@oneuptime/common 13.0.6 → 13.0.7

package/Tests/Server/Services/SessionRetention.test.ts

@@ -0,0 +1,334 @@
+import StatusPagePrivateUserSession from "../../../Models/DatabaseModels/StatusPagePrivateUserSession";
+import UserSession from "../../../Models/DatabaseModels/UserSession";
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import Services from "../../../Server/Services/Index";
+import { Service as PrivateSessionService } from "../../../Server/Services/StatusPagePrivateUserSessionService";
+import { Service as UserSessionService } from "../../../Server/Services/UserSessionService";
+import FindBy from "../../../Server/Types/Database/FindBy";
+import logger from "../../../Server/Utils/Logger";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import ObjectID from "../../../Types/ObjectID";
+import { EVERY_DAY } from "../../../Utils/CronTime";
+import { getJestSpyOn } from "../../Spy";
+import RunCron from "../../../../App/FeatureSet/Workers/Utils/Cron";
+import "../../../../App/FeatureSet/Workers/Jobs/HardDelete/HardDeleteItemsInDatabase";
+import fs from "fs";
+import path from "path";
+import { DeleteResult, FindOperator, Repository } from "typeorm";
+
+jest.mock("../../../../App/FeatureSet/Workers/Utils/Cron", () => {
+  return { __esModule: true, default: jest.fn() };
+});
+
+/*
+ * Run the real worker and session services, with its registry narrowed to the
+ * two session tables. A separate assertion checks the production registration.
+ */
+jest.mock("../../../Server/Services/Index", () => {
+  return { __esModule: true, default: [] };
+});
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  return {
+    ...jest.requireActual("../../../Server/EnvironmentConfig"),
+    IsBillingEnabled: false,
+    IsDevelopment: false,
+  };
+});
+
+// Small batches exercise the worker's loop without allocating 10,001 rows.
+jest.mock("../../../Types/Database/LimitMax", () => {
+  return { __esModule: true, default: 2 };
+});
+
+type Session = StatusPagePrivateUserSession | UserSession;
+type CronHandler = () => Promise<void>;
+
+interface SessionCase {
+  name: string;
+  service: DatabaseService<Session>;
+}
+
+interface RetentionQuery {
+  refreshTokenExpiresAt: FindOperator<Date>;
+  _id?: FindOperator<Array<string>>;
+}
+
+interface RepositoryBoundary {
+  rows: Array<Session>;
+  find: jest.SpyInstance;
+  deleteRows: jest.Mock;
+}
+
+const NOW: Date = new Date("2026-09-17T12:00:00.000Z");
+const DAY_MS: number = 24 * 60 * 60 * 1000;
+const CUTOFF: Date = new Date(NOW.getTime() - 30 * DAY_MS);
+const JOB_NAME: string = "HardDelete:HardDeleteOlderItemsInDatabase";
+
+const SESSION_CASES: Array<SessionCase> = [
+  {
+    name: "StatusPagePrivateUserSession",
+    service: new PrivateSessionService(),
+  },
+  { name: "UserSession", service: new UserSessionService() },
+];
+
+function sessionRow(
+  entry: SessionCase,
+  expiresAt: Date,
+  fields: Partial<Session> = {},
+): Session {
+  const row: Session = new entry.service.modelType();
+  row.id = ObjectID.generate();
+  row.refreshTokenExpiresAt = expiresAt;
+  row.isRevoked = false;
+  row.createdAt = new Date(NOW.getTime() - 365 * DAY_MS);
+  row.lastActiveAt = row.createdAt;
+  row.ipAddress = "192.0.2.10";
+  row.userAgent = "Test browser";
+  row.deviceName = "Test device";
+  Object.assign(row, fields);
+  return row;
+}
+
+function queryCutoff(query: RetentionQuery): Date {
+  const operator: FindOperator<Date> = query.refreshTokenExpiresAt;
+  expect(Object.keys(query).sort()).toEqual(
+    query._id ? ["_id", "refreshTokenExpiresAt"] : ["refreshTokenExpiresAt"],
+  );
+  expect(operator.getSql!("expiry")).toMatch(/^\(expiry < :\w+\)$/);
+  const cutoff: Date = Object.values(operator.objectLiteralParameters!)[0];
+  expect(cutoff).toEqual(CUTOFF);
+  return cutoff;
+}
+
+/*
+ * Only the database reads and physical DELETE are replaced. The cron callback,
+ * configured retention, permission scoping, batch selection, and hardDeleteBy
+ * run unchanged, including the expiry predicate on the final DELETE.
+ */
+function installRepositoryBoundary(
+  entry: SessionCase,
+  initialRows: Array<Session>,
+  beforeDelete?: (() => void) | undefined,
+): RepositoryBoundary {
+  const rows: Array<Session> = [...initialRows];
+  const find: jest.SpyInstance = getJestSpyOn(
+    entry.service,
+    "_findBy",
+  ).mockImplementation(
+    async (
+      request: FindBy<Session>,
+      includeDeleted: boolean,
+    ): Promise<Array<Session>> => {
+      expect(includeDeleted).toBe(true);
+      expect(request.props.isRoot).toBe(true);
+      expect(request.limit).toBe(LIMIT_MAX);
+      expect(request.skip).toBe(0);
+      const cutoff: Date = queryCutoff(
+        request.query as unknown as RetentionQuery,
+      );
+      return rows
+        .filter((row: Session): boolean => {
+          return Boolean(
+            row.refreshTokenExpiresAt && row.refreshTokenExpiresAt < cutoff,
+          );
+        })
+        .slice(0, LIMIT_MAX);
+    },
+  );
+  const deleteRows: jest.Mock = jest.fn(
+    async (query: RetentionQuery): Promise<DeleteResult> => {
+      beforeDelete?.();
+      const cutoff: Date = queryCutoff(query);
+      expect(query._id?.getSql!("id")).toMatch(/^\(id IN \(:\.\.\.\w+\)\)$/);
+      const ids: Array<string> = Object.values(
+        query._id!.objectLiteralParameters!,
+      )[0];
+      let affected: number = 0;
+      for (let index: number = rows.length - 1; index >= 0; index--) {
+        const row: Session = rows[index]!;
+        if (
+          ids.includes(row.id!.toString()) &&
+          row.refreshTokenExpiresAt &&
+          row.refreshTokenExpiresAt < cutoff
+        ) {
+          rows.splice(index, 1);
+          affected++;
+        }
+      }
+      return { affected, raw: [] };
+    },
+  );
+  getJestSpyOn(entry.service, "getRepository").mockReturnValue({
+    delete: deleteRows,
+  } as unknown as Repository<Session>);
+  return { rows, find, deleteRows };
+}
+
+function jobRegistration(): [
+  string,
+  { schedule: string; runOnStartup: boolean },
+  CronHandler,
+] {
+  const registration: Array<unknown> | undefined = (
+    RunCron as jest.Mock
+  ).mock.calls.find((call: Array<unknown>): boolean => {
+    return call[0] === JOB_NAME;
+  });
+  expect(registration).toBeDefined();
+  return registration as [
+    string,
+    { schedule: string; runOnStartup: boolean },
+    CronHandler,
+  ];
+}
+
+describe("session personal data retention", () => {
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    jest.useFakeTimers();
+    jest.setSystemTime(NOW);
+    Services.splice(0, Services.length);
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  test("runs daily without requiring billing or running immediately at startup", () => {
+    expect(jobRegistration()[1]).toEqual({
+      schedule: EVERY_DAY,
+      runOnStartup: false,
+    });
+  });
+
+  test.each(SESSION_CASES)(
+    "$name is registered and retains 30 days after credential expiry",
+    (entry: SessionCase) => {
+      expect(entry.service.hardDeleteItemByColumnName).toBe(
+        "refreshTokenExpiresAt",
+      );
+      expect(entry.service.hardDeleteItemsOlderThanDays).toBe(30);
+      const registry: string = fs.readFileSync(
+        path.resolve(__dirname, "../../../Server/Services/Index.ts"),
+        "utf8",
+      );
+      expect(registry).toContain(
+        `import ${entry.name}Service from "./${entry.name}Service";`,
+      );
+      expect(registry).toMatch(new RegExp(`^  ${entry.name}Service,$`, "m"));
+      const workers: string = fs.readFileSync(
+        path.resolve(__dirname, "../../../../App/FeatureSet/Workers/Index.ts"),
+        "utf8",
+      );
+      expect(workers).toContain(
+        'import "./Jobs/HardDelete/HardDeleteItemsInDatabase";',
+      );
+    },
+  );
+
+  test.each(SESSION_CASES)(
+    "$name physically deletes expired, revoked, and abandoned code sessions across batches",
+    async (entry: SessionCase) => {
+      const expired: Session = sessionRow(
+        entry,
+        new Date(CUTOFF.getTime() - 1),
+      );
+      const revoked: Session = sessionRow(
+        entry,
+        new Date(CUTOFF.getTime() - DAY_MS),
+        { isRevoked: true, revokedAt: new Date(NOW.getTime() - 60 * DAY_MS) },
+      );
+      const abandonedCode: Session = sessionRow(
+        entry,
+        new Date(CUTOFF.getTime() - 5 * 60 * 1000),
+        { additionalInfo: { oneuptimeStatusPageSessionPurpose: "login-code" } },
+      );
+      const softDeleted: Session = sessionRow(
+        entry,
+        new Date(CUTOFF.getTime() - DAY_MS),
+        { deletedAt: new Date(NOW.getTime() - DAY_MS) },
+      );
+      const recentExpired: Session = sessionRow(
+        entry,
+        new Date(NOW.getTime() - DAY_MS),
+      );
+      const boundary: Session = sessionRow(entry, CUTOFF);
+      const renewed: Session = sessionRow(
+        entry,
+        new Date(NOW.getTime() + 30 * DAY_MS),
+      );
+      const recentlyRevoked: Session = sessionRow(
+        entry,
+        new Date(NOW.getTime() + DAY_MS),
+        { isRevoked: true, revokedAt: NOW },
+      );
+      const retained: Array<Session> = [
+        recentExpired,
+        boundary,
+        renewed,
+        recentlyRevoked,
+      ];
+      const database: RepositoryBoundary = installRepositoryBoundary(entry, [
+        expired,
+        revoked,
+        abandonedCode,
+        softDeleted,
+        ...retained,
+      ]);
+      Services.push(entry.service);
+
+      await jobRegistration()[2]();
+
+      expect(database.rows).toEqual(retained);
+      expect(database.deleteRows).toHaveBeenCalledTimes(2);
+      expect(database.find).toHaveBeenCalledTimes(3);
+      expect(renewed.ipAddress).toBe("192.0.2.10");
+    },
+  );
+
+  test.each(SESSION_CASES)(
+    "$name keeps the expiry condition on the physical delete",
+    async (entry: SessionCase) => {
+      const row: Session = sessionRow(entry, new Date(CUTOFF.getTime() - 1));
+      const database: RepositoryBoundary = installRepositoryBoundary(
+        entry,
+        [row],
+        (): void => {
+          row.refreshTokenExpiresAt = new Date(NOW.getTime() + 30 * DAY_MS);
+        },
+      );
+      Services.push(entry.service);
+
+      await jobRegistration()[2]();
+
+      expect(database.rows).toEqual([row]);
+      expect(database.deleteRows).toHaveBeenCalledTimes(1);
+    },
+  );
+
+  test("continues purging the other session table if one table fails", async () => {
+    const privateSessions: SessionCase = SESSION_CASES[0]!;
+    const userSessions: SessionCase = SESSION_CASES[1]!;
+    const failure: Error = new Error("Database unavailable");
+    getJestSpyOn(privateSessions.service, "hardDeleteBy").mockRejectedValue(
+      failure,
+    );
+    const log: jest.SpyInstance = getJestSpyOn(
+      logger,
+      "error",
+    ).mockImplementation(() => {});
+    const database: RepositoryBoundary = installRepositoryBoundary(
+      userSessions,
+      [sessionRow(userSessions, new Date(CUTOFF.getTime() - 1))],
+    );
+    Services.push(privateSessions.service, userSessions.service);
+
+    await jobRegistration()[2]();
+
+    expect(log).toHaveBeenCalledWith(failure);
+    expect(database.rows).toEqual([]);
+  });
+});

package/Tests/Server/Services/StatusPagePrivateUserInvitationPolicy.test.ts

@@ -0,0 +1,172 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPagePrivateUser from "../../../Models/DatabaseModels/StatusPagePrivateUser";
+import DatabaseConfig from "../../../Server/DatabaseConfig";
+import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
+import MailService from "../../../Server/Services/MailService";
+import { Service } from "../../../Server/Services/StatusPagePrivateUserService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import Hostname from "../../../Types/API/Hostname";
+import Protocol from "../../../Types/API/Protocol";
+import Email from "../../../Types/Email";
+import EmailTemplateType from "../../../Types/Email/EmailTemplateType";
+import HashedString from "../../../Types/HashedString";
+import ObjectID from "../../../Types/ObjectID";
+import { getJestSpyOn } from "../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+class TestService extends Service {
+  public async completeCreation(
+    user: StatusPagePrivateUser,
+  ): Promise<StatusPagePrivateUser> {
+    return await this.onCreateSuccess(
+      {
+        createBy: { data: user, props: { isRoot: true } },
+        carryForward: null,
+      },
+      user,
+    );
+  }
+}
+
+const FROZEN_NOW: Date = new Date("2026-09-17T10:00:00.000Z");
+const STATUS_PAGE_URL: string = "https://status.example.com";
+
+describe("StatusPagePrivateUserService invitation login policy", () => {
+  let service: TestService;
+  let user: StatusPagePrivateUser;
+  let statusPage: StatusPage;
+  let update: jest.SpyInstance;
+  let sendMail: jest.SpyInstance;
+  let findStatusPage: jest.SpyInstance;
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+    jest.setSystemTime(FROZEN_NOW);
+
+    service = new TestService();
+    statusPage = new StatusPage();
+    statusPage.id = ObjectID.generate();
+    statusPage.projectId = ObjectID.generate();
+    statusPage.name = "Example status";
+    statusPage.requireSsoForLogin = false;
+
+    user = new StatusPagePrivateUser();
+    user.id = ObjectID.generate();
+    user.statusPageId = statusPage.id!;
+    user.projectId = statusPage.projectId!;
+    user.email = new Email("private-user@example.com");
+    user.isSsoUser = false;
+
+    update = getJestSpyOn(service, "updateOneById").mockResolvedValue(1);
+    sendMail = getJestSpyOn(MailService, "sendMail").mockResolvedValue(
+      undefined,
+    );
+    findStatusPage = getJestSpyOn(
+      StatusPageService,
+      "findOneById",
+    ).mockResolvedValue(statusPage);
+    getJestSpyOn(StatusPageService, "getStatusPageURL").mockResolvedValue(
+      STATUS_PAGE_URL,
+    );
+    getJestSpyOn(DatabaseConfig, "getHost").mockResolvedValue(
+      new Hostname("status.example.com"),
+    );
+    getJestSpyOn(DatabaseConfig, "getHttpProtocol").mockResolvedValue(
+      Protocol.HTTPS,
+    );
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.restoreAllMocks();
+  });
+
+  test.each([false, undefined])(
+    "SCIM and admin-created users with isSsoUser=%s receive no password link when the page requires SSO",
+    async (isSsoUser: boolean | undefined) => {
+      if (isSsoUser === undefined) {
+        delete user.isSsoUser;
+      } else {
+        user.isSsoUser = isSsoUser;
+      }
+      statusPage.requireSsoForLogin = true;
+
+      await expect(service.completeCreation(user)).resolves.toBe(user);
+
+      expect(findStatusPage).toHaveBeenCalledWith(
+        expect.objectContaining({
+          id: user.statusPageId,
+          select: expect.objectContaining({ requireSsoForLogin: true }),
+        }),
+      );
+      expect(update).not.toHaveBeenCalled();
+      expect(sendMail).not.toHaveBeenCalled();
+      expect(StatusPageService.getStatusPageURL).not.toHaveBeenCalled();
+    },
+  );
+
+  test("SSO sign-ups do not create an unused password-reset credential", async () => {
+    user.isSsoUser = true;
+
+    await expect(service.completeCreation(user)).resolves.toBe(user);
+
+    expect(findStatusPage).not.toHaveBeenCalled();
+    expect(update).not.toHaveBeenCalled();
+    expect(sendMail).not.toHaveBeenCalled();
+  });
+
+  test("password-enabled pages still send a usable invitation and persist only its digest", async () => {
+    await expect(service.completeCreation(user)).resolves.toBe(user);
+
+    expect(sendMail).toHaveBeenCalledTimes(1);
+    expect(update).toHaveBeenCalledTimes(1);
+    const invitation: {
+      vars: { tokenVerifyUrl: string };
+    } = sendMail.mock.calls[0]![0];
+    const resetUrl: string = invitation.vars.tokenVerifyUrl;
+    expect(resetUrl).toMatch(
+      /^https:\/\/status\.example\.com\/reset-password\//,
+    );
+    const rawToken: string = resetUrl.split("/reset-password/")[1]!;
+    expect(ObjectID.isValidUUID(rawToken)).toBe(true);
+    const digest: string = await HashedString.hashValue(
+      rawToken,
+      EncryptionSecret,
+    );
+
+    expect(update).toHaveBeenCalledWith({
+      id: user.id,
+      data: {
+        resetPasswordToken: digest,
+        resetPasswordExpires: new Date("2026-09-18T10:00:00.000Z"),
+      },
+      props: { isRoot: true, ignoreHooks: true },
+    });
+    expect(digest).not.toBe(rawToken);
+    expect(sendMail).toHaveBeenCalledWith(
+      expect.objectContaining({
+        toEmail: user.email,
+        templateType: EmailTemplateType.StatusPageWelcomeEmail,
+      }),
+      expect.objectContaining({ statusPageId: statusPage.id }),
+    );
+  });
+
+  test("a missing status page cannot leave an unused reset credential", async () => {
+    findStatusPage.mockResolvedValue(null);
+
+    await expect(service.completeCreation(user)).rejects.toThrow(
+      "Status Page not found",
+    );
+
+    expect(update).not.toHaveBeenCalled();
+    expect(sendMail).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Services/StatusPagePrivateUserReadAccess.test.ts

@@ -0,0 +1,178 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import StatusPagePrivateUserSession from "../../../Models/DatabaseModels/StatusPagePrivateUserSession";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import StatusPagePrivateUserSessionService from "../../../Server/Services/StatusPagePrivateUserSessionService";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import { ExpressRequest } from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import logger from "../../../Server/Utils/Logger";
+import Email from "../../../Types/Email";
+import HashedString from "../../../Types/HashedString";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import { MASTER_PASSWORD_COOKIE_IDENTIFIER } from "../../../Types/StatusPage/MasterPassword";
+import { SelectQueryBuilder } from "typeorm";
+
+describe("private status page access requires a live session", () => {
+  const statusPageId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const sessionId: ObjectID = ObjectID.generate();
+  let statusPage: StatusPage;
+  let session: StatusPagePrivateUserSession;
+  let getOne: jest.Mock;
+  let query: SelectQueryBuilder<StatusPagePrivateUserSession>;
+
+  function request(
+    claims: JSONObject = {},
+    expiresInSeconds: number = 900,
+  ): ExpressRequest {
+    const token: string = JSONWebToken.sign({
+      data: {
+        userId,
+        email: new Email("private-user@example.com"),
+        statusPageId,
+        sessionId,
+        ...claims,
+      },
+      expiresInSeconds,
+    });
+    return {
+      cookies: { [CookieUtil.getUserTokenKey(statusPageId)]: token },
+    } as ExpressRequest;
+  }
+
+  async function hasAccess(req: ExpressRequest = request()): Promise<boolean> {
+    return (await StatusPageService.hasReadAccess({ statusPageId, req }))
+      .hasReadAccess;
+  }
+
+  beforeEach(() => {
+    statusPage = new StatusPage();
+    statusPage.id = statusPageId;
+    statusPage.isPublicStatusPage = false;
+    session = new StatusPagePrivateUserSession();
+    session.id = sessionId;
+    session.additionalInfo = {};
+    getOne = jest.fn().mockResolvedValue(session);
+    query = {
+      select: jest.fn().mockReturnThis(),
+      innerJoin: jest.fn().mockReturnThis(),
+      where: jest.fn().mockReturnThis(),
+      andWhere: jest.fn().mockReturnThis(),
+      getOne,
+    } as unknown as SelectQueryBuilder<StatusPagePrivateUserSession>;
+    jest.spyOn(StatusPageService, "findOneById").mockResolvedValue(statusPage);
+    jest
+      .spyOn(StatusPagePrivateUserSessionService, "getQueryBuilder")
+      .mockReturnValue(query);
+    jest.spyOn(logger, "error").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("accepts a signed token backed by an active session", async () => {
+    expect(await hasAccess()).toBe(true);
+    expect(getOne).toHaveBeenCalledTimes(1);
+    expect(query.where).toHaveBeenCalledWith("session._id = :sessionId", {
+      sessionId: sessionId.toString(),
+    });
+    expect(query.andWhere).toHaveBeenCalledWith(
+      "session.statusPagePrivateUserId = :userId",
+      { userId: userId.toString() },
+    );
+    expect(query.andWhere).toHaveBeenCalledWith(
+      "session.statusPageId = :statusPageId",
+      { statusPageId: statusPageId.toString() },
+    );
+  });
+
+  test("rejects a signed token without a live session", async () => {
+    getOne.mockResolvedValue(null);
+    expect(await hasAccess()).toBe(false);
+  });
+
+  test("does not cache successful authorization after revocation or deletion", async () => {
+    const req: ExpressRequest = request();
+    expect(await hasAccess(req)).toBe(true);
+    getOne.mockResolvedValue(null);
+    expect(await hasAccess(req)).toBe(false);
+    expect(getOne).toHaveBeenCalledTimes(2);
+  });
+
+  test("rejects a login-code session even with a valid access token", async () => {
+    session.additionalInfo = {
+      oneuptimeStatusPageSessionPurpose: "login-code",
+    };
+    expect(await hasAccess()).toBe(false);
+  });
+
+  test.each(["sessionId", "userId", "statusPageId"])(
+    "rejects a token missing %s before reading sessions",
+    async (claim: string) => {
+      expect(await hasAccess(request({ [claim]: null }))).toBe(false);
+      expect(getOne).not.toHaveBeenCalled();
+    },
+  );
+
+  test("rejects a token for another status page before reading sessions", async () => {
+    expect(
+      await hasAccess(request({ statusPageId: ObjectID.generate() })),
+    ).toBe(false);
+    expect(getOne).not.toHaveBeenCalled();
+  });
+
+  test.each(["sessionId", "userId"])(
+    "rejects malformed %s before reading sessions",
+    async (claim: string) => {
+      expect(await hasAccess(request({ [claim]: "not-a-uuid" }))).toBe(false);
+      expect(getOne).not.toHaveBeenCalled();
+    },
+  );
+
+  test("rejects an expired JWT before reading sessions", async () => {
+    expect(await hasAccess(request({}, -1))).toBe(false);
+    expect(getOne).not.toHaveBeenCalled();
+  });
+
+  test("rejects a tampered JWT before reading sessions", async () => {
+    const req: ExpressRequest = request();
+    req.cookies[CookieUtil.getUserTokenKey(statusPageId)] += "tampered";
+    expect(await hasAccess(req)).toBe(false);
+    expect(getOne).not.toHaveBeenCalled();
+  });
+
+  test("fails closed if the session database lookup fails", async () => {
+    getOne.mockRejectedValue(new Error("Database unavailable"));
+    expect(await hasAccess()).toBe(false);
+  });
+
+  test("does not grant access to a missing status page", async () => {
+    jest.spyOn(StatusPageService, "findOneById").mockResolvedValue(null);
+    expect(await hasAccess()).toBe(false);
+    expect(getOne).not.toHaveBeenCalled();
+  });
+
+  test("does not query sessions for public pages", async () => {
+    statusPage.isPublicStatusPage = true;
+    expect(await hasAccess()).toBe(true);
+    expect(getOne).not.toHaveBeenCalled();
+  });
+
+  test("preserves independent master-password access", async () => {
+    statusPage.enableMasterPassword = true;
+    statusPage.masterPassword = new HashedString("configured");
+    getOne.mockResolvedValue(null);
+    const req: ExpressRequest = request();
+    req.cookies[CookieUtil.getStatusPageMasterPasswordKey(statusPageId)] =
+      JSONWebToken.signJsonPayload(
+        {
+          statusPageId: statusPageId.toString(),
+          type: MASTER_PASSWORD_COOKIE_IDENTIFIER,
+        },
+        900,
+      );
+    expect(await hasAccess(req)).toBe(true);
+  });
+});