@oneuptime/common 12.0.2 → 12.0.4

package/Tests/Server/Services/WidenHashedStringColumnsForScryptMigration.test.ts

@@ -0,0 +1,220 @@
+import { WidenHashedStringColumnsForScrypt1786023262402 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1786023262402-WidenHashedStringColumnsForScrypt";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import { QueryRunner } from "typeorm";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The migration that widens every HashedString column so a scrypt hash, which
+ * carries its own cost parameters, fits.
+ *
+ * THE REASON THIS FILE EXISTS.
+ *
+ * `typeorm migration:generate` does not express a varchar length change as
+ * ALTER COLUMN TYPE. It emits DROP COLUMN followed by ADD COLUMN — which for
+ * these six columns means deleting every password, every status page and
+ * dashboard master password, and every active session in the instance. The
+ * generated file was replaced by hand for exactly that reason.
+ *
+ * Anyone who regenerates this migration (or writes the next widening the same
+ * way) gets the destructive version back, and it looks perfectly ordinary in
+ * review. The first test below is the guard: no statement in this migration
+ * may drop a column.
+ */
+
+type MakeQueryRunnerResult = {
+  runner: QueryRunner;
+  statements: Array<string>;
+};
+
+type MakeQueryRunnerFunction = () => MakeQueryRunnerResult;
+
+const makeQueryRunner: MakeQueryRunnerFunction = (): MakeQueryRunnerResult => {
+  const statements: Array<string> = [];
+
+  const query: (...args: Array<unknown>) => Promise<undefined> = (
+    ...args: Array<unknown>
+  ): Promise<undefined> => {
+    statements.push(String(args[0]));
+    return Promise.resolve(undefined);
+  };
+
+  return {
+    runner: { query } as unknown as QueryRunner,
+    statements,
+  };
+};
+
+const WIDENED: ReadonlyArray<[string, string]> = [
+  ["User", "password"],
+  ["StatusPagePrivateUser", "password"],
+  ["StatusPage", "masterPassword"],
+  ["Dashboard", "masterPassword"],
+  ["UserSession", "refreshToken"],
+  ["StatusPagePrivateUserSession", "refreshToken"],
+];
+
+describe("WidenHashedStringColumnsForScrypt — must not destroy data", () => {
+  test("up() never drops a column", async () => {
+    /*
+     * The whole point. A DROP COLUMN here silently deletes every credential
+     * in the database, and the migration would still 'succeed'.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/DROP COLUMN/i);
+    }
+  });
+
+  test("down() never drops a column either", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().down(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/DROP COLUMN/i);
+    }
+  });
+
+  test("up() is nothing but ALTER COLUMN TYPE statements", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).toMatch(
+        /^ALTER TABLE "[A-Za-z]+" ALTER COLUMN "[A-Za-z]+" TYPE character varying\(\d+\)$/,
+      );
+    }
+  });
+
+  test("it does not touch constraints or indexes", async () => {
+    /*
+     * The generated version dropped and recreated the refresh-token unique
+     * constraints and indexes purely to work around its own DROP COLUMN.
+     * Widening a varchar needs no table rewrite, so the indexes survive
+     * untouched and none of that churn is necessary.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/CONSTRAINT/i);
+      expect(statement).not.toMatch(/INDEX/i);
+    }
+  });
+});
+
+describe("WidenHashedStringColumnsForScrypt — SQL contract", () => {
+  test("up() widens exactly the six HashedString columns", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    expect(statements).toHaveLength(WIDENED.length);
+
+    for (const [table, column] of WIDENED) {
+      expect(statements).toContain(
+        `ALTER TABLE "${table}" ALTER COLUMN "${column}" TYPE character varying(255)`,
+      );
+    }
+  });
+
+  test("it widens to whatever ColumnLength.HashedString says", async () => {
+    /*
+     * The entity metadata and the migration have to agree, or the drift check
+     * fails and the next generated migration tries to 'fix' it.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).toContain(
+        `character varying(${ColumnLength.HashedString})`,
+      );
+    }
+  });
+
+  test("down() returns the same six columns to 64", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().down(runner);
+
+    expect(statements).toHaveLength(WIDENED.length);
+
+    for (const [table, column] of WIDENED) {
+      expect(statements).toContain(
+        `ALTER TABLE "${table}" ALTER COLUMN "${column}" TYPE character varying(64)`,
+      );
+    }
+  });
+
+  test("down() reverses up()'s order", async () => {
+    const up: MakeQueryRunnerResult = makeQueryRunner();
+    const down: MakeQueryRunnerResult = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(up.runner);
+    await new WidenHashedStringColumnsForScrypt1786023262402().down(
+      down.runner,
+    );
+
+    type ColumnsFunction = (statements: Array<string>) => Array<string>;
+
+    const columns: ColumnsFunction = (
+      statements: Array<string>,
+    ): Array<string> => {
+      return statements.map((statement: string) => {
+        return statement
+          .match(/ALTER TABLE "([^"]+)" ALTER COLUMN "([^"]+)"/)!
+          .slice(1, 3)
+          .join(".");
+      });
+    };
+
+    expect(columns(down.statements)).toEqual(columns(up.statements).reverse());
+  });
+
+  test("the widened column holds a scrypt hash with room to spare", () => {
+    // `scrypt$N=16384,r=8,p=1$` + 64 hex characters.
+    const worstCaseToday: number = "scrypt$N=1048576,r=32,p=16$".length + 64;
+
+    expect(ColumnLength.HashedString).toBeGreaterThan(worstCaseToday);
+  });
+});
+
+describe("WidenHashedStringColumnsForScrypt — registration", () => {
+  test("is registered in SchemaMigrations/Index.ts", () => {
+    expect(SchemaMigrations).toContain(
+      WidenHashedStringColumnsForScrypt1786023262402,
+    );
+  });
+
+  test("appears exactly once", () => {
+    const occurrences: number = SchemaMigrations.filter(
+      (migration: { name: string }) => {
+        return (
+          migration.name === "WidenHashedStringColumnsForScrypt1786023262402"
+        );
+      },
+    ).length;
+
+    expect(occurrences).toBe(1);
+  });
+
+  test("runs after the migration that added the salt columns", () => {
+    const names: Array<string> = SchemaMigrations.map(
+      (migration: { name: string }) => {
+        return migration.name;
+      },
+    );
+
+    expect(
+      names.indexOf("WidenHashedStringColumnsForScrypt1786023262402"),
+    ).toBeGreaterThan(names.indexOf("AddPerUserPasswordSalt1786018109307"));
+  });
+});

package/Tests/Server/Utils/AI/CodeTools.test.ts

@@ -15,7 +15,8 @@ import CodeRepositoryModel from "../../../../Models/DatabaseModels/CodeRepositor
 import TelemetryException from "../../../../Models/DatabaseModels/TelemetryException";
 import CodeRepositoryType from "../../../../Types/CodeRepository/CodeRepositoryType";
 import ObjectID from "../../../../Types/ObjectID";
-import { describe, expect, test, afterEach } from "@jest/globals";
+import GitHubInstallationBinding from "../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import { describe, expect, test, afterEach, beforeEach } from "@jest/globals";
 
 /*
  * The code tools are the bridge from a telemetry signal to the source that
@@ -86,6 +87,19 @@ function mockFileContent(content: string): void {
   });
 }
 
+/*
+ * findReadableRepositories now also proves each row's GitHub App installation
+ * belongs to the row's project (GHSA-xx95-gmcf-7q86), which is a database
+ * read. That guard has its own tests; here it would just be a Postgres
+ * connection these tool tests do not need, so treat every fixture row as
+ * bound.
+ */
+beforeEach(() => {
+  jest
+    .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+    .mockResolvedValue("12345");
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });
@@ -119,6 +133,38 @@ describe("list_code_repositories", () => {
     expect(result.rowCount).toBe(1);
   });
 
+  /*
+   * GHSA-xx95-gmcf-7q86. A row can be in this project and still name a GitHub
+   * App installation the project does not own — that combination used to be
+   * creatable, and these tools would then read, commit and open pull requests
+   * in another tenant's private repositories. Being in the project is not the
+   * same as owning the installation, so an unbound row must be invisible here
+   * exactly like an uninstalled one.
+   */
+  test("hides a repository whose installation is not bound to the project", async () => {
+    jest
+      .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+      .mockResolvedValue("12345");
+
+    mockRepositories([
+      buildRepository({ name: "our-repo", installationId: "12345" }),
+      buildRepository({
+        id: ObjectID.generate(),
+        name: "someone-elses-repo",
+        installationId: "99999999",
+      }),
+    ]);
+
+    const result: ToolExecutionResult = await ListCodeRepositoriesTool.execute(
+      {},
+      ctx,
+    );
+
+    expect(result.dataForLlm).toContain("our-repo");
+    expect(result.dataForLlm).not.toContain("someone-elses-repo");
+    expect(result.rowCount).toBe(1);
+  });
+
   test("says plainly when no repository is connected", async () => {
     mockRepositories([]);
 

package/Tests/Server/Utils/AI/CodeWriteTools.test.ts

@@ -23,6 +23,7 @@ import AIAgentTaskPullRequest from "../../../../Models/DatabaseModels/AIAgentTas
 import CodeRepositoryType from "../../../../Types/CodeRepository/CodeRepositoryType";
 import PullRequestState from "../../../../Types/CodeRepository/PullRequestState";
 import ObjectID from "../../../../Types/ObjectID";
+import GitHubInstallationBinding from "../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
 import { describe, expect, test, afterEach, beforeEach } from "@jest/globals";
 
 /*
@@ -68,6 +69,15 @@ beforeEach(() => {
     .spyOn(CodeRepositoryService, "findBy")
     .mockResolvedValue([buildRepository()] as never);
   jest.spyOn(GitHubUtil, "getDefaultBranchName").mockResolvedValue("main");
+
+  /*
+   * resolveTargetRepository now proves each row's GitHub App installation
+   * belongs to the row's project (GHSA-xx95-gmcf-7q86), which is a database
+   * read. That guard has its own tests; treat the fixture row as bound.
+   */
+  jest
+    .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+    .mockResolvedValue("12345");
 });
 
 afterEach(() => {

package/Tests/Server/Utils/APIKey/AccessPermission.test.ts

@@ -0,0 +1,267 @@
+import {
+  afterAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+import APIKeyAccessPermission from "../../../../Server/Utils/APIKey/AccessPermission";
+import ApiKeyPermissionService from "../../../../Server/Services/ApiKeyPermissionService";
+import APIKeyPermission from "../../../../Models/DatabaseModels/ApiKeyPermission";
+import Label from "../../../../Models/DatabaseModels/Label";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserGlobalAccessPermission,
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { getJestSpyOn } from "../../../Spy";
+
+/*
+ * This class turns an API key into the permission set a request runs under, so
+ * every method here is a privilege-granting decision. The security invariant
+ * that must hold across all of them: a *default* (ordinary) API key is never
+ * silently handed ProjectOwner, while a *master* key deliberately is. A
+ * regression that leaks ProjectOwner into the default path would give every API
+ * key full control of the project; one that dropped it from the master path
+ * would break trusted internal automation. Both directions are pinned below.
+ *
+ * getApiTenantAccessPermission also reshapes stored permission rows into the
+ * runtime UserPermission shape (labels -> labelIds, block flag preserved). That
+ * mapping is where a dropped label would quietly widen a scoped permission, so
+ * it is tested against a spied service rather than a live database.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const apiKeyId: ObjectID = ObjectID.generate();
+
+const permissionValues: (
+  permissions: Array<UserPermission>,
+) => Array<Permission> = (
+  permissions: Array<UserPermission>,
+): Array<Permission> => {
+  return permissions.map((p: UserPermission) => {
+    return p.permission;
+  });
+};
+
+describe("APIKeyAccessPermission.getDefaultApiGlobalPermission", () => {
+  it("grants Public, User and CurrentUser for the project", async () => {
+    const perm: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    expect(perm._type).toBe("UserGlobalAccessPermission");
+    expect(
+      perm.projectIds.map((p: ObjectID) => {
+        return p.toString();
+      }),
+    ).toEqual([projectId.toString()]);
+    expect(perm.globalPermissions).toEqual([
+      Permission.Public,
+      Permission.User,
+      Permission.CurrentUser,
+    ]);
+  });
+
+  it("does NOT grant ProjectOwner to an ordinary key", async () => {
+    // The core boundary: a default key must never be an owner.
+    const perm: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+    expect(perm.globalPermissions).not.toContain(Permission.ProjectOwner);
+  });
+});
+
+describe("APIKeyAccessPermission.getMasterKeyApiGlobalPermission", () => {
+  it("grants everything the default key has, plus ProjectOwner", async () => {
+    const master: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getMasterKeyApiGlobalPermission(projectId);
+    const def: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getDefaultApiGlobalPermission(projectId);
+
+    // Superset: no default grant is lost when elevating to master.
+    for (const p of def.globalPermissions) {
+      expect(master.globalPermissions).toContain(p);
+    }
+    // The one deliberate elevation.
+    expect(master.globalPermissions).toContain(Permission.ProjectOwner);
+  });
+
+  it("scopes to exactly the one project", async () => {
+    const master: UserGlobalAccessPermission =
+      await APIKeyAccessPermission.getMasterKeyApiGlobalPermission(projectId);
+    expect(
+      master.projectIds.map((p: ObjectID) => {
+        return p.toString();
+      }),
+    ).toEqual([projectId.toString()]);
+  });
+});
+
+describe("APIKeyAccessPermission.getMasterApiTenantAccessPermission", () => {
+  it("elevates the default tenant permission with ProjectOwner", async () => {
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getMasterApiTenantAccessPermission(
+        projectId,
+      );
+
+    expect(perm._type).toBe("UserTenantAccessPermission");
+    expect(perm.projectId.toString()).toBe(projectId.toString());
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.ProjectOwner,
+    );
+    // The default tenant baseline is retained alongside the elevation.
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.CurrentUser,
+    );
+  });
+});
+
+describe("APIKeyAccessPermission.getApiTenantAccessPermission", () => {
+  const spyFindBy: jest.SpyInstance = getJestSpyOn(
+    ApiKeyPermissionService,
+    "findBy",
+  );
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  afterAll(() => {
+    jest.restoreAllMocks();
+  });
+
+  const makeRow: (data: {
+    permission: Permission;
+    labelIds?: Array<ObjectID>;
+    isBlockPermission?: boolean;
+  }) => APIKeyPermission = (data: {
+    permission: Permission;
+    labelIds?: Array<ObjectID>;
+    isBlockPermission?: boolean;
+  }): APIKeyPermission => {
+    const row: APIKeyPermission = new APIKeyPermission();
+    row.permission = data.permission;
+    if (data.labelIds) {
+      row.labels = data.labelIds.map((id: ObjectID) => {
+        const label: Label = new Label();
+        label.id = id;
+        return label;
+      });
+    }
+    row.isBlockPermission = data.isBlockPermission ?? false;
+    return row;
+  };
+
+  it("queries the permissions for exactly this api key", async () => {
+    spyFindBy.mockResolvedValue([] as never);
+
+    await APIKeyAccessPermission.getApiTenantAccessPermission(
+      projectId,
+      apiKeyId,
+    );
+
+    expect(spyFindBy).toHaveBeenCalledTimes(1);
+    const arg: { query: { apiKeyId: ObjectID } } = spyFindBy.mock
+      .calls[0]![0] as { query: { apiKeyId: ObjectID } };
+    expect(arg.query.apiKeyId.toString()).toBe(apiKeyId.toString());
+  });
+
+  it("returns just the default baseline when the key has no permissions", async () => {
+    spyFindBy.mockResolvedValue([] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    // No stored rows -> no ProjectOwner. An empty key is not an owner.
+    expect(permissionValues(perm.permissions)).not.toContain(
+      Permission.ProjectOwner,
+    );
+    expect(permissionValues(perm.permissions)).toContain(
+      Permission.CurrentUser,
+    );
+  });
+
+  it("maps each stored permission row onto the tenant permission", async () => {
+    const labelId: ObjectID = ObjectID.generate();
+    spyFindBy.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [labelId],
+        isBlockPermission: false,
+      }),
+    ] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    expect(mapped).toBeDefined();
+    /*
+     * The label scope must survive the mapping, or the permission silently
+     * widens from "these labels" to "all".
+     */
+    expect(
+      mapped!.labelIds.map((l: ObjectID) => {
+        return l.toString();
+      }),
+    ).toEqual([labelId.toString()]);
+  });
+
+  it("preserves the block flag so a deny row stays a deny row", async () => {
+    spyFindBy.mockResolvedValue([
+      makeRow({
+        permission: Permission.CreateProjectIncident,
+        labelIds: [],
+        isBlockPermission: true,
+      }),
+    ] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    // Flipping a block permission to an allow would invert an admin's intent.
+    expect(mapped!.isBlockPermission).toBe(true);
+  });
+
+  it("treats a row with no labels as an empty (unscoped) label set", async () => {
+    const row: APIKeyPermission = new APIKeyPermission();
+    row.permission = Permission.CreateProjectIncident;
+    // labels intentionally left undefined.
+    row.isBlockPermission = false;
+    spyFindBy.mockResolvedValue([row] as never);
+
+    const perm: UserTenantAccessPermission =
+      await APIKeyAccessPermission.getApiTenantAccessPermission(
+        projectId,
+        apiKeyId,
+      );
+
+    const mapped: UserPermission | undefined = perm.permissions.find(
+      (p: UserPermission) => {
+        return p.permission === Permission.CreateProjectIncident;
+      },
+    );
+    expect(mapped).toBeDefined();
+    // No crash on undefined labels, and it becomes [] rather than undefined.
+    expect(mapped!.labelIds).toEqual([]);
+  });
+});