@oneuptime/common 13.0.5 → 13.0.6

package/Tests/Server/Utils/Rules/MonitorRulePatternValidator.test.ts

@@ -0,0 +1,77 @@
+import MonitorRulePatternValidator from "../../../../Server/Utils/Rules/MonitorRulePatternValidator";
+import StatusPageMonitorRulePatternValidator from "../../../../Server/Utils/StatusPage/MonitorRulePatternValidator";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The one pattern validator every monitor rule writes through - SLO monitor
+ * rules and status page monitor rules. A pattern the engines would compile to
+ * nothing must be refused at the write, with a message that names the field
+ * rather than the product, and the status page import path must keep
+ * resolving to exactly the same validator.
+ */
+
+describe("MonitorRulePatternValidator.validate", () => {
+  test("accepts empty patterns - an empty criterion is skipped, not invalid", () => {
+    expect(() => {
+      return MonitorRulePatternValidator.validate({});
+    }).not.toThrow();
+    expect(() => {
+      return MonitorRulePatternValidator.validate({
+        namePattern: "",
+        descriptionPattern: null,
+      });
+    }).not.toThrow();
+  });
+
+  test("accepts regular expressions and * wildcard globs", () => {
+    for (const pattern of [
+      "^api-.*",
+      ".*",
+      "customer facing|tier-1",
+      "*api*",
+    ]) {
+      expect(() => {
+        return MonitorRulePatternValidator.validate({
+          namePattern: pattern,
+          descriptionPattern: pattern,
+        });
+      }).not.toThrow();
+    }
+  });
+
+  test("refuses a name pattern that is neither, naming the field", () => {
+    expect(() => {
+      return MonitorRulePatternValidator.validate({ namePattern: "api-(01" });
+    }).toThrow(BadDataException);
+    expect(() => {
+      return MonitorRulePatternValidator.validate({ namePattern: "api-(01" });
+    }).toThrow('Monitor Name Pattern "api-(01"');
+  });
+
+  test("refuses a description pattern that is neither, naming the field", () => {
+    expect(() => {
+      return MonitorRulePatternValidator.validate({
+        descriptionPattern: "[unclosed",
+      });
+    }).toThrow('Monitor Description Pattern "[unclosed"');
+  });
+
+  test("never names a product, so any monitor rule can use it", () => {
+    let message: string = "";
+
+    try {
+      MonitorRulePatternValidator.validate({ namePattern: "api-(01" });
+    } catch (error) {
+      message = (error as Error).message;
+    }
+
+    expect(message).not.toMatch(/status page|slo/i);
+  });
+
+  test("the status page import path is the same validator", () => {
+    expect(StatusPageMonitorRulePatternValidator).toBe(
+      MonitorRulePatternValidator,
+    );
+  });
+});

package/Tests/Server/Utils/Rules/OwnerRuleAssignment.test.ts

@@ -0,0 +1,177 @@
+import MonitorOwnerTeam from "../../../../Models/DatabaseModels/MonitorOwnerTeam";
+import MonitorOwnerUser from "../../../../Models/DatabaseModels/MonitorOwnerUser";
+import ObjectID from "../../../../Types/ObjectID";
+import DatabaseService from "../../../../Server/Services/DatabaseService";
+import OwnerRuleAssignment, {
+  OwnersToAssign,
+} from "../../../../Server/Utils/Rules/OwnerRuleAssignment";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test - owner rules never create a second owner row for a user
+ * or team that already owns the resource.
+ *
+ * Owner rows have no unique constraint, so a duplicate is not an error: it is
+ * an owner listed twice and notified twice. A rule run meets existing owners
+ * on nearly every resource it touches, which is why this filter sits in front
+ * of every owner rule engine.
+ */
+
+const MONITOR_ID: ObjectID = new ObjectID(
+  "cccccccc-cccc-4ccc-8ccc-cccccccccccc",
+);
+const USER_A: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+const USER_B: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+const TEAM_A: ObjectID = new ObjectID("33333333-3333-4333-8333-333333333333");
+const TEAM_B: ObjectID = new ObjectID("44444444-4444-4444-8444-444444444444");
+
+function ownerUser(userId: ObjectID): MonitorOwnerUser {
+  const row: MonitorOwnerUser = new MonitorOwnerUser();
+  row.userId = userId;
+  row.monitorId = MONITOR_ID;
+  return row;
+}
+
+function ownerTeam(teamId: ObjectID): MonitorOwnerTeam {
+  const row: MonitorOwnerTeam = new MonitorOwnerTeam();
+  row.teamId = teamId;
+  row.monitorId = MONITOR_ID;
+  return row;
+}
+
+interface FakeServices {
+  ownerUserService: DatabaseService<MonitorOwnerUser>;
+  ownerTeamService: DatabaseService<MonitorOwnerTeam>;
+  userFindBy: jest.Mock;
+  teamFindBy: jest.Mock;
+}
+
+function fakeServices(data: {
+  existingUsers?: Array<MonitorOwnerUser>;
+  existingTeams?: Array<MonitorOwnerTeam>;
+}): FakeServices {
+  const userFindBy: jest.Mock = jest.fn(async () => {
+    return data.existingUsers || [];
+  });
+  const teamFindBy: jest.Mock = jest.fn(async () => {
+    return data.existingTeams || [];
+  });
+
+  return {
+    ownerUserService: {
+      findBy: userFindBy,
+    } as unknown as DatabaseService<MonitorOwnerUser>,
+    ownerTeamService: {
+      findBy: teamFindBy,
+    } as unknown as DatabaseService<MonitorOwnerTeam>,
+    userFindBy: userFindBy,
+    teamFindBy: teamFindBy,
+  };
+}
+
+function ids(values: Array<ObjectID>): Array<string> {
+  return values.map((value: ObjectID): string => {
+    return value.toString();
+  });
+}
+
+describe("OwnerRuleAssignment.getOwnersNotYetAssigned", () => {
+  it("drops users and teams that already own the resource", async () => {
+    const services: FakeServices = fakeServices({
+      existingUsers: [ownerUser(USER_A)],
+      existingTeams: [ownerTeam(TEAM_B)],
+    });
+
+    const result: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: services.ownerUserService,
+        ownerTeamService: services.ownerTeamService,
+        resourceIdColumn: "monitorId",
+        resourceId: MONITOR_ID,
+        userIds: [USER_A, USER_B],
+        teamIds: [TEAM_A, TEAM_B],
+      });
+
+    expect(ids(result.userIds)).toEqual([USER_B.toString()]);
+    expect(ids(result.teamIds)).toEqual([TEAM_A.toString()]);
+  });
+
+  it("asks only about this resource and these owners, by the given column", async () => {
+    const services: FakeServices = fakeServices({});
+
+    await OwnerRuleAssignment.getOwnersNotYetAssigned({
+      ownerUserService: services.ownerUserService,
+      ownerTeamService: services.ownerTeamService,
+      resourceIdColumn: "monitorId",
+      resourceId: MONITOR_ID,
+      userIds: [USER_A],
+      teamIds: [TEAM_A],
+    });
+
+    const userQuery: Record<string, unknown> = (
+      services.userFindBy.mock.calls[0]![0] as {
+        query: Record<string, unknown>;
+      }
+    ).query;
+    const teamQuery: Record<string, unknown> = (
+      services.teamFindBy.mock.calls[0]![0] as {
+        query: Record<string, unknown>;
+      }
+    ).query;
+
+    expect(Object.keys(userQuery).sort()).toEqual(["monitorId", "userId"]);
+    expect(String(userQuery["monitorId"])).toBe(MONITOR_ID.toString());
+    expect(Object.keys(teamQuery).sort()).toEqual(["monitorId", "teamId"]);
+  });
+
+  it("collapses duplicates and blanks in its input", async () => {
+    const services: FakeServices = fakeServices({});
+
+    const result: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: services.ownerUserService,
+        ownerTeamService: services.ownerTeamService,
+        resourceIdColumn: "monitorId",
+        resourceId: MONITOR_ID,
+        userIds: [USER_A, USER_A.toString(), ""],
+        teamIds: [TEAM_A, TEAM_A],
+      });
+
+    expect(ids(result.userIds)).toEqual([USER_A.toString()]);
+    expect(ids(result.teamIds)).toEqual([TEAM_A.toString()]);
+  });
+
+  it("does not query for an empty owner set", async () => {
+    const services: FakeServices = fakeServices({});
+
+    const result: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: services.ownerUserService,
+        ownerTeamService: services.ownerTeamService,
+        resourceIdColumn: "monitorId",
+        resourceId: MONITOR_ID,
+        userIds: [],
+        teamIds: [TEAM_A],
+      });
+
+    expect(services.userFindBy).not.toHaveBeenCalled();
+    expect(services.teamFindBy).toHaveBeenCalledTimes(1);
+    expect(result.userIds).toEqual([]);
+  });
+
+  it("returns everything when nobody owns the resource yet", async () => {
+    const services: FakeServices = fakeServices({});
+
+    const result: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: services.ownerUserService,
+        ownerTeamService: services.ownerTeamService,
+        resourceIdColumn: "monitorId",
+        resourceId: MONITOR_ID,
+        userIds: [USER_A, USER_B],
+        teamIds: [],
+      });
+
+    expect(ids(result.userIds)).toEqual([USER_A.toString(), USER_B.toString()]);
+  });
+});

package/Tests/Server/Utils/Rules/RuleRun/RuleRunPermission.test.ts

@@ -0,0 +1,365 @@
+import RuleRunPermission from "../../../../../Server/Utils/Rules/RuleRun/RuleRunPermission";
+import RuleRunRegistry from "../../../../../Server/Utils/Rules/RuleRun/RuleRunRegistry";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import PermissionScope from "../../../../../Types/Database/AccessControl/PermissionScope";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../../../Types/Permission";
+import { RuleRunType } from "../../../../../Types/Rules/RuleRun";
+import { afterEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * Contract under test - who may press "Run now".
+ *
+ * A run writes as root, so this check is the only thing between a role and
+ * everything the run changes. It must hold the caller to the same ACLs a
+ * direct API write would: the rule's own edit permission, edit on the
+ * resources (a rule author must not edit every monitor by proxy), create on
+ * owner rows for owner rules, and a team's block list over all of it. And
+ * because a run reaches the whole project, a grant limited to some labels is
+ * not enough.
+ *
+ * The permissions below are the real ones off the models' @TableAccessControl
+ * - MonitorLabelRule and MonitorOwnerRule are editable by EditMonitor*Rule,
+ * Monitor by EditProjectMonitor, owner rows are created by
+ * CreateMonitorOwnerUser / CreateMonitorOwnerTeam.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+
+function propsWith(data: {
+  permissions?: Array<Permission> | undefined;
+  blockedPermissions?: Array<Permission> | undefined;
+  labelIds?: Array<ObjectID> | undefined;
+  // The scope stored on every granted row; absent, as on legacy rows.
+  scope?: PermissionScope | undefined;
+  isMasterAdmin?: boolean | undefined;
+}): DatabaseCommonInteractionProps {
+  const toUserPermission: (
+    permission: Permission,
+    isBlockPermission: boolean,
+  ) => UserPermission = (
+    permission: Permission,
+    isBlockPermission: boolean,
+  ): UserPermission => {
+    return {
+      permission: permission,
+      labelIds: isBlockPermission ? [] : data.labelIds || [],
+      isBlockPermission: isBlockPermission,
+      ...(data.scope && !isBlockPermission ? { scope: data.scope } : {}),
+      _type: "UserPermission",
+    } as UserPermission;
+  };
+
+  return {
+    tenantId: PROJECT_ID,
+    isMasterAdmin: data.isMasterAdmin || false,
+    userId: ObjectID.generate(),
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: {
+        projectId: PROJECT_ID,
+        permissions: [
+          ...(data.permissions || []).map((permission: Permission) => {
+            return toUserPermission(permission, false);
+          }),
+          ...(data.blockedPermissions || []).map((permission: Permission) => {
+            return toUserPermission(permission, true);
+          }),
+        ],
+        _type: "UserTenantAccessPermission",
+      },
+    },
+  } as unknown as DatabaseCommonInteractionProps;
+}
+
+function assertCanRun(
+  ruleType: RuleRunType,
+  props: DatabaseCommonInteractionProps,
+): void {
+  RuleRunPermission.assertCanRun({ props: props, ruleType: ruleType });
+}
+
+describe("RuleRunPermission.assertCanRun", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("lets a master admin run any rule", () => {
+    for (const ruleType of [
+      RuleRunType.MonitorLabelRule,
+      RuleRunType.MonitorOwnerRule,
+      RuleRunType.StatusPageMonitorRule,
+    ]) {
+      expect(() => {
+        assertCanRun(ruleType, propsWith({ isMasterAdmin: true }));
+      }).not.toThrow();
+    }
+  });
+
+  it("lets a project admin run any rule", () => {
+    for (const ruleType of [
+      RuleRunType.MonitorLabelRule,
+      RuleRunType.MonitorOwnerRule,
+      RuleRunType.StatusPageMonitorRule,
+    ]) {
+      expect(() => {
+        assertCanRun(
+          ruleType,
+          propsWith({ permissions: [Permission.ProjectAdmin] }),
+        );
+      }).not.toThrow();
+    }
+  });
+
+  it("refuses a caller who cannot edit the rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorLabelRule,
+        propsWith({ permissions: [Permission.EditProjectMonitor] }),
+      );
+    }).toThrow(
+      new NotAuthorizedException(
+        "You do not have permission to edit this rule, which running it requires.",
+      ),
+    );
+  });
+
+  it("refuses a rule author who cannot edit the resources the rule changes", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorLabelRule,
+        propsWith({ permissions: [Permission.EditMonitorLabelRule] }),
+      );
+    }).toThrow(
+      "You do not have permission to edit every monitor in this project, which running this rule does.",
+    );
+  });
+
+  it("lets a caller who can edit both the rule and the resources run a label rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditMonitorLabelRule,
+            Permission.EditProjectMonitor,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("requires owner-create permissions for an owner rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorOwnerRule,
+        propsWith({
+          permissions: [
+            Permission.EditMonitorOwnerRule,
+            Permission.EditProjectMonitor,
+          ],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to add owners to monitors, which running this rule does.",
+    );
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorOwnerRule,
+        propsWith({
+          permissions: [
+            Permission.EditMonitorOwnerRule,
+            Permission.EditProjectMonitor,
+            Permission.CreateMonitorOwnerUser,
+            Permission.CreateMonitorOwnerTeam,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("does not count a grant limited to labels, since a run reaches every resource", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorLabelRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          labelIds: [ObjectID.generate()],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("honours a team's block list on the resources, even over an admin grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorLabelRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          blockedPermissions: [Permission.EditProjectMonitor],
+        }),
+      );
+    }).toThrow(/permission block list/);
+  });
+
+  it("only needs the rule's own edit permission to re-sync a status page", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.StatusPageMonitorRule,
+        propsWith({ permissions: [Permission.EditStatusPageMonitorRule] }),
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.StatusPageMonitorRule,
+        propsWith({ permissions: [Permission.EditProjectMonitor] }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  /*
+   * Saving an SLO monitor rule already re-syncs its SLO as root, so running
+   * one needs exactly what saving it needs - the rule's own edit permission,
+   * read off ServiceLevelObjectiveMonitorRule's @TableAccessControl - and
+   * editing the SLO itself is neither required nor enough.
+   */
+  it("only needs the rule's own edit permission to re-sync an SLO's monitors", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveMonitorRule],
+        }),
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({ permissions: [Permission.EditServiceLevelObjective] }),
+      );
+    }).toThrow(
+      new NotAuthorizedException(
+        "You do not have permission to edit this rule, which running it requires.",
+      ),
+    );
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.ReadServiceLevelObjectiveMonitorRule],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("lets master admins and project admins re-sync an SLO's monitors", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({ isMasterAdmin: true }),
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({ permissions: [Permission.ProjectAdmin] }),
+      );
+    }).not.toThrow();
+  });
+
+  it("honours a team's block list on SLO monitor rules, even over an admin grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          blockedPermissions: [Permission.EditServiceLevelObjectiveMonitorRule],
+        }),
+      );
+    }).toThrow(/permission block list/);
+  });
+
+  it("does not count a grant limited to labels for an SLO monitor rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveMonitorRule],
+          labelIds: [ObjectID.generate()],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  /*
+   * ServiceLevelObjectiveMonitorRule is @OwnedThrough its SLO: an Owned-scoped
+   * edit grant reaches only the rules of SLOs the user owns. The run reads the
+   * rule as root, so counting that grant would let it re-sync any SLO.
+   */
+  it("does not count an Owned-scoped grant, which reaches only owned SLOs' rules", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveMonitorRule],
+          scope: PermissionScope.Owned,
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.MonitorLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditMonitorLabelRule,
+            Permission.EditProjectMonitor,
+          ],
+          scope: PermissionScope.Owned,
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+
+    // The same grants scoped to the whole project are enough.
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveMonitorRule],
+          scope: PermissionScope.All,
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("keeps counting scope-exempt admin roles whatever scope is stored on them", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveMonitorRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          scope: PermissionScope.Owned,
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("refuses a rule type with no registered engine, even for a master admin", () => {
+    jest.spyOn(RuleRunRegistry, "getDefinition").mockReturnValue(null);
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.HostLabelRule,
+        propsWith({ isMasterAdmin: true }),
+      );
+    }).toThrow(new BadDataException("This rule cannot be run."));
+  });
+});