@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/API/GlobalConfigLicense.test.ts

@@ -1,5 +1,6 @@
 import GlobalConfigAPI from "../../../Server/API/GlobalConfigAPI";
 import MasterAdminAuthorization from "../../../Server/Middleware/MasterAdminAuthorization";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import GlobalConfigService from "../../../Server/Services/GlobalConfigService";
 import UserService from "../../../Server/Services/UserService";
 import Response from "../../../Server/Utils/Response";
@@ -7,9 +8,12 @@ import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
 import HTTPErrorResponse from "../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../Types/API/HTTPResponse";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
+import UserType from "../../../Types/UserType";
 import API from "../../../Utils/API";
 import {
   NextFunction,
@@ -306,8 +310,13 @@ describe("GlobalConfigAPI licence routes", () => {
         new HTTPResponse<JSONObject>(200, licenseServerPayload(), {}),
       );
 
+    /*
+     * Express always gives a request a `query` object; the licence GET reads
+     * `signedIn` from it before anything else.
+     */
     mockRequest = {
       body: {},
+      query: {},
     } as unknown as OneUptimeRequest;
 
     mockResponse = {
@@ -653,5 +662,136 @@ describe("GlobalConfigAPI licence routes", () => {
       expect(body["canAddMoreUsers"]).toBe(true);
       expect(UserService.countBy).not.toHaveBeenCalled();
     });
+
+    /*
+     * THE EXPIRED-SESSION CASE
+     *
+     * The dashboard's access-token cookie expires with the JWT inside it, so a
+     * signed-in tab left idle past the token lifetime asks for the licence
+     * with no session at all. On its own this route cannot tell that apart
+     * from the login page, and answers with the reduced anonymous payload and
+     * a 200 - which the edition pill reads as "no licence, no instances". The
+     * dashboards now say `?signedIn=true`; a caller that says so but carries
+     * no credentials is answered 401, the one status the browser client
+     * refreshes the session and replays on.
+     */
+    describe("?signedIn=true", () => {
+      type SetCallerFunction = (caller: Record<string, unknown>) => void;
+
+      const setCaller: SetCallerFunction = (
+        caller: Record<string, unknown>,
+      ): void => {
+        Object.assign(
+          mockRequest as unknown as Record<string, unknown>,
+          caller,
+        );
+      };
+
+      it.each([
+        ["no userType at all", {}],
+        [
+          "userType Public (what getUserMiddleware stamps)",
+          { userType: UserType.Public },
+        ],
+      ])(
+        "answers an anonymous caller (%s) with a 401 before reading the config",
+        async (_label: string, caller: Record<string, unknown>) => {
+          setCaller({ ...caller, query: { signedIn: "true" } });
+
+          await callGet();
+
+          const error: Error = nextError();
+
+          expect(error).toBeInstanceOf(NotAuthenticatedException);
+          expect((error as Exception).code).toBe(401);
+          expect(error.message).toBe(
+            UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+          );
+          expect(GlobalConfigService.findOneById).not.toHaveBeenCalled();
+          expect(UserService.countBy).not.toHaveBeenCalled();
+          expect(Response.sendJsonObjectResponse).not.toHaveBeenCalled();
+        },
+      );
+
+      // The login page does not send the flag and must keep working.
+      it("still serves an anonymous caller without the flag the reduced payload", async () => {
+        setCaller({ userType: UserType.Public, query: {} });
+
+        await callGet();
+
+        expect(nextFunction).not.toHaveBeenCalled();
+        expect(GlobalConfigService.findOneById).toHaveBeenCalledTimes(1);
+
+        const body: JSONObject = getResponseBody();
+
+        expect(body["licenseKey"]).toBeNull();
+        expect(body["token"]).toBeNull();
+        expect(body["instanceId"]).toBeNull();
+        expect(body["instances"]).toEqual([]);
+        expect(body["currentVersion"]).toBeNull();
+        expect(body["seatsInUse"]).toBeNull();
+      });
+
+      it.each([
+        ["signedIn=false", { signedIn: "false" }],
+        ["an empty signedIn", { signedIn: "" }],
+        ["signedIn=1", { signedIn: "1" }],
+      ])(
+        'only the exact string "true" asks for a 401 (%s serves the reduced payload)',
+        async (_label: string, query: Record<string, unknown>) => {
+          setCaller({ userType: UserType.Public, query: query });
+
+          await callGet();
+
+          expect(nextFunction).not.toHaveBeenCalled();
+          expect(getResponseBody()["licenseKey"]).toBeNull();
+        },
+      );
+
+      it("serves a signed-in user the full payload with the flag", async () => {
+        setCaller({
+          userType: UserType.User,
+          userAuthorization: { userId: ObjectID.generate() },
+          query: { signedIn: "true" },
+        });
+
+        await callGet();
+
+        expect(nextFunction).not.toHaveBeenCalled();
+
+        const body: JSONObject = getResponseBody();
+
+        expect(body["licenseKey"]).toBe(STORED_LICENSE_KEY);
+        expect(body["instanceId"]).toBe(INSTANCE_ID.toString());
+        expect(body["seatsInUse"]).toBe(42);
+      });
+
+      it("serves a signed-in user the same full payload without the flag", async () => {
+        setCaller({
+          userType: UserType.User,
+          userAuthorization: { userId: ObjectID.generate() },
+          query: {},
+        });
+
+        await callGet();
+
+        expect(nextFunction).not.toHaveBeenCalled();
+        expect(getResponseBody()["licenseKey"]).toBe(STORED_LICENSE_KEY);
+      });
+
+      /*
+       * A project API key has credentials, so it is not an expired session:
+       * no 401. It has no user either, so it still gets only what an
+       * anonymous caller gets.
+       */
+      it("does not 401 an API-key caller that sends the flag", async () => {
+        setCaller({ userType: UserType.API, query: { signedIn: "true" } });
+
+        await callGet();
+
+        expect(nextFunction).not.toHaveBeenCalled();
+        expect(getResponseBody()["licenseKey"]).toBeNull();
+      });
+    });
   });
 });

package/Tests/Server/API/NotificationChannelVerificationAPI.test.ts

@@ -3,6 +3,11 @@ import UserEmailAPI from "../../../Server/API/UserEmailAPI";
 import UserIncomingCallNumberAPI from "../../../Server/API/UserIncomingCallNumberAPI";
 import UserSmsAPI from "../../../Server/API/UserSmsAPI";
 import UserWhatsAppAPI from "../../../Server/API/UserWhatsAppAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+  VerificationCodeRateLimitOutcome,
+} from "../../../Server/Middleware/VerificationCodeRateLimit";
 import UserCallService from "../../../Server/Services/UserCallService";
 import UserEmailService from "../../../Server/Services/UserEmailService";
 import UserIncomingCallNumberService from "../../../Server/Services/UserIncomingCallNumberService";
@@ -22,6 +27,9 @@ import {
 import Response from "../../../Server/Utils/Response";
 import { mockRouter } from "./Helpers";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import JSONWebTokenData from "../../../Types/JsonWebTokenData";
 import ObjectID from "../../../Types/ObjectID";
 import { beforeEach, describe, expect, it } from "@jest/globals";
@@ -517,27 +525,122 @@ describe.each(CHANNELS)("$name verification routes", (channel: Channel) => {
    * is asserted directly.
    */
   describe("rate limiting", () => {
+    /*
+     * The limiter each route was built with, by bucket, captured while the API
+     * class registers its routes. getMiddleware returns a fresh closure per
+     * call, so this is the only way to name "the limiter" by identity rather
+     * than by position.
+     */
+    let limiters: Map<VerificationCodeRateLimitBucket, unknown>;
+
+    beforeEach(() => {
+      limiters = new Map<VerificationCodeRateLimitBucket, unknown>();
+
+      const realGetMiddleware: typeof VerificationCodeRateLimit.getMiddleware =
+        VerificationCodeRateLimit.getMiddleware.bind(VerificationCodeRateLimit);
+
+      const capture: jest.SpyInstance = jest
+        .spyOn(VerificationCodeRateLimit, "getMiddleware")
+        .mockImplementation(((bucket: VerificationCodeRateLimitBucket) => {
+          const limiter: ReturnType<
+            typeof VerificationCodeRateLimit.getMiddleware
+          > = realGetMiddleware(bucket);
+          limiters.set(bucket, limiter);
+          return limiter;
+        }) as never);
+
+      mockRouter.routes.length = 0;
+      channel.build();
+
+      capture.mockRestore();
+    });
+
     it("registers a limiter in front of the verify handler", () => {
       expect(
-        mockRouter.match("post", channel.verifyPath).middlewares.length,
-      ).toBeGreaterThanOrEqual(2);
+        mockRouter.match("post", channel.verifyPath).middlewares,
+      ).toContain(limiters.get(VerificationCodeRateLimitBucket.Verify));
     });
 
     it("registers a limiter in front of the resend handler", () => {
       expect(
-        mockRouter.match("post", channel.resendPath).middlewares.length,
-      ).toBeGreaterThanOrEqual(2);
+        mockRouter.match("post", channel.resendPath).middlewares,
+      ).toContain(limiters.get(VerificationCodeRateLimitBucket.Resend));
     });
 
-    it("runs the limiter after user authorization, so it can key on the user", () => {
-      const middlewares: Array<unknown> = mockRouter.match(
-        "post",
-        channel.verifyPath,
-      ).middlewares;
+    /*
+     * The limiter keys on the user, so it has to run after the session is
+     * resolved. It also has to run after the session is REQUIRED: an expired
+     * session arrives here as an anonymous request (the access-token cookie
+     * expires with the token), and if the limiter ran first that request
+     * would spend the item and IP budgets before being refused - and be
+     * refused with a 429 or a handler 400, neither of which makes the browser
+     * client refresh the session. requireUserAuthentication answers it with a
+     * 401 first, so the budget is only ever spent by a known caller.
+     */
+    it.each([
+      ["verify", VerificationCodeRateLimitBucket.Verify],
+      ["resend", VerificationCodeRateLimitBucket.Resend],
+    ])(
+      "runs the %s limiter after user authorization and the authentication guard",
+      (_label: string, bucket: VerificationCodeRateLimitBucket) => {
+        const path: string =
+          bucket === VerificationCodeRateLimitBucket.Verify
+            ? channel.verifyPath
+            : channel.resendPath;
+
+        const middlewares: Array<unknown> = mockRouter.match(
+          "post",
+          path,
+        ).middlewares;
+
+        expect(limiters.get(bucket)).toBeDefined();
+        expect(middlewares).toHaveLength(3);
+        expect(middlewares[0]).toBe(UserMiddleware.getUserMiddleware);
+        expect(middlewares[1]).toBe(UserMiddleware.requireUserAuthentication);
+        expect(middlewares[2]).toBe(limiters.get(bucket));
+      },
+    );
+
+    it("never spends verification budget on a request with no session", async () => {
+      const consume: jest.SpyInstance = jest
+        .spyOn(VerificationCodeRateLimit, "consume")
+        .mockResolvedValue({
+          outcome: VerificationCodeRateLimitOutcome.Allowed,
+        } as never);
+
+      const anonymous: OneUptimeRequest = {
+        body: { itemId: ITEM_ID, code: CORRECT_CODE },
+        headers: {},
+      } as unknown as OneUptimeRequest;
+
+      const middlewares: ReturnType<typeof mockRouter.match>["middlewares"] =
+        mockRouter.match("post", channel.verifyPath).middlewares;
+
+      // Everything after getUserMiddleware, in order, stopping at a refusal.
+      for (let index: number = 1; index < middlewares.length; index++) {
+        const next: jest.Mock = jest.fn();
+
+        await middlewares[index]!(
+          anonymous,
+          mockResponse,
+          next as unknown as NextFunction,
+        );
+
+        if (next.mock.calls.length === 0) {
+          break;
+        }
+      }
+
+      expect(consume).not.toHaveBeenCalled();
+      expect(Response.sendErrorResponse).toHaveBeenCalledTimes(1);
+
+      const error: Exception = (
+        Response.sendErrorResponse as unknown as jest.Mock
+      ).mock.calls[0]![2] as Exception;
 
-      /* UserMiddleware.getUserMiddleware is registered first. */
-      expect(middlewares[0]).not.toBe(middlewares[1]);
-      expect(typeof middlewares[1]).toBe("function");
+      expect(error).toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(store.current?.verificationFailedAttempts).toBe(0);
     });
   });
 });