@oneuptime/common 12.0.31 → 12.0.33

package/Tests/App/SensitiveUrlTokenBootstrap.test.ts

@@ -0,0 +1,256 @@
+import { describe, expect, it } from "@jest/globals";
+import ejs from "ejs";
+import fs from "fs";
+import { JSDOM } from "jsdom";
+import path from "path";
+
+/*
+ * Password reset and email verification links carry a single-use bearer token
+ * in the URL path. Every analytics and advertising tag on the page reports the
+ * page URL as a matter of course, so the token used to leave the browser to
+ * whoever the Google Tag Manager container happened to be loading. Measured on
+ * production before the fix, one visit to /accounts/reset-password/<token> sent
+ * the token to region1.analytics.google.com, www.google.com, bat.bing.com,
+ * q.quora.com and alb.reddit.com.
+ *
+ * Common/Server/Views/Partials/SensitiveUrlToken.ejs closes that by rewriting
+ * the path before the container starts, and by refusing to start the container
+ * at all if the rewrite did not take. Both halves are load-order sensitive and
+ * invisible at runtime when they break — a tag moved above the partial, or a
+ * `return` dropped from the GTM guard, leaks silently and no other suite would
+ * notice — so they are pinned here.
+ */
+
+const REPOSITORY_ROOT: string = path.resolve(__dirname, "..", "..", "..");
+
+const STORAGE_KEY: string = "oneuptime-sensitive-url-token";
+
+const PARTIAL_PATH: string = path.join(
+  REPOSITORY_ROOT,
+  "Common",
+  "Server",
+  "Views",
+  "Partials",
+  "SensitiveUrlToken.ejs",
+);
+
+const CLIENT_UTIL_PATH: string = path.join(
+  REPOSITORY_ROOT,
+  "Common",
+  "UI",
+  "Utils",
+  "SensitiveUrlToken.ts",
+);
+
+interface Origin {
+  label: string;
+  viewPath: string;
+  // The first external script tag on the page; the bootstrap must precede it.
+  firstExternalScript: string;
+  // A token-bearing URL served by this origin, and the path it must become.
+  tokenUrl: string;
+  cleanedPath: string;
+  // A page on the same origin that carries no token.
+  ordinaryUrl: string;
+}
+
+const ORIGINS: Array<Origin> = [
+  {
+    label: "accounts",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "App",
+      "FeatureSet",
+      "Accounts",
+      "views",
+      "index.ejs",
+    ),
+    firstExternalScript: '<script src="/accounts/env.js">',
+    tokenUrl:
+      "https://oneuptime.com/accounts/reset-password/1522e9be-84cd-44b7-8fc9-606545bfa732",
+    cleanedPath: "/accounts/reset-password",
+    ordinaryUrl: "https://oneuptime.com/accounts/login",
+  },
+  {
+    label: "status page",
+    viewPath: path.join(
+      REPOSITORY_ROOT,
+      "App",
+      "FeatureSet",
+      "StatusPage",
+      "views",
+      "index.ejs",
+    ),
+    firstExternalScript: '<script src="/status-page/env.js">',
+    tokenUrl:
+      "https://status.example/reset-password/1522e9be-84cd-44b7-8fc9-606545bfa732",
+    cleanedPath: "/reset-password",
+    ordinaryUrl: "https://status.example/login",
+  },
+];
+
+const TOKEN: string = "1522e9be-84cd-44b7-8fc9-606545bfa732";
+
+function render(origin: Origin, enableGoogleTagManager: boolean): string {
+  return ejs.render(
+    fs.readFileSync(origin.viewPath, "utf8"),
+    { title: "Acme Status", enableGoogleTagManager },
+    { filename: origin.viewPath },
+  );
+}
+
+function loadPage(origin: Origin, url: string): JSDOM {
+  return new JSDOM(render(origin, true), {
+    url,
+    runScripts: "dangerously",
+    beforeParse: (pageWindow: JSDOM["window"]): void => {
+      (pageWindow as any).tailwind = { config: {} };
+    },
+  });
+}
+
+function gtmScript(page: JSDOM): Element | null {
+  return page.window.document.querySelector(
+    'script[src^="https://www.googletagmanager.com/gtm.js"]',
+  );
+}
+
+describe("the sensitive-URL-token partial", () => {
+  it("keeps its route list in step with the client that reads the stash", () => {
+    /*
+     * The partial decides which paths to strip; Common/UI/Utils/SensitiveUrlToken
+     * decides which paths still hold a token when the strip did not run. A route
+     * added to one and not the other either leaks (stripped nowhere) or breaks
+     * the flow (stripped, then unreadable).
+     */
+    const routeList: string = `["reset-password", "verify-email"]`;
+
+    expect(fs.readFileSync(PARTIAL_PATH, "utf8")).toContain(routeList);
+    expect(fs.readFileSync(CLIENT_UTIL_PATH, "utf8")).toContain(routeList);
+  });
+
+  it("agrees with the client on the storage key", () => {
+    expect(fs.readFileSync(PARTIAL_PATH, "utf8")).toContain(`"${STORAGE_KEY}"`);
+    expect(fs.readFileSync(CLIENT_UTIL_PATH, "utf8")).toContain(
+      `"${STORAGE_KEY}"`,
+    );
+  });
+});
+
+for (const origin of ORIGINS) {
+  describe(`${origin.label}: sensitive URL tokens`, () => {
+    it("runs the bootstrap before any external script and declares no-referrer", () => {
+      const html: string = render(origin, true);
+      const bootstrap: number = html.indexOf(
+        `var STORAGE_KEY = "${STORAGE_KEY}"`,
+      );
+
+      expect(bootstrap).toBeGreaterThan(-1);
+      expect(html).toContain('<meta name="referrer" content="no-referrer" />');
+
+      /*
+       * Ordering is the whole mechanism. Anything that loads before the
+       * bootstrap sees the token.
+       */
+      expect(html.indexOf(origin.firstExternalScript)).toBeGreaterThan(
+        bootstrap,
+      );
+      expect(html.indexOf("googletagmanager.com/gtm.js")).toBeGreaterThan(
+        bootstrap,
+      );
+    });
+
+    it("moves the token out of the address bar before page scripts run", () => {
+      const page: JSDOM = loadPage(origin, origin.tokenUrl);
+
+      expect(page.window.location.pathname).toBe(origin.cleanedPath);
+      expect(page.window.location.href).not.toContain(TOKEN);
+      expect(page.window.sessionStorage.getItem(STORAGE_KEY)).toBe(TOKEN);
+
+      page.window.close();
+    });
+
+    it("still starts analytics once the token is out of the URL", () => {
+      /*
+       * The fix must not cost the signup funnel its reporting. Stripping the
+       * token is what makes the page safe to measure, not switching measurement
+       * off.
+       */
+      const page: JSDOM = loadPage(origin, origin.tokenUrl);
+
+      expect(
+        (page.window as any).__ONEUPTIME_SENSITIVE_URL_TOKEN_PENDING__,
+      ).toBe(false);
+      expect(gtmScript(page)).not.toBeNull();
+
+      page.window.close();
+    });
+
+    it("suppresses analytics entirely when the token cannot be removed", () => {
+      /*
+       * Fail closed. If replaceState is unavailable, the token is still in the
+       * URL every tag is about to report, so no tag may load. Losing a page
+       * view is the cheaper failure.
+       */
+      const page: JSDOM = new JSDOM(render(origin, true), {
+        url: origin.tokenUrl,
+        runScripts: "dangerously",
+        beforeParse: (pageWindow: JSDOM["window"]): void => {
+          (pageWindow as any).tailwind = { config: {} };
+          pageWindow.history.replaceState = (): void => {
+            throw new Error("replaceState unavailable");
+          };
+        },
+      });
+
+      expect(page.window.location.href).toContain(TOKEN);
+      expect(
+        (page.window as any).__ONEUPTIME_SENSITIVE_URL_TOKEN_PENDING__,
+      ).toBe(true);
+      expect(gtmScript(page)).toBeNull();
+
+      page.window.close();
+    });
+
+    it("leaves ordinary pages untouched", () => {
+      const page: JSDOM = loadPage(origin, origin.ordinaryUrl);
+
+      expect(page.window.sessionStorage.getItem(STORAGE_KEY)).toBeNull();
+      expect(
+        (page.window as any).__ONEUPTIME_SENSITIVE_URL_TOKEN_PENDING__,
+      ).toBe(false);
+      expect(gtmScript(page)).not.toBeNull();
+
+      page.window.close();
+    });
+  });
+}
+
+describe("accounts: email verification tokens", () => {
+  const accounts: Origin = ORIGINS[0]!;
+
+  it("strips the verify-email token too", () => {
+    const page: JSDOM = loadPage(
+      accounts,
+      `https://oneuptime.com/accounts/verify-email/${TOKEN}`,
+    );
+
+    expect(page.window.location.pathname).toBe("/accounts/verify-email");
+    expect(page.window.sessionStorage.getItem(STORAGE_KEY)).toBe(TOKEN);
+
+    page.window.close();
+  });
+
+  it("preserves the query string and fragment around the stripped token", () => {
+    const page: JSDOM = loadPage(
+      accounts,
+      `https://oneuptime.com/accounts/reset-password/${TOKEN}?utm_source=email#top`,
+    );
+
+    expect(page.window.location.pathname).toBe("/accounts/reset-password");
+    expect(page.window.location.search).toBe("?utm_source=email");
+    expect(page.window.location.hash).toBe("#top");
+
+    page.window.close();
+  });
+});

package/Tests/App/StatusPage/StatusPageIndexPageRobotsMeta.test.ts

@@ -37,7 +37,17 @@ const NOINDEX_META: RegExp =
   /<meta\s+name="robots"\s+content="noindex,\s*nofollow">/;
 
 function renderIndexPage(variables: JSONObject): string {
-  return ejs.render(fs.readFileSync(INDEX_TEMPLATE, "utf8"), variables);
+  return ejs.render(
+    fs.readFileSync(INDEX_TEMPLATE, "utf8"),
+    variables,
+    /*
+     * The template opens <head> with an include of the shared
+     * sensitive-URL-token partial, and ejs resolves that relative path against
+     * `filename`. Without it every render below throws on the include rather
+     * than reaching the robots tag it means to assert.
+     */
+    { filename: INDEX_TEMPLATE },
+  );
 }
 
 describe("the status page index template", () => {

package/Tests/App/StatusPage/StatusPageLoginCodeBootstrap.test.ts

@@ -20,10 +20,15 @@ const INDEX_TEMPLATE: string = path.join(
 const STORAGE_KEY: string = "oneuptime-status-page-login-code";
 
 function renderIndexPage(enableGoogleTagManager: boolean): string {
-  return ejs.render(fs.readFileSync(INDEX_TEMPLATE, "utf8"), {
-    title: "Acme Status",
-    enableGoogleTagManager,
-  });
+  return ejs.render(
+    fs.readFileSync(INDEX_TEMPLATE, "utf8"),
+    {
+      title: "Acme Status",
+      enableGoogleTagManager,
+    },
+    // The template includes the shared sensitive-URL-token partial.
+    { filename: INDEX_TEMPLATE },
+  );
 }
 
 function loadPage(url: string, existingCode?: string): JSDOM {

package/Tests/Models/DatabaseModels/ModelRegistryInvariants.test.ts

@@ -217,62 +217,47 @@ describe("Database model registry", () => {
    * than through the schema -- so a name that matches no declared column is a
    * silent misfire rather than an error.
    *
-   * Both halves misfire differently and both are live today:
+   * Both halves misfire differently:
    *
    *  - A source that does not exist reads `undefined`, and Slug.getSlug(null)
    *    answers with a slug built from Faker.generateName(). The row still gets
    *    a unique, non-null slug, so nothing fails -- the slug is simply a
-   *    random pair of words instead of the object's own name. Incident is the
-   *    clearest case: it slugifies "name" while its title column is `title`,
+   *    random pair of words instead of the object's own name. Incident was the
+   *    clearest case: it slugified "name" while its title column is `title`,
    *    and its own slug column documents the example
    *    "database-connection-failure-in-production", which is a slugified
-   *    TITLE. Every incident URL in the product is a random name instead.
+   *    TITLE. Every incident created before the fix carries a random name.
    *
    *  - A destination that does not exist has the slug assigned to a property
    *    the table has no column for, and TypeORM drops it on insert. The whole
    *    decorator is dead configuration.
    *
-   * The fourteen below are pre-existing and are recorded as a baseline rather
-   * than fixed here, because each needs its own judgement: the four that mean
-   * `title` are a rename, but the nine with no slug column at all are either a
-   * missing column (which needs a migration) or a decorator that should be
-   * deleted, and picking wrong is a schema change made on a guess.
+   * Fourteen models were recorded here as a baseline and have all since been
+   * fixed, so the list is empty. It is kept, rather than deleted along with
+   * its last entry, because the pair of tests below it is the ratchet: the
+   * first fails on a new misfire, the second fails on an entry left behind
+   * after a fix.
+   *
+   * Where each of the fourteen went, and why:
+   *
+   *  - The four event models (Incident, ScheduledMaintenance and the two
+   *    templates) had a real slug column and a source naming a column they do
+   *    not have, so the slug landed and was random. Their intended sources
+   *    are pinned in EXPECTED_SLUG_SOURCES below and asserted behaviourally
+   *    in Tests/Server/Services/DatabaseServiceGenerateSlug.test.ts.
+   *
+   *  - Domain, likewise, but its identity is the `domain` column.
+   *
+   *  - The nine with no slug column had their decorator deleted rather than a
+   *    column added. Nothing in the product reads any of these slugs -- the
+   *    only slug consumed anywhere is Monitor's, as a template variable --
+   *    and the alternative was adding a NOT NULL column to a live table with
+   *    a backfill, for a value with no reader.
    *
    * THIS LIST MUST ONLY EVER SHRINK. A new entry means a new misfire; a stale
    * entry means somebody fixed one and this test says so.
    */
-  const KNOWN_SLUG_MISFIRES: Array<string> = [
-    /*
-     * Source should almost certainly be `title` -- each of these has a title
-     * column and a real slug column, so the slug lands but is random.
-     */
-    "Incident.slugifyColumn = name",
-    "IncidentTemplate.slugifyColumn = name",
-    "ScheduledMaintenance.slugifyColumn = name",
-    "ScheduledMaintenanceTemplate.slugifyColumn = name",
-
-    /* No name column and no title column; the slug source is `domain`. */
-    "Domain.slugifyColumn = name",
-
-    /* Has the source column, but no slug column to write to. */
-    "AlertState.saveSlugToColumn = slug",
-    "MetricType.saveSlugToColumn = slug",
-    "StatusPageAnnouncementTemplate.saveSlugToColumn = slug",
-
-    /* Neither column exists: the decorator does nothing at all. */
-    "MonitorStatusTimeline.slugifyColumn = name",
-    "MonitorStatusTimeline.saveSlugToColumn = slug",
-    "MonitorTest.slugifyColumn = name",
-    "MonitorTest.saveSlugToColumn = slug",
-    "StatusPageAnnouncement.slugifyColumn = name",
-    "StatusPageAnnouncement.saveSlugToColumn = slug",
-    "StatusPagePrivateUser.slugifyColumn = name",
-    "StatusPagePrivateUser.saveSlugToColumn = slug",
-    "StatusPageResource.slugifyColumn = name",
-    "StatusPageResource.saveSlugToColumn = slug",
-    "StatusPageSubscriber.slugifyColumn = name",
-    "StatusPageSubscriber.saveSlugToColumn = slug",
-  ];
+  const KNOWN_SLUG_MISFIRES: Array<string> = [];
 
   const findSlugMisfires: () => Array<string> = (): Array<string> => {
     const dangling: Array<string> = [];
@@ -321,6 +306,95 @@ describe("Database model registry", () => {
     expect(stale).toEqual([]);
   });
 
+  /*
+   * The sweep above only proves a slug source names a column that EXISTS. It
+   * cannot see the other half of the same mistake: a decorator naming a real
+   * column that is not the one the model means. Incident, before the fix,
+   * would have passed such a sweep the moment "name" were changed to
+   * "description".
+   *
+   * So the models whose source was corrected are pinned by name, with the
+   * evidence for each choice. Behaviour is asserted separately in
+   * Tests/Server/Services/DatabaseServiceGenerateSlug.test.ts; this is the
+   * declaration.
+   */
+  const EXPECTED_SLUG_SOURCES: Record<string, string> = {
+    /*
+     * The slug column's documented example is
+     * "database-connection-failure-in-production" -- the title column's
+     * example, slugified.
+     */
+    Incident: "title",
+    ScheduledMaintenance: "title",
+
+    /*
+     * Both template models carry a title AND a templateName, so this is a
+     * choice between two real columns rather than the only one available.
+     * They mean templateName: each documents a slug example that is its
+     * templateName example slugified ("Server Outage Template" ->
+     * "server-outage-template", "Database Upgrade Template" ->
+     * "database-upgrade-template"), and the title is the incident or event
+     * the template produces rather than anything unique to the template.
+     */
+    IncidentTemplate: "templateName",
+    ScheduledMaintenanceTemplate: "templateName",
+
+    /* Domain has neither a name nor a title; the domain is its identity. */
+    Domain: "domain",
+  };
+
+  it("slugifies the column each model actually means", () => {
+    const declared: Record<string, string | null> = {};
+
+    for (const className of Object.keys(EXPECTED_SLUG_SOURCES)) {
+      const entry: RegisteredModel | undefined = REGISTERED_MODELS.find(
+        (candidate: RegisteredModel) => {
+          return candidate.className === className;
+        },
+      );
+
+      /*
+       * A renamed or unregistered model shows up as a null rather than as a
+       * silently skipped expectation.
+       */
+      declared[className] = entry ? entry.slugifyColumn : null;
+    }
+
+    expect(declared).toEqual(EXPECTED_SLUG_SOURCES);
+  });
+
+  /*
+   * The nine models whose decorator named columns they do not have at all.
+   * Deleting the decorator is what fixed them, so a copy-paste that puts one
+   * back has to fail here as well as in the sweep above.
+   */
+  const MODELS_WITH_NO_SLUG: Array<string> = [
+    "AlertState",
+    "MetricType",
+    "MonitorStatusTimeline",
+    "MonitorTest",
+    "StatusPageAnnouncement",
+    "StatusPageAnnouncementTemplate",
+    "StatusPagePrivateUser",
+    "StatusPageResource",
+    "StatusPageSubscriber",
+  ];
+
+  it("leaves the models with no slug column unslugified", () => {
+    const configured: Array<string> = REGISTERED_MODELS.filter(
+      (entry: RegisteredModel) => {
+        return (
+          MODELS_WITH_NO_SLUG.includes(entry.className) &&
+          Boolean(entry.slugifyColumn || entry.saveSlugToColumn)
+        );
+      },
+    ).map((entry: RegisteredModel) => {
+      return entry.className;
+    });
+
+    expect(configured).toEqual([]);
+  });
+
   /*
    * A model that slugifies a column must have somewhere to put the result.
    * Only the pair together produces a slug; either one alone is dead

package/Tests/Models/NetworkSiteHierarchy.test.ts

@@ -6,13 +6,15 @@
  * to break silently — a lazy-arrow typo or a decorator reorder leaves tsc
  * green while TypeORM builds a relation to the wrong target. The FK actions
  * are pinned too, because they carry the deletion semantics of the whole
- * hierarchy: deleting a parent must orphan (SET NULL) its children, not
- * cascade the subtree away, while timelines/links/rules die with their site.
+ * hierarchy: deleting a parent with surviving children must be rejected, not
+ * silently detach an invalid subtree or cascade it away, while
+ * timelines/links/rules still die with their site.
  */
 
 import NetworkDevice from "../../Models/DatabaseModels/NetworkDevice";
 import NetworkEndpoint from "../../Models/DatabaseModels/NetworkEndpoint";
 import NetworkSite from "../../Models/DatabaseModels/NetworkSite";
+import NetworkSiteType from "../../Models/DatabaseModels/NetworkSiteType";
 import NetworkSiteAssignmentRule from "../../Models/DatabaseModels/NetworkSiteAssignmentRule";
 import NetworkSiteLink from "../../Models/DatabaseModels/NetworkSiteLink";
 import NetworkSiteStatusTimeline from "../../Models/DatabaseModels/NetworkSiteStatusTimeline";
@@ -58,7 +60,7 @@ describe("NetworkSite self-nesting hierarchy", () => {
     expect(metadata.manyToOneRelationColumn).toBe("parentSiteId");
   });
 
-  test("parentSite FK resolves to NetworkSite and orphans children with SET NULL", () => {
+  test("parentSite FK resolves to NetworkSite and protects surviving children", () => {
     const relation: RelationMetadataArgs | undefined = relationArgs(
       NetworkSite,
       "parentSite",
@@ -66,7 +68,42 @@ describe("NetworkSite self-nesting hierarchy", () => {
 
     expect(relation).toBeDefined();
     expect(relationTarget(relation)).toBe(NetworkSite);
-    expect(relation?.options.onDelete).toBe("SET NULL");
+    expect(relation?.options.onDelete).toBe("NO ACTION");
+  });
+
+  test("site type relations protect surviving references at statement end", () => {
+    const parentTypeRelation: RelationMetadataArgs | undefined = relationArgs(
+      NetworkSiteType,
+      "parentNetworkSiteType",
+    );
+    const siteTypeRelation: RelationMetadataArgs | undefined = relationArgs(
+      NetworkSite,
+      "networkSiteType",
+    );
+
+    expect(relationTarget(parentTypeRelation)).toBe(NetworkSiteType);
+    expect(parentTypeRelation?.options.onDelete).toBe("NO ACTION");
+    expect(relationTarget(siteTypeRelation)).toBe(NetworkSiteType);
+    expect(siteTypeRelation?.options.onDelete).toBe("NO ACTION");
+  });
+
+  test("project deletion can cascade through sites and site types together", () => {
+    const siteProjectRelation: RelationMetadataArgs | undefined = relationArgs(
+      NetworkSite,
+      "project",
+    );
+    const typeProjectRelation: RelationMetadataArgs | undefined = relationArgs(
+      NetworkSiteType,
+      "project",
+    );
+    const siteTypeRelation: RelationMetadataArgs | undefined = relationArgs(
+      NetworkSite,
+      "networkSiteType",
+    );
+
+    expect(siteProjectRelation?.options.onDelete).toBe("CASCADE");
+    expect(typeProjectRelation?.options.onDelete).toBe("CASCADE");
+    expect(siteTypeRelation?.options.onDelete).toBe("NO ACTION");
   });
 
   test("NetworkDevice.site relation targets NetworkSite with SET NULL", () => {