@oneuptime/common 13.0.5 → 13.0.6

package/Tests/Models/SecurityDomainAccessControl.test.ts

@@ -1,12 +1,18 @@
 import DetectionRule from "../../Models/DatabaseModels/DetectionRule";
-import GoogleSecOpsConnection from "../../Models/DatabaseModels/GoogleSecOpsConnection";
 import SecurityEventConnection from "../../Models/DatabaseModels/SecurityEventConnection";
+import SecurityEventConnectionRun from "../../Models/DatabaseModels/SecurityEventConnectionRun";
 import ThreatIntelFeed from "../../Models/DatabaseModels/ThreatIntelFeed";
 import SecurityEvent from "../../Models/AnalyticsModels/SecurityEvent";
 import ThreatIntelIndicator from "../../Models/AnalyticsModels/ThreatIntelIndicator";
 import { ColumnAccessControl } from "../../Types/BaseDatabase/AccessControl";
 import Dictionary from "../../Types/Dictionary";
 import Permission from "../../Types/Permission";
+import {
+  ConnectorField,
+  SecurityEventConnectorDefinition,
+  getSecurityEventConnectorDefinition,
+} from "../../Types/SecurityEvent/Connectors/SecurityEventConnectorCatalog";
+import SecurityEventConnectorProvider from "../../Types/SecurityEvent/Connectors/SecurityEventConnectorProvider";
 import { describe, expect, test } from "@jest/globals";
 
 /*
@@ -70,10 +76,10 @@ const buildSecurityModels: BuildSecurityModelsFunction =
   (): Array<SecurityModel> => {
     const detectionRule: DetectionRule = new DetectionRule();
     const threatIntelFeed: ThreatIntelFeed = new ThreatIntelFeed();
-    const googleSecOpsConnection: GoogleSecOpsConnection =
-      new GoogleSecOpsConnection();
     const securityEventConnection: SecurityEventConnection =
       new SecurityEventConnection();
+    const securityEventConnectionRun: SecurityEventConnectionRun =
+      new SecurityEventConnectionRun();
     const securityEvent: SecurityEvent = new SecurityEvent();
     const threatIntelIndicator: ThreatIntelIndicator =
       new ThreatIntelIndicator();
@@ -95,14 +101,6 @@ const buildSecurityModels: BuildSecurityModelsFunction =
         delete: threatIntelFeed.deleteRecordPermissions,
         columns: columnsOf(threatIntelFeed),
       },
-      {
-        name: "GoogleSecOpsConnection",
-        read: googleSecOpsConnection.readRecordPermissions,
-        create: googleSecOpsConnection.createRecordPermissions,
-        update: googleSecOpsConnection.updateRecordPermissions,
-        delete: googleSecOpsConnection.deleteRecordPermissions,
-        columns: columnsOf(googleSecOpsConnection),
-      },
       {
         name: "SecurityEventConnection",
         read: securityEventConnection.readRecordPermissions,
@@ -111,6 +109,14 @@ const buildSecurityModels: BuildSecurityModelsFunction =
         delete: securityEventConnection.deleteRecordPermissions,
         columns: columnsOf(securityEventConnection),
       },
+      {
+        name: "SecurityEventConnectionRun",
+        read: securityEventConnectionRun.readRecordPermissions,
+        create: securityEventConnectionRun.createRecordPermissions,
+        update: securityEventConnectionRun.updateRecordPermissions,
+        delete: securityEventConnectionRun.deleteRecordPermissions,
+        columns: columnsOf(securityEventConnectionRun),
+      },
       {
         name: "SecurityEvent",
         read: securityEvent.getReadPermissions(),
@@ -174,9 +180,9 @@ describe("Security domain access control", () => {
       }).sort(),
     ).toEqual([
       "DetectionRule",
-      "GoogleSecOpsConnection",
       "SecurityEvent",
       "SecurityEventConnection",
+      "SecurityEventConnectionRun",
       "ThreatIntelFeed",
       "ThreatIntelIndicator",
     ]);
@@ -258,9 +264,10 @@ describe("Security domain access control", () => {
       for (const [column, accessControl] of model.columns) {
         /*
          * `read: []` is a deliberate "nobody reads this through the API" -
-         * GoogleSecOpsConnection.serviceAccountJson and
-         * SecurityEventConnection.secrets are the ones that matter. Those
-         * must stay closed, which the credential tests below assert.
+         * SecurityEventConnection.secrets, which holds every provider's
+         * credential (the Google SecOps service-account key included), is
+         * the one that matters. It must stay closed, which the credential
+         * tests below assert.
          */
         if (!accessControl?.read || accessControl.read.length === 0) {
           continue;
@@ -295,16 +302,38 @@ describe("Security domain access control", () => {
   );
 
   /*
-   * The connector's service-account key is a live Google Cloud credential. It
-   * was already closed to everyone before the Security tiers existed, and
+   * The Google SecOps service-account key is a live Google Cloud credential.
+   * It was already closed to everyone before the Security tiers existed, and
    * giving the SIEM its own admin role must not have quietly opened it -
    * SecurityAdmin administers the connection, which is not the same as being
-   * able to read the key back out of it.
+   * able to read the key back out of it. The key used to have a column of its
+   * own; it is now the serviceAccountJson entry of SecurityEventConnection
+   * .secrets, and the move must not have opened it either: it has to be a
+   * secret field of the catalog entry, never a (readable) config field.
    */
-  test("the SecOps service-account key stays unreadable by everyone", () => {
-    const model: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+  test("the Google SecOps service-account key stays unreadable by everyone", () => {
+    const definition: SecurityEventConnectorDefinition | undefined =
+      getSecurityEventConnectorDefinition(
+        SecurityEventConnectorProvider.GoogleSecOps,
+      );
+
+    expect(definition).toBeDefined();
+
+    const keysOf: (fields: Array<ConnectorField>) => Array<string> = (
+      fields: Array<ConnectorField>,
+    ): Array<string> => {
+      return fields.map((field: ConnectorField): string => {
+        return field.key;
+      });
+    };
+
+    expect(keysOf(definition!.secretFields)).toContain("serviceAccountJson");
+    expect(keysOf(definition!.configFields)).not.toContain(
+      "serviceAccountJson",
+    );
+
     const accessControl: ColumnAccessControl | null =
-      model.getColumnAccessControlFor("serviceAccountJson");
+      new SecurityEventConnection().getColumnAccessControlFor("secrets");
 
     expect(accessControl).toBeDefined();
     expect(accessControl?.read).toEqual([]);
@@ -312,11 +341,11 @@ describe("Security domain access control", () => {
 
   /*
    * The framework connections store every provider's credential (client
-   * secrets, API tokens, AWS secret keys) as one encrypted JSON string.
-   * Like the SecOps key it is write-only: SecurityAdmin configures and
-   * rotates it, nobody reads it back through the API. The non-secret
-   * config column, by contrast, is what the edit form and the table show,
-   * so it follows the table into the Security tiers.
+   * secrets, API tokens, AWS secret keys, the Google SecOps service-account
+   * key) as one encrypted JSON string. It is write-only: SecurityAdmin
+   * configures and rotates it, nobody reads it back through the API. The
+   * non-secret config column, by contrast, is what the edit form and the
+   * table show, so it follows the table into the Security tiers.
    */
   test("the framework connection secrets stay unreadable by everyone", () => {
     const model: SecurityEventConnection = new SecurityEventConnection();
@@ -378,32 +407,26 @@ describe("Security domain access control", () => {
   });
 
   /*
-   * Pointing the project at a Chronicle instance, and holding the credential
-   * that reads it, is administration of the SIEM rather than use of it.
+   * Pointing the project at a security product - a Chronicle instance, a
+   * Sentinel workspace - and holding the credential that reads it, is
+   * administration of the SIEM rather than use of it.
    */
-  test.each<[string, GoogleSecOpsConnection | SecurityEventConnection]>([
-    ["GoogleSecOpsConnection", new GoogleSecOpsConnection()],
-    ["SecurityEventConnection", new SecurityEventConnection()],
-  ])(
-    "only the Admin tier configures the %s connector",
-    (
-      _name: string,
-      model: GoogleSecOpsConnection | SecurityEventConnection,
-    ) => {
-      for (const list of [
-        model.createRecordPermissions,
-        model.updateRecordPermissions,
-        model.deleteRecordPermissions,
-      ]) {
-        expect(list).toContain(Permission.SecurityAdmin);
-        expect(list).not.toContain(Permission.SecurityMember);
-        expect(list).not.toContain(Permission.SecurityViewer);
-      }
+  test("only the Admin tier configures security event connections", () => {
+    const model: SecurityEventConnection = new SecurityEventConnection();
 
-      expect(model.readRecordPermissions).toContain(Permission.SecurityMember);
-      expect(model.readRecordPermissions).toContain(Permission.SecurityViewer);
-    },
-  );
+    for (const list of [
+      model.createRecordPermissions,
+      model.updateRecordPermissions,
+      model.deleteRecordPermissions,
+    ]) {
+      expect(list).toContain(Permission.SecurityAdmin);
+      expect(list).not.toContain(Permission.SecurityMember);
+      expect(list).not.toContain(Permission.SecurityViewer);
+    }
+
+    expect(model.readRecordPermissions).toContain(Permission.SecurityMember);
+    expect(model.readRecordPermissions).toContain(Permission.SecurityViewer);
+  });
 
   /*
    * The Member tier is what makes the family usable without handing out admin:
@@ -471,3 +494,111 @@ describe("Security domain access control", () => {
     );
   });
 });
+
+/*
+ * Run history and poll bookkeeping are what the connection diagnostics read,
+ * so every Security tier can see them - and nothing but the worker may write
+ * them. A client that could create a run or set lastPollResult could forge a
+ * healthy connection, or move the cursor past records it never imported.
+ * (Carried over from the Google SecOps diagnostics model suite, which pinned
+ * the same boundaries on its own run model.)
+ */
+describe("Security event connection diagnostics access boundaries", () => {
+  test("run history is tenant scoped and cannot be created, changed or deleted through CRUD", () => {
+    const run: SecurityEventConnectionRun = new SecurityEventConnectionRun();
+
+    expect(run.getTenantColumn()).toBe("projectId");
+    expect(run.getCrudApiPath()?.toString()).toBe(
+      "/security-event-connection-run",
+    );
+    expect(run.createRecordPermissions).toEqual([]);
+    expect(run.updateRecordPermissions).toEqual([]);
+    expect(run.deleteRecordPermissions).toEqual([]);
+    expect(run.readRecordPermissions).toEqual([
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
+    ]);
+    expect(run.readRecordPermissions).not.toContain(Permission.Public);
+  });
+
+  test.each([
+    "projectId",
+    "securityEventConnectionId",
+    "requestedByUserId",
+    "type",
+    "status",
+    "request",
+    "result",
+    "error",
+    "startedAt",
+    "completedAt",
+  ])(
+    "run field %s is readable by security viewers and writable only internally",
+    (field: string) => {
+      const control: ColumnAccessControl | null =
+        new SecurityEventConnectionRun().getColumnAccessControlFor(field);
+
+      expect(control).toBeTruthy();
+      expect(control?.create).toEqual([]);
+      expect(control?.update).toEqual([]);
+      expect(control?.read).toContain(Permission.SecurityViewer);
+    },
+  );
+
+  test.each([
+    "lastSuccessfulPollAt",
+    "lastEventIngestedAt",
+    "lastPollResult",
+    "lastPolledAt",
+    "cursor",
+    "lastError",
+  ])("clients cannot forge the connection's %s", (field: string) => {
+    const control: ColumnAccessControl | null =
+      new SecurityEventConnection().getColumnAccessControlFor(field);
+
+    expect(control).toBeTruthy();
+    expect(control?.create).toEqual([]);
+    expect(control?.update).toEqual([]);
+    expect(control?.read).toContain(Permission.SecurityMember);
+  });
+
+  /*
+   * Alerts only, or alerts and detections, decides what a connection
+   * imports. Changing it is configuring the connection.
+   */
+  test("only connector administrators can change what a connection imports", () => {
+    const control: ColumnAccessControl | null =
+      new SecurityEventConnection().getColumnAccessControlFor("alertingOnly");
+
+    expect(control?.update).toEqual([
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+    ]);
+    expect(control?.create).toEqual(control?.update);
+    expect(control?.read).toContain(Permission.SecurityViewer);
+  });
+
+  test("diagnostics do not make credentials readable or add them to run history", () => {
+    expect(
+      new SecurityEventConnection().getColumnAccessControlFor("secrets")?.read,
+    ).toEqual([]);
+
+    const runColumns: Array<string> =
+      new SecurityEventConnectionRun().getTableColumns().columns;
+
+    for (const credentialColumn of [
+      "secrets",
+      "serviceAccountJson",
+      "config",
+    ]) {
+      expect(runColumns).not.toContain(credentialColumn);
+      expect(Object.keys(new SecurityEventConnectionRun())).not.toContain(
+        credentialColumn,
+      );
+    }
+  });
+});

package/Tests/Server/API/BaseAPI.test.ts

@@ -773,9 +773,15 @@ describe("BaseAPI", () => {
         baseApiInstance.service,
         "updateOneById",
       );
+      /*
+       * A body without miscDataProps still hands the service an empty
+       * object, the way createItem always has (BaseAPIUpdateMiscDataProps
+       * covers the non-empty cases).
+       */
       expect(updateOneBySpy).toHaveBeenCalledWith({
         id: new ObjectID(TEST_UPDATE_ID),
         data: { name: "updatedName" },
+        miscDataProps: {},
         props: emptyProps,
       });
     });

package/Tests/Server/API/BaseAPIUpdateMiscDataProps.test.ts

@@ -0,0 +1,217 @@
+import BaseAPI from "../../../Server/API/BaseAPI";
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import UpdateByID from "../../../Server/Types/Database/UpdateByID";
+import {
+  ExpressResponse,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import { mockRouter } from "./Helpers";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import StatusPageAnnouncement from "../../../Models/DatabaseModels/StatusPageAnnouncement";
+import SubscriberUpdateNotification from "../../../Types/StatusPage/SubscriberUpdateNotification";
+import { getJestSpyOn } from "../../Spy";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn(),
+    sendEntityArrayResponse: jest.fn(),
+    sendJsonObjectResponse: jest.fn(),
+  };
+});
+
+/*
+ * An update request can carry choices that are not columns in
+ * `miscDataProps`, next to its `data` - the same envelope a create request has
+ * always used. createItem passed them to the service; updateItem dropped them,
+ * so "notify subscribers about this edit" could not reach
+ * StatusPageAnnouncementService.onBeforeUpdate at all.
+ */
+
+const TEST_ID: string = "550e8400-e29b-41d4-a716-446655440042";
+
+type AnnouncementUpdate = UpdateByID<StatusPageAnnouncement>;
+
+describe("BaseAPI.updateItem misc data props", () => {
+  let service: DatabaseService<StatusPageAnnouncement>;
+  let api: BaseAPI<
+    StatusPageAnnouncement,
+    DatabaseService<StatusPageAnnouncement>
+  >;
+  let response: ExpressResponse;
+  let updateOneById: jest.SpyInstance<any, any>;
+
+  type RequestWithBodyFunction = (body: JSONObject) => OneUptimeRequest;
+
+  const requestWithBody: RequestWithBodyFunction = (
+    body: JSONObject,
+  ): OneUptimeRequest => {
+    return {
+      params: { id: TEST_ID },
+      body: body,
+      headers: {},
+    } as unknown as OneUptimeRequest;
+  };
+
+  type ForwardedUpdateFunction = () => AnnouncementUpdate;
+
+  const forwardedUpdate: ForwardedUpdateFunction = (): AnnouncementUpdate => {
+    expect(updateOneById).toHaveBeenCalledTimes(1);
+    return updateOneById.mock.calls[0]![0] as AnnouncementUpdate;
+  };
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+
+    service = new DatabaseService<StatusPageAnnouncement>(
+      StatusPageAnnouncement,
+    );
+    api = new BaseAPI<
+      StatusPageAnnouncement,
+      DatabaseService<StatusPageAnnouncement>
+    >(StatusPageAnnouncement, service);
+
+    response = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+      send: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    updateOneById = getJestSpyOn(service, "updateOneById").mockResolvedValue(1);
+  });
+
+  it("hands the notify-subscribers choice to the service with the update", async () => {
+    await api.updateItem(
+      requestWithBody({
+        data: { title: "Maintenance moved to Sunday" },
+        miscDataProps: SubscriberUpdateNotification.getMiscDataProps(),
+      }),
+      response,
+    );
+
+    const update: AnnouncementUpdate = forwardedUpdate();
+
+    expect(update.miscDataProps).toEqual({ notifySubscribersOfUpdate: true });
+    expect(SubscriberUpdateNotification.isRequested(update.miscDataProps)).toBe(
+      true,
+    );
+    expect(update.data).toEqual({ title: "Maintenance moved to Sunday" });
+    expect(update.id).toEqual(new ObjectID(TEST_ID));
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps misc data props out of the columns that get written", async () => {
+    await api.updateItem(
+      requestWithBody({
+        data: { title: "Maintenance moved to Sunday" },
+        miscDataProps: { notifySubscribersOfUpdate: true },
+      }),
+      response,
+    );
+
+    expect(
+      (forwardedUpdate().data as JSONObject)["notifySubscribersOfUpdate"],
+    ).toBeUndefined();
+  });
+
+  it("passes an explicit no through unchanged, so the service can see it was declined", async () => {
+    await api.updateItem(
+      requestWithBody({
+        data: { title: "Typo fix" },
+        miscDataProps: { notifySubscribersOfUpdate: false },
+      }),
+      response,
+    );
+
+    expect(forwardedUpdate().miscDataProps).toEqual({
+      notifySubscribersOfUpdate: false,
+    });
+    expect(
+      SubscriberUpdateNotification.isRequested(forwardedUpdate().miscDataProps),
+    ).toBe(false);
+  });
+
+  it("sends an empty object when the request has no misc data props, as older clients do", async () => {
+    await api.updateItem(
+      requestWithBody({ data: { title: "Typo fix" } }),
+      response,
+    );
+
+    expect(forwardedUpdate().miscDataProps).toEqual({});
+  });
+
+  it.each([
+    ["null", null],
+    ["a string", "notifySubscribersOfUpdate"],
+    ["a number", 1],
+    ["a boolean", true],
+    ["an array", [{ notifySubscribersOfUpdate: true }]],
+  ] as Array<[string, unknown]>)(
+    "ignores misc data props that are %s instead of refusing the edit",
+    async (_label: string, miscDataProps: unknown) => {
+      await api.updateItem(
+        requestWithBody({
+          data: { title: "Typo fix" },
+          miscDataProps: miscDataProps,
+        } as JSONObject),
+        response,
+      );
+
+      expect(forwardedUpdate().miscDataProps).toEqual({});
+      expect(
+        SubscriberUpdateNotification.isRequested(
+          forwardedUpdate().miscDataProps,
+        ),
+      ).toBe(false);
+      expect(Response.sendEmptySuccessResponse).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  it("still refuses an update with no columns even when misc data props ask for a notification", async () => {
+    /*
+     * A notification is about an edit. With nothing to write there is no
+     * edit, so the existing "no fields to update" guard must still win.
+     */
+    await expect(
+      api.updateItem(
+        requestWithBody({
+          data: {},
+          miscDataProps: { notifySubscribersOfUpdate: true },
+        }),
+        response,
+      ),
+    ).rejects.toThrow(/No fields to update/i);
+
+    expect(updateOneById).not.toHaveBeenCalled();
+  });
+
+  it("deserializes misc data props the same way createItem does", async () => {
+    await api.updateItem(
+      requestWithBody({
+        data: { title: "Maintenance moved to Sunday" },
+        miscDataProps: {
+          notifySubscribersOfUpdate: true,
+          nested: { reason: "date change" },
+        },
+      }),
+      response,
+    );
+
+    expect(forwardedUpdate().miscDataProps).toEqual({
+      notifySubscribersOfUpdate: true,
+      nested: { reason: "date change" },
+    });
+  });
+});

package/Tests/Server/API/BillingInvoiceAPI.test.ts

@@ -173,9 +173,16 @@ describe("BillingInvoiceAPI", () => {
         .handlerFunction(mockRequest, mockResponse, nextFunction);
 
       expect(nextFunction).not.toHaveBeenCalled();
+      /*
+       * The cardholder is waiting on this request, so the service is allowed
+       * to stop at a card that needs authentication instead of charging one
+       * of the customer's other cards - this route answers that with the
+       * PaymentIntent's client secret.
+       */
       expect(BillingService.payInvoice).toHaveBeenCalledWith(
         projectCustomerId,
         invoiceId,
+        { canSurfaceAuthenticationPrompt: true },
       );
       expect(BillingInvoiceService.updateOneBy).toHaveBeenCalledWith(
         expect.objectContaining({