@oneuptime/common 12.0.3 → 12.0.4

package/Tests/Server/Services/WidenHashedStringColumnsForScryptMigration.test.ts

@@ -0,0 +1,220 @@
+import { WidenHashedStringColumnsForScrypt1786023262402 } from "../../../Server/Infrastructure/Postgres/SchemaMigrations/1786023262402-WidenHashedStringColumnsForScrypt";
+import SchemaMigrations from "../../../Server/Infrastructure/Postgres/SchemaMigrations/Index";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import { QueryRunner } from "typeorm";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The migration that widens every HashedString column so a scrypt hash, which
+ * carries its own cost parameters, fits.
+ *
+ * THE REASON THIS FILE EXISTS.
+ *
+ * `typeorm migration:generate` does not express a varchar length change as
+ * ALTER COLUMN TYPE. It emits DROP COLUMN followed by ADD COLUMN — which for
+ * these six columns means deleting every password, every status page and
+ * dashboard master password, and every active session in the instance. The
+ * generated file was replaced by hand for exactly that reason.
+ *
+ * Anyone who regenerates this migration (or writes the next widening the same
+ * way) gets the destructive version back, and it looks perfectly ordinary in
+ * review. The first test below is the guard: no statement in this migration
+ * may drop a column.
+ */
+
+type MakeQueryRunnerResult = {
+  runner: QueryRunner;
+  statements: Array<string>;
+};
+
+type MakeQueryRunnerFunction = () => MakeQueryRunnerResult;
+
+const makeQueryRunner: MakeQueryRunnerFunction = (): MakeQueryRunnerResult => {
+  const statements: Array<string> = [];
+
+  const query: (...args: Array<unknown>) => Promise<undefined> = (
+    ...args: Array<unknown>
+  ): Promise<undefined> => {
+    statements.push(String(args[0]));
+    return Promise.resolve(undefined);
+  };
+
+  return {
+    runner: { query } as unknown as QueryRunner,
+    statements,
+  };
+};
+
+const WIDENED: ReadonlyArray<[string, string]> = [
+  ["User", "password"],
+  ["StatusPagePrivateUser", "password"],
+  ["StatusPage", "masterPassword"],
+  ["Dashboard", "masterPassword"],
+  ["UserSession", "refreshToken"],
+  ["StatusPagePrivateUserSession", "refreshToken"],
+];
+
+describe("WidenHashedStringColumnsForScrypt — must not destroy data", () => {
+  test("up() never drops a column", async () => {
+    /*
+     * The whole point. A DROP COLUMN here silently deletes every credential
+     * in the database, and the migration would still 'succeed'.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/DROP COLUMN/i);
+    }
+  });
+
+  test("down() never drops a column either", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().down(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/DROP COLUMN/i);
+    }
+  });
+
+  test("up() is nothing but ALTER COLUMN TYPE statements", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).toMatch(
+        /^ALTER TABLE "[A-Za-z]+" ALTER COLUMN "[A-Za-z]+" TYPE character varying\(\d+\)$/,
+      );
+    }
+  });
+
+  test("it does not touch constraints or indexes", async () => {
+    /*
+     * The generated version dropped and recreated the refresh-token unique
+     * constraints and indexes purely to work around its own DROP COLUMN.
+     * Widening a varchar needs no table rewrite, so the indexes survive
+     * untouched and none of that churn is necessary.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).not.toMatch(/CONSTRAINT/i);
+      expect(statement).not.toMatch(/INDEX/i);
+    }
+  });
+});
+
+describe("WidenHashedStringColumnsForScrypt — SQL contract", () => {
+  test("up() widens exactly the six HashedString columns", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    expect(statements).toHaveLength(WIDENED.length);
+
+    for (const [table, column] of WIDENED) {
+      expect(statements).toContain(
+        `ALTER TABLE "${table}" ALTER COLUMN "${column}" TYPE character varying(255)`,
+      );
+    }
+  });
+
+  test("it widens to whatever ColumnLength.HashedString says", async () => {
+    /*
+     * The entity metadata and the migration have to agree, or the drift check
+     * fails and the next generated migration tries to 'fix' it.
+     */
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(runner);
+
+    for (const statement of statements) {
+      expect(statement).toContain(
+        `character varying(${ColumnLength.HashedString})`,
+      );
+    }
+  });
+
+  test("down() returns the same six columns to 64", async () => {
+    const { runner, statements } = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().down(runner);
+
+    expect(statements).toHaveLength(WIDENED.length);
+
+    for (const [table, column] of WIDENED) {
+      expect(statements).toContain(
+        `ALTER TABLE "${table}" ALTER COLUMN "${column}" TYPE character varying(64)`,
+      );
+    }
+  });
+
+  test("down() reverses up()'s order", async () => {
+    const up: MakeQueryRunnerResult = makeQueryRunner();
+    const down: MakeQueryRunnerResult = makeQueryRunner();
+
+    await new WidenHashedStringColumnsForScrypt1786023262402().up(up.runner);
+    await new WidenHashedStringColumnsForScrypt1786023262402().down(
+      down.runner,
+    );
+
+    type ColumnsFunction = (statements: Array<string>) => Array<string>;
+
+    const columns: ColumnsFunction = (
+      statements: Array<string>,
+    ): Array<string> => {
+      return statements.map((statement: string) => {
+        return statement
+          .match(/ALTER TABLE "([^"]+)" ALTER COLUMN "([^"]+)"/)!
+          .slice(1, 3)
+          .join(".");
+      });
+    };
+
+    expect(columns(down.statements)).toEqual(columns(up.statements).reverse());
+  });
+
+  test("the widened column holds a scrypt hash with room to spare", () => {
+    // `scrypt$N=16384,r=8,p=1$` + 64 hex characters.
+    const worstCaseToday: number = "scrypt$N=1048576,r=32,p=16$".length + 64;
+
+    expect(ColumnLength.HashedString).toBeGreaterThan(worstCaseToday);
+  });
+});
+
+describe("WidenHashedStringColumnsForScrypt — registration", () => {
+  test("is registered in SchemaMigrations/Index.ts", () => {
+    expect(SchemaMigrations).toContain(
+      WidenHashedStringColumnsForScrypt1786023262402,
+    );
+  });
+
+  test("appears exactly once", () => {
+    const occurrences: number = SchemaMigrations.filter(
+      (migration: { name: string }) => {
+        return (
+          migration.name === "WidenHashedStringColumnsForScrypt1786023262402"
+        );
+      },
+    ).length;
+
+    expect(occurrences).toBe(1);
+  });
+
+  test("runs after the migration that added the salt columns", () => {
+    const names: Array<string> = SchemaMigrations.map(
+      (migration: { name: string }) => {
+        return migration.name;
+      },
+    );
+
+    expect(
+      names.indexOf("WidenHashedStringColumnsForScrypt1786023262402"),
+    ).toBeGreaterThan(names.indexOf("AddPerUserPasswordSalt1786018109307"));
+  });
+});

package/Tests/Server/Utils/AI/CodeTools.test.ts

@@ -15,7 +15,8 @@ import CodeRepositoryModel from "../../../../Models/DatabaseModels/CodeRepositor
 import TelemetryException from "../../../../Models/DatabaseModels/TelemetryException";
 import CodeRepositoryType from "../../../../Types/CodeRepository/CodeRepositoryType";
 import ObjectID from "../../../../Types/ObjectID";
-import { describe, expect, test, afterEach } from "@jest/globals";
+import GitHubInstallationBinding from "../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import { describe, expect, test, afterEach, beforeEach } from "@jest/globals";
 
 /*
  * The code tools are the bridge from a telemetry signal to the source that
@@ -86,6 +87,19 @@ function mockFileContent(content: string): void {
   });
 }
 
+/*
+ * findReadableRepositories now also proves each row's GitHub App installation
+ * belongs to the row's project (GHSA-xx95-gmcf-7q86), which is a database
+ * read. That guard has its own tests; here it would just be a Postgres
+ * connection these tool tests do not need, so treat every fixture row as
+ * bound.
+ */
+beforeEach(() => {
+  jest
+    .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+    .mockResolvedValue("12345");
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });
@@ -119,6 +133,38 @@ describe("list_code_repositories", () => {
     expect(result.rowCount).toBe(1);
   });
 
+  /*
+   * GHSA-xx95-gmcf-7q86. A row can be in this project and still name a GitHub
+   * App installation the project does not own — that combination used to be
+   * creatable, and these tools would then read, commit and open pull requests
+   * in another tenant's private repositories. Being in the project is not the
+   * same as owning the installation, so an unbound row must be invisible here
+   * exactly like an uninstalled one.
+   */
+  test("hides a repository whose installation is not bound to the project", async () => {
+    jest
+      .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+      .mockResolvedValue("12345");
+
+    mockRepositories([
+      buildRepository({ name: "our-repo", installationId: "12345" }),
+      buildRepository({
+        id: ObjectID.generate(),
+        name: "someone-elses-repo",
+        installationId: "99999999",
+      }),
+    ]);
+
+    const result: ToolExecutionResult = await ListCodeRepositoriesTool.execute(
+      {},
+      ctx,
+    );
+
+    expect(result.dataForLlm).toContain("our-repo");
+    expect(result.dataForLlm).not.toContain("someone-elses-repo");
+    expect(result.rowCount).toBe(1);
+  });
+
   test("says plainly when no repository is connected", async () => {
     mockRepositories([]);
 

package/Tests/Server/Utils/AI/CodeWriteTools.test.ts

@@ -23,6 +23,7 @@ import AIAgentTaskPullRequest from "../../../../Models/DatabaseModels/AIAgentTas
 import CodeRepositoryType from "../../../../Types/CodeRepository/CodeRepositoryType";
 import PullRequestState from "../../../../Types/CodeRepository/PullRequestState";
 import ObjectID from "../../../../Types/ObjectID";
+import GitHubInstallationBinding from "../../../../Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding";
 import { describe, expect, test, afterEach, beforeEach } from "@jest/globals";
 
 /*
@@ -68,6 +69,15 @@ beforeEach(() => {
     .spyOn(CodeRepositoryService, "findBy")
     .mockResolvedValue([buildRepository()] as never);
   jest.spyOn(GitHubUtil, "getDefaultBranchName").mockResolvedValue("main");
+
+  /*
+   * resolveTargetRepository now proves each row's GitHub App installation
+   * belongs to the row's project (GHSA-xx95-gmcf-7q86), which is a database
+   * read. That guard has its own tests; treat the fixture row as bound.
+   */
+  jest
+    .spyOn(GitHubInstallationBinding, "getBoundInstallationId")
+    .mockResolvedValue("12345");
 });
 
 afterEach(() => {

package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts

@@ -24,6 +24,7 @@ import IncludesNone from "../../../../Types/BaseDatabase/IncludesNone";
 import MultiSearch from "../../../../Types/BaseDatabase/MultiSearch";
 import Search from "../../../../Types/BaseDatabase/Search";
 import StartsWith from "../../../../Types/BaseDatabase/StartsWith";
+import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 
 function expectStatement(actual: Statement, expected: Statement): void {
@@ -1431,6 +1432,125 @@ describe("StatementGenerator", () => {
     });
   });
 
+  /*
+   * The separator here is load-bearing for pagination. `toSortStatement`
+   * used to append sort keys with no delimiter, so anything past the first
+   * key produced a malformed term (`col_1 DESCcol_2 ASC`) — which meant a
+   * multi-key ORDER BY was unusable and, in practice, every paginated read
+   * ran on a single, non-unique sort column. See the pagination-stability
+   * suite in Tests/Server/Services/AnalyticsDatabasePaginationStability.
+   */
+  describe("toSortStatement", () => {
+    /*
+     * TestModel declares its columns through `tableColumns`, not as TS
+     * properties, so a `Sort<TestModel>` literal would fail excess-property
+     * checking on every key. Funnelling through one helper keeps the cast
+     * in a single place instead of on each call.
+     */
+    const sortStatementFor: (sort: Record<string, SortOrder>) => Statement = (
+      sort: Record<string, SortOrder>,
+    ): Statement => {
+      return generator.toSortStatement(sort as any);
+    };
+
+    test("renders a single ascending key with no trailing separator", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Ascending,
+      });
+
+      expect(statement.query).toBe("{p0:Identifier} ASC");
+      expect(statement.query_params).toStrictEqual({ p0: "column_1" });
+    });
+
+    test("renders a single descending key", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Descending,
+      });
+
+      expect(statement.query).toBe("{p0:Identifier} DESC");
+      expect(statement.query_params).toStrictEqual({ p0: "column_1" });
+    });
+
+    test("comma separates two keys", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Descending,
+        column_2: SortOrder.Ascending,
+      });
+
+      expect(statement.query).toBe("{p0:Identifier} DESC, {p1:Identifier} ASC");
+      expect(statement.query_params).toStrictEqual({
+        p0: "column_1",
+        p1: "column_2",
+      });
+    });
+
+    test("comma separates three keys and preserves declaration order", () => {
+      const statement: Statement = sortStatementFor({
+        column_2: SortOrder.Ascending,
+        column_1: SortOrder.Descending,
+        column_ObjectID: SortOrder.Ascending,
+      });
+
+      expect(statement.query).toBe(
+        "{p0:Identifier} ASC, {p1:Identifier} DESC, {p2:Identifier} ASC",
+      );
+      expect(statement.query_params).toStrictEqual({
+        p0: "column_2",
+        p1: "column_1",
+        p2: "column_ObjectID",
+      });
+    });
+
+    /*
+     * Regression guard for the exact malformed shape. Asserting on the
+     * rendered text rather than the param map is deliberate: the old bug
+     * produced correct PARAMS and broken SQL, so a params-only assertion
+     * would have passed straight through it.
+     */
+    test("never concatenates a direction into the next identifier", () => {
+      const statement: Statement = sortStatementFor({
+        column_1: SortOrder.Descending,
+        column_2: SortOrder.Ascending,
+      });
+
+      expect(statement.query).not.toContain("DESC{");
+      expect(statement.query).not.toContain("ASC{");
+      expect(statement.query).toContain(", ");
+    });
+
+    test("separator count is always one fewer than the key count", () => {
+      const statement: Statement = sortStatementFor({
+        column_ObjectID: SortOrder.Ascending,
+        column_1: SortOrder.Ascending,
+        column_2: SortOrder.Ascending,
+      });
+
+      expect(statement.query.split(", ")).toHaveLength(3);
+    });
+
+    test("an empty sort produces an empty statement", () => {
+      const statement: Statement = sortStatementFor({});
+
+      expect(statement.query).toBe("");
+      expect(statement.query_params).toStrictEqual({});
+    });
+
+    test("still rejects an unknown column", () => {
+      expect(() => {
+        return sortStatementFor({ not_a_column: SortOrder.Ascending });
+      }).toThrow(BadDataException);
+    });
+
+    test("rejects an unknown column that appears after a valid one", () => {
+      expect(() => {
+        return sortStatementFor({
+          column_1: SortOrder.Ascending,
+          not_a_column: SortOrder.Descending,
+        });
+      }).toThrow(BadDataException);
+    });
+  });
+
   describe("toColumnsCreateStatement", () => {
     test("should return the columns of a CREATE TABLE statement", () => {
       const statement: Statement = generator.toColumnsCreateStatement([