@oneuptime/common 13.0.7 → 13.0.8

package/Tests/Server/Utils/CaptchaRequestAndLogging.test.ts

@@ -0,0 +1,395 @@
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * Complements Captcha.test.ts (which covers the enable/disable and fail-closed
+ * decisions). This suite pins down the details of the outbound siteverify
+ * request - timeout, content type, form encoding - and what gets logged on
+ * each failure path, including real axios errors such as timeouts.
+ *
+ * Captcha reads CaptchaEnabled / CaptchaSecretKey at module load, so each
+ * configuration is loaded into an isolated registry. axios and the logger are
+ * replaced with recording fakes; nothing here touches the network.
+ */
+
+interface CaptchaUtilLike {
+  isCaptchaEnabled: () => boolean;
+  verifyCaptcha: (options: {
+    token: string | null | undefined;
+    remoteIp?: string | null;
+  }) => Promise<void>;
+}
+
+interface RequestConfig {
+  headers?: { [key: string]: string };
+  timeout?: number;
+}
+
+interface PostCall {
+  url: string;
+  body: string;
+  config: RequestConfig;
+}
+
+interface FakeAxiosError extends Error {
+  isAxiosError: boolean;
+  code?: string;
+}
+
+interface Loaded {
+  captcha: CaptchaUtilLike;
+  posts: Array<PostCall>;
+  errorLogs: Array<string>;
+  warnLogs: Array<string>;
+  respondWith: (response: unknown) => void;
+  rejectWith: (error: unknown) => void;
+}
+
+const GENERIC_ERROR_MESSAGE: string =
+  "Captcha verification failed. Please try again.";
+
+const makeAxiosError: (message: string, code?: string) => FakeAxiosError = (
+  message: string,
+  code?: string,
+): FakeAxiosError => {
+  const error: FakeAxiosError = new Error(message) as FakeAxiosError;
+  error.isAxiosError = true;
+  if (code) {
+    error.code = code;
+  }
+  return error;
+};
+
+const loadCaptcha: (config: {
+  enabled: boolean;
+  secret: string;
+}) => Loaded = (config: { enabled: boolean; secret: string }): Loaded => {
+  const posts: Array<PostCall> = [];
+  const errorLogs: Array<string> = [];
+  const warnLogs: Array<string> = [];
+  let response: unknown = { data: { success: true } };
+  let rejection: unknown = null;
+  let captcha: CaptchaUtilLike | null = null;
+
+  jest.isolateModules((): void => {
+    jest.doMock("../../../Server/EnvironmentConfig", (): unknown => {
+      return {
+        ...(jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+          string,
+          unknown
+        >),
+        CaptchaEnabled: config.enabled,
+        CaptchaSecretKey: config.secret,
+      };
+    });
+
+    jest.doMock("../../../Server/Utils/Logger", (): unknown => {
+      const logger: unknown = {
+        error: (message: unknown): void => {
+          errorLogs.push(String(message));
+        },
+        warn: (message: unknown): void => {
+          warnLogs.push(String(message));
+        },
+        info: (): void => {},
+        debug: (): void => {},
+      };
+      return { __esModule: true, default: logger };
+    });
+
+    jest.doMock("axios", (): unknown => {
+      const post: unknown = (
+        url: string,
+        body: string,
+        requestConfig: RequestConfig,
+      ): Promise<unknown> => {
+        posts.push({ url, body, config: requestConfig });
+
+        if (rejection) {
+          return Promise.reject(rejection);
+        }
+
+        return Promise.resolve(response);
+      };
+
+      const isAxiosError: unknown = (err: unknown): boolean => {
+        return Boolean(
+          err && (err as { isAxiosError?: boolean }).isAxiosError === true,
+        );
+      };
+
+      return {
+        __esModule: true,
+        default: { post, isAxiosError },
+        post,
+        isAxiosError,
+      };
+    });
+
+    captcha = (
+      jest.requireActual("../../../Server/Utils/Captcha") as {
+        default: CaptchaUtilLike;
+      }
+    ).default;
+  });
+
+  return {
+    captcha: captcha as unknown as CaptchaUtilLike,
+    posts,
+    errorLogs,
+    warnLogs,
+    respondWith: (next: unknown): void => {
+      response = next;
+    },
+    rejectWith: (next: unknown): void => {
+      rejection = next;
+    },
+  };
+};
+
+const captureRejection: (work: Promise<void>) => Promise<Error> = async (
+  work: Promise<void>,
+): Promise<Error> => {
+  try {
+    await work;
+  } catch (err) {
+    expect(err).toBeInstanceOf(Error);
+    // Class identity differs across isolated registries; compare by name.
+    expect((err as Error).constructor.name).toBe("BadDataException");
+    return err as Error;
+  }
+
+  throw new Error("Expected verifyCaptcha to reject, but it resolved");
+};
+
+describe("CaptchaUtil outbound request", () => {
+  beforeEach((): void => {
+    jest.resetModules();
+  });
+
+  it("posts form-encoded data to hCaptcha with a 5 second timeout", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s3cret" });
+
+    await loaded.captcha.verifyCaptcha({ token: "tok" });
+
+    expect(loaded.posts).toHaveLength(1);
+    const call: PostCall = loaded.posts[0] as PostCall;
+    expect(call.url).toBe("https://hcaptcha.com/siteverify");
+    expect(call.config.timeout).toBe(5000);
+    expect(call.config.headers).toEqual({
+      "content-type": "application/x-www-form-urlencoded",
+    });
+    expect(typeof call.body).toBe("string");
+  });
+
+  it("form-encodes tokens and IPs containing reserved characters", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "a&b=c" });
+    const token: string = "P1_abc+/=&x y";
+
+    await loaded.captcha.verifyCaptcha({
+      token,
+      remoteIp: "2001:db8::1",
+    });
+
+    const params: URLSearchParams = new URLSearchParams(
+      (loaded.posts[0] as PostCall).body,
+    );
+    expect(params.get("secret")).toBe("a&b=c");
+    expect(params.get("response")).toBe(token);
+    expect(params.get("remoteip")).toBe("2001:db8::1");
+    expect(Array.from(params.keys())).toEqual([
+      "secret",
+      "response",
+      "remoteip",
+    ]);
+  });
+
+  it("omits remoteip when it is null", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+
+    await loaded.captcha.verifyCaptcha({ token: "tok", remoteIp: null });
+
+    const params: URLSearchParams = new URLSearchParams(
+      (loaded.posts[0] as PostCall).body,
+    );
+    expect(params.has("remoteip")).toBe(false);
+  });
+
+  it("makes exactly one request per verification (no retries)", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.rejectWith(
+      makeAxiosError("timeout of 5000ms exceeded", "ECONNABORTED"),
+    );
+
+    await captureRejection(loaded.captcha.verifyCaptcha({ token: "tok" }));
+
+    expect(loaded.posts).toHaveLength(1);
+  });
+});
+
+describe("CaptchaUtil token validation", () => {
+  beforeEach((): void => {
+    jest.resetModules();
+  });
+
+  it.each([
+    ["null", null],
+    ["undefined", undefined],
+    ["empty", ""],
+    ["whitespace", " \t\n "],
+  ])(
+    "rejects a %s token with the 'missing' message without calling the provider",
+    async (_label: string, token: string | null | undefined) => {
+      const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+
+      const error: Error = await captureRejection(
+        loaded.captcha.verifyCaptcha({ token }),
+      );
+
+      expect(error.message).toBe(
+        "Captcha token is missing. Please complete the verification challenge.",
+      );
+      expect(loaded.posts).toHaveLength(0);
+    },
+  );
+
+  it("ignores a missing token entirely when captcha is disabled", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: false, secret: "" });
+
+    await expect(
+      loaded.captcha.verifyCaptcha({ token: null }),
+    ).resolves.toBeUndefined();
+    expect(loaded.posts).toHaveLength(0);
+    expect(loaded.errorLogs).toHaveLength(0);
+  });
+
+  it("is disabled even with a secret when the flag is off, and skips verification", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: false, secret: "s" });
+
+    expect(loaded.captcha.isCaptchaEnabled()).toBe(false);
+    await loaded.captcha.verifyCaptcha({ token: "anything" });
+    expect(loaded.posts).toHaveLength(0);
+  });
+});
+
+describe("CaptchaUtil failure handling and logging", () => {
+  beforeEach((): void => {
+    jest.resetModules();
+  });
+
+  it("logs a configuration error when enabled without a secret", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "" });
+
+    const error: Error = await captureRejection(
+      loaded.captcha.verifyCaptcha({ token: "tok" }),
+    );
+
+    expect(error.message).toBe(GENERIC_ERROR_MESSAGE);
+    expect(loaded.errorLogs).toEqual([
+      "Captcha is enabled but CAPTCHA_SECRET_KEY is not configured.",
+    ]);
+  });
+
+  it("checks the secret before the token, so a blank token still reports misconfiguration", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "" });
+
+    const error: Error = await captureRejection(
+      loaded.captcha.verifyCaptcha({ token: "" }),
+    );
+
+    expect(error.message).toBe(GENERIC_ERROR_MESSAGE);
+    expect(loaded.errorLogs).toHaveLength(1);
+  });
+
+  it("fails closed on an axios timeout and logs the axios message", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.rejectWith(
+      makeAxiosError("timeout of 5000ms exceeded", "ECONNABORTED"),
+    );
+
+    const error: Error = await captureRejection(
+      loaded.captcha.verifyCaptcha({ token: "tok" }),
+    );
+
+    expect(error.message).toBe(GENERIC_ERROR_MESSAGE);
+    expect(loaded.errorLogs).toEqual([
+      "Captcha provider verification failure: timeout of 5000ms exceeded",
+    ]);
+  });
+
+  it("fails closed on an HTTP error status from the provider", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.rejectWith(makeAxiosError("Request failed with status code 500"));
+
+    const error: Error = await captureRejection(
+      loaded.captcha.verifyCaptcha({ token: "tok" }),
+    );
+
+    expect(error.message).toBe(GENERIC_ERROR_MESSAGE);
+    expect(loaded.errorLogs[0]).toContain("status code 500");
+  });
+
+  it("fails closed on a non-axios error and logs its message", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.rejectWith(new TypeError("unexpected"));
+
+    const error: Error = await captureRejection(
+      loaded.captcha.verifyCaptcha({ token: "tok" }),
+    );
+
+    expect(error.message).toBe(GENERIC_ERROR_MESSAGE);
+    expect(loaded.errorLogs).toEqual([
+      "Captcha provider verification failure: unexpected",
+    ]);
+  });
+
+  it("warns with the provider payload when success is false, then logs the failure", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.respondWith({
+      data: { success: false, "error-codes": ["invalid-input-response"] },
+    });
+
+    const error: Error = await captureRejection(
+      loaded.captcha.verifyCaptcha({ token: "tok" }),
+    );
+
+    expect(error.message).toBe(GENERIC_ERROR_MESSAGE);
+    expect(loaded.warnLogs).toEqual([
+      'hCaptcha verification failed: {"success":false,"error-codes":["invalid-input-response"]}',
+    ]);
+    expect(loaded.errorLogs).toEqual([
+      `Captcha provider verification failure: ${GENERIC_ERROR_MESSAGE}`,
+    ]);
+  });
+
+  it("warns with an empty payload when the provider returns no body", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.respondWith({ data: null });
+
+    await captureRejection(loaded.captcha.verifyCaptcha({ token: "tok" }));
+
+    expect(loaded.warnLogs).toEqual(["hCaptcha verification failed: {}"]);
+  });
+
+  it("never logs the secret key", async () => {
+    const secret: string = "very-private-secret";
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret });
+    loaded.respondWith({ data: { success: false } });
+
+    await captureRejection(loaded.captcha.verifyCaptcha({ token: "tok" }));
+
+    for (const line of [...loaded.errorLogs, ...loaded.warnLogs]) {
+      expect(line).not.toContain(secret);
+    }
+  });
+
+  it("does not log anything on success", async () => {
+    const loaded: Loaded = loadCaptcha({ enabled: true, secret: "s" });
+    loaded.respondWith({ data: { success: true, hostname: "example.com" } });
+
+    await expect(
+      loaded.captcha.verifyCaptcha({ token: "tok" }),
+    ).resolves.toBeUndefined();
+    expect(loaded.errorLogs).toHaveLength(0);
+    expect(loaded.warnLogs).toHaveLength(0);
+  });
+});

package/Tests/Server/Utils/MasterAdminPageAccess.test.ts

@@ -0,0 +1,251 @@
+import UserMiddleware from "../../../Server/Middleware/UserAuthorization";
+import { ExpressRequest, ExpressResponse } from "../../../Server/Utils/Express";
+import JSONWebToken from "../../../Server/Utils/JsonWebToken";
+import logger from "../../../Server/Utils/Logger";
+import {
+  ensureMasterAdminPageAccess,
+  NOT_A_MASTER_ADMIN_MESSAGE,
+} from "../../../Server/Utils/MasterAdminPageAccess";
+import Response from "../../../Server/Utils/Response";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Exception from "../../../Types/Exception/Exception";
+import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import { JSONObject } from "../../../Types/JSON";
+import JSONWebTokenData from "../../../Types/JsonWebTokenData";
+import ObjectID from "../../../Types/ObjectID";
+import { getJestSpyOn } from "../../Spy";
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+
+// The decode-failure branch logs at debug; keep the run quiet and observable.
+jest.mock("../../../Server/Utils/Logger");
+
+/*
+ * ensureMasterAdminPageAccess gates the Admin Dashboard's HTML shell (not its
+ * APIs), and replaced two copies of the same inline gate in
+ * App/FeatureSet/Frontend/Index.ts and App/FeatureSet/AdminDashboard/Serve.ts.
+ *
+ * The case it exists for: the access-token cookie expires together with the
+ * JWT inside it. An admin who reloads a tab left open past the token lifetime
+ * arrives with NO token at all. The old gates answered that with a 422 JSON
+ * error page, so the SPA never loaded and never got the chance to refresh the
+ * session - the admin was stuck until they found the login page by hand. Now
+ * a missing or undecodable token is served the shell (it holds nothing the
+ * public static bundle does not), and the SPA's refresh-aware API client
+ * recovers the session or sends a signed-out visitor to the login page.
+ *
+ * The one refusal that did NOT move: a session that decodes and is positively
+ * not a master admin still gets the error. Refreshing would hand back the
+ * same non-admin session.
+ */
+
+const SERVICE: string = "admin-dashboard-test";
+
+describe("ensureMasterAdminPageAccess", () => {
+  let request: ExpressRequest;
+  let response: ExpressResponse;
+  let getAccessTokenSpy: jest.SpyInstance<any, any>;
+  let decodeSpy: jest.SpyInstance<any, any>;
+  let sendErrorSpy: jest.SpyInstance<any, any>;
+
+  type RunFunction = () => Promise<JSONObject>;
+
+  const run: RunFunction = async (): Promise<JSONObject> => {
+    return await ensureMasterAdminPageAccess({
+      req: request,
+      res: response,
+      service: SERVICE,
+    });
+  };
+
+  type DecodedTokenFunction = (isMasterAdmin: unknown) => JSONWebTokenData;
+
+  const decodedToken: DecodedTokenFunction = (
+    isMasterAdmin: unknown,
+  ): JSONWebTokenData => {
+    return {
+      userId: ObjectID.generate(),
+      isMasterAdmin: isMasterAdmin,
+      isGlobalLogin: true,
+    } as unknown as JSONWebTokenData;
+  };
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    jest.clearAllMocks();
+
+    request = { headers: {}, cookies: {} } as unknown as ExpressRequest;
+
+    response = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+      send: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    getAccessTokenSpy = getJestSpyOn(
+      UserMiddleware,
+      "getAccessTokenFromExpressRequest",
+    ).mockReturnValue(undefined);
+
+    /*
+     * Each test that needs a decodable token says what it decodes to. The
+     * default is the real failure: JSONWebToken.decode wraps every jwt.verify
+     * error (expired, bad signature, malformed) in this BadDataException.
+     */
+    decodeSpy = getJestSpyOn(JSONWebToken, "decode").mockImplementation(() => {
+      throw new BadDataException("AccessToken is invalid or expired");
+    });
+
+    sendErrorSpy = getJestSpyOn(
+      Response,
+      "sendErrorResponse",
+    ).mockImplementation(() => {
+      return undefined as never;
+    });
+  });
+
+  describe("with no access token (the expired-cookie reload)", () => {
+    test("resolves to an empty object and sends no error, so the SPA loads", async () => {
+      await expect(run()).resolves.toEqual({});
+
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+      expect(response.status).not.toHaveBeenCalled();
+      expect(response.send).not.toHaveBeenCalled();
+      expect(response.json).not.toHaveBeenCalled();
+    });
+
+    test("reads the token from the request it was given", async () => {
+      await run();
+
+      expect(getAccessTokenSpy).toHaveBeenCalledTimes(1);
+      expect(getAccessTokenSpy).toHaveBeenCalledWith(request);
+    });
+
+    test("never tries to decode a token it does not have", async () => {
+      await run();
+
+      expect(decodeSpy).not.toHaveBeenCalled();
+    });
+
+    test("treats an empty-string token as no token", async () => {
+      getAccessTokenSpy.mockReturnValue("");
+
+      await expect(run()).resolves.toEqual({});
+
+      expect(decodeSpy).not.toHaveBeenCalled();
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("with a token that does not decode", () => {
+    beforeEach(() => {
+      getAccessTokenSpy.mockReturnValue("expired.jwt.token");
+    });
+
+    test("resolves to an empty object and sends no error", async () => {
+      await expect(run()).resolves.toEqual({});
+
+      expect(decodeSpy).toHaveBeenCalledTimes(1);
+      expect(decodeSpy).toHaveBeenCalledWith("expired.jwt.token");
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+      expect(response.status).not.toHaveBeenCalled();
+    });
+
+    // Whatever decode throws, the shell is served and nothing escapes.
+    test.each([
+      [
+        "the BadDataException JSONWebToken.decode raises",
+        (): Error => {
+          return new BadDataException("AccessToken is invalid or expired");
+        },
+      ],
+      [
+        "a plain Error",
+        (): Error => {
+          return new Error("jwt expired");
+        },
+      ],
+      [
+        "a NotAuthorizedException",
+        (): Error => {
+          return new NotAuthorizedException("should not surface");
+        },
+      ],
+    ])(
+      "does not reject or send an error when decode throws %s",
+      async (_label: string, makeError: () => Error) => {
+        decodeSpy.mockImplementation(() => {
+          throw makeError();
+        });
+
+        await expect(run()).resolves.toEqual({});
+
+        expect(sendErrorSpy).not.toHaveBeenCalled();
+      },
+    );
+
+    test("logs the decode failure at debug, tagged with the service", async () => {
+      const thrown: Error = new Error("jwt expired");
+
+      decodeSpy.mockImplementation(() => {
+        throw thrown;
+      });
+
+      await run();
+
+      expect(logger.debug).toHaveBeenCalledWith(thrown, { service: SERVICE });
+    });
+  });
+
+  describe("with a token that decodes", () => {
+    beforeEach(() => {
+      getAccessTokenSpy.mockReturnValue("valid.jwt.token");
+    });
+
+    test("refuses a session that is not a master admin with a 422", async () => {
+      decodeSpy.mockReturnValue(decodedToken(false) as never);
+
+      await expect(run()).resolves.toEqual({});
+
+      expect(sendErrorSpy).toHaveBeenCalledTimes(1);
+
+      const [sentRequest, sentResponse, sentError] = sendErrorSpy.mock
+        .calls[0] as [ExpressRequest, ExpressResponse, Exception];
+
+      expect(sentRequest).toBe(request);
+      expect(sentResponse).toBe(response);
+      expect(sentError).toBeInstanceOf(NotAuthorizedException);
+      expect(sentError).not.toBeInstanceOf(NotAuthenticatedException);
+      expect(sentError.code).toBe(422);
+      expect(sentError.message).toBe(NOT_A_MASTER_ADMIN_MESSAGE);
+    });
+
+    test("refuses a token with no isMasterAdmin claim at all", async () => {
+      decodeSpy.mockReturnValue(decodedToken(undefined) as never);
+
+      await run();
+
+      expect(sendErrorSpy).toHaveBeenCalledTimes(1);
+      expect(
+        (sendErrorSpy.mock.calls[0] as Array<unknown>)[2] as Exception,
+      ).toBeInstanceOf(NotAuthorizedException);
+    });
+
+    test("lets a master admin through without sending anything", async () => {
+      decodeSpy.mockReturnValue(decodedToken(true) as never);
+
+      await expect(run()).resolves.toEqual({});
+
+      expect(decodeSpy).toHaveBeenCalledWith("valid.jwt.token");
+      expect(sendErrorSpy).not.toHaveBeenCalled();
+      expect(response.status).not.toHaveBeenCalled();
+      expect(response.send).not.toHaveBeenCalled();
+    });
+  });
+
+  test("the refusal message names the admin dashboard", () => {
+    expect(NOT_A_MASTER_ADMIN_MESSAGE).toBe(
+      "Unauthorized: Only master admins can access the admin dashboard.",
+    );
+  });
+});