@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/API/UserNotificationSettingAPI.test.ts

@@ -12,9 +12,13 @@ import Response from "../../../Server/Utils/Response";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
 import { ROUTINE_EMAIL_EVENT_TYPES } from "../../../Types/NotificationSetting/RoutineEmailEvents";
 import ObjectID from "../../../Types/ObjectID";
 import Permission from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
 
 jest.mock("../../../Server/Utils/Express", () => {
   return {
@@ -29,6 +33,15 @@ const USER_ID: ObjectID = ObjectID.generate();
 const PROJECT_ID: ObjectID = ObjectID.generate();
 const OTHER_PROJECT_ID: ObjectID = ObjectID.generate();
 
+/*
+ * The exception the handler handed to next(). Its code is the HTTP status the
+ * client sees, and the browser client refreshes the session on 401 only, so
+ * the code is asserted alongside the class.
+ */
+function errorPassedTo(next: jest.Mock): Exception {
+  return next.mock.calls[0]![0] as Exception;
+}
+
 describe("POST reduce routine emails", () => {
   let props: DatabaseCommonInteractionProps;
   let reduceSpy: jest.SpyInstance;
@@ -128,21 +141,67 @@ describe("POST reduce routine emails", () => {
     });
   });
 
-  test.each(["anonymous", "project API key"])(
-    "rejects a %s without an authenticated user",
-    async () => {
+  /*
+   * Both callers are refused, but differently. The anonymous one - no user, no
+   * key, typically a dashboard tab whose access-token cookie expired - gets
+   * NotAuthenticatedException (401), which is what makes the browser refresh
+   * the session and resend; it used to get the 422 below. A project API key
+   * is authenticated but is nobody's preferences, so it keeps the 422: a 401
+   * would send its client off to refresh a session it never had.
+   */
+  test.each([
+    {
+      caller: "an anonymous caller",
+      userType: undefined,
+      exception: NotAuthenticatedException,
+      code: ExceptionCode.NotAuthenticatedException,
+    },
+    {
+      caller: "an explicitly Public caller",
+      userType: UserType.Public,
+      exception: NotAuthenticatedException,
+      code: ExceptionCode.NotAuthenticatedException,
+    },
+    {
+      caller: "a project API key",
+      userType: UserType.API,
+      exception: NotAuthorizedException,
+      code: ExceptionCode.NotAuthorizedException,
+    },
+  ])(
+    "rejects $caller without an authenticated user",
+    async (testCase: {
+      caller: string;
+      userType: UserType | undefined;
+      exception:
+        | typeof NotAuthenticatedException
+        | typeof NotAuthorizedException;
+      code: ExceptionCode;
+    }) => {
       props.userId = undefined;
+      props.userType = testCase.userType;
       const next: jest.Mock = await call({ userId: USER_ID.toString() });
-      expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+      expect(next).toHaveBeenCalledWith(expect.any(testCase.exception));
+      expect(errorPassedTo(next).code).toBe(testCase.code);
       expect(reduceSpy).not.toHaveBeenCalled();
       expect(responseSpy).not.toHaveBeenCalled();
     },
   );
 
+  test("an anonymous caller with no tenant is asked to log in before the missing project is reported", async () => {
+    props.userId = undefined;
+    props.tenantId = undefined;
+    const next: jest.Mock = await call();
+    expect(next).toHaveBeenCalledWith(expect.any(NotAuthenticatedException));
+    expect(errorPassedTo(next).code).toBe(401);
+    expect(reduceSpy).not.toHaveBeenCalled();
+  });
+
   test("rejects missing project context before changing preferences", async () => {
     props.tenantId = undefined;
     const next: jest.Mock = await call({ projectId: PROJECT_ID.toString() });
     expect(next).toHaveBeenCalledWith(expect.any(BadDataException));
+    expect(errorPassedTo(next).code).toBe(ExceptionCode.BadDataException);
     expect(reduceSpy).not.toHaveBeenCalled();
   });
 
@@ -150,6 +209,7 @@ describe("POST reduce routine emails", () => {
     props.userTenantAccessPermission = undefined;
     const next: jest.Mock = await call();
     expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+    expect(errorPassedTo(next).code).toBe(ExceptionCode.NotAuthorizedException);
     expect(reduceSpy).not.toHaveBeenCalled();
   });
 
@@ -157,6 +217,7 @@ describe("POST reduce routine emails", () => {
     props.tenantId = OTHER_PROJECT_ID;
     const next: jest.Mock = await call();
     expect(next).toHaveBeenCalledWith(expect.any(NotAuthorizedException));
+    expect(errorPassedTo(next).code).toBe(ExceptionCode.NotAuthorizedException);
     expect(reduceSpy).not.toHaveBeenCalled();
   });
 

package/Tests/Server/API/UserProjectsAPI.test.ts

@@ -18,6 +18,10 @@ import TeamMember from "../../../Models/DatabaseModels/TeamMember";
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { DEFAULT_LIMIT } from "../../../Types/Database/LimitMax";
 import Dictionary from "../../../Types/Dictionary";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import { JSONObject } from "../../../Types/JSON";
 import JSONWebTokenData from "../../../Types/JsonWebTokenData";
@@ -916,7 +920,7 @@ describe("POST /user/:userId/projects — the master API key path", () => {
   type MiddlewareCallResult = {
     // Whether the gate let the request through to the read.
     reachedHandler: boolean;
-    errorSentToClient: NotAuthorizedException | undefined;
+    errorSentToClient: Exception | undefined;
     // The request object as the handler saw it, to inspect what the gate set.
     request: ExpressRequest;
   };
@@ -974,7 +978,7 @@ describe("POST /user/:userId/projects — the master API key path", () => {
 
     return {
       reachedHandler: reachedHandler,
-      errorSentToClient: errorCall?.[2] as NotAuthorizedException | undefined,
+      errorSentToClient: errorCall?.[2] as Exception | undefined,
       request: req,
     };
   }
@@ -1145,7 +1149,19 @@ describe("POST /user/:userId/projects — the master API key path", () => {
         expect(findBySpy).not.toHaveBeenCalled();
         expect(Response.sendJsonArrayResponse).not.toHaveBeenCalled();
 
-        expect(result.errorSentToClient).toBeInstanceOf(NotAuthorizedException);
+        /*
+         * An unusable key falls through to the session check, and with no
+         * session that is the no-token refusal - a 401 now, where it used to
+         * be a NotAuthorizedException (422). Still a refusal, and still AT the
+         * gate; only the status changed, so that an Admin Dashboard tab whose
+         * session cookie has expired refreshes instead of showing an error.
+         */
+        expect(result.errorSentToClient).toBeInstanceOf(
+          NotAuthenticatedException,
+        );
+        expect(result.errorSentToClient?.code).toBe(
+          ExceptionCode.NotAuthenticatedException,
+        );
         expect(result.errorSentToClient?.message).toBe(
           "Unauthorized: Access token is required.",
         );
@@ -1159,6 +1175,41 @@ describe("POST /user/:userId/projects — the master API key path", () => {
 
       expect(result.reachedHandler).toBe(false);
       expect(findBySpy).not.toHaveBeenCalled();
+
+      /*
+       * This is what the Admin Dashboard's User > Projects page sends once
+       * its session cookie has expired. Only a 401 makes the browser client
+       * refresh the session and replay the read.
+       */
+      expect(result.errorSentToClient).toBeInstanceOf(
+        NotAuthenticatedException,
+      );
+      expect(result.errorSentToClient?.code).toBe(
+        ExceptionCode.NotAuthenticatedException,
+      );
+    });
+
+    test("refuses an expired session with no key with a 401, without reading anything", async () => {
+      jest
+        .spyOn(UserMiddleware, "getAccessTokenFromExpressRequest")
+        .mockReturnValue("an.expired.token" as never);
+
+      jest.spyOn(JSONWebToken, "decode").mockImplementation(() => {
+        throw new BadDataException("AccessToken is invalid or expired");
+      });
+
+      const result: MiddlewareCallResult = await callThroughMiddleware({
+        headers: {},
+      });
+
+      expect(result.reachedHandler).toBe(false);
+      expect(findBySpy).not.toHaveBeenCalled();
+      expect(result.errorSentToClient).toBeInstanceOf(
+        NotAuthenticatedException,
+      );
+      expect(result.errorSentToClient?.message).toBe(
+        "Unauthorized: Invalid or expired access token.",
+      );
     });
 
     /*
@@ -1231,6 +1282,15 @@ describe("POST /user/:userId/projects — the master API key path", () => {
       expect(result.errorSentToClient?.message).toBe(
         "Unauthorized: Only master admins can perform this action.",
       );
+
+      /*
+       * Still a 422, unlike the missing-token case: this caller is signed in,
+       * and refreshing their session would not make them a master admin.
+       */
+      expect(result.errorSentToClient).toBeInstanceOf(NotAuthorizedException);
+      expect(result.errorSentToClient?.code).toBe(
+        ExceptionCode.NotAuthorizedException,
+      );
     });
 
     /*

package/Tests/Server/API/UserTotpAuthAPI.test.ts

@@ -1,4 +1,5 @@
 import UserTotpAuthAPI from "../../../Server/API/UserTotpAuthAPI";
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
 import UserTotpAuthService from "../../../Server/Services/UserTotpAuthService";
 import UserService from "../../../Server/Services/UserService";
 import UserTwoFactorBackupCodeService from "../../../Server/Services/UserTwoFactorBackupCodeService";
@@ -17,6 +18,8 @@ import Dictionary from "../../../Types/Dictionary";
 import Email from "../../../Types/Email";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import UserTotpAuth from "../../../Models/DatabaseModels/UserTotpAuth";
@@ -358,11 +361,54 @@ describe("POST /user-totp-auth/validate", () => {
      * `userAuthorization` off an unauthenticated request, the ownership
      * comparison below would compare against `undefined`, and anybody could
      * verify anybody's TOTP row.
+     *
+     * Two middlewares now, asserted by identity (a count of two would not
+     * notice one being swapped for another). getUserMiddleware resolves the
+     * session, but lets a request with NO session through as Public;
+     * requireUserAuthentication is what turns that request into a 401. It was
+     * added because an enrolment page left open past the session lifetime
+     * sends exactly that request - the access-token cookie expires with the
+     * token - and the handler answered it with a "Two factor auth not found"
+     * 400 (after reading the row as root), which the browser client does not
+     * treat as a cue to refresh the session and retry.
      */
     test("is behind an authentication middleware", () => {
-      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares.length).toBe(
-        1,
+      expect(mockRouter.match("post", VALIDATE_ROUTE).middlewares).toEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    });
+
+    test("answers a request with no session 401 before any row is read", async () => {
+      const req: OneUptimeRequest = {
+        body: { id: TOTP_ID.toString(), code: "123456" },
+        params: {},
+        query: {},
+        headers: {},
+      } as unknown as OneUptimeRequest;
+
+      const res: OneUptimeResponse = {
+        status: jest.fn().mockReturnThis(),
+      } as unknown as OneUptimeResponse;
+
+      const next: jest.Mock = jest.fn();
+
+      await mockRouter.match("post", VALIDATE_ROUTE).middlewares[1]!(
+        req,
+        res,
+        next as unknown as NextFunction,
       );
+
+      expect(next).not.toHaveBeenCalled();
+
+      const error: Exception = asMock(Response.sendErrorResponse).mock
+        .calls[0]![2] as Exception;
+
+      expect(error).toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(findTotpById).not.toHaveBeenCalled();
+      expect(updateTotpById).not.toHaveBeenCalled();
+      expect(generateForUserIfNoneSpy).not.toHaveBeenCalled();
     });
   });
 

package/Tests/Server/API/UserWebAuthnAuthenticationOptionsRoute.test.ts

@@ -281,20 +281,29 @@ describe("POST /user-webauthn/generate-authentication-options", () => {
       ["registration options", REGISTRATION_OPTIONS_ROUTE],
       ["verify registration", VERIFY_REGISTRATION_ROUTE],
     ])(
-      "%s stays behind the user middleware alone",
+      "%s stays behind the user middleware and its authentication guard alone",
       (_name: string, uri: string) => {
         /*
          * Both are authenticated, and neither carries an email in its body --
          * so the limiter's account key would collapse to the same value for
          * every caller and one user's enrolment attempts would throttle
          * everybody's.
+         *
+         * The second entry is requireUserAuthentication, not a limiter. It
+         * turns a request with no session (the access-token cookie expired
+         * while the enrolment dialog was open) into a 401 the browser client
+         * refreshes on. It is the only thing allowed after getUserMiddleware.
          */
         const route: { middlewares: Array<unknown> } = mockRouter.match(
           "post",
           uri,
         );
 
-        expect(route.middlewares).toEqual([UserMiddleware.getUserMiddleware]);
+        expect(route.middlewares).toEqual([
+          UserMiddleware.getUserMiddleware,
+          UserMiddleware.requireUserAuthentication,
+        ]);
+        expect(route.middlewares).not.toContain(mountedMiddleware);
       },
     );
   });

package/Tests/Server/API/UserWebAuthnBackupCodeMinting.test.ts

@@ -13,6 +13,9 @@ import { mockRouter } from "./Helpers";
 import { getJestSpyOn } from "../../Spy";
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import ExceptionCode from "../../../Types/Exception/ExceptionCode";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
 import {
@@ -336,20 +339,60 @@ afterEach(() => {
 
 describe("POST /user-webauthn/verify-registration", () => {
   describe("the route itself", () => {
-    test("is registered as a POST behind the user middleware", () => {
+    test("is registered as a POST behind the user middleware and the authentication guard", () => {
       /*
        * The handler takes the owning user from `userAuthorization`, which is
        * put on the request by this middleware and by nothing else. Without it
        * the id would be undefined for every caller, and asserted by IDENTITY
        * rather than by counting because swapping in a different middleware
-       * keeps the count at one.
+       * keeps the count the same.
+       *
+       * getUserMiddleware lets a request with NO session through as Public,
+       * so requireUserAuthentication follows it and answers that request with
+       * a 401. A key-enrolment dialog left open until the access-token cookie
+       * expired sends exactly that request, and only a 401 makes the browser
+       * client refresh the session and replay the registration.
        */
       const route: { middlewares: Array<unknown> } = mockRouter.match(
         "post",
         VERIFY_REGISTRATION_ROUTE,
       );
 
-      expect(route.middlewares).toEqual([UserMiddleware.getUserMiddleware]);
+      expect(route.middlewares).toEqual([
+        UserMiddleware.getUserMiddleware,
+        UserMiddleware.requireUserAuthentication,
+      ]);
+    });
+
+    test("answers a request with no session 401 before registering or minting anything", async () => {
+      const req: OneUptimeRequest = {
+        params: {},
+        query: {},
+        body: { credential: CREDENTIAL_FROM_THE_BROWSER, name: KEY_NAME },
+        headers: {},
+      } as unknown as OneUptimeRequest;
+
+      const res: OneUptimeResponse = {
+        status: jest.fn().mockReturnThis(),
+      } as unknown as OneUptimeResponse;
+
+      const next: jest.Mock = jest.fn();
+
+      await mockRouter.match("post", VERIFY_REGISTRATION_ROUTE).middlewares[1]!(
+        req,
+        res,
+        next as unknown as NextFunction,
+      );
+
+      expect(next).not.toHaveBeenCalled();
+
+      const error: Exception = asMock(Response.sendErrorResponse).mock
+        .calls[0]![2] as Exception;
+
+      expect(error).toBeInstanceOf(NotAuthenticatedException);
+      expect(error.code).toBe(ExceptionCode.NotAuthenticatedException);
+      expect(verifyRegistrationSpy).not.toHaveBeenCalled();
+      expect(mintSpy).not.toHaveBeenCalled();
     });
 
     test("carries no route parameter that could name a user", () => {

package/Tests/Server/API/UserWebAuthnPasskeyAPI.test.ts

@@ -27,7 +27,13 @@ jest.mock("../../../Server/API/CommonAPI", () => {
 });
 
 jest.mock("../../../Server/Middleware/UserAuthorization", () => {
-  return { __esModule: true, default: { getUserMiddleware: jest.fn() } };
+  return {
+    __esModule: true,
+    default: {
+      getUserMiddleware: jest.fn(),
+      requireUserAuthentication: jest.fn(),
+    },
+  };
 });
 
 jest.mock("../../../Server/Middleware/IdentityRateLimit", () => {
@@ -107,9 +113,19 @@ describe("passkey registration API", () => {
     jest.restoreAllMocks();
   });
 
+  /*
+   * getUserMiddleware resolves the session; requireUserAuthentication turns a
+   * request that has none (a settings page left open until the access-token
+   * cookie expired) into a 401 the browser client refreshes on, rather than
+   * letting the handler dereference a missing userAuthorization. Both are
+   * mocked to distinct functions so the identity check below is real: with
+   * the second left out of the mock, the route would register `undefined` in
+   * its place and toEqual would still match a one-element list.
+   */
   test("requires authentication before allowing registration", () => {
-    expect(mockRouter.match("post", ROUTE).middlewares).toEqual([
+    expect(mockRouter.match("post", ROUTE).middlewares).toStrictEqual([
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
     ]);
   });
 

package/Tests/Server/API/ZZVerifyChatsAuth.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, test } from "@jest/globals";
+import { beforeAll, describe, expect, test } from "@jest/globals";
 import express from "express";
 import http from "http";
 import { AddressInfo } from "net";
@@ -118,11 +118,21 @@ const httpGetJson: HttpGetJsonFunction = (data: {
 };
 
 describe("ANON ACCESS PROBE /microsoft-teams/chats", () => {
-  test("unauthenticated GET with only a tenantid header", async () => {
-    const MicrosoftTeamsAPI: any = (
-      await import("../../../Server/API/MicrosoftTeamsAPI")
-    ).default;
+  let MicrosoftTeamsAPI: any = undefined;
+
+  /*
+   * Loading MicrosoftTeamsAPI pulls in a large module graph. Done inside the
+   * test, that load counted against the probe's 30s budget and timed the test
+   * out on a busy machine even though the route answered correctly. The load
+   * gets its own, generous budget here so the test's timeout measures only the
+   * HTTP round trip it is about.
+   */
+  beforeAll(async () => {
+    MicrosoftTeamsAPI = (await import("../../../Server/API/MicrosoftTeamsAPI"))
+      .default;
+  }, 600000);
 
+  test("unauthenticated GET with only a tenantid header", async () => {
     const app: express.Express = express();
     app.use("/api", new MicrosoftTeamsAPI().getRouter());
 
@@ -148,9 +158,16 @@ describe("ANON ACCESS PROBE /microsoft-teams/chats", () => {
        * route must reject one carrying only a tenantid header. A 200 here would
        * mean the captured chat list leaks to anonymous callers - the exact
        * regression this probe guards against.
+       *
+       * Pinned to exactly 401 (it used to accept any 4xx, and was a 422). A
+       * request with only a tenantid header is what a signed-in user's browser
+       * sends once the access-token cookie has expired, and the dashboard
+       * refreshes the session and resends on a 401 and on nothing else.
        */
-      expect(result.status).toBeGreaterThanOrEqual(400);
-      expect(result.status).toBeLessThan(500);
+      expect(result.status).toBe(401);
+      expect((result.body as { message?: string }).message).toBe(
+        "Authentication required. Please log in to access this resource.",
+      );
 
       const serializedBody: string = JSON.stringify(result.body);
       expect(serializedBody).not.toContain("Jane Doe");