@oneuptime/common 12.0.34 → 13.0.1

package/Tests/Server/Types/Database/Permissions/ReadBlockPermission.test.ts

@@ -1,14 +1,22 @@
 import ReadPermission from "../../../../../Server/Types/Database/Permissions/ReadPermission";
+import QueryUtil from "../../../../../Server/Types/Database/QueryUtil";
 import Incident from "../../../../../Models/DatabaseModels/Incident";
 import Monitor from "../../../../../Models/DatabaseModels/Monitor";
 import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Includes from "../../../../../Types/BaseDatabase/Includes";
+import IncludesAnyOfGroups from "../../../../../Types/BaseDatabase/IncludesAnyOfGroups";
+import IncludesNone from "../../../../../Types/BaseDatabase/IncludesNone";
+import EqualTo from "../../../../../Types/BaseDatabase/EqualTo";
+import NotEqual from "../../../../../Types/BaseDatabase/NotEqual";
+import Search from "../../../../../Types/BaseDatabase/Search";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../../../../Types/ObjectID";
 import Permission, {
   UserPermission,
   UserTenantAccessPermission,
 } from "../../../../../Types/Permission";
-import { FindOperator } from "typeorm";
+import { FindOperator, In } from "typeorm";
 
 describe("ReadPermission.checkReadBlockPermission", () => {
   const projectId: ObjectID = ObjectID.generate();
@@ -16,6 +24,26 @@ describe("ReadPermission.checkReadBlockPermission", () => {
   const blockedLabelA: ObjectID = ObjectID.generate();
   const blockedLabelB: ObjectID = ObjectID.generate();
 
+  beforeEach(() => {
+    jest
+      .spyOn(QueryUtil, "getManyToManyRelationMetadata")
+      .mockImplementation((modelType: any, column: string) => {
+        if (column !== "labels") {
+          return null;
+        }
+        return {
+          joinTableName:
+            modelType === Monitor ? "MonitorLabel" : "IncidentLabel",
+          ownerColumnName: modelType === Monitor ? "monitorId" : "incidentId",
+          relationColumnName: "labelId",
+        };
+      });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   function makeProps(
     permissions: Array<UserPermission>,
   ): DatabaseCommonInteractionProps {
@@ -59,18 +87,21 @@ describe("ReadPermission.checkReadBlockPermission", () => {
   }
 
   /*
-   * The rewrite has to SUBTRACT the blocked labels, not restrict the read to
-   * them. Asserting only that some FindOperator landed on the column would
-   * pass just as happily if notInOrNull() were swapped for its including
-   * counterpart, so read the rendered SQL back and return the ids it denies.
+   * Read the owner-row exclusion predicate, including the relation table it
+   * uses, so the test checks that label blocks are composed independently of
+   * the caller's relation filters.
    */
-  function deniedLabelIds(operator: any): Array<string> {
+  function deniedLabelIds(
+    operator: any,
+    joinTableName: string = "IncidentLabel",
+  ): Array<string> {
     expect(operator).toBeInstanceOf(FindOperator);
     expect(operator.type).toBe("raw");
 
-    const sql: string = operator.getSql("labelId");
-    expect(sql).toContain("NOT IN");
-    expect(sql).toContain("IS NULL");
+    const sql: string = operator.getSql("ownerId");
+    expect(sql).toContain("ownerId NOT IN (SELECT");
+    expect(sql).toContain(`FROM "${joinTableName}"`);
+    expect(sql).toContain(`WHERE "${joinTableName}"."labelId" IN (`);
 
     return Object.values(
       operator.objectLiteralParameters as Record<string, Array<string>>,
@@ -136,8 +167,8 @@ describe("ReadPermission.checkReadBlockPermission", () => {
       makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
     );
 
-    expect(result.query.labels).toBeDefined();
-    expect(deniedLabelIds(result.query.labels._id)).toEqual([
+    expect(result.query.labels).toBeUndefined();
+    expect(deniedLabelIds(result.query._id)).toEqual([
       blockedLabelA.toString(),
     ]);
     // The caller's own filters survive the rewrite.
@@ -156,7 +187,7 @@ describe("ReadPermission.checkReadBlockPermission", () => {
       ]),
     );
 
-    expect(deniedLabelIds(result.query.labels._id)).toEqual([
+    expect(deniedLabelIds(result.query._id)).toEqual([
       blockedLabelA.toString(),
       blockedLabelB.toString(),
     ]);
@@ -204,9 +235,225 @@ describe("ReadPermission.checkReadBlockPermission", () => {
       makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
     );
 
-    expect(result.query.labels).toBeDefined();
-    expect(deniedLabelIds(result.query.labels._id)).toEqual([
+    expect(result.query.labels).toBeUndefined();
+    expect(deniedLabelIds(result.query._id, "MonitorLabel")).toEqual([
+      blockedLabelA.toString(),
+    ]);
+  });
+
+  it("preserves an existing label selection while adding the block condition", async () => {
+    const labels: Includes = new Includes([ObjectID.generate().toString()]);
+    const query: any = { projectId, labels };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Monitor,
+      query,
+      makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+    );
+
+    expect(result.query.labels).toBe(labels);
+    expect(result.query.projectId).toBe(projectId);
+    expect(deniedLabelIds(result.query._id, "MonitorLabel")).toEqual([
+      blockedLabelA.toString(),
+    ]);
+  });
+
+  it("preserves grouped dashboard labels, project, status, and the selected record through query serialization", async () => {
+    const monitorId: ObjectID = ObjectID.generate();
+    const fixedLabelId: string = ObjectID.generate().toString();
+    const selectedLabelId: string = ObjectID.generate().toString();
+    const labels: IncludesAnyOfGroups = new IncludesAnyOfGroups([
+      [fixedLabelId],
+      [selectedLabelId],
+    ]);
+    const currentMonitorStatusId: ObjectID = ObjectID.generate();
+    const query: any = {
+      projectId,
+      _id: monitorId,
+      labels,
+      currentMonitorStatusId,
+    };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Monitor,
+      query,
+      makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+    );
+
+    expect(result.query.labels).toBe(labels);
+    expect(result.query.projectId).toBe(projectId);
+    expect(result.query.currentMonitorStatusId).toBe(currentMonitorStatusId);
+    expect(result.query._id.type).toBe("and");
+    expect(result.query._id.value[0].type).toBe("raw");
+    expect(
+      Object.values(result.query._id.value[0].objectLiteralParameters),
+    ).toEqual([monitorId.toString()]);
+    expect(deniedLabelIds(result.query._id.value[1], "MonitorLabel")).toEqual([
       blockedLabelA.toString(),
     ]);
+
+    const recordAndBlockCondition: FindOperator<any> = result.query._id;
+    const serialized: any = QueryUtil.serializeQuery(Monitor, result.query);
+    expect(serialized.labels).toBeUndefined();
+    expect(serialized._id.type).toBe("and");
+    const clauses: Array<FindOperator<any>> = serialized._id.value;
+    expect(clauses).toHaveLength(3);
+    expect(clauses[0]).toBe(recordAndBlockCondition);
+    expect(Object.values(clauses[1]!.objectLiteralParameters || {})).toEqual([
+      [fixedLabelId],
+    ]);
+    expect(Object.values(clauses[2]!.objectLiteralParameters || {})).toEqual([
+      [selectedLabelId],
+    ]);
+    expect(Object.values(serialized.projectId.objectLiteralParameters)).toEqual(
+      [projectId.toString()],
+    );
+    expect(
+      Object.values(serialized.currentMonitorStatusId.objectLiteralParameters),
+    ).toEqual([currentMonitorStatusId.toString()]);
+  });
+
+  it("combines with an existing database ID condition without replacing it", async () => {
+    const idFilter: FindOperator<string> = In([ObjectID.generate().toString()]);
+    const query: any = { projectId, _id: idFilter };
+
+    const result: any = await ReadPermission.checkReadBlockPermission(
+      Incident,
+      query,
+      makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+    );
+
+    expect(result.query._id.type).toBe("and");
+    expect(result.query._id.value[0]).toBe(idFilter);
+    expect(deniedLabelIds(result.query._id.value[1])).toEqual([
+      blockedLabelA.toString(),
+    ]);
+  });
+
+  const requestedId: string = ObjectID.generate().toString();
+
+  it.each([
+    {
+      name: "EqualTo",
+      idFilter: new EqualTo(requestedId),
+      expectedSql: "Monitor._id = :",
+      expectedParameters: [requestedId],
+    },
+    {
+      name: "IncludesNone",
+      idFilter: new IncludesNone([new ObjectID(requestedId)]),
+      expectedSql: "Monitor._id NOT IN (",
+      expectedParameters: [[requestedId]],
+    },
+    {
+      name: "NotEqual",
+      idFilter: new NotEqual(requestedId),
+      expectedSql: "Monitor._id != :",
+      expectedParameters: [requestedId],
+    },
+    {
+      name: "Search",
+      idFilter: new Search(requestedId),
+      expectedSql: "CAST(Monitor._id AS TEXT) ILIKE",
+      expectedParameters: [`%${requestedId}%`],
+    },
+    {
+      name: "Includes",
+      idFilter: new Includes([requestedId]),
+      expectedSql: "Monitor._id IN (",
+      expectedParameters: [[requestedId]],
+    },
+  ])(
+    "preserves the $name ID filter when composing read label restrictions",
+    async ({
+      idFilter,
+      expectedSql,
+      expectedParameters,
+    }: {
+      idFilter: unknown;
+      expectedSql: string;
+      expectedParameters: Array<unknown>;
+    }): Promise<void> => {
+      const labels: IncludesAnyOfGroups = new IncludesAnyOfGroups([
+        [ObjectID.generate().toString()],
+        [ObjectID.generate().toString()],
+      ]);
+      const query: any = { projectId, _id: idFilter, labels };
+
+      const result: any = await ReadPermission.checkReadBlockPermission(
+        Monitor,
+        query,
+        makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+      );
+
+      expect(result.query.labels).toBe(labels);
+      expect(result.query._id.type).toBe("and");
+      const callerCondition: FindOperator<unknown> = result.query._id.value[0];
+      expect(callerCondition.type).toBe("raw");
+      expect(callerCondition.getSql?.("Monitor._id")).toContain(expectedSql);
+      expect(
+        Object.values(callerCondition.objectLiteralParameters || {}),
+      ).toEqual(expectedParameters);
+      expect(deniedLabelIds(result.query._id.value[1], "MonitorLabel")).toEqual(
+        [blockedLabelA.toString()],
+      );
+
+      const recordAndBlockCondition: FindOperator<unknown> = result.query._id;
+      const serialized: any = QueryUtil.serializeQuery(Monitor, result.query);
+      expect(serialized._id.value[0]).toBe(recordAndBlockCondition);
+      expect(serialized._id.value).toHaveLength(3);
+    },
+  );
+
+  it("rejects an unsupported ID condition before changing the caller's query", async () => {
+    const idFilter: Record<string, unknown> = { comparison: "unsupported" };
+    const labels: Includes = new Includes([ObjectID.generate().toString()]);
+    const query: any = { projectId, _id: idFilter, labels };
+
+    await expect(
+      ReadPermission.checkReadBlockPermission(
+        Monitor,
+        query,
+        makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+      ),
+    ).rejects.toThrow("unsupported ID filter");
+    expect(query).toEqual({ projectId, _id: idFilter, labels });
+  });
+
+  it("reports missing relation metadata without changing the caller's filters", async () => {
+    jest
+      .spyOn(QueryUtil, "getManyToManyRelationMetadata")
+      .mockReturnValue(null);
+    const labels: IncludesAnyOfGroups = new IncludesAnyOfGroups([
+      [ObjectID.generate().toString()],
+      [ObjectID.generate().toString()],
+    ]);
+    const monitorId: ObjectID = ObjectID.generate();
+    const query: any = { projectId, labels, _id: monitorId };
+
+    await expect(
+      ReadPermission.checkReadBlockPermission(
+        Monitor,
+        query,
+        makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+      ),
+    ).rejects.toThrow(BadDataException);
+    expect(query).toEqual({ projectId, labels, _id: monitorId });
+  });
+
+  it("reports an unavailable access-control column before composing label restrictions", async () => {
+    jest
+      .spyOn(Monitor.prototype, "getAccessControlColumn")
+      .mockReturnValue(null);
+    const query: any = { projectId };
+
+    await expect(
+      ReadPermission.checkReadBlockPermission(
+        Monitor,
+        query,
+        makeProps([blockPermission(Permission.ProjectMember, [blockedLabelA])]),
+      ),
+    ).rejects.toThrow("access-control relation metadata");
+    expect(query).toEqual({ projectId });
   });
 });

package/Tests/Server/Types/Database/Permissions/WorkflowVariableColumnPermission.test.ts

@@ -157,6 +157,71 @@ describe("ColumnPermissions on WorkflowVariable", () => {
         checkUpdate({ content: "rotated-token" }, [Permission.ProjectOwner]),
       ).not.toThrow();
     });
+
+    /*
+     * isSecret used to be create-only (update: []), which had two consequences
+     * and neither of them was safety. On the server a request that flipped the
+     * toggle was refused outright; in the dashboard the edit form silently
+     * dropped the field, because ModelForm builds the update form from each
+     * column's UPDATE list (getFieldPermissions) - so a variable saved without
+     * the toggle kept leaking its value into every workflow run log, and the
+     * only fix was to delete it and create it again.
+     *
+     * isSecret is not an encryption switch. RunWorkflow reads it once, to pick
+     * which values to substring-replace with [REDACTED] before the log is
+     * persisted (getSecretWorkflowVariableValues), so flipping it changes what
+     * future runs write and nothing else.
+     */
+    it("lets a key with EditWorkflowVariable flip the secret toggle", () => {
+      expect(
+        checkUpdate({ isSecret: "true" } as Partial<WorkflowVariable>, [
+          Permission.EditWorkflowVariable,
+        ]),
+      ).not.toThrow();
+    });
+
+    it("lets a project admin and a project owner flip the secret toggle", () => {
+      expect(
+        checkUpdate({ isSecret: "true" } as Partial<WorkflowVariable>, [
+          Permission.ProjectAdmin,
+        ]),
+      ).not.toThrow();
+
+      expect(
+        checkUpdate({ isSecret: "true" } as Partial<WorkflowVariable>, [
+          Permission.ProjectOwner,
+        ]),
+      ).not.toThrow();
+    });
+
+    it("still refuses a read-only key that tries to flip the secret toggle", () => {
+      expect(
+        checkUpdate({ isSecret: "true" } as Partial<WorkflowVariable>, [
+          Permission.ReadWorkflowVariable,
+        ]),
+      ).toThrow(BadDataException);
+    });
+
+    /*
+     * Widening isSecret must not widen the columns that decide which project
+     * and which workflow a variable belongs to. Moving a variable between
+     * workflows through an update would change which runs can read it.
+     */
+    it("keeps the scope columns unwritable", () => {
+      expect(
+        checkUpdate({ projectId: ObjectID.generate() }, [
+          Permission.ProjectOwner,
+          Permission.EditWorkflowVariable,
+        ]),
+      ).toThrow(BadDataException);
+
+      expect(
+        checkUpdate({ workflowId: ObjectID.generate() }, [
+          Permission.ProjectOwner,
+          Permission.EditWorkflowVariable,
+        ]),
+      ).toThrow(BadDataException);
+    });
   });
 
   describe("create", () => {
@@ -201,6 +266,36 @@ describe("ColumnPermissions on WorkflowVariable", () => {
       expect(columns.columns).toContain("name");
     });
 
+    /*
+     * The point of the isSecret widening is that the edit form can show the
+     * toggle in its current position. That needs read AND update on the same
+     * key - and it must not have dragged content's read list along with it.
+     */
+    it("reports isSecret as both readable and updatable, while content stays write-only", () => {
+      const userPermissions: Array<UserPermission> = makeUserPermissions([
+        Permission.EditWorkflowVariable,
+        Permission.ReadWorkflowVariable,
+      ]);
+
+      const updatableColumns: Columns =
+        ColumnPermissions.getModelColumnsByPermissions(
+          WorkflowVariable,
+          userPermissions,
+          DatabaseRequestType.Update,
+        );
+
+      const readableColumns: Columns =
+        ColumnPermissions.getModelColumnsByPermissions(
+          WorkflowVariable,
+          userPermissions,
+          DatabaseRequestType.Read,
+        );
+
+      expect(updatableColumns.columns).toContain("isSecret");
+      expect(readableColumns.columns).toContain("isSecret");
+      expect(readableColumns.columns).not.toContain("content");
+    });
+
     it("reports content as updatable but not readable for the same key", () => {
       const userPermissions: Array<UserPermission> = makeUserPermissions([
         Permission.EditWorkflowVariable,

package/Tests/Server/Types/Database/QueryUtilIncludesAnyOfGroups.test.ts

@@ -0,0 +1,169 @@
+import Monitor from "../../../../Models/DatabaseModels/Monitor";
+import QueryUtil from "../../../../Server/Types/Database/QueryUtil";
+import IncludesAnyOfGroups from "../../../../Types/BaseDatabase/IncludesAnyOfGroups";
+import Includes from "../../../../Types/BaseDatabase/Includes";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import ObjectID from "../../../../Types/ObjectID";
+import { FindOperator, In } from "typeorm";
+
+const relation: {
+  joinTableName: string;
+  ownerColumnName: string;
+  relationColumnName: string;
+} = {
+  joinTableName: "MonitorLabel",
+  ownerColumnName: "monitorId",
+  relationColumnName: "labelId",
+};
+
+describe("QueryUtil — grouped relation membership", () => {
+  beforeEach(() => {
+    jest
+      .spyOn(QueryUtil, "getManyToManyRelationMetadata")
+      .mockReturnValue(relation);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("ANDs independent ANY groups without joining the relation into the row set", () => {
+    const result: Record<string, any> = QueryUtil.serializeQuery(Monitor, {
+      labels: new IncludesAnyOfGroups([
+        ["network", "router"],
+        ["0660", "0661"],
+      ]),
+    });
+    expect(result["labels"]).toBeUndefined();
+    const filter: FindOperator<FindOperator<unknown>[]> = result["_id"];
+    expect(filter.type).toBe("and");
+    expect(filter.value).toHaveLength(2);
+    expect(
+      filter.value.map((child: FindOperator<unknown>) => {
+        return Object.values(child.objectLiteralParameters || {});
+      }),
+    ).toEqual([[["network", "router"]], [["0660", "0661"]]]);
+    for (const child of filter.value) {
+      expect(child.getSql?.("Monitor._id")).toContain(
+        'Monitor._id IN (SELECT "MonitorLabel"."monitorId"',
+      );
+    }
+    const parameterNames: Array<string> = filter.value.flatMap(
+      (child: FindOperator<unknown>) => {
+        return Object.keys(child.objectLiteralParameters || {});
+      },
+    );
+    expect(new Set(parameterNames).size).toBe(2);
+  });
+
+  test("an empty group contributes a false condition", () => {
+    const result: Record<string, any> = QueryUtil.serializeQuery(Monitor, {
+      labels: new IncludesAnyOfGroups([["network"], []]),
+    });
+    expect(result["_id"].value[1].getSql("Monitor._id")).toBe("TRUE = FALSE");
+  });
+
+  test.each(["before", "after"])(
+    "preserves an ObjectID filter placed %s the relation key",
+    (position: string) => {
+      const id: ObjectID = ObjectID.generate();
+      const labels: IncludesAnyOfGroups = new IncludesAnyOfGroups([
+        ["network"],
+        ["0660"],
+      ]);
+      const query: Record<string, unknown> =
+        position === "before" ? { _id: id, labels } : { labels, _id: id };
+      const result: Record<string, any> = QueryUtil.serializeQuery(
+        Monitor,
+        query as any,
+      );
+      expect(result["_id"].type).toBe("and");
+      expect(result["_id"].value).toHaveLength(3);
+      expect(
+        Object.values(result["_id"].value[0].objectLiteralParameters),
+      ).toEqual([id.toString()]);
+    },
+  );
+
+  test.each(["before", "after"])(
+    "preserves an Includes id filter placed %s the relation key",
+    (position: string) => {
+      const ids: Array<string> = [
+        ObjectID.generate().toString(),
+        ObjectID.generate().toString(),
+      ];
+      const labels: IncludesAnyOfGroups = new IncludesAnyOfGroups([
+        ["network"],
+        ["0660"],
+      ]);
+      const query: Record<string, unknown> =
+        position === "before"
+          ? { _id: new Includes(ids), labels }
+          : { labels, _id: new Includes(ids) };
+      const result: Record<string, any> = QueryUtil.serializeQuery(
+        Monitor,
+        query as any,
+      );
+      expect(result["_id"].value[0].type).toBe("raw");
+      expect(
+        Object.values(result["_id"].value[0].objectLiteralParameters),
+      ).toEqual([ids]);
+    },
+  );
+
+  test("preserves existing string and TypeORM id conditions", () => {
+    const id: string = ObjectID.generate().toString();
+    const stringResult: Record<string, any> = QueryUtil.serializeQuery(
+      Monitor,
+      {
+        _id: id,
+        labels: new IncludesAnyOfGroups([["network"], ["0660"]]),
+      },
+    );
+    expect(
+      Object.values(stringResult["_id"].value[0].objectLiteralParameters),
+    ).toEqual([id]);
+    const idFilter: FindOperator<string> = In([id]);
+    const operatorResult: Record<string, any> = QueryUtil.serializeQuery(
+      Monitor,
+      {
+        _id: idFilter as any,
+        labels: new IncludesAnyOfGroups([["network"], ["0660"]]),
+      },
+    );
+    expect(operatorResult["_id"].value[0]).toBe(idFilter);
+  });
+
+  test("retains the project and other widget conditions", () => {
+    const projectId: ObjectID = ObjectID.generate();
+    const result: Record<string, any> = QueryUtil.serializeQuery(Monitor, {
+      projectId,
+      disableActiveMonitoring: false,
+      labels: new IncludesAnyOfGroups([["network"], ["0660"]]),
+    });
+    expect(Object.values(result["projectId"].objectLiteralParameters)).toEqual([
+      projectId.toString(),
+    ]);
+    expect(result["disableActiveMonitoring"]).toBe(false);
+  });
+
+  test.each(["name", "customFields", "project", "missingColumn"])(
+    "rejects the operator on the unsupported %s column",
+    (column: string) => {
+      expect(() => {
+        return QueryUtil.serializeQuery(Monitor, {
+          [column]: new IncludesAnyOfGroups([["network"]]),
+        });
+      }).toThrow(BadDataException);
+    },
+  );
+
+  test("fails clearly when the many-to-many relation cannot be resolved", () => {
+    jest.mocked(QueryUtil.getManyToManyRelationMetadata).mockReturnValue(null);
+    expect(() => {
+      return QueryUtil.serializeQuery(Monitor, {
+        labels: new IncludesAnyOfGroups([["network"], ["0660"]]),
+      });
+    }).toThrow("available many-to-many relation metadata");
+  });
+});