@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/API/AIChatRouteAuthorization.test.ts

@@ -27,6 +27,8 @@ import LlmProvider from "../../../Models/DatabaseModels/LlmProvider";
 import Project from "../../../Models/DatabaseModels/Project";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import Dictionary from "../../../Types/Dictionary";
 import { JSONObject } from "../../../Types/JSON";
@@ -265,6 +267,24 @@ function withProps(props: DatabaseCommonInteractionProps): void {
     .mockResolvedValue(props);
 }
 
+/*
+ * The refusal an anonymous caller must get: 401, not 422. A request with no
+ * credentials is almost always a signed-in user whose access-token cookie
+ * expired together with its JWT, and the dashboard refreshes the session and
+ * replays the request on a 401 and on nothing else. A 422 would strand that
+ * user on "You are not authorized to access this project's data."
+ */
+function expectAuthenticationRequired(thrown: unknown): void {
+  expect(thrown).toBeInstanceOf(NotAuthenticatedException);
+  expect(thrown).not.toBeInstanceOf(NotAuthorizedException);
+  expect((thrown as NotAuthenticatedException).code).toBe(
+    ExceptionCode.NotAuthenticatedException,
+  );
+  expect((thrown as NotAuthenticatedException).message).toBe(
+    CommonAPI.AUTHENTICATION_REQUIRED_MESSAGE,
+  );
+}
+
 // A provider row with the exact metadata the advisory says leaked.
 function victimProvider(): LlmProvider {
   const provider: LlmProvider = new LlmProvider(PROVIDER_ID);
@@ -441,17 +461,35 @@ describe("POST /ai-chat/providers - cross-tenant disclosure (GHSA-hm7m-9qjj-xj5x
   });
 });
 
+/*
+ * Anonymous callers used to get the same 422 as an outsider. They now get
+ * 401 (see expectAuthenticationRequired): still a refusal, still before any
+ * lookup, but one the browser client answers by refreshing the session
+ * instead of showing an authorization error to someone who is signed in.
+ */
 describe("POST /ai-chat/providers - anonymous and unscoped callers", () => {
-  test("an unauthenticated caller (getUserMiddleware admits these as public) is refused", async () => {
+  test("an unauthenticated caller (getUserMiddleware admits these as public) is refused with 401, not 422", async () => {
     withProps(buildProps({ tenantId: PROJECT_B_ID }));
 
     const call: RouteCall = await callProviders();
 
-    expect(call.thrown).toBeInstanceOf(NotAuthorizedException);
+    expectAuthenticationRequired(call.thrown);
+    expect(providerLookupsRan()).toBe(false);
+    expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+  });
+
+  test("an explicitly Public caller is anonymous too, and gets 401", async () => {
+    withProps(
+      buildProps({ tenantId: PROJECT_B_ID, userType: UserType.Public }),
+    );
+
+    const call: RouteCall = await callProviders();
+
+    expectAuthenticationRequired(call.thrown);
     expect(providerLookupsRan()).toBe(false);
   });
 
-  test("an anonymous caller carrying a stray tenant permission entry but no user id is refused", async () => {
+  test("an anonymous caller carrying a stray tenant permission entry but no user id is refused with 401", async () => {
     withProps(
       buildProps({
         userId: undefined,
@@ -462,7 +500,37 @@ describe("POST /ai-chat/providers - anonymous and unscoped callers", () => {
 
     const call: RouteCall = await callProviders();
 
-    expect(call.thrown).toBeInstanceOf(NotAuthorizedException);
+    expectAuthenticationRequired(call.thrown);
+    expect(providerLookupsRan()).toBe(false);
+  });
+
+  /*
+   * "Who are you?" comes before "which project?". An expired session that
+   * also lost its tenantid header must still be told to authenticate, or the
+   * client shows "Project ID is required" instead of refreshing.
+   */
+  test("an anonymous caller with no tenantid header gets 401, not the missing-project 400", async () => {
+    withProps(buildProps({}));
+
+    const call: RouteCall = await callProviders();
+
+    expectAuthenticationRequired(call.thrown);
+    expect(call.thrown).not.toBeInstanceOf(BadDataException);
+    expect(providerLookupsRan()).toBe(false);
+  });
+
+  /*
+   * isMasterAdmin is derived from a master-admin SESSION (userType
+   * MasterAdmin). The flag on its own, with no user and no such session, is
+   * not a credential and must not turn an anonymous request into an
+   * authenticated one.
+   */
+  test("an isMasterAdmin flag without a user or a master-admin session is not a credential", async () => {
+    withProps(buildProps({ tenantId: PROJECT_B_ID, isMasterAdmin: true }));
+
+    const call: RouteCall = await callProviders();
+
+    expectAuthenticationRequired(call.thrown);
     expect(providerLookupsRan()).toBe(false);
   });
 
@@ -483,6 +551,11 @@ describe("POST /ai-chat/providers - anonymous and unscoped callers", () => {
     expect(providerLookupsRan()).toBe(false);
   });
 
+  /*
+   * An API key IS a credential, so it is not "anonymous" and must not get
+   * the 401 an expired session gets - its client has no session to refresh
+   * and would only retry. It keeps the member-route refusal it always had.
+   */
   test("a project API key (no user id) cannot use this route - it is a logged-in-member route", async () => {
     withProps(
       buildProps({
@@ -495,6 +568,13 @@ describe("POST /ai-chat/providers - anonymous and unscoped callers", () => {
     const call: RouteCall = await callProviders();
 
     expect(call.thrown).toBeInstanceOf(NotAuthorizedException);
+    expect(call.thrown).not.toBeInstanceOf(NotAuthenticatedException);
+    expect((call.thrown as NotAuthorizedException).code).toBe(
+      ExceptionCode.NotAuthorizedException,
+    );
+    expect((call.thrown as NotAuthorizedException).message).toBe(
+      "You are not authorized to access this project's data.",
+    );
     expect(providerLookupsRan()).toBe(false);
   });
 });
@@ -767,8 +847,13 @@ describe("every /ai-chat/* route requires membership of the project it was given
     },
   );
 
+  /*
+   * Was NotAuthorizedException (422). An unauthenticated caller is now told
+   * to authenticate (401) so an expired dashboard session refreshes and
+   * replays instead of surfacing an authorization error.
+   */
   test.each(routes)(
-    "$uri refuses an unauthenticated caller",
+    "$uri refuses an unauthenticated caller with 401 and touches nothing",
     async (route: { uri: string; body: JSONObject }) => {
       withProps(buildProps({ tenantId: PROJECT_B_ID }));
 
@@ -777,7 +862,55 @@ describe("every /ai-chat/* route requires membership of the project it was given
         body: route.body,
       });
 
+      expectAuthenticationRequired(call.thrown);
+      expect(call.nextCallCount).toBe(1);
+      expect(AIConversationService.findOneById).not.toHaveBeenCalled();
+      expect(AIConversationMessageService.findOneById).not.toHaveBeenCalled();
+      expect(ProjectService.findOneById).not.toHaveBeenCalled();
+      expect(providerLookupsRan()).toBe(false);
+      expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+    },
+  );
+
+  test.each(routes)(
+    "$uri refuses an unauthenticated caller with no tenantid header with 401, not 400",
+    async (route: { uri: string; body: JSONObject }) => {
+      withProps(buildProps({}));
+
+      const call: RouteCall = await callRoute({
+        uri: route.uri,
+        body: route.body,
+      });
+
+      expectAuthenticationRequired(call.thrown);
+      expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+    },
+  );
+
+  test.each(routes)(
+    "$uri still refuses a project API key with 422, not 401",
+    async (route: { uri: string; body: JSONObject }) => {
+      withProps(
+        buildProps({
+          tenantId: PROJECT_B_ID,
+          memberOfProjectId: PROJECT_B_ID,
+          userType: UserType.API,
+        }),
+      );
+
+      const call: RouteCall = await callRoute({
+        uri: route.uri,
+        body: route.body,
+      });
+
       expect(call.thrown).toBeInstanceOf(NotAuthorizedException);
+      expect((call.thrown as NotAuthorizedException).code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
+      expect(AIConversationService.findOneById).not.toHaveBeenCalled();
+      expect(AIConversationMessageService.findOneById).not.toHaveBeenCalled();
+      expect(providerLookupsRan()).toBe(false);
+      expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
     },
   );
 

package/Tests/Server/API/AIGenerationProjectAIToggle.test.ts

@@ -4,6 +4,7 @@ import CommonAPI from "../../../Server/API/CommonAPI";
 import IncidentAPI from "../../../Server/API/IncidentAPI";
 import IncidentEpisodeAPI from "../../../Server/API/IncidentEpisodeAPI";
 import ScheduledMaintenanceAPI from "../../../Server/API/ScheduledMaintenanceAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import AIService from "../../../Server/Services/AIService";
 import AlertService from "../../../Server/Services/AlertService";
 import IncidentEpisodeService from "../../../Server/Services/IncidentEpisodeService";
@@ -30,12 +31,15 @@ import ScheduledMaintenance from "../../../Models/DatabaseModels/ScheduledMainte
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, {
   UserPermission,
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
 import {
   afterEach,
   beforeAll,
@@ -539,6 +543,189 @@ describe.each(GENERATE_ROUTES)(
   },
 );
 
+/*
+ * A project API key holding Project Admin in `tenantId`: what
+ * getDatabaseCommonInteractionProps returns for a key - no userId, userType
+ * API, and the permissions ProjectMiddleware attached to the key itself.
+ */
+function apiKeyProps(tenantId: ObjectID): DatabaseCommonInteractionProps {
+  const props: DatabaseCommonInteractionProps = adminProps(tenantId);
+
+  return {
+    ...props,
+    userId: undefined,
+    userType: UserType.API,
+  };
+}
+
+type GateResult = {
+  // False when a middleware answered the request itself.
+  handlerReached: boolean;
+  thrown: unknown;
+};
+
+/*
+ * Runs a registered route the way Express does once getUserMiddleware has
+ * classified the caller as `userType`: every later middleware in order, then
+ * the handler, stopping at the first middleware that answers instead of
+ * calling next(). getUserMiddleware itself is not run - it needs a real
+ * token to verify - so the request carries the userType it would have set.
+ */
+async function callThroughAuthGate(
+  route: GenerateRoute,
+  userType: UserType | undefined,
+): Promise<GateResult> {
+  const req: ExpressRequest = {
+    params: route.params,
+    query: {},
+    body: route.body,
+    headers: {},
+    userType: userType,
+  } as unknown as ExpressRequest;
+
+  const res: ExpressResponse = {} as ExpressResponse;
+
+  const registered: {
+    middlewares: Array<
+      (
+        req: ExpressRequest,
+        res: ExpressResponse,
+        next: NextFunction,
+      ) => void | Promise<void>
+    >;
+  } = mockRouter.match("post", route.uri);
+
+  for (const middleware of registered.middlewares.slice(1)) {
+    let calledNext: boolean = false;
+
+    await middleware(req, res, ((): void => {
+      calledNext = true;
+    }) as NextFunction);
+
+    if (!calledNext) {
+      return { handlerReached: false, thrown: undefined };
+    }
+  }
+
+  const next: jest.Mock = jest.fn();
+
+  await mockRouter
+    .match("post", route.uri)
+    .handlerFunction(req, res, next as unknown as NextFunction);
+
+  return {
+    handlerReached: true,
+    thrown: next.mock.calls[0] ? next.mock.calls[0][0] : undefined,
+  };
+}
+
+/*
+ * The expired-session half of these routes. The dashboard's access-token
+ * cookie expires with the JWT inside it, so a tab left open past the token
+ * lifetime sends "Generate with AI" with no credentials at all.
+ * getUserMiddleware lets that through as Public; requireUserAuthentication,
+ * mounted straight after it, answers 401 - the one status the browser client
+ * refreshes the session on and replays. Before it was mounted the handler's
+ * own permission check answered 400, which the client showed as an error.
+ */
+describe.each(GENERATE_ROUTES)(
+  "POST $uri - expired session",
+  (route: GenerateRoute) => {
+    test("is mounted with requireUserAuthentication directly after getUserMiddleware", () => {
+      expect(mockRouter.match("post", route.uri).middlewares).toEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    });
+
+    test.each([
+      ["a Public caller", UserType.Public],
+      ["a caller getUserMiddleware left unclassified", undefined],
+    ])(
+      "%s is answered 401 before the handler runs, and nothing is read or spent",
+      async (_label: string, userType: UserType | undefined) => {
+        const stubs: RouteStubs = route.stub(PROJECT_ID);
+
+        const result: GateResult = await callThroughAuthGate(route, userType);
+
+        expect(result.handlerReached).toBe(false);
+
+        const sendError: jest.Mock =
+          Response.sendErrorResponse as unknown as jest.Mock;
+        expect(sendError).toHaveBeenCalledTimes(1);
+
+        const error: unknown = sendError.mock.calls[0]![2];
+        expect(error).toBeInstanceOf(NotAuthenticatedException);
+        expect((error as NotAuthenticatedException).code).toBe(
+          ExceptionCode.NotAuthenticatedException,
+        );
+        expect((error as NotAuthenticatedException).message).toBe(
+          UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+        );
+
+        expect(stubs.resourceLookup).not.toHaveBeenCalled();
+        expect(stubs.contextBuild).not.toHaveBeenCalled();
+        expect(projectLookup).not.toHaveBeenCalled();
+        expect(executeWithLogging).not.toHaveBeenCalled();
+        expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+      },
+    );
+
+    /*
+     * Generating from CI or a script is supported: the gate is about "no
+     * credentials", not "no human". A key with the right permission still
+     * gets its text, subject to the same kill switch as everyone else.
+     */
+    test("a project API key passes the gate and still generates", async () => {
+      const stubs: RouteStubs = route.stub(PROJECT_ID);
+      jest
+        .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+        .mockResolvedValue(apiKeyProps(PROJECT_ID));
+
+      const result: GateResult = await callThroughAuthGate(route, UserType.API);
+
+      expect(result.handlerReached).toBe(true);
+      expect(result.thrown).toBeUndefined();
+      expect(Response.sendErrorResponse).not.toHaveBeenCalled();
+      expect(stubs.contextBuild).toHaveBeenCalledTimes(1);
+      expect(executeWithLogging).toHaveBeenCalledTimes(1);
+      expect(sentPayload()[route.responseKey]).toBe(GENERATED_TEXT);
+    });
+
+    test("a logged-in user passes the gate unchanged", async () => {
+      route.stub(PROJECT_ID);
+
+      const result: GateResult = await callThroughAuthGate(
+        route,
+        UserType.User,
+      );
+
+      expect(result.handlerReached).toBe(true);
+      expect(result.thrown).toBeUndefined();
+      expect(executeWithLogging).toHaveBeenCalledTimes(1);
+    });
+
+    /*
+     * Defence in depth: the handler does not rely on the middleware alone.
+     * Its own tenant check refuses a credential-less caller with the same
+     * 401 - ahead of the permission check that used to answer it with 400.
+     */
+    test("the handler itself answers credential-less props with 401 before reading the row", async () => {
+      const stubs: RouteStubs = route.stub(PROJECT_ID);
+      jest
+        .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+        .mockResolvedValue({ tenantId: PROJECT_ID });
+
+      const call: RouteCall = await callRoute(route);
+
+      expect(call.thrown).toBeInstanceOf(NotAuthenticatedException);
+      expect(call.thrown).not.toBeInstanceOf(BadDataException);
+      expect(stubs.resourceLookup).not.toHaveBeenCalled();
+      expect(executeWithLogging).not.toHaveBeenCalled();
+    });
+  },
+);
+
 /*
  * The shape of the gate's own read is load-bearing, and wrong in a way no
  * route-level assertion above would notice — because getting either half

package/Tests/Server/API/AIInvestigationAvailabilityAuthorization.test.ts

@@ -20,9 +20,12 @@ import AIRunStatus from "../../../Types/AI/AIRunStatus";
 import AIRunType from "../../../Types/AI/AIRunType";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
+import UserType from "../../../Types/UserType";
 
 jest.mock("../../../Server/Utils/Express", () => {
   return {
@@ -225,13 +228,58 @@ describe.each(["incident", "alert"] as const)(
       expectNoPrivateReads();
     });
 
-    test("requires a logged-in user before any subject or explanation read", async () => {
+    /*
+     * A caller with no credentials at all (only a tenantid header) is an
+     * expired session far more often than a stranger, so it gets 401 - the
+     * status the dashboard answers by refreshing the session and replaying -
+     * rather than the 422 it used to get.
+     */
+    test("requires a logged-in user before any subject or explanation read, answering an anonymous caller with 401", async () => {
       jest
         .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
         .mockResolvedValue({ tenantId: PROJECT_ID });
 
-      expect(await callRoute()).toHaveBeenCalledWith(
-        expect.any(NotAuthorizedException),
+      const next: jest.Mock = await callRoute();
+
+      expect(next).toHaveBeenCalledTimes(1);
+      expect(next).toHaveBeenCalledWith(expect.any(NotAuthenticatedException));
+      expect((next.mock.calls[0]![0] as NotAuthenticatedException).code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+      expect(subjectRead).not.toHaveBeenCalled();
+      expectNoPrivateReads();
+    });
+
+    test("an anonymous caller with no tenant either still gets 401, not the missing-tenant 400", async () => {
+      jest
+        .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+        .mockResolvedValue({ userType: UserType.Public });
+
+      const next: jest.Mock = await callRoute();
+
+      expect(next).toHaveBeenCalledWith(expect.any(NotAuthenticatedException));
+      expect(subjectRead).not.toHaveBeenCalled();
+      expectNoPrivateReads();
+    });
+
+    /*
+     * A project API key is authenticated, just not as a person. The panel
+     * is a person's view, so the key is refused - with 422, never the 401
+     * that would send its client off to refresh a session it never had.
+     */
+    test("refuses a project API key with 422 before any subject or explanation read", async () => {
+      jest
+        .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+        .mockResolvedValue({ tenantId: PROJECT_ID, userType: UserType.API });
+
+      const next: jest.Mock = await callRoute();
+
+      expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+      expect(next).not.toHaveBeenCalledWith(
+        expect.any(NotAuthenticatedException),
+      );
+      expect((next.mock.calls[0]![0] as NotAuthorizedException).message).toBe(
+        "A logged-in user session is required.",
       );
       expect(subjectRead).not.toHaveBeenCalled();
       expectNoPrivateReads();

package/Tests/Server/API/AIInvestigationEvidenceAPI.test.ts

@@ -37,9 +37,12 @@ import { InvestigationEvidenceRowsResponse } from "../../../Types/AI/Investigati
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
+import UserType from "../../../Types/UserType";
 import {
   afterEach,
   beforeEach,
@@ -340,7 +343,12 @@ describe("POST /ai-investigation/evidence", () => {
       expectNoReads();
     });
 
-    it("requires a logged-in user session", async () => {
+    /*
+     * No credentials at all is 401, not 422: it is almost always an expired
+     * dashboard session, and 401 is what makes the client refresh it and
+     * replay the request.
+     */
+    it("requires a logged-in user session, answering a caller with no credentials with 401", async () => {
       jest
         .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
         .mockResolvedValue({
@@ -350,7 +358,52 @@ describe("POST /ai-investigation/evidence", () => {
       const next: ReturnType<typeof jest.fn> =
         await callEvidenceRoute(incidentBody());
 
-      expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+      expect(next).toHaveBeenCalledTimes(1);
+      expect(next).toHaveBeenCalledWith(expect.any(NotAuthenticatedException));
+      expect((next.mock.calls[0]![0] as NotAuthenticatedException).code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+      expectNoReads();
+    });
+
+    it("answers an anonymous caller with 401 even when its body is malformed too", async () => {
+      jest
+        .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+        .mockResolvedValue({
+          userType: UserType.Public,
+        } as DatabaseCommonInteractionProps);
+
+      const next: ReturnType<typeof jest.fn> = await callEvidenceRoute(
+        incidentBody({ citationId: "not-a-citation" }),
+      );
+
+      expect(next).toHaveBeenCalledWith(expect.any(NotAuthenticatedException));
+      expectNoReads();
+    });
+
+    /*
+     * A project API key is authenticated, so it keeps the 422 this
+     * person-only route has always given it; a 401 would only send its
+     * client to refresh a session that does not exist.
+     */
+    it("refuses a project API key with 422 before any read", async () => {
+      jest
+        .spyOn(CommonAPI, "getDatabaseCommonInteractionProps")
+        .mockResolvedValue({
+          tenantId: PROJECT_ID,
+          userType: UserType.API,
+          userTenantAccessPermission: viewerProps.userTenantAccessPermission,
+        } as DatabaseCommonInteractionProps);
+
+      const next: ReturnType<typeof jest.fn> =
+        await callEvidenceRoute(incidentBody());
+
+      expect(next).toHaveBeenCalledWith(
+        new NotAuthorizedException("A logged-in user session is required."),
+      );
+      expect(next).not.toHaveBeenCalledWith(
+        expect.any(NotAuthenticatedException),
+      );
       expectNoReads();
     });