ROUTE)
+      .handlerFunction(req, res, next as unknown as NextFunction);
+  }
+
+  describe("cross-tenant token minting", () => {
+    /*
+     * The advisory's step 3. Everything up to here passes: valid agent key,
+     * repository row in the agent's own project. Only the binding check stands
+     * between the attacker and a `ghs_` token over the victim's repositories.
+     */
+    test("refuses to mint when the row names an installation the project does not own", async () => {
+      mockRepository(victimInstallationId);
+      bindingSpy.mockResolvedValue(false);
+
+      await callRoute();
+
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+    });
+
+    test("returns no token in the response when the binding is missing", async () => {
+      mockRepository(victimInstallationId);
+      bindingSpy.mockResolvedValue(false);
+
+      await callRoute();
+
+      expect(jsonResponse()).toBeUndefined();
+    });
+
+    test("checks the binding against the repository's project and installation", async () => {
+      mockRepository(ownInstallationId);
+      bindingSpy.mockResolvedValue(true);
+
+      await callRoute();
+
+      expect(bindingSpy).toHaveBeenCalledTimes(1);
+
+      const args: { projectId: ObjectID; installationId: string } = bindingSpy
+        .mock.calls[0]![0] as {
+        projectId: ObjectID;
+        installationId: string;
+      };
+
+      expect(args.projectId.toString()).toBe(attackerProjectId.toString());
+      expect(args.installationId).toBe(ownInstallationId);
+    });
+
+    /*
+     * Being in the right project is necessary but not sufficient — pin that
+     * the binding check is what gates the mint, so nobody "simplifies" it away
+     * on the grounds that the project check already ran.
+     */
+    test("the project check alone does not authorize a mint", async () => {
+      mockRepository(victimInstallationId);
+      bindingSpy.mockResolvedValue(false);
+
+      await callRoute();
+
+      // Repository genuinely belongs to the caller's project...
+      const repository: CodeRepository = (await findRepositorySpy.mock
+        .results[0]!.value) as CodeRepository;
+      expect(repository.projectId!.toString()).toBe(
+        attackerProjectId.toString(),
+      );
+
+      // ...and it still does not get a token.
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+    });
+
+    test("checks the binding before calling GitHub at all", async () => {
+      const callOrder: Array<string> = [];
+
+      mockRepository(ownInstallationId);
+      bindingSpy.mockImplementation(async (): Promise<boolean> => {
+        callOrder.push("binding");
+        return true;
+      });
+      mintTokenSpy.mockImplementation(async (): Promise<JSONObject> => {
+        callOrder.push("mint");
+        return {
+          token: "ghs_live_token",
+          expiresAt: OneUptimeDate.getCurrentDate(),
+        } as unknown as JSONObject;
+      });
+
+      await callRoute();
+
+      expect(callOrder).toEqual(["binding", "mint"]);
+    });
+  });
+
+  describe("legitimate use keeps working", () => {
+    test("mints a token when the project genuinely owns the installation", async () => {
+      mockRepository(ownInstallationId);
+      bindingSpy.mockResolvedValue(true);
+
+      await callRoute();
+
+      expect(thrownError()).toBeUndefined();
+      expect(mintTokenSpy).toHaveBeenCalledTimes(1);
+      expect(mintTokenSpy.mock.calls[0]![0]).toBe(ownInstallationId);
+      expect(jsonResponse()!["token"]).toBe("ghs_live_token");
+    });
+
+    test("still requests only the scopes the agent needs", async () => {
+      mockRepository(ownInstallationId);
+      bindingSpy.mockResolvedValue(true);
+
+      await callRoute();
+
+      const options: {
+        permissions: {
+          contents?: string;
+          pull_requests?: string;
+          metadata?: string;
+        };
+      } = mintTokenSpy.mock.calls[0]![1] as {
+        permissions: {
+          contents?: string;
+          pull_requests?: string;
+          metadata?: string;
+        };
+      };
+
+      expect(options.permissions.contents).toBe("write");
+      expect(options.permissions.pull_requests).toBe("write");
+      expect(options.permissions.metadata).toBe("read");
+    });
+  });
+
+  describe("pre-existing guards still hold", () => {
+    test("rejects invalid agent credentials before reading anything", async () => {
+      jest
+        .spyOn(CodeFixAgentAuth, "resolveAgentIdentity")
+        .mockResolvedValue(null);
+
+      await callRoute();
+
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+      expect(findRepositorySpy).not.toHaveBeenCalled();
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+    });
+
+    test("rejects a repository in another project without checking a binding", async () => {
+      const repository: CodeRepository = new CodeRepository();
+      repository.id = codeRepositoryId;
+      repository.projectId = ObjectID.generate(); // someone else's project
+      repository.repositoryHostedAt = CodeRepositoryType.GitHub;
+      repository.gitHubAppInstallationId = victimInstallationId;
+      findRepositorySpy.mockResolvedValue(repository);
+
+      await callRoute();
+
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+      expect(bindingSpy).not.toHaveBeenCalled();
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+    });
+
+    test("rejects a repository with no installation id", async () => {
+      mockRepository(null);
+
+      await callRoute();
+
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+    });
+
+    test("rejects a repository that does not exist", async () => {
+      findRepositorySpy.mockResolvedValue(null);
+
+      await callRoute();
+
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+    });
+
+    test("still enforces the open pull request cap", async () => {
+      mockRepository(ownInstallationId);
+      bindingSpy.mockResolvedValue(true);
+
+      const capSpy: jest.SpyInstance = jest.spyOn(
+        OpenPullRequestCap,
+        "checkForRepository",
+      );
+      capSpy.mockResolvedValue({ allowed: false, openCount: 5, limit: 5 });
+
+      await callRoute();
+
+      expect(thrownError()).toBeInstanceOf(BadDataException);
+      expect(mintTokenSpy).not.toHaveBeenCalled();
+    });
+  });
+});