@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/Services/TeamMemberMultiTenantReadPostgres.test.ts

@@ -0,0 +1,394 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Entities from "../../../Models/DatabaseModels/Index";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import BaseAPI from "../../../Server/API/BaseAPI";
+import PostgresAppInstance from "../../../Server/Infrastructure/PostgresDatabase";
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import Select from "../../../Server/Types/Database/Select";
+import {
+  ExpressResponse,
+  OneUptimeRequest,
+} from "../../../Server/Utils/Express";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONObject } from "../../../Types/JSON";
+import JSONFunctions from "../../../Types/JSONFunctions";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+import UserType from "../../../Types/UserType";
+import { DataSource } from "typeorm";
+
+/*
+ * The handler receives an already-authenticated request and uses a dedicated
+ * DataSource below. Avoid loading unrelated login, billing, and boot-migration
+ * services; no permission check, repository operation, or serializer is mocked.
+ */
+jest.mock("../../../Server/Middleware/UserAuthorization", () => {
+  return { getUserMiddleware: jest.fn() };
+});
+jest.mock("../../../Server/Services/ProjectService", () => {
+  return { getCurrentPlan: jest.fn() };
+});
+jest.mock("../../../Server/Infrastructure/Postgres/DataSourceOptions", () => {
+  return {};
+});
+
+/*
+ * Opt in with RUN_POSTGRES_TEAM_MEMBER_PERMISSION_TESTS=true and config.env.
+ * Only table definitions are copied from public. Every row is synthetic and
+ * every read/write is directed to an isolated schema that is removed below.
+ * The permission pipeline, request-header translation, TypeORM joins, and
+ * response serialization run unchanged.
+ */
+const describePostgres: typeof describe =
+  process.env["RUN_POSTGRES_TEAM_MEMBER_PERMISSION_TESTS"] === "true"
+    ? describe
+    : describe.skip;
+
+describePostgres(
+  "multi-tenant team-member read authorization against Postgres",
+  () => {
+    const schema: string = `team_member_permission_test_${ObjectID.generate().toString().replace(/-/g, "")}`;
+    const userId: ObjectID = ObjectID.generate();
+    const otherUserId: ObjectID = ObjectID.generate();
+    const inviterId: ObjectID = ObjectID.generate();
+    const firstProjectId: ObjectID = ObjectID.generate();
+    const secondProjectId: ObjectID = ObjectID.generate();
+    const firstTeamId: ObjectID = ObjectID.generate();
+    const secondTeamId: ObjectID = ObjectID.generate();
+    const firstInvitationId: ObjectID = ObjectID.generate();
+    const secondInvitationId: ObjectID = ObjectID.generate();
+    const otherInvitationId: ObjectID = ObjectID.generate();
+    const acceptedMembershipId: ObjectID = ObjectID.generate();
+    const passwordHash: string = "synthetic-inviter-password-hash";
+    const resetToken: string = "synthetic-inviter-reset-token";
+    const privateTeamDescription: string = "Synthetic private team description";
+    const service: DatabaseService<TeamMember> = new DatabaseService(
+      TeamMember,
+    );
+    const api: BaseAPI<TeamMember, DatabaseService<TeamMember>> = new BaseAPI(
+      TeamMember,
+      service,
+    );
+    let database: DataSource;
+
+    beforeAll(async () => {
+      database = new DataSource({
+        type: "postgres",
+        host:
+          process.env["TEAM_MEMBER_PERMISSION_TEST_DATABASE_HOST"] ||
+          "localhost",
+        port: Number(
+          process.env["TEAM_MEMBER_PERMISSION_TEST_DATABASE_PORT"] || "5400",
+        ),
+        username: process.env["DATABASE_USERNAME"] || "postgres",
+        password: process.env["DATABASE_PASSWORD"] || "password",
+        database: process.env["DATABASE_NAME"] || "oneuptimedb",
+        entities: Entities,
+        schema,
+        synchronize: false,
+        extra: { options: `-c search_path=${schema},public` },
+      });
+      await database.initialize();
+      await database.query(`CREATE SCHEMA "${schema}"`);
+      for (const table of ["User", "Project", "Team", "TeamMember"]) {
+        await database.query(
+          `CREATE TABLE "${schema}"."${table}" (LIKE public."${table}" INCLUDING ALL)`,
+        );
+      }
+      jest.spyOn(PostgresAppInstance, "isConnected").mockReturnValue(true);
+      jest
+        .spyOn(PostgresAppInstance, "getDataSource")
+        .mockReturnValue(database);
+
+      for (const id of [userId, otherUserId, inviterId]) {
+        await database.query(
+          `INSERT INTO "${schema}"."User"
+         ("_id", "name", "email", "slug", "password", "resetPasswordToken", "version")
+         VALUES ($1, 'Synthetic User', $2, $3, $4, $5, 1)`,
+          [
+            id.toString(),
+            `${id.toString()}@example.com`,
+            id.toString(),
+            passwordHash,
+            resetToken,
+          ],
+        );
+      }
+      for (const [projectId, teamId, projectName, teamName] of [
+        [
+          firstProjectId,
+          firstTeamId,
+          "First invitation project",
+          "First invitation team",
+        ],
+        [
+          secondProjectId,
+          secondTeamId,
+          "Second invitation project",
+          "Second invitation team",
+        ],
+      ] as Array<[ObjectID, ObjectID, string, string]>) {
+        await database.query(
+          `INSERT INTO "${schema}"."Project" ("_id", "name", "slug", "version") VALUES ($1, $2, $3, 1)`,
+          [projectId.toString(), projectName, projectId.toString()],
+        );
+        await database.query(
+          `INSERT INTO "${schema}"."Team" ("_id", "projectId", "name", "slug", "description", "version")
+         VALUES ($1, $2, $3, $4, $5, 1)`,
+          [
+            teamId.toString(),
+            projectId.toString(),
+            teamName,
+            teamId.toString(),
+            privateTeamDescription,
+          ],
+        );
+      }
+      for (const [id, memberId, projectId, teamId, accepted] of [
+        [firstInvitationId, userId, firstProjectId, firstTeamId, false],
+        [secondInvitationId, userId, secondProjectId, secondTeamId, false],
+        [otherInvitationId, otherUserId, firstProjectId, firstTeamId, false],
+        [acceptedMembershipId, userId, firstProjectId, firstTeamId, true],
+      ] as Array<[ObjectID, ObjectID, ObjectID, ObjectID, boolean]>) {
+        await database.query(
+          `INSERT INTO "${schema}"."TeamMember"
+         ("_id", "userId", "projectId", "teamId", "createdByUserId", "hasAcceptedInvitation", "version")
+         VALUES ($1, $2, $3, $4, $5, $6, 1)`,
+          [
+            id.toString(),
+            memberId.toString(),
+            projectId.toString(),
+            teamId.toString(),
+            inviterId.toString(),
+            accepted,
+          ],
+        );
+      }
+    });
+
+    afterAll(async () => {
+      jest.restoreAllMocks();
+      if (database?.isInitialized) {
+        await database.query(`DROP SCHEMA IF EXISTS "${schema}" CASCADE`);
+        await database.destroy();
+      }
+    });
+
+    function props(
+      isMultiTenantRequest: boolean = true,
+    ): DatabaseCommonInteractionProps {
+      return {
+        userId,
+        userType: UserType.User,
+        isMultiTenantRequest,
+        userGlobalAccessPermission: {
+          _type: "UserGlobalAccessPermission",
+          globalPermissions: [Permission.User, Permission.CurrentUser],
+          // An invited user may not belong to any project yet.
+          projectIds: [],
+        },
+      };
+    }
+
+    function safeSelect(): Select<TeamMember> {
+      return {
+        _id: true,
+        userId: true,
+        hasAcceptedInvitation: true,
+        team: { name: true },
+        project: { name: true },
+      };
+    }
+
+    async function getList(data: {
+      select: Select<TeamMember>;
+      query?: JSONObject;
+      isMultiTenantRequest?: boolean;
+    }): Promise<JSONObject> {
+      const requestProps: DatabaseCommonInteractionProps = props();
+      const req: OneUptimeRequest = {
+        headers:
+          data.isMultiTenantRequest === false
+            ? {}
+            : { "is-multi-tenant-query": "true" },
+        query: {},
+        body: JSONFunctions.serialize({
+          query: data.query || {},
+          select: data.select,
+          limit: 20,
+        }),
+        userAuthorization: { userId },
+        userGlobalAccessPermission: requestProps.userGlobalAccessPermission,
+        userType: UserType.User,
+      } as unknown as OneUptimeRequest;
+      let body: JSONObject | undefined;
+      const res: ExpressResponse = {
+        status: jest.fn().mockReturnThis(),
+        set: jest.fn().mockReturnThis(),
+        send: jest.fn((responseBody: JSONObject) => {
+          // Express serializes ListData and its database property wrappers.
+          body = JSON.parse(JSON.stringify(responseBody)) as JSONObject;
+        }),
+      } as unknown as ExpressResponse;
+      await api.getList(req, res);
+      expect(res.status).toHaveBeenCalledWith(200);
+      expect(body).toBeDefined();
+      return body as JSONObject;
+    }
+
+    test("the privileged control reaches synthetic inviter secrets through the real join and serializer", async () => {
+      const records: Array<TeamMember> = await service.findBy({
+        query: { _id: firstInvitationId.toString() },
+        select: { createdByUser: { password: true, resetPasswordToken: true } },
+        skip: 0,
+        limit: 1,
+        props: { isRoot: true },
+      });
+      expect(records).toHaveLength(1);
+      const serialized: string = JSON.stringify(
+        BaseModel.toJSONArray(records, TeamMember),
+      );
+      expect(serialized).toContain(passwordHash);
+      expect(serialized).toContain(resetToken);
+    });
+
+    test.each([
+      [
+        "inviter password hash",
+        { createdByUser: { password: true } },
+        "permissions to select on - createdByUser",
+      ],
+      [
+        "inviter password reset token",
+        { createdByUser: { resetPasswordToken: true } },
+        "permissions to select on - createdByUser",
+      ],
+      [
+        "restricted team field",
+        { team: { description: true } },
+        "Column description on Team does not support read on relation query",
+      ],
+      [
+        "restricted user relation",
+        { user: { password: true } },
+        "permissions to select on - user",
+      ],
+      [
+        "deep relation",
+        { team: { createdByUser: { password: true } } },
+        "You cannot query deep relations",
+      ],
+    ] as Array<[string, Select<TeamMember>, string]>)(
+      "rejects a multi-tenant API selection of %s",
+      async (
+        _label: string,
+        select: Select<TeamMember>,
+        expectedError: string,
+      ) => {
+        await expect(getList({ select })).rejects.toThrow(expectedError);
+      },
+    );
+
+    test("the same nested credential projection is already denied without the multi-tenant header", async () => {
+      await expect(
+        getList({
+          select: {
+            createdByUser: { password: true, resetPasswordToken: true },
+          },
+          isMultiTenantRequest: false,
+        }),
+      ).rejects.toThrow("permissions to select on - createdByUser");
+    });
+
+    test.each([true, false])(
+      "lists pending invitations and their safe labels with no project memberships (multi-tenant=%s)",
+      async (isMultiTenantRequest: boolean) => {
+        const response: JSONObject = await getList({
+          select: safeSelect(),
+          query: { hasAcceptedInvitation: false },
+          isMultiTenantRequest,
+        });
+        expect(response["count"]).toBe(2);
+        const rows: Array<JSONObject> = response["data"] as Array<JSONObject>;
+        expect(rows).toHaveLength(2);
+        expect(
+          rows
+            .map((row: JSONObject) => {
+              return row["_id"];
+            })
+            .sort(),
+        ).toEqual(
+          [firstInvitationId.toString(), secondInvitationId.toString()].sort(),
+        );
+        const serialized: string = JSON.stringify(response);
+        expect(serialized).toContain("First invitation project");
+        expect(serialized).toContain("Second invitation project");
+        expect(serialized).toContain("First invitation team");
+        expect(serialized).toContain("Second invitation team");
+        expect(serialized).not.toContain(otherInvitationId.toString());
+        expect(serialized).not.toContain(passwordHash);
+        expect(serialized).not.toContain(resetToken);
+        expect(serialized).not.toContain(privateTeamDescription);
+      },
+    );
+
+    test("caller filters remain effective for both list and count", async () => {
+      const response: JSONObject = await getList({
+        select: safeSelect(),
+        query: { projectId: secondProjectId, hasAcceptedInvitation: false },
+      });
+      expect(response["count"]).toBe(1);
+      expect(response["data"]).toHaveLength(1);
+      expect(JSON.stringify(response)).toContain(secondInvitationId.toString());
+      expect(JSON.stringify(response)).not.toContain(
+        firstInvitationId.toString(),
+      );
+    });
+
+    test("count authorization rejects predicates on forbidden columns", async () => {
+      await expect(
+        service.countBy({
+          query: { createdByUserId: inviterId },
+          props: props(),
+        }),
+      ).rejects.toThrow("permissions to query on - createdByUserId");
+    });
+
+    test("safe counts are restricted to the current user's rows", async () => {
+      expect(
+        (await service.countBy({ query: {}, props: props() })).toNumber(),
+      ).toBe(3);
+      expect(
+        (
+          await service.countBy({
+            query: { hasAcceptedInvitation: false },
+            props: props(),
+          })
+        ).toNumber(),
+      ).toBe(2);
+      expect(
+        (
+          await service.countBy({ query: {}, props: { isRoot: true } })
+        ).toNumber(),
+      ).toBe(4);
+    });
+
+    test("a caller cannot redirect the current-user scope to another member", async () => {
+      await expect(
+        getList({ select: safeSelect(), query: { userId: otherUserId } }),
+      ).rejects.toThrow("permission to access another user's Team Member");
+      await expect(
+        service.countBy({ query: { userId: otherUserId }, props: props() }),
+      ).rejects.toThrow("permission to access another user's Team Member");
+    });
+
+    test("an explicit foreign membership ID returns no row and a zero count", async () => {
+      const response: JSONObject = await getList({
+        select: safeSelect(),
+        query: { _id: otherInvitationId.toString() },
+      });
+      expect(response["data"]).toEqual([]);
+      expect(response["count"]).toBe(0);
+    });
+  },
+);

package/Tests/Server/Services/TeamPrivilegeEscalation.test.ts

@@ -103,6 +103,11 @@ function propsWith(
   return {
     userId: USER_ID,
     tenantId: tenantId,
+    userGlobalAccessPermission: {
+      _type: "UserGlobalAccessPermission",
+      projectIds: [tenantId],
+      globalPermissions: [Permission.Public, Permission.User],
+    },
     userTenantAccessPermission: {
       [tenantId.toString()]: tenantPermission,
     },
@@ -117,6 +122,7 @@ function makePermission(data?: {
   scope?: PermissionScope | undefined;
 }): TeamPermission {
   const permission: TeamPermission = new TeamPermission();
+  permission.id = ObjectID.generate();
   permission.projectId = data?.projectId || PROJECT_ID;
   permission.teamId = data?.teamId || TEAM_ID;
   permission.permission = data?.permission || Permission.ProjectMember;

package/Tests/Server/Services/TelemetryPayAsYouGoBilling.test.ts

@@ -2,10 +2,13 @@ import TelemetryIngestionKeyService, {
   Service,
 } from "../../../Server/Services/TelemetryIngestionKeyService";
 import PayAsYouGoBillingService from "../../../Server/Services/PayAsYouGoBillingService";
+import BillingService from "../../../Server/Services/BillingService";
+import ProjectService from "../../../Server/Services/ProjectService";
 import TelemetryIngest, {
   TelemetryRequest,
 } from "../../../Server/Middleware/TelemetryIngest";
 import TelemetryIngestionKey from "../../../Models/DatabaseModels/TelemetryIngestionKey";
+import Project from "../../../Models/DatabaseModels/Project";
 import CreateBy from "../../../Server/Types/Database/CreateBy";
 import UpdateBy from "../../../Server/Types/Database/UpdateBy";
 import {
@@ -16,6 +19,9 @@ import {
 import TelemetryIngestSurface from "../../../Types/Telemetry/TelemetryIngestSurface";
 import TelemetryIngestionKeyType from "../../../Types/Telemetry/TelemetryIngestionKeyType";
 import PaymentRequiredException from "../../../Types/Exception/PaymentRequiredException";
+import SubscriptionPlan, {
+  PlanType,
+} from "../../../Types/Billing/SubscriptionPlan";
 import ObjectID from "../../../Types/ObjectID";
 import * as EnvironmentConfig from "../../../Server/EnvironmentConfig";
 import {
@@ -101,6 +107,25 @@ function expectPaymentCheckedFor(project: ObjectID): void {
   }
 }
 
+function useRealPaymentEligibility(plan: PlanType): void {
+  jest.mocked(PayAsYouGoBillingService.canUsePayAsYouGo).mockRestore();
+  PayAsYouGoBillingService.invalidate(projectId);
+  PayAsYouGoBillingService.invalidate(otherProjectId);
+  jest.spyOn(BillingService, "isBillingEnabled").mockReturnValue(true);
+  jest.spyOn(BillingService, "hasPaymentMethods").mockResolvedValue(false);
+  jest.spyOn(ProjectService, "findOneById").mockResolvedValue(
+    Object.assign(new Project(), {
+      paymentProviderPlanId: plan,
+      paymentProviderCustomerId: "cus_telemetry_project",
+    }),
+  );
+  jest
+    .spyOn(SubscriptionPlan, "getSubscriptionPlanById")
+    .mockReturnValue(
+      new SubscriptionPlan(plan, `${plan}_yearly`, plan, 0, 0, 0, 0),
+    );
+}
+
 beforeEach(() => {
   jest.restoreAllMocks();
   (EnvironmentConfig as { IsBillingEnabled: boolean }).IsBillingEnabled = true;
@@ -353,3 +378,109 @@ describe("HTTP telemetry admission integrates key resolution and billing", () =>
     expect(TelemetryIngestionKeyService.markUsed).toHaveBeenCalledTimes(1);
   });
 });
+
+describe("telemetry operations use the stored subscription plan for payment eligibility", () => {
+  describe.each([PlanType.Growth, PlanType.Scale, PlanType.Enterprise])(
+    "%s telemetry keys without a payment method",
+    (plan: PlanType) => {
+      test.each(Object.values(TelemetryIngestionKeyType))(
+        "allows creating a %s key",
+        async (keyType: TelemetryIngestionKeyType) => {
+          useRealPaymentEligibility(plan);
+          const input: CreateBy<TelemetryIngestionKey> = createInput();
+          input.data.keyType = keyType;
+          input.data.allowedOrigins = ["https://example.com"];
+
+          await expect(hooks.onBeforeCreate(input)).resolves.toBeDefined();
+
+          expect(ProjectService.findOneById).toHaveBeenCalledWith(
+            expect.objectContaining({ id: projectId }),
+          );
+          expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+        },
+      );
+
+      test("allows re-enabling a key using its stored project", async () => {
+        useRealPaymentEligibility(plan);
+        jest.spyOn(service, "findBy").mockResolvedValue([key(otherProjectId)]);
+
+        await expect(
+          hooks.onBeforeUpdate(updateInput({ isEnabled: true })),
+        ).resolves.toBeDefined();
+
+        expect(ProjectService.findOneById).toHaveBeenCalledWith(
+          expect.objectContaining({ id: otherProjectId }),
+        );
+        expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+      });
+    },
+  );
+
+  test("still requires a payment method to create or re-enable Free telemetry keys", async () => {
+    useRealPaymentEligibility(PlanType.Free);
+    jest.spyOn(service, "findBy").mockResolvedValue([key()]);
+
+    await expect(hooks.onBeforeCreate(createInput())).rejects.toBeInstanceOf(
+      PaymentRequiredException,
+    );
+    await expect(
+      hooks.onBeforeUpdate(updateInput({ isEnabled: true })),
+    ).rejects.toBeInstanceOf(PaymentRequiredException);
+
+    expect(BillingService.hasPaymentMethods).toHaveBeenCalledWith(
+      "cus_telemetry_project",
+    );
+  });
+
+  describe.each([
+    PlanType.Free,
+    PlanType.Growth,
+    PlanType.Scale,
+    PlanType.Enterprise,
+  ])("%s HTTP telemetry without a payment method", (plan: PlanType) => {
+    test.each(Object.values(TelemetryIngestSurface))(
+      "applies plan eligibility before the %s handler",
+      async (surface: TelemetryIngestSurface) => {
+        useRealPaymentEligibility(plan);
+        const existingKey: TelemetryIngestionKey = key();
+        jest
+          .spyOn(TelemetryIngestionKeyService, "findOneBy")
+          .mockResolvedValue(existingKey);
+        jest
+          .spyOn(TelemetryIngestionKeyService, "markUsed")
+          .mockResolvedValue(undefined);
+        const request: ExpressRequest = {
+          headers: { "x-oneuptime-token": existingKey.secretKey!.toString() },
+        } as unknown as ExpressRequest;
+        const next: NextFunction = jest.fn() as unknown as NextFunction;
+
+        await TelemetryIngest.forSurface(surface)(
+          request,
+          {} as ExpressResponse,
+          next,
+        );
+
+        expect(next).toHaveBeenCalledTimes(1);
+        if (plan === PlanType.Free) {
+          expect(next).toHaveBeenCalledWith(
+            expect.any(PaymentRequiredException),
+          );
+          expect((request as TelemetryRequest).projectId).toBeUndefined();
+          expect(TelemetryIngestionKeyService.markUsed).not.toHaveBeenCalled();
+          expect(BillingService.hasPaymentMethods).toHaveBeenCalledWith(
+            "cus_telemetry_project",
+          );
+        } else {
+          expect(next).toHaveBeenCalledWith();
+          expect((request as TelemetryRequest).projectId.toString()).toBe(
+            projectId.toString(),
+          );
+          expect(TelemetryIngestionKeyService.markUsed).toHaveBeenCalledTimes(
+            1,
+          );
+          expect(BillingService.hasPaymentMethods).not.toHaveBeenCalled();
+        }
+      },
+    );
+  });
+});

package/Tests/Server/Services/UserNotificationRuleAdminGuards.test.ts

@@ -38,6 +38,7 @@ import NotificationRuleType from "../../../Types/NotificationRule/NotificationRu
 import ObjectID from "../../../Types/ObjectID";
 import UserNotificationEventType from "../../../Types/UserNotification/UserNotificationEventType";
 import UserNotificationStatus from "../../../Types/UserNotification/UserNotificationStatus";
+import UserType from "../../../Types/UserType";
 import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
 
 /*
@@ -616,6 +617,11 @@ describe("UserNotificationRule administrative write guards", () => {
        * An API key has no user identity. If the widened create list ever admits
        * one, "actor equals owner" is trivially false and must NOT be read as
        * "nobody else involved, carry on".
+       *
+       * The fixture says userType API because an API key is the only actor-less
+       * caller that can reach this hook: DatabaseService.create now refuses a
+       * caller with no credentials at all (no userId, not an API key) with a
+       * 401 before any hook runs.
        */
       stubs.teamMemberFind.mockResolvedValue(null as never);
 
@@ -623,7 +629,7 @@ describe("UserNotificationRule administrative write guards", () => {
         hooks().onBeforeCreate(
           createBy({
             userId: VICTIM_USER_ID,
-            props: { tenantId: PROJECT_ID },
+            props: { tenantId: PROJECT_ID, userType: UserType.API },
             channels: { userEmailId: METHOD_ID },
           }),
         ),
@@ -631,10 +637,15 @@ describe("UserNotificationRule administrative write guards", () => {
     });
 
     test("a rule with neither an owner nor an actor is refused rather than written unowned", async () => {
+      /*
+       * Actor-less means an API key here, for the same reason as above: an
+       * anonymous caller is refused (401) by DatabaseService.create before
+       * this hook, so it never sees this 400.
+       */
       await expect(
         hooks().onBeforeCreate(
           createBy({
-            props: { tenantId: PROJECT_ID },
+            props: { tenantId: PROJECT_ID, userType: UserType.API },
             channels: { userEmailId: METHOD_ID },
           }),
         ),