@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/API/SecurityEventAttributesAPI.test.ts

@@ -8,6 +8,10 @@ import {
 import Response from "../../../Server/Utils/Response";
 import Dictionary from "../../../Types/Dictionary";
 import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, {
@@ -339,7 +343,13 @@ describe("Security event attribute API", () => {
   });
 
   describe("access control", () => {
-    test("an unauthenticated caller is refused", async () => {
+    /*
+     * Tightened from "refused somehow" to the exact refusal. A tokenless
+     * request is, in practice, a SIEM page left open past the access-token
+     * lifetime; the browser client refreshes the session and replays only on
+     * a 401, so the status is as much the contract as the refusal itself.
+     */
+    test("an unauthenticated caller is refused with NotAuthenticatedException (401)", async () => {
       const result: CallResult = await callRoute({
         uri: KEYS_ROUTE,
         request: { userType: UserType.Public, tenantId: projectId },
@@ -347,10 +357,71 @@ describe("Security event attribute API", () => {
       });
 
       expect(result.reachedHandler).toBe(false);
-      expect(result.deniedWith).toBeDefined();
+      expect(result.deniedWith).toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+      expect(result.deniedWith?.code).toBe(401);
+      expect(result.deniedWith?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+      expect(fetchAttributes.mock.calls).toHaveLength(0);
+    });
+
+    test("a request with no userType at all is the same 401", async () => {
+      const result: CallResult = await callRoute({
+        uri: KEYS_ROUTE,
+        request: { tenantId: projectId },
+        body: {},
+      });
+
+      expect(result.reachedHandler).toBe(false);
+      expect(result.deniedWith).toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(401);
       expect(fetchAttributes.mock.calls).toHaveLength(0);
     });
 
+    /*
+     * requireUserAuthentication answers the anonymous caller first, but the
+     * permission guard behind it must not depend on that ordering: run on its
+     * own, it too asks "who are you?" before comparing permissions, rather
+     * than answering an expired session with the 422 below.
+     */
+    test("the permission guard on its own answers an anonymous caller with 401, not 422", async () => {
+      const guard: RouterFunction | undefined =
+        findRoute(KEYS_ROUTE).handlers[2];
+
+      expect(guard).toBeDefined();
+
+      const req: ExpressRequest = {
+        userType: UserType.Public,
+        tenantId: projectId,
+        headers: {},
+      } as unknown as ExpressRequest;
+
+      const res: ExpressResponse = {
+        status: jest.fn().mockReturnThis(),
+        send: jest.fn(),
+      } as unknown as ExpressResponse;
+
+      const step: { calledNext: boolean } = { calledNext: false };
+
+      await guard!(req, res, ((): void => {
+        step.calledNext = true;
+      }) as unknown as NextFunction);
+
+      // The guard answered the request itself.
+      expect(step.calledNext).toBe(false);
+
+      const sendErrorResponse: jest.Mock =
+        Response.sendErrorResponse as unknown as jest.Mock;
+      const denied: Exception = sendErrorResponse.mock
+        .calls[0]![2] as Exception;
+
+      expect(denied).toBeInstanceOf(NotAuthenticatedException);
+      expect(denied.code).toBe(401);
+    });
+
     test("a project member without any security read permission is refused", async () => {
       const result: CallResult = await callRoute({
         uri: KEYS_ROUTE,
@@ -364,6 +435,14 @@ describe("Security event attribute API", () => {
 
       expect(result.reachedHandler).toBe(false);
       expect(result.deniedWith).toBeDefined();
+      /*
+       * Logged in, so this stays the 422: a 401 here would make the browser
+       * refresh a perfectly good session and replay into the same refusal.
+       */
+      expect(result.deniedWith).toBeInstanceOf(NotAuthorizedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
       expect(fetchAttributes.mock.calls).toHaveLength(0);
     });
 
@@ -507,6 +586,14 @@ describe("Security event attribute API", () => {
 
       expect(result.reachedHandler).toBe(false);
       expect(result.deniedWith).toBeDefined();
+      expect(result.deniedWith).toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+      expect(result.deniedWith?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+      expect(fetchAttributeValues.mock.calls).toHaveLength(0);
     });
   });
 

package/Tests/Server/API/SessionReplayAPI.test.ts

@@ -35,7 +35,9 @@ import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/Database
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, {
@@ -631,6 +633,125 @@ describe("Session replay playback API", () => {
     });
   });
 
+  /*
+   * The one caller the note on status codes at the top of this file does NOT
+   * cover: somebody with no credentials at all. That is a 401 - it is the case
+   * NotAuthenticatedException exists for - and in practice it is a reviewer
+   * whose replay tab sat open past the access-token lifetime, so the cookie
+   * stopped being sent. The browser client refreshes the session and replays
+   * the request on a 401 and on nothing else, which is why these assert the
+   * code and not merely a refusal.
+   */
+  describe("an expired session is asked to authenticate, on every route", () => {
+    const allRoutes: Array<string> = [
+      LIST_ROUTE,
+      SUMMARIES_ROUTE,
+      USERS_ROUTE,
+      MANIFEST_ROUTE,
+      CHUNKS_ROUTE,
+      HEARTBEAT_ROUTE,
+      VIEWS_ROUTE,
+      FOR_EXCEPTION_ROUTE,
+      INGEST_STATUS_ROUTE,
+    ];
+
+    function expectAuthenticationRequired(denied: Exception | undefined): void {
+      expect(denied).toBeInstanceOf(NotAuthenticatedException);
+      expect(denied?.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(denied?.code).toBe(401);
+      expect(denied?.message).toBe(
+        UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+      );
+    }
+
+    test.each(allRoutes)(
+      "%s refuses a Public caller carrying a tenant with 401 and reads nothing",
+      async (uri: string) => {
+        const result: CallResult = await callRoute({
+          uri: uri,
+          request: {
+            userType: UserType.Public,
+            tenantId: projectId,
+          } as unknown as JSONObject,
+          body: { sessionId: "session-1" },
+        });
+
+        expectAuthenticationRequired(result.deniedWith);
+        expect(result.reachedHandler).toBe(false);
+        expect(result.thrownToNext).toBeUndefined();
+        expect(headerQuerySpy).not.toHaveBeenCalled();
+        expect(chunkQuerySpy).not.toHaveBeenCalled();
+        expect(recordViewSpy).not.toHaveBeenCalled();
+      },
+    );
+
+    /*
+     * requireUserAuthentication answers first on the real chain, so this runs
+     * each route's permission guard (handlers[2]) by itself. It must ask "who
+     * are you?" before comparing permissions too; otherwise an anonymous
+     * request that ever reached it would get the 422 - the answer that left
+     * the customer's dashboard stuck.
+     */
+    test.each(allRoutes)(
+      "%s: the permission guard alone answers an anonymous caller with 401, not 422",
+      async (uri: string) => {
+        const guard: RouterFunction | undefined = findRoute(uri).handlers[2];
+
+        expect(guard).toBeDefined();
+
+        const req: ExpressRequest = {
+          userType: UserType.Public,
+          tenantId: projectId,
+          headers: {},
+        } as unknown as ExpressRequest;
+
+        const res: ExpressResponse = {
+          status: jest.fn().mockReturnThis(),
+          send: jest.fn(),
+        } as unknown as ExpressResponse;
+
+        const next: jest.Mock = jest.fn();
+
+        await guard!(req, res, next as unknown as NextFunction);
+
+        expect(next).not.toHaveBeenCalled();
+
+        const sendErrorResponse: jest.Mock =
+          Response.sendErrorResponse as unknown as jest.Mock;
+
+        expectAuthenticationRequired(
+          sendErrorResponse.mock.calls[0]?.[2] as Exception | undefined,
+        );
+      },
+    );
+
+    test("a logged-in caller without the payload permission still gets the 422, not a 401", async () => {
+      const principal: {
+        request: JSONObject;
+        databaseProps: DatabaseCommonInteractionProps;
+      } = buildPrincipal({
+        projectId: projectId,
+        userId: userId,
+        permissions: [Permission.ProjectMember],
+      });
+
+      mockProps(principal.databaseProps);
+
+      const result: CallResult = await callRoute({
+        uri: MANIFEST_ROUTE,
+        request: principal.request,
+        body: { sessionId: "session-1" },
+      });
+
+      expect(result.deniedWith).toBeInstanceOf(NotAuthorizedException);
+      expect(result.deniedWith).not.toBeInstanceOf(NotAuthenticatedException);
+      expect(result.deniedWith?.code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
+      expect(result.reachedHandler).toBe(false);
+    });
+  });
+
   /*
    * The chunk table's replace key is (projectId, sessionId, tabId,
    * chunkIndex) - rumApplicationId is a plain column. sessionId is minted

package/Tests/Server/API/StatusPageMasterPasswordRateLimit.test.ts

@@ -331,9 +331,11 @@ describe("StatusPageAPI master password rate limiting", () => {
       );
 
       expect(registered.middlewares[0]).not.toBe(
-        UserMiddleware.getUserMiddleware,
+        UserMiddleware.getPublicRouteUserMiddleware,
+      );
+      expect(registered.middlewares[1]).toBe(
+        UserMiddleware.getPublicRouteUserMiddleware,
       );
-      expect(registered.middlewares[1]).toBe(UserMiddleware.getUserMiddleware);
     });
   });