@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/Types/Database/Permissions/MultiTenantPermissions.test.ts

@@ -0,0 +1,350 @@
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import TeamMember from "../../../../../Models/DatabaseModels/TeamMember";
+import User from "../../../../../Models/DatabaseModels/User";
+import ModelPermission from "../../../../../Server/Types/Database/Permissions/Index";
+import { CheckReadPermissionType } from "../../../../../Server/Types/Database/Permissions/ReadPermission";
+import Query from "../../../../../Server/Types/Database/Query";
+import Select from "../../../../../Server/Types/Database/Select";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotEqual from "../../../../../Types/BaseDatabase/NotEqual";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission from "../../../../../Types/Permission";
+import { FindOperator } from "typeorm";
+
+/*
+ * These permission checks never connect to Postgres. Avoid loading the app's
+ * entire startup migration registry while retaining the real permission code.
+ */
+jest.mock(
+  "../../../../../Server/Infrastructure/Postgres/DataSourceOptions",
+  () => {
+    return { __esModule: true, default: {} };
+  },
+);
+
+const userId: ObjectID = ObjectID.generate();
+const otherUserId: ObjectID = ObjectID.generate();
+const projectId: ObjectID = ObjectID.generate();
+
+function makeProps(
+  isMultiTenantRequest: boolean,
+  withProject: boolean = false,
+): DatabaseCommonInteractionProps {
+  return {
+    userId,
+    isMultiTenantRequest,
+    userGlobalAccessPermission: {
+      projectIds: withProject ? [projectId] : [],
+      globalPermissions: [Permission.Public, Permission.CurrentUser],
+      _type: "UserGlobalAccessPermission",
+    },
+    ...(withProject
+      ? {
+          tenantId: projectId,
+          userTenantAccessPermission: {
+            [projectId.toString()]: {
+              projectId,
+              permissions: [
+                {
+                  permission: Permission.ProjectMember,
+                  labelIds: [],
+                  isBlockPermission: false,
+                  _type: "UserPermission" as const,
+                },
+              ],
+              _type: "UserTenantAccessPermission" as const,
+            },
+          },
+        }
+      : {}),
+  };
+}
+
+/*
+ * Assert the effective SQL predicate, including its bound value. An own-row
+ * query must remain an equality after the permission pipeline serializes it.
+ */
+function expectExactScope(value: unknown, id: ObjectID): void {
+  expect(value).toBeInstanceOf(FindOperator);
+  const predicate: FindOperator<unknown> = value as FindOperator<unknown>;
+  const parameters: Record<string, unknown> =
+    predicate.objectLiteralParameters || {};
+  expect(Object.values(parameters)).toEqual([id.toString()]);
+  expect(predicate.getSql?.("scope_column")).toBe(
+    `(scope_column = :${Object.keys(parameters)[0]})`,
+  );
+}
+
+function invitationSelect(): Select<TeamMember> {
+  // The actual pending-invitation UI must work before a user joins a project.
+  return {
+    _id: true,
+    createdAt: true,
+    projectId: true,
+    project: { _id: true, name: true },
+    teamId: true,
+    team: { _id: true, name: true },
+  };
+}
+
+describe.each([false, true])(
+  "TeamMember read authorization with isMultiTenantRequest=%s",
+  (isMultiTenantRequest: boolean) => {
+    it.each(["password", "passwordSalt", "resetPasswordToken"])(
+      "rejects a creator relation exposing %s for a user with no projects",
+      async (secretColumn: string) => {
+        await expect(
+          ModelPermission.checkReadQueryPermission(
+            TeamMember,
+            {},
+            { createdByUser: { [secretColumn]: true } },
+            makeProps(isMultiTenantRequest),
+          ),
+        ).rejects.toThrow(NotAuthorizedException);
+      },
+    );
+
+    it.each(["createdByUserId", "deletedByUserId", "invitationAcceptedAt"])(
+      "rejects the forbidden top-level select %s",
+      async (column: string) => {
+        await expect(
+          ModelPermission.checkReadQueryPermission(
+            TeamMember,
+            {},
+            { [column]: true },
+            makeProps(isMultiTenantRequest),
+          ),
+        ).rejects.toThrow(NotAuthorizedException);
+      },
+    );
+
+    it.each(["createdByUserId", "deletedByUserId"])(
+      "rejects count queries using the forbidden %s predicate without a select",
+      async (column: string) => {
+        await expect(
+          ModelPermission.checkReadQueryPermission(
+            TeamMember,
+            { [column]: otherUserId },
+            null,
+            makeProps(isMultiTenantRequest),
+          ),
+        ).rejects.toThrow(NotAuthorizedException);
+      },
+    );
+
+    it("rejects forbidden query fields even when selecting only the record ID", async () => {
+      await expect(
+        ModelPermission.checkReadQueryPermission(
+          TeamMember,
+          { createdByUserId: otherUserId },
+          { _id: true },
+          makeProps(isMultiTenantRequest),
+        ),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it.each(["password", "passwordSalt", "resetPasswordToken"])(
+      "rejects %s inside a relation the project member may otherwise read",
+      async (secretColumn: string) => {
+        await expect(
+          ModelPermission.checkReadQueryPermission(
+            TeamMember,
+            {},
+            { user: { [secretColumn]: true } },
+            makeProps(isMultiTenantRequest, true),
+          ),
+        ).rejects.toThrow(BadDataException);
+      },
+    );
+
+    it("allows safe labels on an authorized user relation", async () => {
+      const result: CheckReadPermissionType<TeamMember> =
+        await ModelPermission.checkReadQueryPermission(
+          TeamMember,
+          {},
+          { _id: true, user: { _id: true, name: true, email: true } },
+          makeProps(isMultiTenantRequest, true),
+        );
+
+      expect(result.relationSelect).toEqual({ user: true });
+      expect(result.select).toMatchObject({
+        user: { _id: true, name: true, email: true },
+      });
+      if (isMultiTenantRequest) {
+        expectExactScope(result.query.userId, userId);
+      } else {
+        expectExactScope(result.query.projectId, projectId);
+      }
+    });
+
+    it.each([false, true])(
+      "allows invitation labels without any project membership (explicit user filter=%s)",
+      async (withUserFilter: boolean) => {
+        const query: Query<TeamMember> = {
+          hasAcceptedInvitation: false,
+          ...(withUserFilter ? { userId } : {}),
+        };
+        const result: CheckReadPermissionType<TeamMember> =
+          await ModelPermission.checkReadQueryPermission(
+            TeamMember,
+            query,
+            invitationSelect(),
+            makeProps(isMultiTenantRequest),
+          );
+
+        expectExactScope(result.query.userId, userId);
+        expect(result.query.projectId).toBeUndefined();
+        expect(result.query.hasAcceptedInvitation).toBe(false);
+        expect(result.relationSelect).toEqual({ project: true, team: true });
+        expect(result.select).toMatchObject({
+          project: { _id: true, name: true },
+          team: { _id: true, name: true },
+        });
+        expect(query).toEqual({
+          hasAcceptedInvitation: false,
+          ...(withUserFilter ? { userId } : {}),
+        });
+      },
+    );
+
+    it("keeps a safe count scoped to the authenticated user's invitations", async () => {
+      const result: CheckReadPermissionType<TeamMember> =
+        await ModelPermission.checkReadQueryPermission(
+          TeamMember,
+          { hasAcceptedInvitation: false },
+          null,
+          makeProps(isMultiTenantRequest),
+        );
+
+      expectExactScope(result.query.userId, userId);
+      expect(result.select).toBeNull();
+    });
+
+    it("does not trust a caller-supplied array as an authorized multi-project query", async () => {
+      await expect(
+        ModelPermission.checkReadQueryPermission(
+          TeamMember,
+          [{ userId: otherUserId }] as unknown as Query<TeamMember>,
+          { _id: true },
+          makeProps(isMultiTenantRequest),
+        ),
+      ).rejects.toThrow(BadDataException);
+    });
+
+    it.each([
+      otherUserId,
+      otherUserId.toString(),
+      new NotEqual<string>(userId.toString()),
+    ])(
+      "rejects an ownership filter targeting other users: %p",
+      async (filter: string | ObjectID | NotEqual<string>) => {
+        await expect(
+          ModelPermission.checkReadQueryPermission(
+            TeamMember,
+            { userId: filter } as Query<TeamMember>,
+            invitationSelect(),
+            makeProps(isMultiTenantRequest),
+          ),
+        ).rejects.toThrow(NotAuthorizedException);
+      },
+    );
+  },
+);
+
+describe("multi-tenant project permission checks", () => {
+  const firstProjectId: ObjectID = ObjectID.generate();
+  const secondProjectId: ObjectID = ObjectID.generate();
+  const deniedProjectId: ObjectID = ObjectID.generate();
+
+  function makeMultiProjectProps(
+    isMultiTenantRequest: boolean = true,
+  ): DatabaseCommonInteractionProps {
+    return {
+      userId,
+      isMultiTenantRequest,
+      userGlobalAccessPermission: {
+        projectIds: [firstProjectId, deniedProjectId, secondProjectId],
+        globalPermissions: [Permission.Public, Permission.CurrentUser],
+        _type: "UserGlobalAccessPermission",
+      },
+      userTenantAccessPermission: Object.fromEntries(
+        [firstProjectId, secondProjectId].map((id: ObjectID) => {
+          return [
+            id.toString(),
+            {
+              projectId: id,
+              permissions: [
+                {
+                  permission: Permission.ReadProjectIncident,
+                  labelIds: [],
+                  isBlockPermission: false,
+                  _type: "UserPermission" as const,
+                },
+              ],
+              _type: "UserTenantAccessPermission" as const,
+            },
+          ];
+        }),
+      ),
+    };
+  }
+
+  it.each([false, true])(
+    "keeps reads authorized separately for each project (multi-tenant header=%s)",
+    async (isMultiTenantRequest: boolean) => {
+      const result: CheckReadPermissionType<Incident> =
+        await ModelPermission.checkReadQueryPermission(
+          Incident,
+          {},
+          { _id: true, title: true },
+          makeMultiProjectProps(isMultiTenantRequest),
+        );
+      const queries: Array<Query<Incident>> = result.query as unknown as Array<
+        Query<Incident>
+      >;
+
+      expect(queries).toHaveLength(2);
+      expectExactScope(queries[0]?.projectId, firstProjectId);
+      expectExactScope(queries[1]?.projectId, secondProjectId);
+      expect(result.select).toMatchObject({ _id: true, title: true });
+    },
+  );
+
+  it("rejects unsafe relation selects in every project", async () => {
+    await expect(
+      ModelPermission.checkReadQueryPermission(
+        Incident,
+        {},
+        { createdByUser: { password: true } },
+        makeMultiProjectProps(),
+      ),
+    ).rejects.toThrow(/password/);
+  });
+
+  it("rejects a read when no project grants table access", async () => {
+    const props: DatabaseCommonInteractionProps = makeMultiProjectProps();
+    props.userTenantAccessPermission = {};
+
+    await expect(
+      ModelPermission.checkReadQueryPermission(
+        Incident,
+        {},
+        { _id: true, title: true },
+        props,
+      ),
+    ).rejects.toThrow(NotAuthorizedException);
+  });
+
+  it("rejects a multi-tenant header on a model that does not allow it", async () => {
+    await expect(
+      ModelPermission.checkReadQueryPermission(
+        User,
+        {},
+        { name: true },
+        makeProps(true),
+      ),
+    ).rejects.toThrow(BadDataException);
+  });
+});

package/Tests/Server/Types/Database/Permissions/OnCallCalendarFeedPermissions.test.ts

@@ -2,7 +2,13 @@ import ModelPermission from "../../../../../Server/Types/Database/Permissions/In
 import CalendarFeedToken from "../../../../../Server/Utils/OnCall/CalendarFeedToken";
 import OnCallDutyPolicyScheduleCalendarFeed from "../../../../../Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed";
 import ProjectOnCallCalendarFeed from "../../../../../Models/DatabaseModels/ProjectOnCallCalendarFeed";
+import UserOnCallCalendarFeed from "../../../../../Models/DatabaseModels/UserOnCallCalendarFeed";
+import Select from "../../../../../Server/Types/Database/Select";
+import { CheckReadPermissionType } from "../../../../../Server/Types/Database/Permissions/ReadPermission";
+import { FindOperator } from "typeorm";
 import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
+import NotAuthenticatedException from "../../../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../../../../Types/ObjectID";
 import Permission, {
@@ -35,6 +41,7 @@ const userId: ObjectID = ObjectID.generate();
 
 function propsFor(
   permissions: Array<Permission>,
+  labelIds: Array<ObjectID> = [],
 ): DatabaseCommonInteractionProps {
   const tenantPermission: UserTenantAccessPermission = {
     projectId,
@@ -43,7 +50,7 @@ function propsFor(
       return {
         _type: "UserPermission",
         permission: permission,
-        labelIds: [],
+        labelIds,
         isBlockPermission: false,
       };
     }),
@@ -214,41 +221,291 @@ describe("shared calendar feeds: the real permission gate", () => {
   });
 
   /*
-   * "Any schedule reader may copy the link" is half the design, so it is
-   * pinned too: a reader must still be able to READ the row.
+   * Match the complete status projections in OnCallCalendarAPI. Selecting only
+   * a few settings missed the empty read ACL on previousTokenExpiresAt and
+   * allowed the shared-feed status endpoint to fail for every reader.
    */
-  describe("any reader may copy the link", () => {
-    for (const permission of [Permission.Viewer, Permission.OnCallViewer]) {
-      it(`a ${permission} may read the schedule feed's non-secret columns`, async () => {
-        await expect(
-          ModelPermission.checkReadQueryPermission(
-            OnCallDutyPolicyScheduleCalendarFeed,
-            { projectId: projectId },
-            { _id: true, isEnabled: true, tokenHint: true },
-            propsFor([permission]),
-          ),
-        ).resolves.toBeDefined();
+  const statusSelect: Select<ProjectOnCallCalendarFeed> = {
+    _id: true,
+    projectId: true,
+    isEnabled: true,
+    tokenHint: true,
+    rotatedAt: true,
+    previousTokenExpiresAt: true,
+    lastFetchedAt: true,
+    lastFetchedClient: true,
+    fetchCount: true,
+    lastRenderTruncated: true,
+    pastDays: true,
+    futureDays: true,
+  } as const;
+
+  const sharedStatusSelect: Select<ProjectOnCallCalendarFeed> = {
+    ...statusSelect,
+    includeCoverageGaps: true,
+    minimumGapMinutes: true,
+    rotateWhenMemberLeaves: true,
+  } as const;
+
+  const scheduleStatusSelect: Select<OnCallDutyPolicyScheduleCalendarFeed> = {
+    ...sharedStatusSelect,
+    onCallDutyPolicyScheduleId: true,
+  };
+
+  const personalStatusSelect: Select<UserOnCallCalendarFeed> = {
+    ...statusSelect,
+    userId: true,
+    includeCoveringShifts: true,
+  };
+
+  describe("any schedule reader may read the complete shared-feed status", () => {
+    for (const modelType of [
+      OnCallDutyPolicyScheduleCalendarFeed,
+      ProjectOnCallCalendarFeed,
+    ]) {
+      const select: Select<OnCallDutyPolicyScheduleCalendarFeed> =
+        modelType === OnCallDutyPolicyScheduleCalendarFeed
+          ? scheduleStatusSelect
+          : sharedStatusSelect;
+
+      describe(modelType.name, () => {
+        for (const permission of [
+          Permission.ProjectOwner,
+          Permission.ProjectAdmin,
+          Permission.ProjectMember,
+          Permission.Viewer,
+          Permission.OnCallAdmin,
+          Permission.OnCallMember,
+          Permission.OnCallViewer,
+          Permission.ReadProjectOnCallDutyPolicySchedule,
+        ]) {
+          it(`a ${permission} may read status including the previous token expiry`, async () => {
+            const result: CheckReadPermissionType<OnCallDutyPolicyScheduleCalendarFeed> =
+              await ModelPermission.checkReadQueryPermission(
+                modelType,
+                { projectId },
+                select,
+                propsFor([permission]),
+              );
+
+            expect(result.select).toEqual(select);
+          });
+        }
+
+        it("refuses status to a caller without schedule read permissions", async () => {
+          await expect(
+            ModelPermission.checkReadQueryPermission(
+              modelType,
+              { projectId },
+              select,
+              propsFor([]),
+            ),
+          ).rejects.toThrow(NotAuthorizedException);
+        });
+
+        it("does not use a role granted for a different project", async () => {
+          const otherProjectId: ObjectID = ObjectID.generate();
+          const props: DatabaseCommonInteractionProps = {
+            ...propsFor([Permission.ProjectOwner]),
+            tenantId: otherProjectId,
+          };
+
+          await expect(
+            ModelPermission.checkReadQueryPermission(
+              modelType,
+              { projectId: otherProjectId },
+              select,
+              props,
+            ),
+          ).rejects.toThrow(NotAuthorizedException);
+        });
+
+        it("keeps a status read scoped to the caller's project", async () => {
+          const result: CheckReadPermissionType<OnCallDutyPolicyScheduleCalendarFeed> =
+            await ModelPermission.checkReadQueryPermission(
+              modelType,
+              { projectId: ObjectID.generate() },
+              select,
+              propsFor([Permission.Viewer]),
+            );
+
+          expect(result.query.projectId).toBeInstanceOf(FindOperator);
+          expect(
+            Object.values(
+              (result.query.projectId as unknown as FindOperator<string>)
+                .objectLiteralParameters || {},
+            ),
+          ).toEqual([projectId.toString()]);
+        });
+
+        for (const permission of [
+          Permission.ProjectOwner,
+          Permission.ProjectAdmin,
+          Permission.OnCallMember,
+          Permission.EditProjectOnCallDutyPolicySchedule,
+        ]) {
+          it(`a ${permission} cannot change the server-managed expiry`, async () => {
+            const props: DatabaseCommonInteractionProps = propsFor([
+              permission,
+              Permission.ReadProjectOnCallDutyPolicySchedule,
+            ]);
+            await expect(
+              ModelPermission.checkUpdateQueryPermissions(
+                modelType,
+                { _id: feedId.toString(), projectId },
+                { isEnabled: true },
+                props,
+              ),
+            ).resolves.toBeDefined();
+            await expect(
+              ModelPermission.checkUpdateQueryPermissions(
+                modelType,
+                { _id: feedId.toString(), projectId },
+                { previousTokenExpiresAt: new Date("2026-10-01T00:00:00Z") },
+                props,
+              ),
+            ).rejects.toThrow(BadDataException);
+          });
+        }
       });
     }
 
-    it("nobody, however privileged, may select the token columns", async () => {
+    it("preserves schedule and label scope when reading the complete status", async () => {
+      const permittedLabelId: ObjectID = ObjectID.generate();
+      const result: CheckReadPermissionType<OnCallDutyPolicyScheduleCalendarFeed> =
+        await ModelPermission.checkReadQueryPermission(
+          OnCallDutyPolicyScheduleCalendarFeed,
+          {
+            projectId,
+            onCallDutyPolicyScheduleId: scheduleId,
+            onCallDutyPolicySchedule: { _id: scheduleId.toString() },
+          },
+          scheduleStatusSelect,
+          propsFor(
+            [Permission.ReadProjectOnCallDutyPolicySchedule],
+            [permittedLabelId],
+          ),
+        );
+
+      expect(result.query.onCallDutyPolicySchedule).toEqual({
+        _id: scheduleId.toString(),
+        labels: [permittedLabelId],
+      });
+      expect(
+        Object.values(
+          (
+            result.query
+              .onCallDutyPolicyScheduleId as unknown as FindOperator<string>
+          ).objectLiteralParameters || {},
+        ),
+      ).toEqual([scheduleId.toString()]);
+      expect(result.select).toEqual(scheduleStatusSelect);
+    });
+  });
+
+  describe("personal feed status remains restricted to its owner", () => {
+    it("allows the current user's complete status and applies both user and project scope", async () => {
+      const result: CheckReadPermissionType<UserOnCallCalendarFeed> =
+        await ModelPermission.checkReadQueryPermission(
+          UserOnCallCalendarFeed,
+          {},
+          personalStatusSelect,
+          propsFor([Permission.CurrentUser]),
+        );
+
+      expect(result.select).toEqual(personalStatusSelect);
+      for (const [column, expectedId] of [
+        ["projectId", projectId],
+        ["userId", userId],
+      ] as const) {
+        expect(result.query[column]).toBeInstanceOf(FindOperator);
+        expect(
+          Object.values(
+            (result.query[column] as unknown as FindOperator<string>)
+              .objectLiteralParameters || {},
+          ),
+        ).toEqual([expectedId.toString()]);
+      }
+    });
+
+    it("refuses another user's status even when the caller is a project owner", async () => {
       await expect(
         ModelPermission.checkReadQueryPermission(
-          OnCallDutyPolicyScheduleCalendarFeed,
-          { projectId: projectId },
-          { _id: true, token: true },
-          propsFor([Permission.ProjectOwner, Permission.ProjectAdmin]),
+          UserOnCallCalendarFeed,
+          { projectId, userId: ObjectID.generate() },
+          personalStatusSelect,
+          propsFor([Permission.CurrentUser, Permission.ProjectOwner]),
         ),
-      ).rejects.toThrow();
+      ).rejects.toThrow(NotAuthorizedException);
+    });
 
+    it("refuses the current-user grant without a user session", async () => {
+      const props: DatabaseCommonInteractionProps = {
+        ...propsFor([Permission.CurrentUser]),
+        userId: undefined,
+      };
       await expect(
         ModelPermission.checkReadQueryPermission(
-          ProjectOnCallCalendarFeed,
-          { projectId: projectId },
-          { _id: true, tokenHash: true },
-          propsFor([Permission.ProjectOwner, Permission.ProjectAdmin]),
+          UserOnCallCalendarFeed,
+          { projectId },
+          personalStatusSelect,
+          props,
         ),
-      ).rejects.toThrow();
+      ).rejects.toThrow(NotAuthenticatedException);
     });
+
+    it("does not allow the owner to change the server-managed expiry", async () => {
+      const props: DatabaseCommonInteractionProps = propsFor([
+        Permission.CurrentUser,
+        Permission.ProjectOwner,
+      ]);
+      await expect(
+        ModelPermission.checkUpdateQueryPermissions(
+          UserOnCallCalendarFeed,
+          { _id: feedId.toString(), projectId, userId },
+          { isEnabled: true },
+          props,
+        ),
+      ).resolves.toBeDefined();
+      await expect(
+        ModelPermission.checkUpdateQueryPermissions(
+          UserOnCallCalendarFeed,
+          { _id: feedId.toString(), projectId, userId },
+          { previousTokenExpiresAt: new Date("2026-10-01T00:00:00Z") },
+          props,
+        ),
+      ).rejects.toThrow(BadDataException);
+    });
+  });
+
+  describe("making status readable never exposes token secrets", () => {
+    for (const modelType of [
+      OnCallDutyPolicyScheduleCalendarFeed,
+      ProjectOnCallCalendarFeed,
+      UserOnCallCalendarFeed,
+    ]) {
+      for (const secretColumn of [
+        "token",
+        "tokenHash",
+        "previousTokenHash",
+      ] as const) {
+        it(`${modelType.name}.${secretColumn} stays unreadable to owners and admins`, async () => {
+          await expect(
+            ModelPermission.checkReadQueryPermission(
+              modelType,
+              { projectId },
+              { _id: true, [secretColumn]: true },
+              propsFor([
+                Permission.CurrentUser,
+                Permission.ProjectOwner,
+                Permission.ProjectAdmin,
+              ]),
+            ),
+          ).rejects.toThrow(
+            `You do not have permissions to select on - ${secretColumn}.`,
+          );
+        });
+      }
+    }
   });
 });