@oneuptime/common 12.0.28 → 12.0.30

package/Tests/Server/Types/Database/Permissions/OnCallCalendarFeedPermissions.test.ts

@@ -0,0 +1,254 @@
+import ModelPermission from "../../../../../Server/Types/Database/Permissions/Index";
+import CalendarFeedToken from "../../../../../Server/Utils/OnCall/CalendarFeedToken";
+import OnCallDutyPolicyScheduleCalendarFeed from "../../../../../Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed";
+import ProjectOnCallCalendarFeed from "../../../../../Models/DatabaseModels/ProjectOnCallCalendarFeed";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * The permission gate on the SHARED calendar feeds, exercised for real.
+ *
+ * The shared schedule and project links are the one part of this feature that
+ * hands a project's whole on-call roster to anyone holding a URL, and the only
+ * thing standing between a project READER and rotating (or publishing) that
+ * link is ModelPermission. The API tests prove the routes make a non-root
+ * write with exactly `{ isEnabled }` as the probe, and the model tests prove
+ * the declared lists match OnCallDutyPolicySchedule's; what neither of them
+ * does is RUN the gate. These do: the declaration and the enforcement are
+ * checked against each other, so a change to either -- a widened column list,
+ * a tenant-wiring surprise, a probe that stops carrying a column -- is a red
+ * test rather than a reader who can rotate the team's link.
+ *
+ * The four "refused by the service" API tests next to these are mocked
+ * rejections: they prove the route propagates a 403, not that a 403 happens.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const feedId: ObjectID = ObjectID.generate();
+const scheduleId: ObjectID = ObjectID.generate();
+const userId: ObjectID = ObjectID.generate();
+
+function propsFor(
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission) => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId,
+    tenantId: projectId,
+    userTenantAccessPermission: {
+      [projectId.toString()]: tenantPermission,
+    },
+  };
+}
+
+/* Exactly the probe write POST /schedule-feed/:id/rotate makes. */
+async function probeScheduleFeedUpdate(
+  props: DatabaseCommonInteractionProps,
+): Promise<unknown> {
+  return await ModelPermission.checkUpdateQueryPermissions(
+    OnCallDutyPolicyScheduleCalendarFeed,
+    { _id: feedId.toString(), projectId: projectId },
+    { isEnabled: true },
+    props,
+  );
+}
+
+async function probeProjectFeedUpdate(
+  props: DatabaseCommonInteractionProps,
+): Promise<unknown> {
+  return await ModelPermission.checkUpdateQueryPermissions(
+    ProjectOnCallCalendarFeed,
+    { _id: feedId.toString(), projectId: projectId },
+    { isEnabled: true },
+    props,
+  );
+}
+
+/*
+ * What the service's onBeforeCreate leaves on createBy.data by the time
+ * DatabaseService runs the create check: the token columns are stamped by the
+ * SERVER and checked with the CALLER's permissions.
+ */
+function stampedScheduleFeed(): OnCallDutyPolicyScheduleCalendarFeed {
+  const model: OnCallDutyPolicyScheduleCalendarFeed =
+    new OnCallDutyPolicyScheduleCalendarFeed();
+
+  model.projectId = projectId;
+  model.onCallDutyPolicyScheduleId = scheduleId;
+  CalendarFeedToken.applyTokenColumnsOnCreate(model, {
+    trustSuppliedToken: false,
+  });
+
+  return model;
+}
+
+function stampedProjectFeed(): ProjectOnCallCalendarFeed {
+  const model: ProjectOnCallCalendarFeed = new ProjectOnCallCalendarFeed();
+
+  model.projectId = projectId;
+  CalendarFeedToken.applyTokenColumnsOnCreate(model, {
+    trustSuppliedToken: false,
+  });
+
+  return model;
+}
+
+describe("shared calendar feeds: the real permission gate", () => {
+  describe("publishing and rotating needs edit rights on the schedule", () => {
+    for (const permission of [
+      Permission.Viewer,
+      Permission.OnCallViewer,
+      Permission.ReadProjectOnCallDutyPolicySchedule,
+    ]) {
+      it(`a ${permission} may not update the schedule feed`, async () => {
+        await expect(
+          probeScheduleFeedUpdate(propsFor([permission])),
+        ).rejects.toThrow(NotAuthorizedException);
+      });
+
+      it(`a ${permission} may not update the project feed`, async () => {
+        await expect(
+          probeProjectFeedUpdate(propsFor([permission])),
+        ).rejects.toThrow(NotAuthorizedException);
+      });
+
+      it(`a ${permission} may not create a schedule feed`, () => {
+        expect(() => {
+          ModelPermission.checkCreatePermissions(
+            OnCallDutyPolicyScheduleCalendarFeed,
+            stampedScheduleFeed(),
+            propsFor([permission]),
+          );
+        }).toThrow(NotAuthorizedException);
+      });
+
+      it(`a ${permission} may not create a project feed`, () => {
+        expect(() => {
+          ModelPermission.checkCreatePermissions(
+            ProjectOnCallCalendarFeed,
+            stampedProjectFeed(),
+            propsFor([permission]),
+          );
+        }).toThrow(NotAuthorizedException);
+      });
+    }
+
+    it("a caller with no permissions at all is refused (harness guard)", async () => {
+      await expect(probeScheduleFeedUpdate(propsFor([]))).rejects.toThrow(
+        NotAuthorizedException,
+      );
+      await expect(probeProjectFeedUpdate(propsFor([]))).rejects.toThrow(
+        NotAuthorizedException,
+      );
+    });
+  });
+
+  describe("an editor may publish and rotate", () => {
+    for (const permission of [
+      Permission.OnCallMember,
+      Permission.ProjectMember,
+      Permission.ProjectAdmin,
+    ]) {
+      it(`a ${permission} may update the schedule feed`, async () => {
+        await expect(
+          probeScheduleFeedUpdate(propsFor([permission])),
+        ).resolves.toBeDefined();
+      });
+
+      it(`a ${permission} may update the project feed`, async () => {
+        await expect(
+          probeProjectFeedUpdate(propsFor([permission])),
+        ).resolves.toBeDefined();
+      });
+    }
+
+    /*
+     * The create check runs on the STAMPED data, with the caller's
+     * permissions. The token columns are `computed`, which is what keeps a
+     * server-stamped secret from being refused for a caller who may not write
+     * it -- the same shape that once made the Slack/Teams feature dead on
+     * arrival (see WorkspaceMethodStampedColumnCreate.test.ts).
+     */
+    for (const permission of [
+      Permission.OnCallMember,
+      Permission.ProjectAdmin,
+      Permission.CreateProjectOnCallDutyPolicySchedule,
+    ]) {
+      it(`a ${permission} may create the schedule feed the service stamped`, () => {
+        expect(() => {
+          ModelPermission.checkCreatePermissions(
+            OnCallDutyPolicyScheduleCalendarFeed,
+            stampedScheduleFeed(),
+            propsFor([permission]),
+          );
+        }).not.toThrow();
+      });
+
+      it(`a ${permission} may create the project feed the service stamped`, () => {
+        expect(() => {
+          ModelPermission.checkCreatePermissions(
+            ProjectOnCallCalendarFeed,
+            stampedProjectFeed(),
+            propsFor([permission]),
+          );
+        }).not.toThrow();
+      });
+    }
+  });
+
+  /*
+   * "Any schedule reader may copy the link" is half the design, so it is
+   * pinned too: a reader must still be able to READ the row.
+   */
+  describe("any reader may copy the link", () => {
+    for (const permission of [Permission.Viewer, Permission.OnCallViewer]) {
+      it(`a ${permission} may read the schedule feed's non-secret columns`, async () => {
+        await expect(
+          ModelPermission.checkReadQueryPermission(
+            OnCallDutyPolicyScheduleCalendarFeed,
+            { projectId: projectId },
+            { _id: true, isEnabled: true, tokenHint: true },
+            propsFor([permission]),
+          ),
+        ).resolves.toBeDefined();
+      });
+    }
+
+    it("nobody, however privileged, may select the token columns", async () => {
+      await expect(
+        ModelPermission.checkReadQueryPermission(
+          OnCallDutyPolicyScheduleCalendarFeed,
+          { projectId: projectId },
+          { _id: true, token: true },
+          propsFor([Permission.ProjectOwner, Permission.ProjectAdmin]),
+        ),
+      ).rejects.toThrow();
+
+      await expect(
+        ModelPermission.checkReadQueryPermission(
+          ProjectOnCallCalendarFeed,
+          { projectId: projectId },
+          { _id: true, tokenHash: true },
+          propsFor([Permission.ProjectOwner, Permission.ProjectAdmin]),
+        ),
+      ).rejects.toThrow();
+    });
+  });
+});

package/Tests/Server/Types/Database/QueryHelperFindWithSameTextAndIsNull.test.ts

@@ -0,0 +1,83 @@
+import QueryHelper from "../../../../Server/Types/Database/QueryHelper";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Fills the last two gaps in QueryHelper coverage that the sibling
+ * QueryHelper*.test.ts files leave untouched: the case-insensitive single-value
+ * `findWithSameText` and the parameterless `isNull` predicate.
+ *
+ * As with every QueryHelper operator, the SQL is produced by a function on the
+ * FindOperator's `.value`, given a column alias, and the comparand must live in
+ * the bound-parameter bag rather than the SQL text — these operators filter on
+ * user-typed / ingest-stamped identifiers, so an interpolated value would be an
+ * injection vector.
+ */
+
+interface RawOperator {
+  type: string;
+  objectLiteralParameters: Record<string, unknown>;
+  getSql: (aliasPath: string) => string;
+}
+
+function asRaw(operator: unknown): RawOperator {
+  return operator as unknown as RawOperator;
+}
+
+const ALIAS: string = '"Monitor"."name"';
+
+function paramValues(operator: RawOperator): Array<unknown> {
+  return Object.values(operator.objectLiteralParameters ?? {});
+}
+
+describe("QueryHelper.findWithSameText", () => {
+  it("wraps the column in LOWER() and lower-cases a string comparand", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText("Production"));
+    const sql: string = op.getSql(ALIAS);
+
+    // A string comparison must be case-insensitive on BOTH sides.
+    expect(sql.toUpperCase()).toContain("LOWER(");
+    expect(sql).toContain(`LOWER(${ALIAS}) =`);
+
+    // Value is bound, lower-cased, never interpolated.
+    expect(sql).not.toContain("Production");
+    expect(sql).not.toContain("production");
+    expect(paramValues(op)).toEqual(["production"]);
+  });
+
+  it("trims surrounding whitespace off a string comparand", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText("  Prod  "));
+    expect(paramValues(op)).toEqual(["prod"]);
+  });
+
+  it("compares a number without LOWER() and binds it as a string", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText(42));
+    const sql: string = op.getSql(ALIAS);
+
+    // Numbers can't be lower-cased; the column must be compared directly.
+    expect(sql.toUpperCase()).not.toContain("LOWER(");
+    expect(sql).toContain(`(${ALIAS} =`);
+
+    // The value is still routed through the parameter bag, stringified.
+    expect(sql).not.toContain("42");
+    expect(paramValues(op)).toEqual(["42"]);
+  });
+
+  it("binds exactly one parameter", () => {
+    const op: RawOperator = asRaw(QueryHelper.findWithSameText("anything"));
+    expect(Object.keys(op.objectLiteralParameters)).toHaveLength(1);
+  });
+});
+
+describe("QueryHelper.isNull", () => {
+  it("emits IS NULL and binds nothing", () => {
+    const op: RawOperator = asRaw(QueryHelper.isNull());
+    const sql: string = op.getSql(ALIAS);
+
+    expect(sql.toUpperCase()).toContain("IS NULL");
+    expect(sql.toUpperCase()).not.toContain("IS NOT NULL");
+    expect(sql).toContain(ALIAS);
+
+    // A pure IS NULL predicate has no comparand to bind.
+    expect(Object.keys(op.objectLiteralParameters ?? {})).toHaveLength(0);
+  });
+});