@oneuptime/common 12.0.30 → 12.0.31

package/Tests/Server/Services/UserServiceSeatLimit.test.ts

@@ -0,0 +1,182 @@
+import UserService from "../../../Server/Services/UserService";
+import EnterpriseLicenseSeatUtil from "../../../Server/Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import User from "../../../Models/DatabaseModels/User";
+import Email from "../../../Types/Email";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { beforeEach, afterEach, describe, expect, it } from "@jest/globals";
+
+/*
+ * Where the enterprise seat limit is actually enforced.
+ *
+ * The limit is bought per user and shared by every instance on the licence,
+ * and a seat is consumed by a person EXISTING on the installation — not by the
+ * particular door they walked through. There are eight of those doors: team
+ * invitations, self-service signup, SAML and OIDC just-in-time provisioning
+ * (project-level and global), three SCIM routes, the Admin Dashboard user
+ * form, and the master API key posting to /api/user. Every one of them ends up
+ * in UserService.create, so the check belongs in its create hook and nowhere
+ * else; a check on the invitation would have left signup and SSO as open doors
+ * beside it.
+ *
+ * The single most important assertion in this file is the isRoot one. Team
+ * invitations create the invited user with `props: { isRoot: true }`
+ * (TeamMemberService.onBeforeCreate), so the usual "internal writes bypass
+ * this" instinct would exempt invitations — the exact path this feature was
+ * asked for.
+ */
+
+jest.mock(
+  "../../../Server/Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil",
+  () => {
+    return {
+      __esModule: true,
+      default: {
+        assertSeatAvailableForNewUser: jest.fn(),
+      },
+    };
+  },
+);
+
+type OnBeforeCreateFunction = (createBy: CreateBy<User>) => Promise<unknown>;
+
+/*
+ * onBeforeCreate is protected, which is exactly the right shape for it and
+ * exactly the wrong shape for a test. Reached through the instance rather than
+ * re-implemented, so this suite breaks if the hook is renamed or removed.
+ */
+const onBeforeCreate: OnBeforeCreateFunction = (
+  createBy: CreateBy<User>,
+): Promise<unknown> => {
+  return (
+    UserService as unknown as {
+      onBeforeCreate: OnBeforeCreateFunction;
+    }
+  ).onBeforeCreate(createBy);
+};
+
+type MakeCreateByFunction = (props?: Record<string, unknown>) => CreateBy<User>;
+
+const makeCreateBy: MakeCreateByFunction = (
+  props?: Record<string, unknown>,
+): CreateBy<User> => {
+  const user: User = new User();
+  user.email = new Email("someone@acme.com");
+
+  return {
+    data: user,
+    props: props || {},
+  } as unknown as CreateBy<User>;
+};
+
+type AssertSeatMockFunction = () => jest.Mock;
+
+const assertSeatMock: AssertSeatMockFunction = (): jest.Mock => {
+  return EnterpriseLicenseSeatUtil.assertSeatAvailableForNewUser as unknown as jest.Mock;
+};
+
+describe("UserService - the enterprise seat limit", () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    assertSeatMock().mockResolvedValue(undefined);
+    UserService.countBy = jest.fn().mockResolvedValue(new PositiveNumber(7));
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("checks the seat limit before creating a user", async () => {
+    await onBeforeCreate(makeCreateBy());
+
+    expect(assertSeatMock()).toHaveBeenCalledTimes(1);
+  });
+
+  it("refuses the create when there is no seat for the new user", async () => {
+    assertSeatMock().mockRejectedValue(new BadDataException("No seats left"));
+
+    await expect(onBeforeCreate(makeCreateBy())).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+  });
+
+  /*
+   * The one that matters. TeamMemberService creates the invited user as root,
+   * so an isRoot exemption would exempt invitations — and inviting users past
+   * the licence is the thing being prevented.
+   */
+  it.each([
+    ["a root write, which is how invitations create users", { isRoot: true }],
+    ["a master admin acting from the Admin Dashboard", { isMasterAdmin: true }],
+    ["an ordinary tenant write", { userId: ObjectID.generate() }],
+  ])(
+    "still checks the limit for %s",
+    async (_label: string, props: Record<string, unknown>) => {
+      await onBeforeCreate(makeCreateBy(props));
+
+      expect(assertSeatMock()).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("checks the limit before anything else the hook does", async () => {
+    /*
+     * The hook also sanitizes attribution columns. If a refusal came after
+     * that, a rejected create would still have done work; more importantly the
+     * ordering pins that nothing was inserted ahead of the check later on.
+     */
+    assertSeatMock().mockRejectedValue(new BadDataException("No seats left"));
+
+    const createBy: CreateBy<User> = makeCreateBy();
+    (createBy.data as unknown as Record<string, unknown>)["clickIds"] = {
+      gclid: "abc",
+    };
+
+    await expect(onBeforeCreate(createBy)).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+  });
+
+  describe("the user count it enforces against", () => {
+    type GetLocalUserCountFunction = () => Promise<number>;
+
+    type CapturedCallbackFunction = () => GetLocalUserCountFunction;
+
+    const capturedCallback: CapturedCallbackFunction =
+      (): GetLocalUserCountFunction => {
+        const call: Record<string, unknown> = assertSeatMock().mock
+          .calls[0]![0] as Record<string, unknown>;
+
+        return call["getLocalUserCount"] as GetLocalUserCountFunction;
+      };
+
+    it("counts every user on this installation, not just the caller's project", async () => {
+      await onBeforeCreate(makeCreateBy());
+
+      const count: number = await capturedCallback()();
+
+      expect(count).toBe(7);
+
+      const countCall: Record<string, unknown> = (
+        UserService.countBy as unknown as jest.Mock
+      ).mock.calls[0]![0] as Record<string, unknown>;
+
+      expect(countCall["query"]).toEqual({});
+      expect((countCall["props"] as Record<string, unknown>)["isRoot"]).toBe(
+        true,
+      );
+    });
+
+    /*
+     * The count is deliberately behind a callback rather than passed in: on
+     * Community Edition, and on a licence with no seat limit, it must never
+     * run at all. This is the create path of every user on the installation.
+     */
+    it("does not count users unless the seat check asks for it", async () => {
+      await onBeforeCreate(makeCreateBy());
+
+      expect(UserService.countBy).not.toHaveBeenCalled();
+    });
+  });
+});

package/Tests/Server/Types/AnalyticsDatabase/SecurityEventModelPermission.test.ts

@@ -0,0 +1,255 @@
+import ModelPermission from "../../../../Server/Types/AnalyticsDatabase/ModelPermission";
+import DatabaseRequestType from "../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import Log from "../../../../Models/AnalyticsModels/Log";
+import SecurityEvent from "../../../../Models/AnalyticsModels/SecurityEvent";
+import ThreatIntelIndicator from "../../../../Models/AnalyticsModels/ThreatIntelIndicator";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../Types/Permission";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The SIEM's ClickHouse tables go through a different gate from the Postgres
+ * ones - AnalyticsDatabase/ModelPermission rather than TablePermission - and it
+ * is the gate the /security-events CRUD API and the AI security tools both run
+ * through. The Security tiers have to hold on this path too, and one thing that
+ * only exists on this path has to be checked here: the
+ * *AllOperationalResources wildcards.
+ */
+
+const projectId: ObjectID = ObjectID.generate();
+const userId: ObjectID = ObjectID.generate();
+
+type MakePropsFunction = (
+  grantedByTeams: Array<Permission>,
+) => DatabaseCommonInteractionProps;
+
+const makeProps: MakePropsFunction = (
+  grantedByTeams: Array<Permission>,
+): DatabaseCommonInteractionProps => {
+  const permissions: Array<Permission> = [
+    Permission.CurrentUser,
+    Permission.UnAuthorizedSsoUser,
+    Permission.ProjectUser,
+    ...grantedByTeams,
+  ];
+
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        _type: "UserPermission",
+        permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId,
+    tenantId: projectId,
+    userTenantAccessPermission: {
+      [projectId.toString()]: tenantPermission,
+    },
+  };
+};
+
+type ModelType = { new (): any };
+
+type CanFunction = (
+  modelType: ModelType,
+  props: DatabaseCommonInteractionProps,
+  requestType: DatabaseRequestType,
+) => boolean;
+
+const can: CanFunction = (
+  modelType: ModelType,
+  props: DatabaseCommonInteractionProps,
+  requestType: DatabaseRequestType,
+): boolean => {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (ModelPermission as any).checkModelLevelPermissions(
+      modelType,
+      props,
+      requestType,
+    );
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+type CanReadFunction = (
+  modelType: ModelType,
+  props: DatabaseCommonInteractionProps,
+) => boolean;
+
+const canRead: CanReadFunction = (
+  modelType: ModelType,
+  props: DatabaseCommonInteractionProps,
+): boolean => {
+  return can(modelType, props, DatabaseRequestType.Read);
+};
+
+const ANALYTICS_SIEM_MODELS: Array<[string, ModelType]> = [
+  ["SecurityEvent", SecurityEvent],
+  ["ThreatIntelIndicator", ThreatIntelIndicator],
+];
+
+describe("Security events through the analytics permission gate", () => {
+  test.each(ANALYTICS_SIEM_MODELS)(
+    "a Security Viewer can read %s",
+    (_name: string, modelType: ModelType) => {
+      expect(canRead(modelType, makeProps([Permission.SecurityViewer]))).toBe(
+        true,
+      );
+    },
+  );
+
+  test.each(ANALYTICS_SIEM_MODELS)(
+    "a Telemetry Admin cannot read %s",
+    (_name: string, modelType: ModelType) => {
+      expect(canRead(modelType, makeProps([Permission.TelemetryAdmin]))).toBe(
+        false,
+      );
+    },
+  );
+
+  test.each(ANALYTICS_SIEM_MODELS)(
+    "a plain project member cannot read %s",
+    (_name: string, modelType: ModelType) => {
+      expect(canRead(modelType, makeProps([Permission.ProjectMember]))).toBe(
+        false,
+      );
+    },
+  );
+
+  test.each(ANALYTICS_SIEM_MODELS)(
+    "the project-wide Viewer cannot read %s",
+    (_name: string, modelType: ModelType) => {
+      expect(canRead(modelType, makeProps([Permission.Viewer]))).toBe(false);
+    },
+  );
+
+  /*
+   * The pairing the split exists for, on the analytics path: the same principal
+   * that reads every log in the project reads no security events, and the
+   * security principal reads no logs.
+   */
+  test("logs and security events are separate grants", () => {
+    const telemetryViewer: DatabaseCommonInteractionProps = makeProps([
+      Permission.TelemetryViewer,
+    ]);
+    const securityViewer: DatabaseCommonInteractionProps = makeProps([
+      Permission.SecurityViewer,
+    ]);
+
+    expect(canRead(Log, telemetryViewer)).toBe(true);
+    expect(canRead(SecurityEvent, telemetryViewer)).toBe(false);
+
+    expect(canRead(SecurityEvent, securityViewer)).toBe(true);
+    expect(canRead(Log, securityViewer)).toBe(false);
+  });
+
+  /*
+   * The wildcard door.
+   *
+   * @OperationalResource() widens an analytics table's permission list with
+   * ReadAllOperationalResources and its siblings, and SecurityEvent carried the
+   * decorator because it was written as a copy of Log. That grant's own
+   * description is "all operational resources in this project (Monitor,
+   * Incident, Alert, StatusPage, etc.)" - somebody handing it to an integration
+   * is not deciding to hand over the SIEM, and it is a granular permission
+   * rather than a role, so none of the role-level assertions elsewhere would
+   * have noticed it staying open.
+   *
+   * Log keeps the decorator, which is what makes this a real assertion rather
+   * than a check that the wildcard mechanism is broken.
+   */
+  test("the operational-resource wildcards do not reach security events", () => {
+    const wildcardHolder: DatabaseCommonInteractionProps = makeProps([
+      Permission.ReadAllOperationalResources,
+      Permission.EditAllOperationalResources,
+      Permission.DeleteAllOperationalResources,
+      Permission.CreateAllOperationalResources,
+    ]);
+
+    expect(canRead(Log, wildcardHolder)).toBe(true);
+
+    for (const requestType of [
+      DatabaseRequestType.Read,
+      DatabaseRequestType.Update,
+      DatabaseRequestType.Delete,
+      DatabaseRequestType.Create,
+    ]) {
+      expect(can(SecurityEvent, wildcardHolder, requestType)).toBe(false);
+    }
+  });
+
+  /*
+   * Owned-scope filtering keys off @OwnedThrough, not @OperationalResource, so
+   * dropping the latter must not have taken "this team only sees the services
+   * it owns" with it.
+   */
+  test("security events are still ownable through their primary entity", () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect((new SecurityEvent() as any).ownedThrough).toBeTruthy();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    expect((new SecurityEvent() as any).isOperationalResource).toBeFalsy();
+  });
+
+  test("Security Viewer is read-only on the analytics tables too", () => {
+    const securityViewer: DatabaseCommonInteractionProps = makeProps([
+      Permission.SecurityViewer,
+    ]);
+
+    for (const requestType of [
+      DatabaseRequestType.Create,
+      DatabaseRequestType.Update,
+      DatabaseRequestType.Delete,
+    ]) {
+      expect(can(SecurityEvent, securityViewer, requestType)).toBe(false);
+    }
+  });
+
+  test("Security Admin can purge security events, Security Member cannot", () => {
+    expect(
+      can(
+        SecurityEvent,
+        makeProps([Permission.SecurityAdmin]),
+        DatabaseRequestType.Delete,
+      ),
+    ).toBe(true);
+
+    expect(
+      can(
+        SecurityEvent,
+        makeProps([Permission.SecurityMember]),
+        DatabaseRequestType.Delete,
+      ),
+    ).toBe(false);
+  });
+
+  test("the project's own administrators still reach the analytics tables", () => {
+    for (const permission of [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+    ]) {
+      for (const [, modelType] of ANALYTICS_SIEM_MODELS) {
+        expect(canRead(modelType, makeProps([permission]))).toBe(true);
+      }
+    }
+  });
+
+  test("a granular ReadSecurityEvent key still works on its own", () => {
+    expect(
+      canRead(SecurityEvent, makeProps([Permission.ReadSecurityEvent])),
+    ).toBe(true);
+  });
+});

package/Tests/Server/Types/Database/Permissions/ReadBlockPermission.test.ts

@@ -0,0 +1,212 @@
+import ReadPermission from "../../../../../Server/Types/Database/Permissions/ReadPermission";
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import Monitor from "../../../../../Models/DatabaseModels/Monitor";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+import { FindOperator } from "typeorm";
+
+describe("ReadPermission.checkReadBlockPermission", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const blockedLabelA: ObjectID = ObjectID.generate();
+  const blockedLabelB: ObjectID = ObjectID.generate();
+
+  function makeProps(
+    permissions: Array<UserPermission>,
+  ): DatabaseCommonInteractionProps {
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions,
+    };
+
+    return {
+      userId,
+      tenantId: projectId,
+      userTenantAccessPermission: {
+        [projectId.toString()]: tenantPermission,
+      },
+    };
+  }
+
+  function blockPermission(
+    permission: Permission,
+    labelIds: Array<ObjectID>,
+  ): UserPermission {
+    return {
+      _type: "UserPermission",
+      permission,
+      labelIds,
+      isBlockPermission: true,
+    };
+  }
+
+  function allowPermission(
+    permission: Permission,
+    labelIds: Array<ObjectID>,
+  ): UserPermission {
+    return {
+      _type: "UserPermission",
+      permission,
+      labelIds,
+      isBlockPermission: false,
+    };
+  }
+
+  /*
+   * The rewrite has to SUBTRACT the blocked labels, not restrict the read to
+   * them. Asserting only that some FindOperator landed on the column would
+   * pass just as happily if notInOrNull() were swapped for its including
+   * counterpart, so read the rendered SQL back and return the ids it denies.
+   */
+  function deniedLabelIds(operator: any): Array<string> {
+    expect(operator).toBeInstanceOf(FindOperator);
+    expect(operator.type).toBe("raw");
+
+    const sql: string = operator.getSql("labelId");
+    expect(sql).toContain("NOT IN");
+    expect(sql).toContain("IS NULL");
+
+    return Object.values(
+      operator.objectLiteralParameters as Record<string, Array<string>>,
+    )[0] as Array<string>;
+  }
+
+  it("leaves the query untouched for a root request", async () => {
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      {
+        isRoot: true,
+        ...makeProps([
+          blockPermission(Permission.ProjectMember, [blockedLabelA]),
+        ]),
+      },
+    );
+
+    expect(result.query.labels).toBeUndefined();
+  });
+
+  it("leaves the query untouched for a master admin request", async () => {
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      {
+        isMasterAdmin: true,
+        ...makeProps([
+          blockPermission(Permission.ProjectMember, [blockedLabelA]),
+        ]),
+      },
+    );
+
+    expect(result.query.labels).toBeUndefined();
+  });
+
+  it("throws when a block permission on this model carries no labels", async () => {
+    /*
+     * A block row without labels is a table-level deny: there is no subset of
+     * rows left to read, so the request is refused rather than filtered.
+     */
+    const query: any = { projectId };
+
+    await expect(
+      ReadPermission.checkReadBlockPermission(
+        Incident,
+        query,
+        makeProps([blockPermission(Permission.ProjectMember, [])]),
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("filters the blocked labels out of the query when the block carries labels", async () => {
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+    );
+
+    expect(result.query.labels).toBeDefined();
+    expect(deniedLabelIds(result.query.labels._id)).toEqual([
+      blockedLabelA.toString(),
+    ]);
+    // The caller's own filters survive the rewrite.
+    expect(result.query.projectId).toEqual(projectId);
+  });
+
+  it("merges the labels of every block permission that belongs to the model", async () => {
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      makeProps([
+        blockPermission(Permission.ProjectMember, [blockedLabelA]),
+        blockPermission(Permission.IncidentViewer, [blockedLabelB]),
+      ]),
+    );
+
+    expect(deniedLabelIds(result.query.labels._id)).toEqual([
+      blockedLabelA.toString(),
+      blockedLabelB.toString(),
+    ]);
+  });
+
+  it("ignores a block permission that does not belong to this model", async () => {
+    /*
+     * Monitor-only permissions must not narrow an Incident read, otherwise a
+     * block on one resource would silently hide rows of another.
+     */
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      makeProps([blockPermission(Permission.MonitorViewer, [blockedLabelA])]),
+    );
+
+    expect(result.query.labels).toBeUndefined();
+  });
+
+  it("ignores labels carried by an allow permission", async () => {
+    /*
+     * Labels on an allow row scope what the user can see; only a block row
+     * subtracts from it. Reading the flag the wrong way round would turn a
+     * grant into a deny.
+     */
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      makeProps([allowPermission(Permission.ProjectMember, [blockedLabelA])]),
+    );
+
+    expect(result.query.labels).toBeUndefined();
+  });
+
+  it("applies the same filtering to another labelled model", async () => {
+    const query: any = { projectId };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Monitor,
+      query,
+      makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+    );
+
+    expect(result.query.labels).toBeDefined();
+    expect(deniedLabelIds(result.query.labels._id)).toEqual([
+      blockedLabelA.toString(),
+    ]);
+  });
+});