@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/Services/DatabaseServiceTenantRelationGuard.test.ts

@@ -0,0 +1,259 @@
+import Incident from "../../../Models/DatabaseModels/Incident";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import Project from "../../../Models/DatabaseModels/Project";
+import IncidentService from "../../../Server/Services/IncidentService";
+import MonitorService from "../../../Server/Services/MonitorService";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, { UserPermission } from "../../../Types/Permission";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { getJestSpyOn } from "../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * PasswordHash has a known TS5.9 compile failure under ts-jest that breaks any
+ * suite whose import graph reaches it (see ApiKeyPermissionSecurity.test.ts).
+ * Nothing here touches password hashing; stub it before the service import
+ * graph drags it into compilation.
+ */
+jest.mock("../../../Server/Utils/PasswordHash", () => {
+  return {
+    __esModule: true,
+    default: class PasswordHashStub {},
+  };
+});
+
+/*
+ * Cross-tenant write via the tenant RELATION (confused deputy).
+ *
+ * A tenant model declares its tenant twice — the scalar `projectId` column and
+ * the `project` @ManyToOne relation joined on that same column — and both are
+ * writable by an ordinary member on create. `DatabaseService.create` stamps
+ * only the scalar to `props.tenantId`; TypeORM then lets the relation object
+ * override the scalar join value on the INSERT, so a member of project A who
+ * posts `project: { _id: B }` writes the row into project B.
+ *
+ * `enforceTenantRelationMatchesScalar` rejects a tenant relation pointing at a
+ * different project and deletes it so the stamped scalar is the only thing
+ * that reaches the database. These tests drive the real `create()` pipeline
+ * (only the IO/validation neighbours that are orthogonal to tenancy are
+ * stubbed) and the guard directly for the update-shaped (plain object) input.
+ */
+
+const PROJECT_A: ObjectID = new ObjectID(
+  "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+);
+const PROJECT_B: ObjectID = new ObjectID(
+  "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
+);
+
+function userPermission(permission: Permission): UserPermission {
+  return {
+    permission,
+    labelIds: [],
+    isBlockPermission: false,
+    _type: "UserPermission",
+  };
+}
+
+function memberProps(
+  tenantId: ObjectID = PROJECT_A,
+): DatabaseCommonInteractionProps {
+  return {
+    userId: new ObjectID("dddddddd-dddd-4ddd-8ddd-dddddddddddd"),
+    tenantId,
+    ignoreHooks: true,
+    userGlobalAccessPermission: {
+      projectIds: [tenantId],
+      globalPermissions: [Permission.Public, Permission.User],
+      _type: "UserGlobalAccessPermission",
+    },
+    userTenantAccessPermission: {
+      [tenantId.toString()]: {
+        projectId: tenantId,
+        permissions: [userPermission(Permission.ProjectMember)],
+        _type: "UserTenantAccessPermission",
+      },
+    },
+  };
+}
+
+function rootProps(): DatabaseCommonInteractionProps {
+  return { isRoot: true, ignoreHooks: true };
+}
+
+type Target = {
+  name: string;
+  service: typeof MonitorService | typeof IncidentService;
+  build: () => Monitor | Incident;
+};
+
+const TARGETS: Array<Target> = [
+  {
+    name: "Monitor",
+    service: MonitorService,
+    build: () => {
+      const monitor: Monitor = new Monitor();
+      monitor.name = "guard-test";
+      return monitor;
+    },
+  },
+  {
+    name: "Incident",
+    service: IncidentService,
+    build: () => {
+      const incident: Incident = new Incident();
+      incident.title = "guard-test";
+      return incident;
+    },
+  },
+];
+
+function projectRelation(id: ObjectID): Project {
+  const project: Project = new Project();
+  project._id = id.toString();
+  return project;
+}
+
+describe("DatabaseService tenant-relation cross-tenant write guard", () => {
+  describe.each(TARGETS)("$name create()", (target: Target) => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const service: any = target.service;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    let save: jest.Mock<(entity: any) => Promise<any>>;
+
+    beforeEach(() => {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      save = jest.fn(async (entity: any) => {
+        return entity;
+      }) as any;
+      getJestSpyOn(service, "getRepository").mockReturnValue({
+        save,
+      } as never);
+      // Count-backed validators (unique/limit checks) must not hit Postgres.
+      getJestSpyOn(service, "countBy").mockResolvedValue(
+        new PositiveNumber(0) as never,
+      );
+      /*
+       * Required-field validation is orthogonal to the tenancy guard under
+       * test; keep it from failing on unrelated columns.
+       */
+      getJestSpyOn(service, "checkRequiredFields").mockImplementation(((
+        data: unknown,
+      ) => {
+        return data;
+      }) as never);
+      // Fire-and-forget side effects that would otherwise reach the network.
+      getJestSpyOn(service, "onTriggerWorkflow").mockResolvedValue(
+        undefined as never,
+      );
+      getJestSpyOn(service, "onTriggerRealtime").mockResolvedValue(
+        undefined as never,
+      );
+    });
+
+    afterEach(() => {
+      jest.restoreAllMocks();
+    });
+
+    test("rejects a create whose project relation points at another project", async () => {
+      const data: Monitor | Incident = target.build();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (data as any).project = projectRelation(PROJECT_B);
+
+      await expect(
+        service.create({ data, props: memberProps(PROJECT_A) }),
+      ).rejects.toThrow(BadDataException);
+
+      expect(save).not.toHaveBeenCalled();
+    });
+
+    test("drops a matching project relation and persists under the request tenant only", async () => {
+      const data: Monitor | Incident = target.build();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (data as any).project = projectRelation(PROJECT_A);
+
+      await service.create({ data, props: memberProps(PROJECT_A) });
+
+      expect(save).toHaveBeenCalledTimes(1);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const saved: any = save.mock.calls[0]![0];
+      expect(saved.project).toBeUndefined();
+      expect(saved.projectId?.toString()).toBe(PROJECT_A.toString());
+    });
+
+    test("leaves the project relation untouched for a root/internal caller", async () => {
+      const data: Monitor | Incident = target.build();
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (data as any).project = projectRelation(PROJECT_B);
+
+      await service.create({ data, props: rootProps() });
+
+      expect(save).toHaveBeenCalledTimes(1);
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const saved: any = save.mock.calls[0]![0];
+      expect(saved.project).toBeInstanceOf(Project);
+      expect(saved.project._id).toBe(PROJECT_B.toString());
+    });
+  });
+
+  /*
+   * The same guard runs on the update path, where the payload is a plain
+   * object (BaseAPI.updateItem deserializes rather than fromJSON'ing), so the
+   * relation arrives as `{ _id: ... }` rather than a Project instance.
+   */
+  describe("enforceTenantRelationMatchesScalar (update-shaped input)", () => {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const guard: any = MonitorService;
+
+    test("throws when a plain-object project relation points at another project", () => {
+      const data: Record<string, unknown> = {
+        name: "x",
+        project: { _id: PROJECT_B.toString() },
+      };
+
+      expect(() => {
+        guard.enforceTenantRelationMatchesScalar(data, memberProps(PROJECT_A));
+      }).toThrow(BadDataException);
+    });
+
+    test("strips a matching plain-object project relation", () => {
+      const data: Record<string, unknown> = {
+        name: "x",
+        project: { _id: PROJECT_A.toString() },
+      };
+
+      guard.enforceTenantRelationMatchesScalar(data, memberProps(PROJECT_A));
+
+      expect(data["project"]).toBeUndefined();
+      expect(data["name"]).toBe("x");
+    });
+
+    test("is a no-op when no project relation is supplied", () => {
+      const data: Record<string, unknown> = { name: "x" };
+
+      expect(() => {
+        guard.enforceTenantRelationMatchesScalar(data, memberProps(PROJECT_A));
+      }).not.toThrow();
+      expect(data).toEqual({ name: "x" });
+    });
+
+    test("does not touch the relation for a root/internal caller", () => {
+      const data: Record<string, unknown> = {
+        project: { _id: PROJECT_B.toString() },
+      };
+
+      guard.enforceTenantRelationMatchesScalar(data, rootProps());
+
+      expect(data["project"]).toEqual({ _id: PROJECT_B.toString() });
+    });
+  });
+});

package/Tests/Server/Services/DatabaseServiceWriteOperatorValues.test.ts

@@ -0,0 +1,147 @@
+import ProbeService from "../../../Server/Services/ProbeService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Probe from "../../../Models/DatabaseModels/Probe";
+import StartsWith from "../../../Types/BaseDatabase/StartsWith";
+import NotNull from "../../../Types/BaseDatabase/NotNull";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * Query operators belong in the `query` of a read/update, never in the `data`
+ * of a write. A request value shaped like a serialized operator, e.g.
+ * {"_type":"StartsWith","value":"a"} or {"_type":"NotNull"}, becomes a real
+ * operator instance: JSONFunctions.deserialize runs on every request body while
+ * DatabaseBaseModel._fromJSON builds the model, and the operator is assigned to
+ * the column unchanged.
+ *
+ * An operator is never a valid stored value, and one left on a write payload is
+ * also fed to the lookups built from that data (the uniqueness check, service
+ * hooks), where it turns an intended exact comparison into a pattern match.
+ * DatabaseService rejects such a write up front, before any hook or query runs.
+ * JSON columns are exempt - they legitimately hold arbitrary objects.
+ *
+ * The first two tests document the deserialization behaviour, which is
+ * unchanged; the last two pin the rejection and that ordinary writes still pass.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "00000000-0000-4000-8000-00000000000a",
+);
+
+const memberProps: (
+  permissions: Array<Permission>,
+) => DatabaseCommonInteractionProps = (
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps => {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission): UserPermission => {
+      return {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: new ObjectID("00000000-0000-4000-8000-000000000003"),
+    tenantId: PROJECT_ID,
+    userType: UserType.User,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+};
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("Query operators supplied as write values", () => {
+  test("request body value {_type:StartsWith} deserializes into a StartsWith on a text column", () => {
+    const body: JSONObject = {
+      key: { _type: "StartsWith", value: "a" } as unknown as JSONObject,
+      name: "a probe",
+    };
+
+    const probe: Probe = BaseModel.fromJSON<Probe>(body, Probe) as Probe;
+
+    expect(probe.key).toBeInstanceOf(StartsWith);
+    expect((probe.key as unknown as StartsWith<string>).toString()).toBe("a");
+  });
+
+  test("request body value {_type:NotNull} deserializes into a NotNull operator", () => {
+    const body: JSONObject = {
+      key: { _type: "NotNull" } as unknown as JSONObject,
+    };
+
+    const probe: Probe = BaseModel.fromJSON<Probe>(body, Probe) as Probe;
+    expect(probe.key).toBeInstanceOf(NotNull);
+  });
+
+  test("DatabaseService.create rejects an operator in write data before any lookup", async () => {
+    /*
+     * If the check regresses, the uniqueness check would run its countBy with
+     * the operator in the query; make that fail loudly instead.
+     */
+    const countSpy: jest.SpyInstance = jest
+      .spyOn(ProbeService, "countBy")
+      .mockImplementation((() => {
+        throw new Error("countBy must not run for an operator-carrying create");
+      }) as never) as unknown as jest.SpyInstance;
+    const hookSpy: jest.SpyInstance = jest.spyOn(
+      ProbeService,
+      "onBeforeCreate" as never,
+    ) as unknown as jest.SpyInstance;
+
+    const probe: Probe = new Probe();
+    (probe as unknown as { key: unknown }).key = new StartsWith("a");
+    probe.name = "a probe";
+
+    const createBy: CreateBy<Probe> = {
+      data: probe,
+      props: memberProps([Permission.CreateProjectProbe]),
+    };
+
+    await expect(ProbeService.create(createBy)).rejects.toBeInstanceOf(
+      BadDataException,
+    );
+    expect(hookSpy).not.toHaveBeenCalled();
+    expect(countSpy).not.toHaveBeenCalled();
+  });
+
+  test("the operator check leaves an ordinary create untouched", () => {
+    /*
+     * The check must refuse operators without touching plain values. Call it
+     * directly - it is the choke point create()/update() run - and assert a
+     * normal payload passes while an operator is refused.
+     */
+    const legit: Probe = new Probe();
+    legit.key = "a-real-plaintext-key";
+    legit.name = "a probe";
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const service: any = ProbeService as any;
+    expect(() => {
+      service.rejectQueryOperatorsInData(legit);
+    }).not.toThrow();
+
+    const withOperator: Probe = new Probe();
+    (withOperator as unknown as { key: unknown }).key = new StartsWith("a");
+    expect(() => {
+      service.rejectQueryOperatorsInData(withOperator);
+    }).toThrow(BadDataException);
+  });
+});

package/Tests/Server/Services/MonitorPayAsYouGoBilling.test.ts

@@ -2,15 +2,19 @@ import MonitorService from "../../../Server/Services/MonitorService";
 import MonitorStatusService from "../../../Server/Services/MonitorStatusService";
 import ProjectService from "../../../Server/Services/ProjectService";
 import PayAsYouGoBillingService from "../../../Server/Services/PayAsYouGoBillingService";
+import BillingService from "../../../Server/Services/BillingService";
 import MonitorStepsProjectValidator from "../../../Server/Utils/Monitor/MonitorStepsProjectValidator";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
+import Project from "../../../Models/DatabaseModels/Project";
 import CreateBy from "../../../Server/Types/Database/CreateBy";
 import UpdateBy from "../../../Server/Types/Database/UpdateBy";
 import MonitorType from "../../../Types/Monitor/MonitorType";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
-import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
+import SubscriptionPlan, {
+  PlanType,
+} from "../../../Types/Billing/SubscriptionPlan";
 import PaymentRequiredException from "../../../Types/Exception/PaymentRequiredException";
 import * as EnvironmentConfig from "../../../Server/EnvironmentConfig";
 import {
@@ -89,6 +93,30 @@ function expectPaymentCheckedFor(project: ObjectID): void {
   }
 }
 
+function useRealPaymentEligibility(plan: PlanType): void {
+  jest.mocked(PayAsYouGoBillingService.canUsePayAsYouGo).mockRestore();
+  PayAsYouGoBillingService.invalidate(projectId);
+  PayAsYouGoBillingService.invalidate(otherProjectId);
+  jest.spyOn(BillingService, "isBillingEnabled").mockReturnValue(true);
+  jest.spyOn(BillingService, "hasPaymentMethods").mockResolvedValue(false);
+  jest.spyOn(BillingService, "getSubscription");
+  jest.spyOn(ProjectService, "findOneById").mockResolvedValue(
+    Object.assign(new Project(), {
+      paymentProviderPlanId: plan,
+      paymentProviderCustomerId: "cus_monitor_project",
+    }),
+  );
+  jest
+    .spyOn(SubscriptionPlan, "getSubscriptionPlanById")
+    .mockReturnValue(
+      new SubscriptionPlan(plan, `${plan}_yearly`, plan, 0, 0, 0, 0),
+    );
+  jest.spyOn(ProjectService, "getCurrentPlan").mockResolvedValue({
+    plan,
+    isSubscriptionUnpaid: false,
+  });
+}
+
 beforeEach(() => {
   jest.restoreAllMocks();
   (EnvironmentConfig as { IsBillingEnabled: boolean }).IsBillingEnabled = true;
@@ -300,3 +328,89 @@ describe("monitor update payment admission", () => {
     expect(MonitorService.findBy).not.toHaveBeenCalled();
   });
 });
+
+describe("monitor operations use the stored subscription plan for payment eligibility", () => {
+  test.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "allows active monitor creation on %s without a payment method",
+    async (plan: PlanType) => {
+      useRealPaymentEligibility(plan);
+
+      await expect(
+        hooks.onBeforeCreate(createInput(MonitorType.Website)),
+      ).resolves.toBeDefined();
+
+      expect(ProjectService.findOneById).toHaveBeenCalledWith(
+        expect.objectContaining({ id: projectId }),
+      );
+      expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+      expect(BillingService.getSubscription).not.toHaveBeenCalled();
+      expect(MonitorService.countBy).not.toHaveBeenCalled();
+    },
+  );
+
+  describe.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "%s monitor updates without a payment method",
+    (plan: PlanType) => {
+      test.each([
+        { disableActiveMonitoring: false },
+        { monitorType: MonitorType.API },
+      ])(
+        "allows the billable update %j",
+        async (data: UpdateBy<Monitor>["data"]) => {
+          useRealPaymentEligibility(plan);
+          jest
+            .spyOn(MonitorService, "findBy")
+            .mockResolvedValue([
+              storedMonitor(otherProjectId, MonitorType.Website),
+            ]);
+
+          await expect(
+            hooks.onBeforeUpdate(updateInput(data)),
+          ).resolves.toBeDefined();
+
+          expect(ProjectService.findOneById).toHaveBeenCalledWith(
+            expect.objectContaining({ id: otherProjectId }),
+          );
+          expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+        },
+      );
+    },
+  );
+
+  test("still rejects Free monitor creation and re-enabling without a payment method", async () => {
+    useRealPaymentEligibility(PlanType.Free);
+    jest
+      .spyOn(MonitorService, "findBy")
+      .mockResolvedValue([storedMonitor(projectId, MonitorType.Website)]);
+
+    await expect(
+      hooks.onBeforeCreate(createInput(MonitorType.Website)),
+    ).rejects.toBeInstanceOf(PaymentRequiredException);
+    await expect(
+      hooks.onBeforeUpdate(updateInput({ disableActiveMonitoring: false })),
+    ).rejects.toBeInstanceOf(PaymentRequiredException);
+
+    expect(BillingService.hasPaymentMethods).toHaveBeenCalledWith(
+      "cus_monitor_project",
+    );
+    expect(MonitorStatusService.findOneBy).not.toHaveBeenCalled();
+  });
+
+  test.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "retains the separate unpaid %s subscription check after exempting payment setup",
+    async (plan: PlanType) => {
+      useRealPaymentEligibility(plan);
+      jest.spyOn(ProjectService, "getCurrentPlan").mockResolvedValue({
+        plan,
+        isSubscriptionUnpaid: true,
+      });
+
+      await expect(
+        hooks.onBeforeCreate(createInput(MonitorType.Website)),
+      ).rejects.toThrow("subscription is unpaid");
+
+      expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+      expect(MonitorStatusService.findOneBy).not.toHaveBeenCalled();
+    },
+  );
+});