@oneuptime/common 12.0.3 → 12.0.5

package/Tests/App/StatusPage/StatusPageModelAPIPolymorphism.test.ts

@@ -0,0 +1,223 @@
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import StatusPageAPI from "../../../../App/FeatureSet/StatusPage/src/Utils/API";
+import StatusPageModelAPI from "../../../../App/FeatureSet/StatusPage/src/Utils/ModelAPI";
+import StatusPageResource from "../../../Models/DatabaseModels/StatusPageResource";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import HTTPMethod from "../../../Types/API/HTTPMethod";
+import HTTPResponse from "../../../Types/API/HTTPResponse";
+import URL from "../../../Types/API/URL";
+import SortOrder from "../../../Types/BaseDatabase/SortOrder";
+import { JSONArray, JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import { FormType } from "../../../UI/Components/Forms/ModelForm";
+import DashboardAPI from "../../../UI/Utils/API/API";
+
+/*
+ * StatusPageModelAPI is deliberately a ModelAPI subclass instead of a second
+ * copy of the model request implementation. The polymorphic boundary is
+ * security-sensitive: falling back to DashboardAPI means a public status-page
+ * request can inherit a dashboard tenant and, on a 401/405, clear the user's
+ * unrelated dashboard session.
+ *
+ * These tests spy on the status-page and dashboard clients independently.
+ * They therefore fail if ModelAPI ever hard-codes DashboardAPI again, even if
+ * the request payload and successful response happen to look identical.
+ */
+
+const STATUS_PAGE_ID: ObjectID = new ObjectID(
+  "019acd10-1111-4111-8111-111111111111",
+);
+const RESOURCE_ID: string = "019acd10-2222-4222-8222-222222222222";
+const DASHBOARD_PROJECT_ID: string = "019acd10-3333-4333-8333-333333333333";
+
+interface StaticSpy {
+  mockResolvedValue: (value: unknown) => StaticSpy;
+  mockRejectedValue: (value: unknown) => StaticSpy;
+  mock: { calls: Array<Array<unknown>> };
+}
+
+type FetchArguments = {
+  method: HTTPMethod;
+  url: URL;
+  data?: JSONObject | undefined;
+  headers?: Record<string, string> | undefined;
+  params?: Record<string, string> | undefined;
+};
+
+let statusPageFetchSpy: StaticSpy;
+let dashboardFetchSpy: StaticSpy;
+
+const buildResource: () => StatusPageResource = (): StatusPageResource => {
+  const resource: StatusPageResource = new StatusPageResource();
+  resource._id = RESOURCE_ID;
+  resource.statusPageId = STATUS_PAGE_ID;
+  resource.displayName = "Checkout API";
+  resource.order = 1;
+  return resource;
+};
+
+const buildListResponse: (
+  resource: StatusPageResource,
+) => HTTPResponse<JSONArray> = (
+  resource: StatusPageResource,
+): HTTPResponse<JSONArray> => {
+  return new HTTPResponse<JSONArray>(
+    200,
+    {
+      data: [BaseModel.toJSON(resource, StatusPageResource)],
+      count: 1,
+      skip: 0,
+      limit: 25,
+    },
+    {},
+  );
+};
+
+const buildModelResponse: (
+  resource: StatusPageResource,
+) => HTTPResponse<StatusPageResource> = (
+  resource: StatusPageResource,
+): HTTPResponse<StatusPageResource> => {
+  return new HTTPResponse<StatusPageResource>(
+    200,
+    BaseModel.toJSON(resource, StatusPageResource),
+    {},
+  );
+};
+
+const statusPageFetchArguments: () => FetchArguments = (): FetchArguments => {
+  return statusPageFetchSpy.mock.calls[0]![0] as FetchArguments;
+};
+
+beforeEach(() => {
+  window.localStorage.clear();
+  window.sessionStorage.clear();
+  window.history.replaceState(
+    window.history.state,
+    "",
+    `/status-page/${STATUS_PAGE_ID.toString()}/subscribe/email`,
+  );
+
+  /*
+   * Keep an unrelated dashboard project in the same tab. This is the browser
+   * state from the reported bug and proves that the explicit blank tenant
+   * wins over any dashboard context that ModelAPI could otherwise discover.
+   */
+  window.localStorage.setItem("statusPageId", STATUS_PAGE_ID.toString());
+  window.sessionStorage.setItem("current_project_id", DASHBOARD_PROJECT_ID);
+
+  /*
+   * Spy on the inherited method on the subclass first. Jest then installs an
+   * own spy on StatusPageAPI; the later DashboardAPI spy remains independent.
+   */
+  statusPageFetchSpy = jest.spyOn(
+    StatusPageAPI,
+    "fetch",
+  ) as unknown as StaticSpy;
+  dashboardFetchSpy = jest.spyOn(DashboardAPI, "fetch") as unknown as StaticSpy;
+
+  dashboardFetchSpy.mockRejectedValue(
+    new Error("the dashboard API client must not receive this request"),
+  );
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  window.localStorage.clear();
+  window.sessionStorage.clear();
+  window.history.replaceState(window.history.state, "", "/");
+});
+
+describe("StatusPageModelAPI polymorphic API client", () => {
+  test("getList dispatches through the status-page client with page-scoped headers", async () => {
+    const resource: StatusPageResource = buildResource();
+    statusPageFetchSpy.mockResolvedValue(buildListResponse(resource));
+
+    const overrideRequestUrl: URL = URL.fromString(
+      `https://status.example.com/api/status-page/resources/${STATUS_PAGE_ID.toString()}`,
+    );
+
+    const result: {
+      data: Array<StatusPageResource>;
+      count: number;
+      skip: number;
+      limit: number;
+    } = await StatusPageModelAPI.getList<StatusPageResource>({
+      modelType: StatusPageResource,
+      query: { statusPageId: STATUS_PAGE_ID },
+      limit: 25,
+      skip: 0,
+      select: { _id: true, displayName: true },
+      sort: { order: SortOrder.Ascending },
+      requestOptions: {
+        overrideRequestUrl,
+        requestHeaders: { "x-status-page-test": "list" },
+      },
+    });
+
+    expect(statusPageFetchSpy.mock.calls).toHaveLength(1);
+    expect(dashboardFetchSpy.mock.calls).toHaveLength(0);
+
+    const request: FetchArguments = statusPageFetchArguments();
+    expect(request.method).toBe(HTTPMethod.POST);
+    expect(request.url.toString()).toBe(overrideRequestUrl.toString());
+    expect(request.params).toEqual({ limit: "25", skip: "0" });
+    expect(request.headers).toEqual({
+      "status-page-id": STATUS_PAGE_ID.toString(),
+      tenantid: "",
+      "x-status-page-test": "list",
+    });
+
+    expect(result.count).toBe(1);
+    expect(result.data).toHaveLength(1);
+    expect(result.data[0]).toBeInstanceOf(StatusPageResource);
+    expect(result.data[0]?._id?.toString()).toBe(RESOURCE_ID);
+  });
+
+  test("createOrUpdate dispatches through the status-page client with the same isolated headers", async () => {
+    const resource: StatusPageResource = buildResource();
+    statusPageFetchSpy.mockResolvedValue(buildModelResponse(resource));
+
+    const overrideRequestUrl: URL = URL.fromString(
+      `https://status.example.com/api/status-page/subscribe/${STATUS_PAGE_ID.toString()}`,
+    );
+
+    const result: {
+      data: StatusPageResource;
+    } = await StatusPageModelAPI.createOrUpdate<StatusPageResource>({
+      model: resource,
+      modelType: StatusPageResource,
+      formType: FormType.Create,
+      miscDataProps: { source: "public-status-page" },
+      requestOptions: {
+        overrideRequestUrl,
+        requestHeaders: { "x-status-page-test": "create" },
+      },
+    });
+
+    expect(statusPageFetchSpy.mock.calls).toHaveLength(1);
+    expect(dashboardFetchSpy.mock.calls).toHaveLength(0);
+
+    const request: FetchArguments = statusPageFetchArguments();
+    expect(request.method).toBe(HTTPMethod.POST);
+    expect(request.url.toString()).toBe(overrideRequestUrl.toString());
+    expect(request.headers).toEqual({
+      "status-page-id": STATUS_PAGE_ID.toString(),
+      tenantid: "",
+      "x-status-page-test": "create",
+    });
+    expect(request.data?.["miscDataProps"]).toEqual({
+      source: "public-status-page",
+    });
+
+    expect(result.data).toBeInstanceOf(StatusPageResource);
+    expect(result.data._id?.toString()).toBe(RESOURCE_ID);
+  });
+});

package/Tests/Models/DatabaseModels/PermissionCatalogueCoverage.test.ts

@@ -0,0 +1,243 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Permission, {
+  PermissionHelper,
+  PermissionProps,
+} from "../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Contract under test: every permission a model gates CRUD on must exist in the
+ * permission catalogue, and a model must not gate its own columns on another
+ * model's permission.
+ *
+ * The case that prompted this: ScheduledMaintenanceTemplateOwnerUser gated its
+ * required, non-nullable scheduledMaintenanceTemplateId column on the *Team*
+ * create permission. It was invisible only because the two enum values happened
+ * to collide, so both names resolved to one string. The moment that collision
+ * was fixed the mis-key became a hard BadDataException on every create, on a
+ * column the dashboard always sends — a latent break sitting behind an
+ * unrelated bug.
+ *
+ * Sweeping every model rather than asserting on a list is the point: a mis-key
+ * in a model nobody is looking at fails here instead of in production. The
+ * sweep found twenty-one more of them, listed below; they are recorded as a
+ * baseline rather than fixed, because each needs its own judgement about which
+ * permission was meant.
+ */
+
+type ModelType = { new (): BaseModel };
+
+const MODEL_TYPES: Array<ModelType> = AllModelTypes as Array<ModelType>;
+
+/*
+ * The only two permissions a model may reference without a PermissionProps
+ * entry. Both are internal markers rather than capabilities an administrator
+ * hands out — AuthenticatedRequest marks "some authenticated principal made
+ * this call" and UnAuthorizedSsoUser marks a user who has not yet passed the
+ * project's SSO. Neither belongs in the picker, so neither has props.
+ *
+ * Anything else appearing here means a permission is referenced by a live model
+ * but cannot be granted on its own, which is a bug, not a policy.
+ */
+const PERMISSIONS_WITHOUT_PROPS_BY_DESIGN: Array<string> = [
+  "AuthenticatedRequest",
+  "UnAuthorizedSsoUser",
+];
+
+/*
+ * Columns whose create list requires a granular permission the table's own
+ * create list never accepts. Each is a pre-existing copy-paste mis-key of the
+ * same family as the ScheduledMaintenanceTemplateOwnerUser one this test was
+ * written for — MonitorFeed asking for CreateScheduledMaintenanceFeed,
+ * MetricType asking for CreateProjectIncident, and so on. They are recorded
+ * rather than fixed here because each needs its own judgement about which
+ * permission was intended, and because a required column gated this way cannot
+ * be set by a granular-only holder at all.
+ *
+ * This list must only ever shrink. A new entry means a new mis-key.
+ */
+const KNOWN_CROSS_MODEL_COLUMN_GATES: Array<string> = [
+  "IncidentFeed.postedAt requires CreateScheduledMaintenanceFeed",
+  "IncidentFeed.user requires CreateScheduledMaintenanceFeed",
+  "IncidentFeed.userId requires CreateScheduledMaintenanceFeed",
+  "MetricType.services requires CreateProjectIncident",
+  "Monitor.currentMonitorStatusId requires CreateProjectIncident",
+  "MonitorFeed.postedAt requires CreateScheduledMaintenanceFeed",
+  "MonitorFeed.user requires CreateScheduledMaintenanceFeed",
+  "MonitorFeed.userId requires CreateScheduledMaintenanceFeed",
+  "MonitorSecret.monitors requires ReadMonitorSecret",
+  "OnCallDutyPolicyFeed.postedAt requires CreateScheduledMaintenanceFeed",
+  "OnCallDutyPolicyFeed.user requires CreateScheduledMaintenanceFeed",
+  "OnCallDutyPolicyFeed.userId requires CreateScheduledMaintenanceFeed",
+  "Project.businessDetails requires ManageProjectBilling",
+  "Project.businessDetailsCountry requires ManageProjectBilling",
+  "Project.createdByUser requires CurrentUser",
+  "Project.createdByUserId requires CurrentUser",
+  "Project.financeAccountingEmail requires ManageProjectBilling",
+  "Project.paymentProviderPlanId requires CurrentUser",
+  "Project.sendInvoicesByEmail requires ManageProjectBilling",
+  "RunbookSecret.runners requires ReadRunbookSecret",
+  "ScheduledMaintenance.subscriberNotificationStatusMessage requires CreateIncidentPublicNote",
+];
+
+function modelName(modelType: ModelType): string {
+  return modelType.name;
+}
+
+function tableLevelPermissions(model: BaseModel): Array<Permission> {
+  return [
+    ...(model.createRecordPermissions || []),
+    ...(model.readRecordPermissions || []),
+    ...(model.updateRecordPermissions || []),
+    ...(model.deleteRecordPermissions || []),
+  ];
+}
+
+function columnLevelPermissions(model: BaseModel): Array<Permission> {
+  const permissions: Array<Permission> = [];
+
+  for (const column of model.getTableColumns().columns) {
+    const accessControl: ReturnType<BaseModel["getColumnAccessControlFor"]> =
+      model.getColumnAccessControlFor(column);
+
+    if (!accessControl) {
+      continue;
+    }
+
+    permissions.push(
+      ...(accessControl.create || []),
+      ...(accessControl.read || []),
+      ...(accessControl.update || []),
+    );
+  }
+
+  return permissions;
+}
+
+describe("Permission catalogue coverage across database models", () => {
+  test("every model-referenced permission is a real enum member", () => {
+    const validValues: Set<string> = new Set(Object.values(Permission));
+    const unknown: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      for (const permission of [
+        ...tableLevelPermissions(model),
+        ...columnLevelPermissions(model),
+      ]) {
+        if (!validValues.has(permission as unknown as string)) {
+          unknown.push(`${modelName(modelType)} -> ${permission}`);
+        }
+      }
+    }
+
+    expect(unknown).toEqual([]);
+  });
+
+  test("every model-referenced permission resolves to a props entry", () => {
+    const withProps: Set<string> = new Set(
+      PermissionHelper.getAllPermissionProps().map((props: PermissionProps) => {
+        return props.permission.toString();
+      }),
+    );
+
+    const allowed: Set<string> = new Set(PERMISSIONS_WITHOUT_PROPS_BY_DESIGN);
+
+    const missing: Set<string> = new Set<string>();
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      for (const permission of [
+        ...tableLevelPermissions(model),
+        ...columnLevelPermissions(model),
+      ]) {
+        const value: string = permission.toString();
+
+        if (withProps.has(value) || allowed.has(value)) {
+          continue;
+        }
+
+        missing.add(`${modelName(modelType)} -> ${value}`);
+      }
+    }
+
+    expect(Array.from(missing).sort()).toEqual([]);
+  });
+
+  test("the by-design exemptions really have no props", () => {
+    /*
+     * If somebody gives one of these a props entry, the exemption must go too —
+     * otherwise it keeps excusing a permission that no longer needs it, and the
+     * next genuinely-missing one hides behind it.
+     */
+    const withProps: Set<string> = new Set(
+      PermissionHelper.getAllPermissionProps().map((props: PermissionProps) => {
+        return props.permission.toString();
+      }),
+    );
+
+    const stale: Array<string> = PERMISSIONS_WITHOUT_PROPS_BY_DESIGN.filter(
+      (permission: string) => {
+        return withProps.has(permission);
+      },
+    );
+
+    expect(stale).toEqual([]);
+  });
+
+  test("no column is gated on a granular permission its table does not accept", () => {
+    /*
+     * A column's create list must not require a granular permission that the
+     * table's own create list never accepts — the caller would pass the table
+     * gate and then fail on the column, which for a required column means the
+     * record can never be created by that permission at all. Roles are excluded
+     * because they legitimately appear in different combinations.
+     */
+    const rolePermissions: Set<string> = new Set(
+      PermissionHelper.getRolePermissionProps().map(
+        (props: PermissionProps) => {
+          return props.permission.toString();
+        },
+      ),
+    );
+
+    const offenders: Array<string> = [];
+
+    for (const modelType of MODEL_TYPES) {
+      const model: BaseModel = new modelType();
+
+      const tableCreate: Set<string> = new Set(
+        (model.createRecordPermissions || []).map((permission: Permission) => {
+          return permission.toString();
+        }),
+      );
+
+      if (tableCreate.size === 0) {
+        continue;
+      }
+
+      for (const column of model.getTableColumns().columns) {
+        const accessControl: ReturnType<
+          BaseModel["getColumnAccessControlFor"]
+        > = model.getColumnAccessControlFor(column);
+
+        for (const permission of accessControl?.create || []) {
+          const value: string = permission.toString();
+
+          if (rolePermissions.has(value) || tableCreate.has(value)) {
+            continue;
+          }
+
+          offenders.push(`${modelName(modelType)}.${column} requires ${value}`);
+        }
+      }
+    }
+
+    expect(offenders.sort()).toEqual(
+      KNOWN_CROSS_MODEL_COLUMN_GATES.slice().sort(),
+    );
+  });
+});