@oneuptime/common 12.0.2 → 12.0.4

package/Tests/Server/Infrastructure/SemaphoreMutex.test.ts

@@ -0,0 +1,215 @@
+import Redis, { ClientType } from "../../../Server/Infrastructure/Redis";
+import Semaphore, {
+  SemaphoreMutex,
+} from "../../../Server/Infrastructure/Semaphore";
+import { Mutex as RedisMutex } from "redis-semaphore";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Companion to SemaphorePermit.test.ts, covering the OTHER half of Semaphore:
+ * lock()/release(), the exclusive mutex.
+ *
+ * This is the primitive every cross-process critical section in the codebase
+ * runs on -- project counters, timeline writes, the SLO sweep, and the
+ * first-Master-Admin election (GHSA-3qqq-hprx-g2jw). What is pinned here is the
+ * option plumbing between our wrapper and redis-semaphore: a lockTimeout or
+ * acquireTimeout silently dropped on the way through would not fail any test
+ * about election outcomes, it would just quietly turn a bounded wait into an
+ * unbounded one, or a self-refreshing lock into one with the library default.
+ */
+
+interface MockMutex {
+  acquire: jest.Mock;
+  release: jest.Mock;
+}
+
+jest.mock("redis-semaphore", () => {
+  const actual: Record<string, unknown> = jest.requireActual(
+    "redis-semaphore",
+  ) as Record<string, unknown>;
+
+  return {
+    ...actual,
+    Mutex: jest.fn().mockImplementation((): MockMutex => {
+      return {
+        acquire: jest.fn(async (): Promise<void> => {}),
+        release: jest.fn(async (): Promise<void> => {}),
+      };
+    }),
+  };
+});
+
+const redisMutexConstructor: jest.MockedClass<typeof RedisMutex> =
+  RedisMutex as jest.MockedClass<typeof RedisMutex>;
+
+function mockRedisClient(): ClientType {
+  const client: ClientType = {} as ClientType;
+  jest.spyOn(Redis, "getClient").mockReturnValue(client);
+  return client;
+}
+
+function lastMockMutex(): MockMutex {
+  /*
+   * Indexed rather than .at(-1): this project targets es2017, so
+   * Array.prototype.at is outside its lib.
+   */
+  const results: Array<{ value: unknown }> = redisMutexConstructor.mock.results;
+  const result: unknown = results[results.length - 1]?.value;
+  return result as MockMutex;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  redisMutexConstructor.mockClear();
+});
+
+describe("Semaphore exclusive mutex", () => {
+  test("constructs and acquires with every option forwarded", async () => {
+    const client: ClientType = mockRedisClient();
+
+    const mutex: SemaphoreMutex = await Semaphore.lock({
+      key: "instance",
+      namespace: "UserService.firstMasterAdminElection",
+      lockTimeout: 10_000,
+      acquireTimeout: 5_000,
+      acquireAttemptsLimit: 4,
+      retryInterval: 25,
+    });
+
+    expect(redisMutexConstructor).toHaveBeenCalledWith(
+      client,
+      "UserService.firstMasterAdminElection-instance",
+      {
+        lockTimeout: 10_000,
+        acquireTimeout: 5_000,
+        acquireAttemptsLimit: 4,
+        retryInterval: 25,
+      },
+    );
+    expect(lastMockMutex().acquire).toHaveBeenCalledTimes(1);
+    expect(mutex).toBe(lastMockMutex());
+  });
+
+  test("composes the Redis key as namespace-key", async () => {
+    mockRedisClient();
+
+    await Semaphore.lock({
+      key: "project-1",
+      namespace: "ProjectService.incidentCounter",
+    });
+
+    /*
+     * Callers coordinate purely by agreeing on this string. Two replicas that
+     * compose it differently exclude nobody.
+     */
+    expect(redisMutexConstructor).toHaveBeenCalledWith(
+      expect.anything(),
+      "ProjectService.incidentCounter-project-1",
+      expect.anything(),
+    );
+  });
+
+  test("defaults lockTimeout to five seconds when none is supplied", async () => {
+    mockRedisClient();
+
+    await Semaphore.lock({
+      key: "project-1",
+      namespace: "ProjectService.incidentCounter",
+    });
+
+    expect(redisMutexConstructor).toHaveBeenCalledWith(
+      expect.anything(),
+      "ProjectService.incidentCounter-project-1",
+      { lockTimeout: 5_000 },
+    );
+  });
+
+  test("omits options the caller did not set rather than passing undefined", async () => {
+    mockRedisClient();
+
+    await Semaphore.lock({
+      key: "project-1",
+      namespace: "ProjectService.incidentCounter",
+      acquireTimeout: 1_000,
+    });
+
+    const options: Record<string, unknown> = redisMutexConstructor.mock
+      .calls[0]![2] as unknown as Record<string, unknown>;
+
+    /*
+     * redis-semaphore destructures its options with defaults, and an explicit
+     * `undefined` does take the default -- but only because of how it is
+     * written. Not passing the key at all is what actually guarantees the
+     * library's own default applies.
+     */
+    expect(Object.keys(options).sort()).toEqual([
+      "acquireTimeout",
+      "lockTimeout",
+    ]);
+  });
+
+  test("rejects when Redis is not connected", async () => {
+    jest.spyOn(Redis, "getClient").mockReturnValue(null);
+
+    await expect(
+      Semaphore.lock({
+        key: "instance",
+        namespace: "UserService.firstMasterAdminElection",
+      }),
+    ).rejects.toThrow(/Redis client is not connected/i);
+
+    /*
+     * Callers treat a throw as "I do not hold the lock". Constructing a mutex
+     * against a dead client and returning it would be worse than failing.
+     */
+    expect(redisMutexConstructor).not.toHaveBeenCalled();
+  });
+
+  test("propagates acquisition failures without returning an unheld mutex", async () => {
+    mockRedisClient();
+    const acquireError: Error = new Error("acquire timeout");
+    redisMutexConstructor.mockImplementationOnce(() => {
+      return {
+        acquire: jest.fn(async (): Promise<void> => {
+          throw acquireError;
+        }),
+        release: jest.fn(async (): Promise<void> => {}),
+      } as unknown as RedisMutex;
+    });
+
+    /*
+     * The load-bearing failure mode for the Master Admin election: a caller
+     * that got a mutex handle back would run its critical section believing it
+     * was serialized.
+     */
+    await expect(
+      Semaphore.lock({
+        key: "instance",
+        namespace: "UserService.firstMasterAdminElection",
+      }),
+    ).rejects.toBe(acquireError);
+  });
+
+  test("releases the exact acquired mutex", async () => {
+    mockRedisClient();
+
+    const mutex: SemaphoreMutex = await Semaphore.lock({
+      key: "instance",
+      namespace: "UserService.firstMasterAdminElection",
+    });
+
+    await Semaphore.release(mutex);
+
+    expect(lastMockMutex().release).toHaveBeenCalledTimes(1);
+  });
+
+  test("two different keys produce two independent mutexes", async () => {
+    mockRedisClient();
+
+    await Semaphore.lock({ key: "a", namespace: "ns" });
+    await Semaphore.lock({ key: "b", namespace: "ns" });
+
+    expect(redisMutexConstructor.mock.calls[0]![1]).toBe("ns-a");
+    expect(redisMutexConstructor.mock.calls[1]![1]).toBe("ns-b");
+  });
+});

package/Tests/Server/Services/AddPerUserPasswordSaltMigration.test.ts

@@ -0,0 +1,178 @@
+import { AddPerUserPasswordSalt1786018109307 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1786018109307-AddPerUserPasswordSalt";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import { QueryRunner } from "typeorm";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The migration that adds the per-user salt columns.
+ *
+ * Three things have to hold together or per-user salts silently do not exist
+ * in a deployed instance:
+ *
+ *   1. up() adds exactly the two columns, nullable — existing rows must keep
+ *      their (unsalted) passwords working, so a NOT NULL column or a default
+ *      would be wrong;
+ *   2. down() removes exactly what up() added;
+ *   3. the migration is registered in SchemaMigrations/Index.ts. An
+ *      unregistered migration never runs on boot, so the column would be
+ *      missing while the code writes to it — every login and every signup
+ *      would 500.
+ *
+ * Pure SQL-contract assertions against a fake QueryRunner. No Postgres.
+ */
+
+type MakeQueryRunnerResult = {
+  runner: QueryRunner;
+  statements: Array<string>;
+};
+
+type MakeQueryRunnerFunction = () => MakeQueryRunnerResult;
+
+const makeQueryRunner: MakeQueryRunnerFunction = (): MakeQueryRunnerResult => {
+  const statements: Array<string> = [];
+
+  const query: (...args: Array<unknown>) => Promise<undefined> = (
+    ...args: Array<unknown>
+  ): Promise<undefined> => {
+    statements.push(String(args[0]));
+    return Promise.resolve(undefined);
+  };
+
+  return {
+    runner: { query } as unknown as QueryRunner,
+    statements,
+  };
+};
+
+describe("AddPerUserPasswordSalt1786018109307 — SQL contract", () => {
+  test("up() adds exactly the two salt columns and nothing else", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddPerUserPasswordSalt1786018109307().up(runner);
+
+    expect(statements).toEqual([
+      `ALTER TABLE "User" ADD "passwordSalt" character varying(100)`,
+      `ALTER TABLE "StatusPagePrivateUser" ADD "passwordSalt" character varying(100)`,
+    ]);
+  });
+
+  test("the columns are nullable, so every existing password keeps working", async () => {
+    /*
+     * Rows written before salts existed have no salt, and are verified
+     * against the legacy unsalted scheme until the next successful login
+     * re-hashes them. A NOT NULL column would have needed a backfill value,
+     * and any backfilled salt would be wrong for the hash already stored.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddPerUserPasswordSalt1786018109307().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/NOT NULL/i);
+      expect(statement).not.toMatch(/DEFAULT/i);
+    }
+  });
+
+  test("the column is wide enough for the salts the code generates", async () => {
+    /*
+     * HashedString.generateSalt() produces 64 hex characters. A narrower
+     * column would truncate on write and the password would never verify
+     * again.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddPerUserPasswordSalt1786018109307().up(runner);
+
+    for (const statement of statements) {
+      const width: RegExpMatchArray | null = statement.match(
+        /character varying\((\d+)\)/,
+      );
+
+      expect(width).not.toBeNull();
+      expect(Number(width![1])).toBeGreaterThanOrEqual(64);
+    }
+  });
+
+  test("down() drops exactly what up() added", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new AddPerUserPasswordSalt1786018109307().down(runner);
+
+    expect(statements).toEqual([
+      `ALTER TABLE "StatusPagePrivateUser" DROP COLUMN "passwordSalt"`,
+      `ALTER TABLE "User" DROP COLUMN "passwordSalt"`,
+    ]);
+  });
+
+  test("up() and down() touch the same tables", async () => {
+    const up: MakeQueryRunnerResult = makeQueryRunner();
+    const down: MakeQueryRunnerResult = makeQueryRunner();
+
+    await new AddPerUserPasswordSalt1786018109307().up(up.runner);
+    await new AddPerUserPasswordSalt1786018109307().down(down.runner);
+
+    type TablesFunction = (statements: Array<string>) => Array<string>;
+
+    const tables: TablesFunction = (
+      statements: Array<string>,
+    ): Array<string> => {
+      return statements
+        .map((statement: string) => {
+          return statement.match(/ALTER TABLE "([^"]+)"/)?.[1] as string;
+        })
+        .sort();
+    };
+
+    expect(tables(up.statements)).toEqual(tables(down.statements));
+  });
+});
+
+describe("AddPerUserPasswordSalt1786018109307 — registration", () => {
+  test("is registered in SchemaMigrations/Index.ts", () => {
+    /*
+     * The step that is easiest to forget and that fails the loudest in
+     * production: an unregistered migration is dead code, so the column never
+     * appears and the write path fails on the column that is not there.
+     */
+    expect(SchemaMigrations).toContain(AddPerUserPasswordSalt1786018109307);
+  });
+
+  test("its class name carries the timestamp its filename does", () => {
+    // TypeORM orders migrations by the timestamp suffix on the class name.
+    expect(AddPerUserPasswordSalt1786018109307.name).toBe(
+      "AddPerUserPasswordSalt1786018109307",
+    );
+  });
+
+  test("runs after every migration registered before it", () => {
+    const names: Array<string> = SchemaMigrations.map(
+      (migration: { name: string }) => {
+        return migration.name;
+      },
+    );
+
+    const index: number = names.indexOf("AddPerUserPasswordSalt1786018109307");
+
+    expect(index).toBeGreaterThan(-1);
+
+    type TimestampFunction = (name: string) => number;
+
+    const timestampOf: TimestampFunction = (name: string): number => {
+      return Number(name.match(/(\d+)$/)?.[1] || 0);
+    };
+
+    for (const earlier of names.slice(0, index)) {
+      expect(timestampOf(earlier)).toBeLessThan(1786018109307);
+    }
+  });
+
+  test("appears exactly once", () => {
+    const occurrences: number = SchemaMigrations.filter(
+      (migration: { name: string }) => {
+        return migration.name === "AddPerUserPasswordSalt1786018109307";
+      },
+    ).length;
+
+    expect(occurrences).toBe(1);
+  });
+});