@oneuptime/common 13.0.0 → 13.0.1

package/Tests/UI/Utils/UserEmailRegistrationStatus.test.tsx

@@ -0,0 +1,295 @@
+import "@testing-library/jest-dom";
+import { act, cleanup, render } from "@testing-library/react";
+import * as React from "react";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * This hook is what the invite forms call on every keystroke to find out
+ * whether the address being typed already has a OneUptime account.
+ *
+ * It is therefore attached to a form the user is actively typing into, and the
+ * state it owns lives on the page that renders that form - so every time it
+ * flips, the whole form re-renders. The invite-user bug was ultimately about a
+ * form that could not survive being re-rendered while in use; the fixes for that
+ * live in ModelForm/BasicForm/Input, and these tests cover the other half of
+ * the bargain: this hook must not cause MORE renders than the answer needs.
+ */
+
+interface PendingCheck {
+  email: string;
+  headers: unknown;
+  resolve: (isRegistered: boolean) => void;
+  reject: (error: Error) => void;
+}
+
+let pendingChecks: Array<PendingCheck> = [];
+
+jest.mock("../../../UI/Utils/API/API", () => {
+  return {
+    __esModule: true,
+    default: {
+      post: (data: {
+        data: { email: string };
+        headers?: unknown;
+      }): Promise<{ data: { isRegistered: boolean } }> => {
+        return new Promise<{ data: { isRegistered: boolean } }>(
+          (
+            resolve: (value: { data: { isRegistered: boolean } }) => void,
+            reject: (error: Error) => void,
+          ) => {
+            pendingChecks.push({
+              email: data.data.email,
+              headers: data.headers,
+              resolve: (isRegistered: boolean) => {
+                resolve({ data: { isRegistered: isRegistered } });
+              },
+              reject: reject,
+            });
+          },
+        );
+      },
+      getFriendlyMessage: (): string => {
+        return "";
+      },
+    },
+  };
+});
+
+import { useUserEmailRegistrationStatus } from "../../../UI/Utils/UserEmailRegistrationStatus";
+
+const DEBOUNCE_MS: number = 400;
+
+interface ProbeResult {
+  checkEmailIdentities: Array<unknown>;
+  statuses: Array<boolean | null>;
+  rerender: () => void;
+  check: (email: string) => void;
+}
+
+type RenderProbeFunction = (
+  headersFactory?: () => {
+    [key: string]: string;
+  },
+) => ProbeResult;
+
+/*
+ * Renders the hook the way every real caller does - passing its options as an
+ * inline object literal, so the options and the header factory are brand new
+ * on every render - and records what comes back.
+ */
+const renderProbe: RenderProbeFunction = (
+  headersFactory?: () => {
+    [key: string]: string;
+  },
+): ProbeResult => {
+  const result: ProbeResult = {
+    checkEmailIdentities: [],
+    statuses: [],
+    rerender: () => {},
+    check: () => {},
+  };
+
+  const Probe: React.FunctionComponent = (): React.ReactElement => {
+    const [, setTick] = React.useState<number>(0);
+
+    const { isEmailRegistered, checkEmail } = useUserEmailRegistrationStatus({
+      getRequestHeaders: headersFactory
+        ? () => {
+            return headersFactory();
+          }
+        : undefined,
+    });
+
+    result.checkEmailIdentities.push(checkEmail);
+    result.statuses.push(isEmailRegistered);
+    result.check = checkEmail;
+    result.rerender = () => {
+      setTick((tick: number) => {
+        return tick + 1;
+      });
+    };
+
+    return <div />;
+  };
+
+  render(<Probe />);
+
+  return result;
+};
+
+describe("useUserEmailRegistrationStatus", () => {
+  beforeEach(() => {
+    pendingChecks = [];
+    jest.useFakeTimers();
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    cleanup();
+  });
+
+  /*
+   * The whole reason the header factory is held in a ref. A caller writing its
+   * options inline used to get a new checkEmail on every render, which becomes
+   * a new field definition, which becomes another render of the form.
+   */
+  test("hands back the same checkEmail across re-renders", () => {
+    const probe: ProbeResult = renderProbe(() => {
+      return { tenant: "abc" };
+    });
+
+    act(() => {
+      probe.rerender();
+    });
+    act(() => {
+      probe.rerender();
+    });
+
+    expect(probe.checkEmailIdentities.length).toBeGreaterThan(2);
+
+    const identities: Set<unknown> = new Set(probe.checkEmailIdentities);
+    expect(identities.size).toBe(1);
+  });
+
+  /*
+   * And it still has to use the CURRENT headers, not the ones captured when the
+   * hook first ran - the auth headers a form sends can change while the page is
+   * open.
+   */
+  test("sends the headers the caller has now, not the ones it had first", () => {
+    let tenant: string = "first";
+
+    const probe: ProbeResult = renderProbe(() => {
+      return { tenant: tenant };
+    });
+
+    tenant = "second";
+
+    act(() => {
+      probe.rerender();
+    });
+
+    act(() => {
+      probe.check("member@company.com");
+    });
+
+    act(() => {
+      jest.advanceTimersByTime(DEBOUNCE_MS);
+    });
+
+    expect(pendingChecks.length).toBe(1);
+    expect(pendingChecks[0]!.headers).toEqual({ tenant: "second" });
+  });
+
+  test("only asks once the typing has settled, and reports the answer", async () => {
+    const probe: ProbeResult = renderProbe();
+
+    act(() => {
+      probe.check("mem");
+    });
+    act(() => {
+      probe.check("member@comp");
+    });
+    act(() => {
+      probe.check("member@company.com");
+    });
+
+    // Still mid-word: nothing has been asked yet.
+    expect(pendingChecks.length).toBe(0);
+
+    act(() => {
+      jest.advanceTimersByTime(DEBOUNCE_MS);
+    });
+
+    expect(pendingChecks.length).toBe(1);
+    expect(pendingChecks[0]!.email).toBe("member@company.com");
+
+    await act(async () => {
+      pendingChecks[0]!.resolve(true);
+    });
+
+    expect(probe.statuses[probe.statuses.length - 1]).toBe(true);
+  });
+
+  /*
+   * An address that is not a valid email cannot have an account, so it must not
+   * cost a request - which also means the first few keystrokes of any address
+   * are free.
+   */
+  test("does not ask about an address that is not a valid email", () => {
+    const probe: ProbeResult = renderProbe();
+
+    act(() => {
+      probe.check("mem");
+    });
+
+    act(() => {
+      jest.advanceTimersByTime(DEBOUNCE_MS * 3);
+    });
+
+    expect(pendingChecks.length).toBe(0);
+    expect(probe.statuses[probe.statuses.length - 1]).toBeNull();
+  });
+
+  /*
+   * The user carried on typing while a check was in flight. The old answer is
+   * about an address they are no longer entering, so applying it would show the
+   * wrong prompt - and, before the form fixes, would have wiped what they were
+   * typing for good measure.
+   */
+  test("ignores an answer about an address that has since changed", async () => {
+    const probe: ProbeResult = renderProbe();
+
+    act(() => {
+      probe.check("first@company.com");
+    });
+    act(() => {
+      jest.advanceTimersByTime(DEBOUNCE_MS);
+    });
+
+    expect(pendingChecks.length).toBe(1);
+
+    act(() => {
+      probe.check("second@company.com");
+    });
+    act(() => {
+      jest.advanceTimersByTime(DEBOUNCE_MS);
+    });
+
+    expect(pendingChecks.length).toBe(2);
+
+    // The first request answers last.
+    await act(async () => {
+      pendingChecks[1]!.resolve(false);
+    });
+    await act(async () => {
+      pendingChecks[0]!.resolve(true);
+    });
+
+    expect(probe.statuses[probe.statuses.length - 1]).toBe(false);
+  });
+
+  // A check still pending when the form closes has nowhere to report to.
+  test("drops a pending check when the caller unmounts", () => {
+    const probe: ProbeResult = renderProbe();
+
+    act(() => {
+      probe.check("member@company.com");
+    });
+
+    cleanup();
+
+    act(() => {
+      jest.advanceTimersByTime(DEBOUNCE_MS * 3);
+    });
+
+    expect(pendingChecks.length).toBe(0);
+  });
+});

package/Tests/UI/Utils/WebAuthn.test.ts

@@ -0,0 +1,265 @@
+import { SpyInstance } from "jest-mock";
+/* global PublicKeyCredentialRequestOptions, PublicKeyCredentialDescriptor, PublicKeyCredentialCreationOptions */
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import WebAuthn from "../../../UI/Utils/WebAuthn";
+import { JSONObject } from "../../../Types/JSON";
+import WebAuthnTestUtil, {
+  authenticationOptions,
+  registrationOptions,
+} from "../../Utils/WebAuthnTestUtil";
+
+describe("WebAuthn browser boundary", () => {
+  beforeEach(() => {
+    WebAuthnTestUtil.install();
+  });
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("decodes base64url challenge and leaves discoverable credentials unrestricted", async () => {
+    const get: SpyInstance<typeof navigator.credentials.get> = jest.spyOn(
+      navigator.credentials,
+      "get",
+    );
+    await WebAuthn.authenticate(authenticationOptions);
+    const request: PublicKeyCredentialRequestOptions =
+      get.mock.calls[0]![0]!.publicKey!;
+    expect(new Uint8Array(request.challenge as ArrayBuffer)).toEqual(
+      new Uint8Array([251, 255, 0]),
+    );
+    expect(request.allowCredentials).toBeUndefined();
+    expect(request.userVerification).toBe("required");
+    expect(authenticationOptions["challenge"]).toBe("-_8A");
+  });
+
+  test("preserves allowCredentials and transports for existing security key MFA", async () => {
+    const get: SpyInstance<typeof navigator.credentials.get> = jest.spyOn(
+      navigator.credentials,
+      "get",
+    );
+    await WebAuthn.authenticate({
+      ...authenticationOptions,
+      allowCredentials: [
+        { type: "public-key", id: "-_8A", transports: ["usb"] },
+      ],
+    });
+    const descriptor: PublicKeyCredentialDescriptor =
+      get.mock.calls[0]![0]!.publicKey!.allowCredentials![0]!;
+    expect(new Uint8Array(descriptor.id as ArrayBuffer)).toEqual(
+      new Uint8Array([251, 255, 0]),
+    );
+    expect(descriptor.transports).toEqual(["usb"]);
+  });
+
+  test("serializes every assertion byte, user handle, attachment and extension", async () => {
+    expect(await WebAuthn.authenticate(authenticationOptions)).toEqual({
+      id: "-_8A",
+      rawId: "-_8A",
+      type: "public-key",
+      authenticatorAttachment: "platform",
+      clientExtensionResults: { credProps: { rk: true } },
+      response: {
+        authenticatorData: "BAUG",
+        clientDataJSON: "AQID",
+        signature: "BwgJ",
+        userHandle: "CgsM",
+      },
+    });
+  });
+
+  test("serializes a nullable userHandle without inventing bytes", async () => {
+    const credential: PublicKeyCredential = WebAuthnTestUtil.credential();
+    Object.defineProperty(credential.response, "userHandle", { value: null });
+    jest.spyOn(navigator.credentials, "get").mockResolvedValue(credential);
+    const result: JSONObject = await WebAuthn.authenticate(
+      authenticationOptions,
+    );
+    expect((result["response"] as JSONObject)["userHandle"]).toBeNull();
+  });
+
+  test("decodes registration challenge, user id and excluded credentials without changing selection rules", async () => {
+    const create: SpyInstance<typeof navigator.credentials.create> = jest.spyOn(
+      navigator.credentials,
+      "create",
+    );
+    await WebAuthn.register(registrationOptions);
+    const request: PublicKeyCredentialCreationOptions =
+      create.mock.calls[0]![0]!.publicKey!;
+    expect(new Uint8Array(request.challenge as ArrayBuffer)).toEqual(
+      new Uint8Array([251, 255, 0]),
+    );
+    expect(new Uint8Array(request.user.id as ArrayBuffer)).toEqual(
+      new Uint8Array([1, 2, 3]),
+    );
+    expect(
+      new Uint8Array(request.excludeCredentials![0]!.id as ArrayBuffer),
+    ).toEqual(new Uint8Array([251, 255, 0]));
+    expect(request.excludeCredentials![0]!.transports).toEqual(["internal"]);
+    expect(request.authenticatorSelection).toEqual({
+      residentKey: "required",
+      userVerification: "required",
+    });
+    expect((registrationOptions["user"] as JSONObject)["id"]).toBe("AQID");
+  });
+
+  test("sends the attestation, transports and resident key extension to registration verification", async () => {
+    expect(await WebAuthn.register(registrationOptions)).toEqual({
+      id: "-_8A",
+      rawId: "-_8A",
+      type: "public-key",
+      authenticatorAttachment: "platform",
+      clientExtensionResults: { credProps: { rk: true } },
+      response: {
+        attestationObject: "BAUG",
+        clientDataJSON: "AQID",
+        transports: ["internal", "hybrid"],
+      },
+    });
+  });
+
+  test("supports authenticators that omit transports and attachment", async () => {
+    const credential: PublicKeyCredential = WebAuthnTestUtil.credential(true);
+    Object.defineProperty(credential.response, "getTransports", {
+      value: undefined,
+    });
+    Object.defineProperty(credential, "authenticatorAttachment", {
+      value: null,
+    });
+    jest.spyOn(navigator.credentials, "create").mockResolvedValue(credential);
+    const result: JSONObject = await WebAuthn.register(registrationOptions);
+    expect((result["response"] as JSONObject)["transports"]).toEqual([]);
+    expect(result["authenticatorAttachment"]).toBeUndefined();
+  });
+
+  test("handles a null browser result as cancellation for either ceremony", async () => {
+    jest.spyOn(navigator.credentials, "get").mockResolvedValue(null);
+    jest.spyOn(navigator.credentials, "create").mockResolvedValue(null);
+    await expect(
+      WebAuthn.authenticate(authenticationOptions),
+    ).rejects.toMatchObject({ name: "NotAllowedError" });
+    await expect(WebAuthn.register(registrationOptions)).rejects.toMatchObject({
+      name: "NotAllowedError",
+    });
+  });
+
+  test("reports unsupported browsers and insecure origins before invoking an authenticator", () => {
+    expect(WebAuthn.isSupported()).toBe(true);
+    Object.defineProperty(window, "PublicKeyCredential", { value: undefined });
+    expect(WebAuthn.isSupported()).toBe(false);
+    expect(() => {
+      WebAuthn.ensureSupported();
+    }).toThrow("This browser does not support passkeys");
+    Object.defineProperty(window, "isSecureContext", { value: false });
+    expect(WebAuthn.isSupported()).toBe(false);
+    expect(() => {
+      WebAuthn.ensureSupported();
+    }).toThrow("Passkeys require a secure connection");
+  });
+
+  test.each(["sign-in", "registration"])(
+    "passes cancellation to the browser for %s",
+    async (operation: string) => {
+      const controller: AbortController = new AbortController();
+      const get: SpyInstance<typeof navigator.credentials.get> = jest.spyOn(
+        navigator.credentials,
+        "get",
+      );
+      const create: SpyInstance<typeof navigator.credentials.create> =
+        jest.spyOn(navigator.credentials, "create");
+      if (operation === "sign-in") {
+        await WebAuthn.authenticate(authenticationOptions, controller.signal);
+        expect(get.mock.calls[0]![0]!.signal).toBe(controller.signal);
+      } else {
+        await WebAuthn.register(registrationOptions, controller.signal);
+        expect(create.mock.calls[0]![0]!.signal).toBe(controller.signal);
+      }
+    },
+  );
+
+  test.each(["sign-in", "registration"])(
+    "does not open an already canceled %s prompt",
+    async (operation: string) => {
+      const controller: AbortController = new AbortController();
+      controller.abort();
+      const get: SpyInstance<typeof navigator.credentials.get> = jest.spyOn(
+        navigator.credentials,
+        "get",
+      );
+      const create: SpyInstance<typeof navigator.credentials.create> =
+        jest.spyOn(navigator.credentials, "create");
+      await expect(
+        operation === "sign-in"
+          ? WebAuthn.authenticate(authenticationOptions, controller.signal)
+          : WebAuthn.register(registrationOptions, controller.signal),
+      ).rejects.toMatchObject({ name: "AbortError" });
+      expect(get).not.toHaveBeenCalled();
+      expect(create).not.toHaveBeenCalled();
+    },
+  );
+
+  test.each(["sign-in", "registration"])(
+    "discards a late %s credential after cancellation",
+    async (operation: string) => {
+      const controller: AbortController = new AbortController();
+      jest.spyOn(navigator.credentials, "get").mockImplementation(async () => {
+        controller.abort();
+        return WebAuthnTestUtil.credential();
+      });
+      jest
+        .spyOn(navigator.credentials, "create")
+        .mockImplementation(async () => {
+          controller.abort();
+          return WebAuthnTestUtil.credential(true);
+        });
+      await expect(
+        operation === "sign-in"
+          ? WebAuthn.authenticate(authenticationOptions, controller.signal)
+          : WebAuthn.register(registrationOptions, controller.signal),
+      ).rejects.toMatchObject({ name: "AbortError" });
+    },
+  );
+
+  test.each(["NotAllowedError", "AbortError"])(
+    "explains %s with a retry and password fallback",
+    (name: string) => {
+      const error: DOMException = new DOMException("Browser detail", name);
+      expect(WebAuthn.getErrorMessage(error, "sign-in")).toBe(
+        "Passkey sign-in was canceled or timed out. Try again, or sign in with your password.",
+      );
+      expect(WebAuthn.getErrorMessage(error, "registration")).toContain(
+        "Try again when you are ready",
+      );
+    },
+  );
+
+  test("explains an already registered authenticator", () => {
+    expect(
+      WebAuthn.getErrorMessage(
+        new DOMException("Duplicate", "InvalidStateError"),
+        "registration",
+      ),
+    ).toContain("already registered");
+  });
+
+  test("preserves actionable server errors", () => {
+    expect(
+      WebAuthn.getErrorMessage(
+        new Error("Challenge expired. Please try again."),
+        "sign-in",
+      ),
+    ).toBe("Challenge expired. Please try again.");
+  });
+
+  test("keeps an unexpected failure recoverable instead of failing while formatting it", () => {
+    expect(WebAuthn.getErrorMessage(null, "sign-in")).toBe(
+      "Unable to complete passkey sign-in. Please try again.",
+    );
+  });
+});

package/Tests/Utils/Dashboard/Components/DashboardComponentDefaults.test.ts

@@ -51,6 +51,8 @@ import DashboardTraceChartComponentUtil from "../../../../Utils/Dashboard/Compon
 import DashboardTraceListComponentUtil from "../../../../Utils/Dashboard/Components/DashboardTraceListComponent";
 import DashboardTraceTableComponentUtil from "../../../../Utils/Dashboard/Components/DashboardTraceTableComponent";
 import DashboardValueComponentUtil from "../../../../Utils/Dashboard/Components/DashboardValueComponent";
+import DashboardVMwareHostListComponentUtil from "../../../../Utils/Dashboard/Components/DashboardVMwareHostListComponent";
+import DashboardVMwareVirtualMachineListComponentUtil from "../../../../Utils/Dashboard/Components/DashboardVMwareVirtualMachineListComponent";
 import DashboardBaseComponentUtil from "../../../../Utils/Dashboard/Components/DashboardBaseComponent";
 
 /*
@@ -145,6 +147,9 @@ const TYPE_TO_UTIL: Record<DashboardComponentType, ComponentUtil> = {
     DashboardProxmoxNodeListComponentUtil,
   [DashboardComponentType.ProxmoxGuestList]:
     DashboardProxmoxGuestListComponentUtil,
+  [DashboardComponentType.VMwareHostList]: DashboardVMwareHostListComponentUtil,
+  [DashboardComponentType.VMwareVirtualMachineList]:
+    DashboardVMwareVirtualMachineListComponentUtil,
   [DashboardComponentType.DockerSwarmNodeList]:
     DashboardDockerSwarmNodeListComponentUtil,
   [DashboardComponentType.DockerSwarmServiceList]: