@oneuptime/common 13.0.6 → 13.0.8

package/Tests/Server/Services/StatusPagePrivateUserReadAccessPostgres.test.ts

@@ -0,0 +1,311 @@
+import Entities from "../../../Models/DatabaseModels/Index";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
+import PostgresAppInstance from "../../../Server/Infrastructure/PostgresDatabase";
+import StatusPagePrivateUserSessionService from "../../../Server/Services/StatusPagePrivateUserSessionService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import { ExpressRequest } from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import logger from "../../../Server/Utils/Logger";
+import Email from "../../../Types/Email";
+import HashedString from "../../../Types/HashedString";
+import ObjectID from "../../../Types/ObjectID";
+import { DataSource } from "typeorm";
+
+/*
+ * Opt in with RUN_POSTGRES_STATUS_PAGE_PRIVACY_TESTS=true and config.env.
+ * Clone the real tables into an isolated schema; never modify project data.
+ */
+const describePostgres: typeof describe =
+  process.env["RUN_POSTGRES_STATUS_PAGE_PRIVACY_TESTS"] === "true"
+    ? describe
+    : describe.skip;
+
+describePostgres("private status page authorization against Postgres", () => {
+  const schema: string = `status_page_access_test_${ObjectID.generate().toString().replace(/-/g, "")}`;
+  const projectId: ObjectID = ObjectID.generate();
+  const statusPageId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const sessionId: ObjectID = ObjectID.generate();
+  let database: DataSource;
+  let req: ExpressRequest;
+
+  beforeAll(async () => {
+    database = new DataSource({
+      type: "postgres",
+      host:
+        process.env["STATUS_PAGE_PRIVACY_TEST_DATABASE_HOST"] || "localhost",
+      port: Number(
+        process.env["STATUS_PAGE_PRIVACY_TEST_DATABASE_PORT"] || "5400",
+      ),
+      username: process.env["DATABASE_USERNAME"] || "postgres",
+      password: process.env["DATABASE_PASSWORD"] || "password",
+      database: process.env["DATABASE_NAME"] || "oneuptimedb",
+      entities: Entities,
+      schema,
+      synchronize: false,
+      extra: { options: `-c search_path=${schema},public` },
+    });
+    await database.initialize();
+    await database.query(`CREATE SCHEMA "${schema}"`);
+    for (const table of [
+      "StatusPagePrivateUser",
+      "StatusPagePrivateUserSession",
+    ]) {
+      await database.query(
+        `CREATE TABLE "${schema}"."${table}" (LIKE public."${table}" INCLUDING ALL)`,
+      );
+    }
+    jest.spyOn(PostgresAppInstance, "isConnected").mockReturnValue(true);
+    jest.spyOn(PostgresAppInstance, "getDataSource").mockReturnValue(database);
+    const statusPage: StatusPage = new StatusPage();
+    statusPage.id = statusPageId;
+    statusPage.isPublicStatusPage = false;
+    jest.spyOn(StatusPageService, "findOneById").mockResolvedValue(statusPage);
+    req = {
+      cookies: {
+        [CookieUtil.getUserTokenKey(statusPageId)]: JSONWebToken.sign({
+          data: {
+            userId,
+            statusPageId,
+            sessionId,
+            email: new Email("synthetic@example.com"),
+          },
+          expiresInSeconds: 900,
+        }),
+      },
+    } as ExpressRequest;
+  });
+
+  beforeEach(async () => {
+    await database.query(
+      `TRUNCATE "${schema}"."StatusPagePrivateUserSession", "${schema}"."StatusPagePrivateUser"`,
+    );
+    await database.query(
+      `INSERT INTO "${schema}"."StatusPagePrivateUser" ("_id", "projectId", "statusPageId", "version") VALUES ($1, $2, $3, 1)`,
+      [userId.toString(), projectId.toString(), statusPageId.toString()],
+    );
+    await database.query(
+      `INSERT INTO "${schema}"."StatusPagePrivateUserSession"
+       ("_id", "projectId", "statusPageId", "statusPagePrivateUserId", "refreshToken", "refreshTokenExpiresAt", "version")
+       VALUES ($1, $2, $3, $4, 'synthetic-token-hash', NOW() + INTERVAL '1 day', 1)`,
+      [
+        sessionId.toString(),
+        projectId.toString(),
+        statusPageId.toString(),
+        userId.toString(),
+      ],
+    );
+  });
+
+  afterAll(async () => {
+    jest.restoreAllMocks();
+    if (database?.isInitialized) {
+      await database.query(`DROP SCHEMA IF EXISTS "${schema}" CASCADE`);
+      await database.destroy();
+    }
+  });
+
+  async function hasAccess(): Promise<boolean> {
+    return (await StatusPageService.hasReadAccess({ statusPageId, req }))
+      .hasReadAccess;
+  }
+
+  test("authorizes an active session with exactly one database query", async () => {
+    const logQuery: jest.SpyInstance = jest.spyOn(database.logger, "logQuery");
+    try {
+      expect(await hasAccess()).toBe(true);
+      expect(logQuery).toHaveBeenCalledTimes(1);
+      const sql: string = logQuery.mock.calls[0]![0] as string;
+      expect(sql).toContain('"session"."_id" = $1');
+      expect(sql).not.toContain('"email"');
+      expect(sql).not.toContain('"ipAddress"');
+      expect(sql).not.toContain('"userAgent"');
+    } finally {
+      logQuery.mockRestore();
+    }
+  });
+
+  test.each([
+    [
+      "revoked session",
+      'UPDATE "StatusPagePrivateUserSession" SET "isRevoked" = true',
+    ],
+    [
+      "expired refresh token",
+      'UPDATE "StatusPagePrivateUserSession" SET "refreshTokenExpiresAt" = NOW()',
+    ],
+    [
+      "soft-deleted session",
+      'UPDATE "StatusPagePrivateUserSession" SET "deletedAt" = NOW()',
+    ],
+    ["hard-deleted session", 'DELETE FROM "StatusPagePrivateUserSession"'],
+    [
+      "soft-deleted user",
+      'UPDATE "StatusPagePrivateUser" SET "deletedAt" = NOW()',
+    ],
+    ["hard-deleted user", 'DELETE FROM "StatusPagePrivateUser"'],
+    [
+      "session owned by another user",
+      'UPDATE "StatusPagePrivateUserSession" SET "statusPagePrivateUserId" = uuid_generate_v4()',
+    ],
+    [
+      "session for another page",
+      'UPDATE "StatusPagePrivateUserSession" SET "statusPageId" = uuid_generate_v4()',
+    ],
+    [
+      "user moved to another page",
+      'UPDATE "StatusPagePrivateUser" SET "statusPageId" = uuid_generate_v4()',
+    ],
+    [
+      "unexchanged login code",
+      `UPDATE "StatusPagePrivateUserSession" SET "additionalInfo" = '{"oneuptimeStatusPageSessionPurpose":"login-code"}'::jsonb`,
+    ],
+  ])(
+    "denies the same unexpired JWT after %s",
+    async (_label: string, sql: string) => {
+      expect(await hasAccess()).toBe(true);
+      // All connections in this test use only the isolated schema first.
+      await database.query(sql);
+      expect(await hasAccess()).toBe(false);
+    },
+  );
+
+  describe("login-code exchange activity", () => {
+    let loginCode: string;
+
+    beforeEach(async () => {
+      loginCode = ObjectID.generate().toString();
+      const codeHash: string = await HashedString.hashValue(
+        loginCode,
+        EncryptionSecret,
+      );
+      await database.query(
+        `UPDATE "${schema}"."StatusPagePrivateUserSession"
+         SET "refreshToken" = $1, "refreshTokenExpiresAt" = NOW() + INTERVAL '5 minutes',
+             "additionalInfo" = '{"oneuptimeStatusPageSessionPurpose":"login-code"}'::jsonb
+         WHERE "_id" = $2`,
+        [codeHash, sessionId.toString()],
+      );
+    });
+
+    async function activity(): Promise<Date | null> {
+      const rows: Array<{ lastActive: Date | null }> = await database.query(
+        `SELECT "lastActive" FROM "${schema}"."StatusPagePrivateUser" WHERE "_id" = $1`,
+        [userId.toString()],
+      );
+      return rows[0]?.lastActive || null;
+    }
+
+    test("successful exchange records activity once without logging private data", async () => {
+      const email: string = "synthetic-activity@example.com";
+      const ipAddress: string = "192.0.2.42";
+      const userAgent: string = "Synthetic private browser";
+      await database.query(
+        `UPDATE "${schema}"."StatusPagePrivateUser" SET "email" = $1 WHERE "_id" = $2`,
+        [email, userId.toString()],
+      );
+      const logSpies: Array<jest.SpyInstance> = [
+        jest.spyOn(logger, "debug").mockImplementation(() => {}),
+        jest.spyOn(logger, "info").mockImplementation(() => {}),
+        jest.spyOn(logger, "warn").mockImplementation(() => {}),
+        jest.spyOn(logger, "error").mockImplementation(() => {}),
+      ];
+
+      try {
+        expect(await activity()).toBeNull();
+        const startedAt: number = Date.now();
+        await expect(
+          StatusPagePrivateUserSessionService.exchangeLoginCode(loginCode, {
+            statusPageId,
+            ipAddress,
+            userAgent,
+          }),
+        ).resolves.not.toBeNull();
+
+        const lastActive: Date | null = await activity();
+        expect(lastActive).toBeInstanceOf(Date);
+        expect(lastActive!.getTime()).toBeGreaterThanOrEqual(startedAt);
+        expect(lastActive!.getTime()).toBeLessThanOrEqual(Date.now());
+
+        await expect(
+          StatusPagePrivateUserSessionService.exchangeLoginCode(loginCode, {
+            statusPageId,
+          }),
+        ).resolves.toBeNull();
+        expect(await activity()).toEqual(lastActive);
+
+        const logs: string = JSON.stringify(
+          logSpies.map((spy: jest.SpyInstance) => {
+            return spy.mock.calls;
+          }),
+        );
+        expect(logs).not.toContain(email);
+        expect(logs).not.toContain(ipAddress);
+        expect(logs).not.toContain(userAgent);
+      } finally {
+        for (const spy of logSpies) {
+          spy.mockRestore();
+        }
+      }
+    });
+
+    test.each([
+      [
+        "soft-deleted user",
+        'UPDATE "StatusPagePrivateUser" SET "deletedAt" = NOW()',
+      ],
+      ["hard-deleted user", 'DELETE FROM "StatusPagePrivateUser"'],
+      [
+        "user moved to another page",
+        'UPDATE "StatusPagePrivateUser" SET "statusPageId" = uuid_generate_v4()',
+      ],
+      [
+        "user moved to another project",
+        'UPDATE "StatusPagePrivateUser" SET "projectId" = uuid_generate_v4()',
+      ],
+      [
+        "session assigned to another user",
+        'UPDATE "StatusPagePrivateUserSession" SET "statusPagePrivateUserId" = uuid_generate_v4()',
+      ],
+    ])(
+      "exchange cannot record activity for a %s",
+      async (_label: string, sql: string) => {
+        await database.query(sql);
+
+        await expect(
+          StatusPagePrivateUserSessionService.exchangeLoginCode(loginCode, {
+            statusPageId,
+          }),
+        ).resolves.not.toBeNull();
+
+        expect(await activity()).toBeNull();
+      },
+    );
+
+    test.each([
+      [
+        "expired",
+        'UPDATE "StatusPagePrivateUserSession" SET "refreshTokenExpiresAt" = NOW() - INTERVAL \'1 second\'',
+      ],
+      [
+        "revoked",
+        'UPDATE "StatusPagePrivateUserSession" SET "isRevoked" = true',
+      ],
+    ])(
+      "a %s code cannot record activity",
+      async (_label: string, sql: string) => {
+        await database.query(sql);
+
+        await expect(
+          StatusPagePrivateUserSessionService.exchangeLoginCode(loginCode, {
+            statusPageId,
+          }),
+        ).resolves.toBeNull();
+
+        expect(await activity()).toBeNull();
+      },
+    );
+  });
+});

package/Tests/Server/Services/StatusPagePrivateUserSessionService.test.ts

@@ -1,6 +1,10 @@
+import StatusPagePrivateUser from "../../../Models/DatabaseModels/StatusPagePrivateUser";
 import StatusPagePrivateUserSession from "../../../Models/DatabaseModels/StatusPagePrivateUserSession";
+import StatusPagePrivateUserService from "../../../Server/Services/StatusPagePrivateUserService";
 import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
 import FindOneBy from "../../../Server/Types/Database/FindOneBy";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import logger from "../../../Server/Utils/Logger";
 import {
   CreateSessionOptions,
   Service,
@@ -264,11 +268,23 @@ const installInMemoryBoundary: (
   return { casCalls, replacementWasPreHashed };
 };
 
-describe("StatusPagePrivateUserSessionService login-code exchange", () => {
+describe("StatusPagePrivateUserSessionService sign-in and login-code exchange", () => {
+  let privateUserUpdate: ReturnType<
+    typeof jest.fn<() => Promise<UpdateResult>>
+  >;
+
   beforeEach(() => {
     jest.restoreAllMocks();
     jest.useFakeTimers();
     jest.setSystemTime(FROZEN_NOW);
+    privateUserUpdate = jest.fn(async (): Promise<UpdateResult> => {
+      return makeUpdateResult(1);
+    });
+    getJestSpyOn(StatusPagePrivateUserService, "getRepository").mockReturnValue(
+      {
+        update: privateUserUpdate,
+      } as unknown as Repository<StatusPagePrivateUser>,
+    );
   });
 
   afterEach(() => {
@@ -276,6 +292,126 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
     jest.restoreAllMocks();
   });
 
+  test.each(["password", "SSO"])(
+    "records private-user lastActive after successful %s sign-in",
+    async (provider: string) => {
+      const service: Service = new Service();
+      const ids: SessionIds = buildIds();
+      const create: jest.SpyInstance = getJestSpyOn(
+        service,
+        "create",
+      ).mockImplementation(
+        async (
+          request: CreateBy<StatusPagePrivateUserSession>,
+        ): Promise<StatusPagePrivateUserSession> => {
+          expect(privateUserUpdate).not.toHaveBeenCalled();
+          request.data.id = ids.sessionId;
+          return request.data;
+        },
+      );
+      const options: CreateSessionOptions = {
+        projectId: ids.projectId,
+        statusPageId: ids.statusPageId,
+        statusPagePrivateUserId: ids.privateUserId,
+      };
+
+      if (provider === "password") {
+        await service.createSession(options);
+      } else {
+        await service.createLoginCodeSession(options);
+      }
+
+      expect(create).toHaveBeenCalledTimes(1);
+      expect(privateUserUpdate).toHaveBeenCalledTimes(1);
+      expect(privateUserUpdate).toHaveBeenCalledWith(
+        {
+          _id: ids.privateUserId.toString(),
+          projectId: ids.projectId,
+          statusPageId: ids.statusPageId,
+          deletedAt: expect.objectContaining({ _type: "isNull" }),
+        },
+        { lastActive: FROZEN_NOW },
+      );
+    },
+  );
+
+  test("does not record a sign-in when session creation fails", async () => {
+    const service: Service = new Service();
+    const ids: SessionIds = buildIds();
+    getJestSpyOn(service, "create").mockRejectedValue(
+      new Error("Session creation failed"),
+    );
+
+    await expect(
+      service.createSession({
+        projectId: ids.projectId,
+        statusPageId: ids.statusPageId,
+        statusPagePrivateUserId: ids.privateUserId,
+      }),
+    ).rejects.toThrow("Session creation failed");
+    expect(privateUserUpdate).not.toHaveBeenCalled();
+  });
+
+  test.each(["session creation", "login-code exchange"])(
+    "%s remains successful when activity bookkeeping fails",
+    async (flow: string) => {
+      const service: Service = new Service();
+      const ids: SessionIds = buildIds();
+      const loginCode: string = ObjectID.generate().toString();
+      const session: StatusPagePrivateUserSession = await buildLoginSession({
+        ids,
+        loginCode,
+      });
+      const warn: jest.SpyInstance = getJestSpyOn(
+        logger,
+        "warn",
+      ).mockImplementation((): void => {});
+      privateUserUpdate.mockRejectedValue(
+        new Error("Failed write containing private-user@example.com"),
+      );
+
+      if (flow === "session creation") {
+        getJestSpyOn(service, "create").mockResolvedValue(session);
+        await expect(
+          service.createSession({
+            projectId: ids.projectId,
+            statusPageId: ids.statusPageId,
+            statusPagePrivateUserId: ids.privateUserId,
+          }),
+        ).resolves.toEqual(expect.objectContaining({ session }));
+      } else {
+        installInMemoryBoundary(service, session);
+        await expect(
+          service.exchangeLoginCode(loginCode, {
+            statusPageId: ids.statusPageId,
+          }),
+        ).resolves.not.toBeNull();
+      }
+
+      expect(warn).toHaveBeenCalledTimes(1);
+      expect(warn).toHaveBeenCalledWith(
+        `Failed to record sign-in activity for status page private user ${ids.privateUserId.toString()}`,
+      );
+    },
+  );
+
+  test("refresh and session activity do not count as a new sign-in", async () => {
+    const service: Service = new Service();
+    const ids: SessionIds = buildIds();
+    const session: StatusPagePrivateUserSession = await buildLoginSession({
+      ids,
+      loginCode: ObjectID.generate().toString(),
+      purpose: "",
+    });
+    getJestSpyOn(service, "updateOneByIdAndFetch").mockResolvedValue(session);
+    getJestSpyOn(service, "updateOneById").mockResolvedValue(1);
+
+    await service.renewSessionWithNewRefreshToken({ session });
+    await service.touchSession(ids.sessionId, {});
+
+    expect(privateUserUpdate).not.toHaveBeenCalled();
+  });
+
   test("creates a purpose-marked login code that expires after five minutes", async () => {
     const service: Service = new Service();
     const ids: SessionIds = buildIds();
@@ -334,6 +470,7 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
       }),
     ).resolves.toBeNull();
     expect(findActiveSessionSpy).not.toHaveBeenCalled();
+    expect(privateUserUpdate).not.toHaveBeenCalled();
   });
 
   test("rejects an ordinary refresh session with no login-code purpose", async () => {
@@ -360,6 +497,7 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
       }),
     ).resolves.toBeNull();
     expect(update).not.toHaveBeenCalled();
+    expect(privateUserUpdate).not.toHaveBeenCalled();
   });
 
   test("rejects a valid login code presented for another status page", async () => {
@@ -385,8 +523,73 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
       }),
     ).resolves.toBeNull();
     expect(update).not.toHaveBeenCalled();
+    expect(privateUserUpdate).not.toHaveBeenCalled();
   });
 
+  test.each(["statusPagePrivateUserId", "projectId"] as const)(
+    "rejects a login code missing %s without changing any user's activity",
+    async (missingField: "statusPagePrivateUserId" | "projectId") => {
+      const service: Service = new Service();
+      const ids: SessionIds = buildIds();
+      const loginCode: string = ObjectID.generate().toString();
+      const session: StatusPagePrivateUserSession = await buildLoginSession({
+        ids,
+        loginCode,
+      });
+      Object.assign(session, { [missingField]: undefined });
+      getJestSpyOn(
+        service,
+        "findActiveSessionByRefreshToken",
+      ).mockResolvedValue(session);
+      const repository: jest.SpyInstance = getJestSpyOn(
+        service,
+        "getRepository",
+      );
+
+      await expect(
+        service.exchangeLoginCode(loginCode, {
+          statusPageId: ids.statusPageId,
+        }),
+      ).resolves.toBeNull();
+
+      expect(repository).not.toHaveBeenCalled();
+      expect(privateUserUpdate).not.toHaveBeenCalled();
+    },
+  );
+
+  test.each(["expired", "revoked"])(
+    "a %s login code cannot update private-user lastActive",
+    async (state: string) => {
+      const service: Service = new Service();
+      const ids: SessionIds = buildIds();
+      const loginCode: string = ObjectID.generate().toString();
+      const session: StatusPagePrivateUserSession = await buildLoginSession({
+        ids,
+        loginCode,
+      });
+
+      if (state === "expired") {
+        session.refreshTokenExpiresAt = new Date(FROZEN_NOW.getTime() - 1);
+      } else {
+        session.isRevoked = true;
+      }
+
+      const boundary: InMemoryBoundary = installInMemoryBoundary(
+        service,
+        session,
+      );
+
+      await expect(
+        service.exchangeLoginCode(loginCode, {
+          statusPageId: ids.statusPageId,
+        }),
+      ).resolves.toBeNull();
+
+      expect(boundary.casCalls).toHaveLength(0);
+      expect(privateUserUpdate).not.toHaveBeenCalled();
+    },
+  );
+
   test("binds the atomic exchange to the old hash, expiry, purpose, and revocation state", async () => {
     const service: Service = new Service();
     const ids: SessionIds = buildIds();
@@ -470,6 +673,15 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
     });
     expect(data.additionalInfo?.[PURPOSE_KEY]).toBeUndefined();
     expect(result!.session.additionalInfo?.[PURPOSE_KEY]).toBeUndefined();
+    expect(privateUserUpdate).toHaveBeenCalledWith(
+      {
+        _id: ids.privateUserId.toString(),
+        projectId: ids.projectId,
+        statusPageId: ids.statusPageId,
+        deletedAt: expect.objectContaining({ _type: "isNull" }),
+      },
+      { lastActive: FROZEN_NOW },
+    );
   });
 
   test("returns null when the compare-and-swap affects no row", async () => {
@@ -499,6 +711,7 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
       }),
     ).resolves.toBeNull();
     expect(update).toHaveBeenCalledTimes(1);
+    expect(privateUserUpdate).not.toHaveBeenCalled();
   });
 
   test("allows exactly one of two concurrent redemptions", async () => {
@@ -543,6 +756,7 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
     expect(boundary.replacementWasPreHashed).toEqual([true, true]);
     expect(row.additionalInfo).toEqual({ identityProvider: "saml" });
     expect(row.additionalInfo?.[PURPOSE_KEY]).toBeUndefined();
+    expect(privateUserUpdate).toHaveBeenCalledTimes(1);
   });
 
   test("resolves the rotated plaintext credential but never the consumed code", async () => {
@@ -583,5 +797,6 @@ describe("StatusPagePrivateUserSessionService login-code exchange", () => {
       }),
     ).resolves.toBeNull();
     expect(boundary.casCalls).toHaveLength(1);
+    expect(privateUserUpdate).toHaveBeenCalledTimes(1);
   });
 });

package/Tests/Server/Services/TeamComplianceServiceBehaviour.test.ts

@@ -73,7 +73,7 @@ jest.mock("../../../Server/Services/OnCallReadinessService", () => {
  *
  * This file began as a CHARACTERIZATION suite: it pinned the behaviour the
  * service had before the readiness work, including four defects the plan
- * (Internal/Roadmap/OnCallNotificationReadiness.md, section 2.6) called out.
+ * (Docs/Internal/Roadmap/OnCallNotificationReadiness.md, section 2.6) called out.
  * PHASE 2 HAS NOW CLOSED ALL FOUR, by rebuilding the two "has on-call rules"
  * checks on top of OnCallReadinessService, and the four DEFECT blocks below
  * have been inverted in place - each still sits under its original heading so