@oneuptime/common 12.0.34 → 13.0.1

package/Tests/Server/API/GitHubWebhookSignature.test.ts

@@ -0,0 +1,368 @@
+import GitHubAPI from "../../../Server/API/GitHubAPI";
+import GitHubWebhookHandler from "../../../Server/Utils/CodeRepository/GitHub/GitHubWebhookHandler";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import { mockRouter } from "./Helpers";
+import { JSONObject } from "../../../Types/JSON";
+import * as crypto from "crypto";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  test,
+} from "@jest/globals";
+
+/*
+ * POST /github/webhook — signature verification against the bytes GitHub
+ * actually sent.
+ *
+ * The handler used to verify `JSON.stringify(req.body)`: the parsed body,
+ * re-serialized by V8. That is not a forgery hole — the HMAC is still keyed on
+ * the webhook secret — but it is wrong in a way that fails CLOSED and silently.
+ * Verification only succeeds when GitHub's payload happens to be a fixed point
+ * of parse-then-stringify, and a payload that is not one is rejected as
+ * "Invalid webhook signature" with nothing to distinguish it from an attack.
+ * Real payloads that are not fixed points are ordinary: a \uXXXX escape in an
+ * issue title, a renormalized number, a numeric-looking object key that V8
+ * reorders, any whitespace at all.
+ *
+ * It is also the parser-differential pattern that signature checks exist to
+ * avoid — verifying a canonicalized re-serialization rather than the signed
+ * bytes means two different byte strings can both "verify".
+ *
+ * Express already captures the true body for exactly this purpose (the
+ * `verify` hook on jsonBodyParserOptions in StartServer). These tests pin that
+ * the route reads it, and that a request without it is refused rather than
+ * guessed at.
+ */
+
+/*
+ * The secret is inlined in the factory rather than referenced from a const.
+ * jest hoists jest.mock() above every import and every declaration, so a
+ * factory that closes over a module-level binding reads it in its temporal
+ * dead zone and the whole suite fails to load.
+ */
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >),
+    GitHubAppName: "oneuptime-test-app",
+    GitHubAppWebhookSecret: "test-webhook-secret",
+  };
+});
+
+const WEBHOOK_SECRET: string = "test-webhook-secret";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    redirect: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+  };
+});
+
+const WEBHOOK_ROUTE: string = "/github/webhook";
+
+function sign(rawBody: string): string {
+  return `sha256=${crypto
+    .createHmac("sha256", WEBHOOK_SECRET)
+    .update(rawBody)
+    .digest("hex")}`;
+}
+
+function errorMessage(): string | undefined {
+  const sendErrorResponse: jest.Mock =
+    Response.sendErrorResponse as unknown as jest.Mock;
+
+  if (sendErrorResponse.mock.calls.length === 0) {
+    return undefined;
+  }
+
+  return (sendErrorResponse.mock.calls[0]![2] as Error).message;
+}
+
+function successBody(): JSONObject | undefined {
+  const sendJsonObjectResponse: jest.Mock =
+    Response.sendJsonObjectResponse as unknown as jest.Mock;
+
+  if (sendJsonObjectResponse.mock.calls.length === 0) {
+    return undefined;
+  }
+
+  return sendJsonObjectResponse.mock.calls[0]![2] as JSONObject;
+}
+
+async function callWebhook(data: {
+  rawBody: string | undefined;
+  parsedBody: JSONObject;
+  signature?: string | undefined;
+  event?: string | undefined;
+  deliveryId?: string | undefined;
+}): Promise<void> {
+  const headers: Record<string, string> = {};
+
+  if (data.signature !== undefined) {
+    headers["x-hub-signature-256"] = data.signature;
+  }
+
+  if (data.event !== undefined) {
+    headers["x-github-event"] = data.event;
+  }
+
+  if (data.deliveryId !== undefined) {
+    headers["x-github-delivery"] = data.deliveryId;
+  }
+
+  const req: ExpressRequest = {
+    params: {},
+    query: {},
+    body: data.parsedBody,
+    rawBody: data.rawBody,
+    headers: headers,
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {
+    send: jest.fn(),
+    json: jest.fn(),
+    status: jest.fn().mockReturnThis(),
+    redirect: jest.fn(),
+  } as unknown as ExpressResponse;
+
+  const next: jest.Mock = jest.fn();
+
+  await mockRouter
+    .match("POST", WEBHOOK_ROUTE)
+    .handlerFunction(req, res, next as unknown as NextFunction);
+}
+
+describe("POST /github/webhook signature verification", () => {
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new GitHubAPI().getRouter();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    /*
+     * The interactive handler has its own test file. Here it is stubbed so
+     * these cases are about the signature gate alone — and so that reaching
+     * the handler at all is itself an assertable outcome.
+     */
+    jest
+      .spyOn(GitHubWebhookHandler, "handleEvent")
+      .mockResolvedValue({ handled: false, outcome: "stubbed" });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("accepts a payload whose signature covers the raw bytes", async () => {
+    const rawBody: string = '{"action":"created","zen":"Keep it simple."}';
+
+    await callWebhook({
+      rawBody: rawBody,
+      parsedBody: JSON.parse(rawBody) as JSONObject,
+      signature: sign(rawBody),
+      event: "ping",
+    });
+
+    expect(errorMessage()).toBeUndefined();
+    expect(successBody()?.["success"]).toBe(true);
+  });
+
+  /*
+   * The regression this file exists for. Both payloads below are legitimate
+   * GitHub deliveries whose bytes do NOT survive parse-then-stringify, so the
+   * old implementation rejected them outright — the integration simply stopped
+   * working for anyone whose issue title contained an escaped character.
+   */
+  describe("payloads that are not JSON.stringify fixed points", () => {
+    test.each([
+      [
+        "a unicode escape in a title",
+        '{"action":"opened","issue":{"title":"caf\\u00e9 crash"}}',
+      ],
+      ["whitespace between tokens", '{"action": "opened", "number": 7}'],
+      ["a renormalizable number", '{"action":"opened","number":1.0}'],
+      [
+        "numeric-looking object keys V8 would reorder",
+        '{"action":"opened","counts":{"2":"b","1":"a"}}',
+      ],
+      ["a forward slash GitHub does not escape", '{"repository":"a/b"}'],
+    ])("accepts %s", async (_name: string, rawBody: string) => {
+      await callWebhook({
+        rawBody: rawBody,
+        parsedBody: JSON.parse(rawBody) as JSONObject,
+        signature: sign(rawBody),
+        event: "issues",
+      });
+
+      expect(errorMessage()).toBeUndefined();
+      expect(successBody()?.["success"]).toBe(true);
+    });
+
+    test("would have been rejected when verifying the re-serialized body", () => {
+      /*
+       * Not a test of the route — a test of the PREMISE. If these payloads
+       * were fixed points, every case above would pass either way and this
+       * file would be pinning nothing.
+       */
+      const rawBodies: Array<string> = [
+        '{"action":"opened","issue":{"title":"caf\\u00e9 crash"}}',
+        '{"action": "opened", "number": 7}',
+        '{"action":"opened","number":1.0}',
+        '{"action":"opened","counts":{"2":"b","1":"a"}}',
+      ];
+
+      for (const rawBody of rawBodies) {
+        expect(JSON.stringify(JSON.parse(rawBody))).not.toEqual(rawBody);
+      }
+    });
+  });
+
+  test("rejects a signature computed over different bytes", async () => {
+    const rawBody: string = '{"action":"opened"}';
+
+    await callWebhook({
+      rawBody: rawBody,
+      parsedBody: JSON.parse(rawBody) as JSONObject,
+      signature: sign('{"action":"closed"}'),
+      event: "issues",
+    });
+
+    expect(errorMessage()).toBe("Invalid webhook signature");
+    expect(GitHubWebhookHandler.handleEvent).not.toHaveBeenCalled();
+  });
+
+  /*
+   * The parser-differential the old implementation allowed: a captured
+   * delivery replayed with cosmetically different bytes. Verifying the real
+   * bytes means the replay's signature no longer matches them.
+   */
+  test("rejects a replay of a valid payload with cosmetically different bytes", async () => {
+    const originalBody: string = '{"action":"opened","number":7}';
+    const replayedBody: string = '{"action":"opened", "number":7}';
+
+    await callWebhook({
+      rawBody: replayedBody,
+      parsedBody: JSON.parse(replayedBody) as JSONObject,
+      signature: sign(originalBody),
+      event: "issues",
+    });
+
+    expect(errorMessage()).toBe("Invalid webhook signature");
+    expect(GitHubWebhookHandler.handleEvent).not.toHaveBeenCalled();
+  });
+
+  test("rejects a request with no signature header", async () => {
+    await callWebhook({
+      rawBody: "{}",
+      parsedBody: {},
+      event: "issues",
+    });
+
+    expect(errorMessage()).toBe("Missing webhook signature");
+    expect(GitHubWebhookHandler.handleEvent).not.toHaveBeenCalled();
+  });
+
+  /*
+   * A missing rawBody means the route was mounted without the json parser that
+   * captures it. Verifying a body we did not capture is not something to guess
+   * at, so it fails closed — and says something an operator can act on rather
+   * than "invalid signature", which would send them hunting for the wrong bug.
+   */
+  test("refuses when the raw body was never captured", async () => {
+    const rawBody: string = '{"action":"opened"}';
+
+    await callWebhook({
+      rawBody: undefined,
+      parsedBody: JSON.parse(rawBody) as JSONObject,
+      signature: sign(rawBody),
+      event: "issues",
+    });
+
+    expect(errorMessage()).toBe("Could not verify webhook signature");
+    expect(GitHubWebhookHandler.handleEvent).not.toHaveBeenCalled();
+  });
+
+  test("passes the event name and delivery id to the interactive handler", async () => {
+    const rawBody: string = '{"action":"created"}';
+
+    await callWebhook({
+      rawBody: rawBody,
+      parsedBody: JSON.parse(rawBody) as JSONObject,
+      signature: sign(rawBody),
+      event: "issue_comment",
+      deliveryId: "delivery-abc-123",
+    });
+
+    expect(GitHubWebhookHandler.handleEvent).toHaveBeenCalledWith(
+      expect.objectContaining({
+        event: "issue_comment",
+        deliveryId: "delivery-abc-123",
+      }),
+    );
+  });
+
+  /*
+   * GitHub redelivers anything that did not answer 2xx, which is WHY
+   * GitHubWebhookHandler.handleEvent swallows its own errors rather than
+   * letting them reach here — an escaping exception would turn one bad payload
+   * into an endless redelivery loop of that exact payload.
+   *
+   * This pins the backstop for the day one escapes anyway: the route's own
+   * catch answers, so express never sees an unhandled rejection and the
+   * installation bookkeeping that already ran is not undone. GitHub will still
+   * retry that delivery, and that is the correct behaviour for a request the
+   * server genuinely failed to process.
+   */
+  test("answers rather than throwing when the interactive handler fails", async () => {
+    (
+      GitHubWebhookHandler.handleEvent as unknown as jest.Mock
+    ).mockRejectedValue(new Error("boom"));
+
+    const rawBody: string = '{"action":"created"}';
+
+    await callWebhook({
+      rawBody: rawBody,
+      parsedBody: JSON.parse(rawBody) as JSONObject,
+      signature: sign(rawBody),
+      event: "issue_comment",
+    });
+
+    /*
+     * The route's own catch answers an error response rather than throwing out
+     * of express — GitHub sees a response either way, which is what stops the
+     * redelivery loop.
+     */
+    expect(errorMessage()).toBe("boom");
+  });
+});

package/Tests/Server/API/GoogleSecOpsConnectionAPI.test.ts

@@ -0,0 +1,248 @@
+import GoogleSecOpsConnectionAPI from "../../../Server/API/GoogleSecOpsConnectionAPI";
+import CommonAPI from "../../../Server/API/CommonAPI";
+import GoogleSecOpsConnection from "../../../Models/DatabaseModels/GoogleSecOpsConnection";
+import GoogleSecOpsConnectionService from "../../../Server/Services/GoogleSecOpsConnectionService";
+import GoogleSecOpsRunExecutor from "../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsRunExecutor";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import Response from "../../../Server/Utils/Response";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+
+type Handler = (
+  req: ExpressRequest,
+  res: ExpressResponse,
+  next: NextFunction,
+) => Promise<void>;
+const recordedRoutes: Array<{ uri: string; handlers: Array<Handler> }> = [];
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return {
+        post: (uri: string, ...handlers: Array<Handler>): void => {
+          recordedRoutes.push({ uri, handlers });
+        },
+        get: jest.fn(),
+        put: jest.fn(),
+        delete: jest.fn(),
+      };
+    },
+  };
+});
+jest.mock("../../../Server/Utils/Response", () => {
+  return { sendJsonObjectResponse: jest.fn() };
+});
+jest.mock(
+  "../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller",
+  () => {
+    return { __esModule: true, default: {} };
+  },
+);
+
+const PROJECT: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const OTHER: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const CONNECTION: ObjectID = new ObjectID(
+  "33333333-3333-4333-8333-333333333333",
+);
+const RUN: ObjectID = new ObjectID("44444444-4444-4444-8444-444444444444");
+let props: DatabaseCommonInteractionProps;
+let handler: Handler;
+let next: jest.Mock;
+let req: ExpressRequest;
+const res: ExpressResponse = {} as ExpressResponse;
+
+function setPermission(permission: Permission, blocked: boolean = false): void {
+  props.userTenantAccessPermission = {
+    [PROJECT.toString()]: {
+      _type: "UserTenantAccessPermission",
+      projectId: PROJECT,
+      permissions: [
+        {
+          _type: "UserPermission",
+          permission,
+          labelIds: [],
+          isBlockPermission: blocked,
+        },
+      ],
+    },
+  };
+}
+
+beforeAll(() => {
+  new GoogleSecOpsConnectionAPI();
+  handler = recordedRoutes
+    .find((route: { uri: string }) => {
+      return route.uri === "/google-secops-connection/:connectionId/run";
+    })!
+    .handlers.slice(-1)[0]!;
+});
+beforeEach(() => {
+  props = { userId: OTHER, tenantId: PROJECT };
+  setPermission(Permission.SecurityAdmin);
+  req = {
+    params: { connectionId: CONNECTION.toString() },
+    body: { type: "test" },
+  } as unknown as ExpressRequest;
+  next = jest.fn();
+  jest
+    .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+    .mockImplementation(async () => {
+      return props;
+    });
+  const connection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+  connection.id = CONNECTION;
+  connection.projectId = PROJECT;
+  jest
+    .spyOn(GoogleSecOpsConnectionService, "findOneBy")
+    .mockResolvedValue(connection);
+  jest
+    .spyOn(GoogleSecOpsConnectionService, "findOneById")
+    .mockResolvedValue(null);
+  jest.spyOn(GoogleSecOpsRunExecutor, "enqueue").mockResolvedValue(RUN);
+});
+afterEach(() => {
+  jest.restoreAllMocks();
+  jest.clearAllMocks();
+});
+
+test("registers both user resolution and required authentication before the operation", () => {
+  const route: { uri: string; handlers: Array<Handler> } = recordedRoutes.find(
+    (item: { uri: string }) => {
+      return item.uri.endsWith("/:connectionId/run");
+    },
+  )!;
+  expect(route.handlers.slice(0, 2)).toEqual([
+    UserMiddleware.getUserMiddleware,
+    UserMiddleware.requireUserAuthentication,
+  ]);
+});
+
+test.each([
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+])(
+  "allows %s and reads no credentials in the API process",
+  async (permission: Permission) => {
+    setPermission(permission);
+    await handler(req, res, next);
+    expect(next).not.toHaveBeenCalled();
+    expect(GoogleSecOpsConnectionService.findOneBy).toHaveBeenCalledWith({
+      query: { _id: CONNECTION.toString(), projectId: PROJECT },
+      select: { _id: true, projectId: true },
+      props,
+    });
+    expect(GoogleSecOpsConnectionService.findOneById).not.toHaveBeenCalled();
+    expect(GoogleSecOpsRunExecutor.enqueue).toHaveBeenCalledWith({
+      projectId: PROJECT,
+      connectionId: CONNECTION,
+      requestedByUserId: OTHER,
+      options: { type: "test" },
+    });
+    expect(Response.sendJsonObjectResponse).toHaveBeenCalledWith(req, res, {
+      runId: RUN.toString(),
+    });
+  },
+);
+
+test.each([
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
+  Permission.ProjectMember,
+  Permission.Public,
+])(
+  "denies %s before resource or credential access and queueing",
+  async (permission: Permission) => {
+    setPermission(permission);
+    await handler(req, res, next);
+    expect(next).toHaveBeenCalledWith(expect.any(Error));
+    expect(GoogleSecOpsConnectionService.findOneBy).not.toHaveBeenCalled();
+    expect(GoogleSecOpsRunExecutor.enqueue).not.toHaveBeenCalled();
+  },
+);
+
+test.each([
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+])("never treats blocked %s as a grant", async (permission: Permission) => {
+  setPermission(permission, true);
+  await handler(req, res, next);
+  expect(next).toHaveBeenCalledWith(expect.any(Error));
+  expect(GoogleSecOpsRunExecutor.enqueue).not.toHaveBeenCalled();
+});
+
+test.each(["anonymous", "missing tenant", "not a member"])(
+  "rejects %s before any resource access",
+  async (reason: string) => {
+    if (reason === "anonymous") {
+      props.userId = undefined;
+    }
+    if (reason === "missing tenant") {
+      props.tenantId = undefined;
+    }
+    if (reason === "not a member") {
+      props.userTenantAccessPermission = {};
+    }
+    await handler(req, res, next);
+    expect(next).toHaveBeenCalledWith(expect.any(Error));
+    expect(GoogleSecOpsConnectionService.findOneBy).not.toHaveBeenCalled();
+    expect(GoogleSecOpsRunExecutor.enqueue).not.toHaveBeenCalled();
+  },
+);
+
+test.each([null, OTHER])(
+  "rejects missing/foreign resource project %s even with a forged route ID",
+  async (projectId: ObjectID | null) => {
+    const connection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+    if (projectId) {
+      connection.projectId = projectId;
+    }
+    (GoogleSecOpsConnectionService.findOneBy as jest.Mock).mockResolvedValue(
+      projectId ? connection : null,
+    );
+    await handler(req, res, next);
+    expect(next).toHaveBeenCalledWith(expect.any(Error));
+    expect(GoogleSecOpsRunExecutor.enqueue).not.toHaveBeenCalled();
+  },
+);
+
+test("does not accept permissions belonging to another tenant", async () => {
+  props.userTenantAccessPermission![OTHER.toString()] = {
+    ...props.userTenantAccessPermission![PROJECT.toString()]!,
+    projectId: OTHER,
+    permissions: [
+      ...props.userTenantAccessPermission![PROJECT.toString()]!.permissions,
+    ],
+  };
+  props.userTenantAccessPermission![PROJECT.toString()]!.permissions = [];
+  await handler(req, res, next);
+  expect(next).toHaveBeenCalledWith(expect.any(Error));
+  expect(GoogleSecOpsRunExecutor.enqueue).not.toHaveBeenCalled();
+});
+
+test.each(["", "not-a-uuid"])(
+  "rejects malformed connection ID %s",
+  async (id: string) => {
+    req.params["connectionId"] = id;
+    await handler(req, res, next);
+    expect(next).toHaveBeenCalledWith(expect.any(Error));
+    expect(GoogleSecOpsConnectionService.findOneBy).not.toHaveBeenCalled();
+  },
+);
+
+test("propagates admission failure instead of reporting a queued run", async () => {
+  (GoogleSecOpsRunExecutor.enqueue as jest.Mock).mockRejectedValue(
+    new Error("Queue unavailable"),
+  );
+  await handler(req, res, next);
+  expect(next).toHaveBeenCalledWith(
+    expect.objectContaining({ message: "Queue unavailable" }),
+  );
+  expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+});