@oneuptime/common 12.0.6 → 12.0.8

package/Tests/Server/API/FileAPIAccessControl.test.ts

@@ -0,0 +1,316 @@
+import File from "../../../Models/DatabaseModels/File";
+import FileAPI from "../../../Server/API/FileAPI";
+import FileService from "../../../Server/Services/FileService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import Response from "../../../Server/Utils/Response";
+import MimeType from "../../../Types/File/MimeType";
+import ObjectID from "../../../Types/ObjectID";
+import { mockRouter } from "./Helpers";
+import { beforeAll, beforeEach, describe, expect, it } from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendFileResponse: jest.fn(),
+    sendErrorResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+    sendEmptySuccessResponse: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/Services/FileService", () => {
+  return {
+    findOneBy: jest.fn(),
+    findOneById: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/Middleware/UserAuthorization", () => {
+  return {
+    getAccessTokenFromExpressRequest: jest.fn(),
+  };
+});
+
+jest.mock("../../../Server/Utils/JsonWebToken", () => {
+  return {
+    decode: jest.fn(),
+  };
+});
+
+const TOKEN_ROUTE: string = "/file/image/access-token/:token";
+const ID_ROUTE: string = "/file/image/:imageId";
+
+type BuildFileFunction = (isPublic: unknown) => File;
+
+/*
+ * The route only ever reads file/fileType/isPublic, and isPublic is
+ * deliberately typed loose here so the varchar-era value (the STRING
+ * "false") can be fed through the gate as well as a real boolean.
+ */
+const buildFile: BuildFileFunction = (isPublic: unknown): File => {
+  const file: File = new File();
+  file.file = Buffer.from("png-bytes");
+  file.fileType = MimeType.png;
+  (file as unknown as { isPublic: unknown }).isPublic = isPublic;
+  return file;
+};
+
+type CallRouteFunction = (
+  uri: string,
+  params: Record<string, string>,
+) => Promise<void>;
+
+const callRoute: CallRouteFunction = async (
+  uri: string,
+  params: Record<string, string>,
+): Promise<void> => {
+  const req: ExpressRequest = { params } as unknown as ExpressRequest;
+  const res: ExpressResponse = {} as ExpressResponse;
+  const next: NextFunction = (() => {}) as NextFunction;
+
+  await mockRouter.match("GET", uri).handlerFunction(req, res, next);
+};
+
+type SetAuthenticatedFunction = (isAuthenticated: boolean) => void;
+
+const setAuthenticated: SetAuthenticatedFunction = (
+  isAuthenticated: boolean,
+): void => {
+  (
+    UserMiddleware.getAccessTokenFromExpressRequest as unknown as jest.Mock
+  ).mockReturnValue(isAuthenticated ? "a-token" : undefined);
+  (JSONWebToken.decode as unknown as jest.Mock).mockReturnValue({
+    userId: isAuthenticated ? new ObjectID("user-id") : undefined,
+  });
+};
+
+describe("FileAPI access control", () => {
+  beforeAll(() => {
+    new FileAPI();
+  });
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    setAuthenticated(false);
+  });
+
+  describe("token route — anonymous callers", () => {
+    it("serves a public file", async () => {
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        buildFile(true) as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).toHaveBeenCalled();
+      expect(Response.sendErrorResponse).not.toHaveBeenCalled();
+    });
+
+    it("refuses a private file", async () => {
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        buildFile(false) as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    /*
+     * Regression guard for the varchar bug: isPublic was persisted as a
+     * varchar, so a private file hydrated as the STRING "false", which is
+     * truthy — the gate below never fired and every inline image was served
+     * to anonymous callers. The column is a real boolean now; this pins the
+     * gate to a strict boolean check so a loose value cannot slip through.
+     */
+    it("refuses a file whose isPublic is the string 'false'", async () => {
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        buildFile("false") as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses when no file matches the token", async () => {
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        null as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses when the token param is missing", async () => {
+      await callRoute(TOKEN_ROUTE, {});
+
+      expect(FileService.findOneBy).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses a public row that carries no bytes", async () => {
+      const file: File = buildFile(true);
+      delete (file as Partial<File>).file;
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        file as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses a public row that carries no fileType", async () => {
+      const file: File = buildFile(true);
+      delete (file as Partial<File>).fileType;
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        file as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+  });
+
+  describe("token route — authenticated callers", () => {
+    it("serves a private file to a valid session", async () => {
+      setAuthenticated(true);
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        buildFile(false) as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).toHaveBeenCalled();
+      expect(Response.sendErrorResponse).not.toHaveBeenCalled();
+    });
+
+    it("refuses a private file when the session token has no userId", async () => {
+      (
+        UserMiddleware.getAccessTokenFromExpressRequest as unknown as jest.Mock
+      ).mockReturnValue("a-token");
+      (JSONWebToken.decode as unknown as jest.Mock).mockReturnValue({});
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        buildFile(false) as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses a private file when the session token fails verification", async () => {
+      (
+        UserMiddleware.getAccessTokenFromExpressRequest as unknown as jest.Mock
+      ).mockReturnValue("a-forged-token");
+      (JSONWebToken.decode as unknown as jest.Mock).mockImplementation(() => {
+        throw new Error("invalid signature");
+      });
+      (FileService.findOneBy as unknown as jest.Mock).mockResolvedValue(
+        buildFile(false) as never,
+      );
+
+      await callRoute(TOKEN_ROUTE, { token: "abc123" });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+  });
+
+  describe("legacy id route", () => {
+    it("serves a public file", async () => {
+      (FileService.findOneById as unknown as jest.Mock).mockResolvedValue(
+        buildFile(true) as never,
+      );
+
+      await callRoute(ID_ROUTE, {
+        imageId: "e7c4f2a1-0000-4000-8000-000000000000",
+      });
+
+      expect(Response.sendFileResponse).toHaveBeenCalled();
+      expect(Response.sendErrorResponse).not.toHaveBeenCalled();
+    });
+
+    it("refuses a private file", async () => {
+      (FileService.findOneById as unknown as jest.Mock).mockResolvedValue(
+        buildFile(false) as never,
+      );
+
+      await callRoute(ID_ROUTE, {
+        imageId: "e7c4f2a1-0000-4000-8000-000000000000",
+      });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses a file whose isPublic is the string 'false'", async () => {
+      (FileService.findOneById as unknown as jest.Mock).mockResolvedValue(
+        buildFile("false") as never,
+      );
+
+      await callRoute(ID_ROUTE, {
+        imageId: "e7c4f2a1-0000-4000-8000-000000000000",
+      });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    /*
+     * This route is public-only by design — it addresses files by an
+     * enumerable ObjectID, so a session is deliberately NOT enough to reach a
+     * private file through it. Private inline images use the token route.
+     */
+    it("refuses a private file even to a valid session", async () => {
+      setAuthenticated(true);
+      (FileService.findOneById as unknown as jest.Mock).mockResolvedValue(
+        buildFile(false) as never,
+      );
+
+      await callRoute(ID_ROUTE, {
+        imageId: "e7c4f2a1-0000-4000-8000-000000000000",
+      });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+
+    it("refuses when no file matches the id", async () => {
+      (FileService.findOneById as unknown as jest.Mock).mockResolvedValue(
+        null as never,
+      );
+
+      await callRoute(ID_ROUTE, {
+        imageId: "e7c4f2a1-0000-4000-8000-000000000000",
+      });
+
+      expect(Response.sendFileResponse).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalled();
+    });
+  });
+});

package/Tests/Server/API/ProjectAPI.test.ts

@@ -1,4 +1,6 @@
-import ProjectAPI from "../../../Server/API/ProjectAPI";
+import ProjectAPI, {
+  MAX_DELETION_REASON_LENGTH,
+} from "../../../Server/API/ProjectAPI";
 import MasterAdminAuthorization from "../../../Server/Middleware/MasterAdminAuthorization";
 import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import JSONWebToken from "../../../Server/Utils/JsonWebToken";
@@ -487,4 +489,300 @@ describe("ProjectAPI", () => {
       expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
     });
   });
+
+  /*
+   * The delete confirmation in the dashboard asks why the customer is leaving,
+   * and a DELETE has nowhere to put the answer. This route is the same delete
+   * with a body - so the interesting cases are the ones where the body could
+   * be used to reach a project the caller is not authenticated for, or to
+   * store something the column was never sized for.
+   */
+  describe("POST /project/:id/delete-project", () => {
+    const tenantMismatchError: BadDataException = new BadDataException(
+      "Project ID in the URL does not match the project the request is authenticated for",
+    );
+
+    beforeEach(() => {
+      ProjectService.deleteOneById = jest.fn().mockResolvedValue(1);
+      /*
+       * getDatabaseCommonInteractionProps asks for the plan of the
+       * authenticated tenant when billing is on.
+       */
+      ProjectService.getCurrentPlan = jest.fn().mockResolvedValue({
+        plan: null,
+        isSubscriptionUnpaid: false,
+      });
+      mockRequest.headers = {};
+
+      /*
+       * Response is module-mocked once for the whole file, so its call log
+       * carries over from the suites above.
+       */
+      (Response.sendEmptySuccessResponse as jest.Mock).mockClear();
+    });
+
+    it("deletes the authenticated tenant's own project", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { deletionReason: "We built our own" } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: projectId,
+          deletionReason: "We built our own",
+        }),
+      );
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+        mockRequest,
+        mockResponse,
+      );
+    });
+
+    /*
+     * Permissions are resolved for the authenticated tenant, so without this
+     * guard being an owner of one project would authorize deleting another.
+     */
+    it("refuses to delete a project the request is not authenticated for", async () => {
+      const victimProjectId: ObjectID = ObjectID.generate();
+      const attackerProjectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: victimProjectId.toString() };
+      mockRequest.tenantId = attackerProjectId;
+      mockRequest.body = { data: { deletionReason: "not mine to delete" } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledWith(tenantMismatchError);
+      expect(ProjectService.deleteOneById).not.toHaveBeenCalled();
+    });
+
+    it("refuses when the request has no authenticated tenant", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      delete mockRequest.tenantId;
+      mockRequest.body = { data: { deletionReason: "anything" } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledWith(tenantMismatchError);
+      expect(ProjectService.deleteOneById).not.toHaveBeenCalled();
+    });
+
+    it("rejects an id that is not a project id", async () => {
+      mockRequest.params = { id: "not-a-uuid" };
+      mockRequest.tenantId = ObjectID.generate();
+      mockRequest.body = { data: {} };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalled();
+      expect(ProjectService.deleteOneById).not.toHaveBeenCalled();
+    });
+
+    /*
+     * The reason is optional: a customer who does not want to answer must
+     * still be able to delete their project.
+     */
+    it("deletes without a reason when none was given", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = {};
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: projectId,
+          deletionReason: undefined,
+        }),
+      );
+    });
+
+    it("treats a blank reason as no reason", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { deletionReason: "   " } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ deletionReason: undefined }),
+      );
+    });
+
+    it("ignores a reason that is not text", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { deletionReason: { $ne: null } } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ deletionReason: undefined }),
+      );
+    });
+
+    /*
+     * Postgres rejects NUL bytes in a text column. The insert that would fail
+     * is the audit record of a project that has already been deleted, and
+     * there is no second chance at writing it - so they are dropped here.
+     */
+    it("strips NUL bytes the database would reject", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = {
+        data: { deletionReason: "too\u0000 expensive\u0000" },
+      };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ deletionReason: "too expensive" }),
+      );
+    });
+
+    it("treats a reason that is only NUL bytes as no reason", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { deletionReason: "\u0000\u0000" } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).not.toHaveBeenCalled();
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ deletionReason: undefined }),
+      );
+    });
+
+    it("trims the reason before storing it", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { deletionReason: "  too expensive  " } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(ProjectService.deleteOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ deletionReason: "too expensive" }),
+      );
+    });
+
+    /*
+     * The column is unbounded text and the field is free text from a browser,
+     * so the only thing standing between a client and an arbitrarily large
+     * row is this cap.
+     */
+    it("caps how much free text a client can store", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = {
+        data: { deletionReason: "a".repeat(MAX_DELETION_REASON_LENGTH + 500) },
+      };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      const call: { deletionReason?: string } = (
+        ProjectService.deleteOneById as unknown as {
+          mock: { calls: Array<Array<{ deletionReason?: string }>> };
+        }
+      ).mock.calls[0]![0]!;
+
+      expect(call.deletionReason).toHaveLength(MAX_DELETION_REASON_LENGTH);
+    });
+
+    /*
+     * The delete goes through the ordinary permission-checked path with the
+     * caller's own props - the reason must not turn this into a privileged
+     * delete.
+     */
+    it("deletes as the caller, not as root", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+      const userId: ObjectID = ObjectID.generate();
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.userAuthorization = { userId: userId } as JSONWebTokenData;
+      mockRequest.body = { data: { deletionReason: "done with it" } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      const call: { props: { isRoot?: boolean; userId?: ObjectID } } = (
+        ProjectService.deleteOneById as unknown as {
+          mock: {
+            calls: Array<
+              Array<{ props: { isRoot?: boolean; userId?: ObjectID } }>
+            >;
+          };
+        }
+      ).mock.calls[0]![0]!;
+
+      expect(call.props.isRoot).toBeFalsy();
+      expect(call.props.userId).toBe(userId);
+    });
+
+    it("forwards a refused delete to next instead of reporting success", async () => {
+      const projectId: ObjectID = ObjectID.generate();
+      const notAllowed: BadDataException = new BadDataException(
+        "Delete on Project is not allowed",
+      );
+
+      ProjectService.deleteOneById = jest.fn().mockRejectedValue(notAllowed);
+
+      mockRequest.params = { id: projectId.toString() };
+      mockRequest.tenantId = projectId;
+      mockRequest.body = { data: { deletionReason: "nope" } };
+
+      await mockRouter
+        .match("post", "/project/:id/delete-project")
+        .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+      expect(nextFunction).toHaveBeenCalledWith(notAllowed);
+      expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
+    });
+  });
 });