@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/Services/SsoRequirementReadMasking.test.ts

@@ -0,0 +1,419 @@
+import ProjectService from "../../../Server/Services/ProjectService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import ModelPermission from "../../../Server/Types/Database/Permissions/Index";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../Types/ObjectID";
+import { UserGlobalAccessPermission } from "../../../Types/Permission";
+import Project from "../../../Models/DatabaseModels/Project";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import FakeEnterpriseModule, {
+  createEditionStateCases,
+  createLicenseSnapshotWithStatus,
+  EditionStateCase,
+  installFakeEnterpriseModule,
+  uninstallEnterpriseModule,
+} from "../Enterprise/FakeEnterpriseModule";
+import logger from "../../../Server/Utils/Logger";
+import { setTestBillingEnabled } from "../Enterprise/TestBillingFlag";
+import { getJestSpyOn } from "../../Spy";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+jest.mock("../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../Enterprise/TestBillingFlag",
+    ) as typeof import("../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+/*
+ * While SSO is not active - the Community Edition, where the SSO login routes
+ * do not exist, or an Enterprise install whose license lapsed, where they
+ * refuse - SSO requirements are not enforced. Clients decide from the stored
+ * columns whether to start an SSO flow - the mobile app hides a project's
+ * on-call pages and schedules behind an SSO login when Project.requireSsoForLogin
+ * is true, and app-store builds cannot be patched - so reads made for a caller
+ * report the EFFECTIVE value instead (EditionEnforcement.shouldMaskSsoRequirementOnRead):
+ *
+ *   Project.requireSsoForLogin          -> false
+ *   Project.requireSsoWithSsoProviderId -> null
+ *   StatusPage.requireSsoForLogin       -> false
+ *
+ * and nothing else changes:
+ *   - internal reads (root, and the ignoreHooks lookups the write path uses)
+ *     see the stored value,
+ *   - while SSO is active (the Enterprise Edition with billing on, or a
+ *     license that covers SSO, or an unknown license state) nothing is masked,
+ *   - the stored row is never written, so moving back to the Enterprise
+ *     Edition, or renewing the license, restores enforcement exactly as
+ *     configured, without a restart.
+ *
+ * These tests run the real DatabaseService read path; only the repository and
+ * the read-permission check (not under test) are stubbed.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const STATUS_PAGE_ID: ObjectID = new ObjectID(
+  "77777777-7777-4777-8777-777777777777",
+);
+const PROVIDER_ID: ObjectID = new ObjectID(
+  "88888888-8888-4888-8888-888888888888",
+);
+const USER_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+// Every Enterprise state (CE is covered by its own tests below).
+const ENTERPRISE_STATES: Array<EditionStateCase> =
+  createEditionStateCases().filter((state: EditionStateCase): boolean => {
+    return state.isLoaded;
+  });
+
+// What the database holds. Each read builds fresh entities from it.
+type StoredProjectRow = {
+  name: string;
+  requireSsoForLogin: boolean;
+  requireSsoWithSsoProviderId: ObjectID | null;
+};
+
+type StoredStatusPageRow = {
+  name: string;
+  requireSsoForLogin: boolean;
+};
+
+let storedProject: StoredProjectRow;
+let storedStatusPage: StoredStatusPageRow;
+let projectRepositoryWrites: Array<string>;
+
+const userProps: () => DatabaseCommonInteractionProps =
+  (): DatabaseCommonInteractionProps => {
+    return {
+      userId: USER_ID,
+      tenantId: PROJECT_ID,
+      userGlobalAccessPermission: {
+        projectIds: [PROJECT_ID],
+      } as unknown as UserGlobalAccessPermission,
+    };
+  };
+
+const masterAdminProps: () => DatabaseCommonInteractionProps =
+  (): DatabaseCommonInteractionProps => {
+    return { userId: USER_ID, isMasterAdmin: true };
+  };
+
+const readProject: (
+  props: DatabaseCommonInteractionProps,
+) => Promise<Project> = async (
+  props: DatabaseCommonInteractionProps,
+): Promise<Project> => {
+  const projects: Array<Project> = await ProjectService.findBy({
+    query: { _id: PROJECT_ID.toString() },
+    select: {
+      _id: true,
+      name: true,
+      requireSsoForLogin: true,
+      requireSsoWithSsoProviderId: true,
+    },
+    limit: 10,
+    skip: 0,
+    props,
+  });
+
+  expect(projects).toHaveLength(1);
+
+  return projects[0]!;
+};
+
+const readStatusPage: (
+  props: DatabaseCommonInteractionProps,
+) => Promise<StatusPage> = async (
+  props: DatabaseCommonInteractionProps,
+): Promise<StatusPage> => {
+  const statusPages: Array<StatusPage> = await StatusPageService.findBy({
+    query: { _id: STATUS_PAGE_ID.toString() },
+    select: { _id: true, name: true, requireSsoForLogin: true },
+    limit: 10,
+    skip: 0,
+    props,
+  });
+
+  expect(statusPages).toHaveLength(1);
+
+  return statusPages[0]!;
+};
+
+const expectProjectMasked: (project: Project) => void = (
+  project: Project,
+): void => {
+  expect(project.requireSsoForLogin).toBe(false);
+  expect(project.requireSsoWithSsoProviderId).toBeNull();
+  // Everything else is untouched.
+  expect(project.name).toBe("Acme");
+  expect(project.id?.toString()).toBe(PROJECT_ID.toString());
+};
+
+const expectProjectRaw: (project: Project) => void = (
+  project: Project,
+): void => {
+  expect(project.requireSsoForLogin).toBe(true);
+  expect(project.requireSsoWithSsoProviderId?.toString()).toBe(
+    PROVIDER_ID.toString(),
+  );
+  expect(project.name).toBe("Acme");
+};
+
+describe("SSO requirement columns are read as their effective value on the Community Edition", () => {
+  beforeEach(() => {
+    setTestBillingEnabled(false);
+    uninstallEnterpriseModule();
+
+    storedProject = {
+      name: "Acme",
+      requireSsoForLogin: true,
+      requireSsoWithSsoProviderId: PROVIDER_ID,
+    };
+    storedStatusPage = { name: "Customer Status", requireSsoForLogin: true };
+    projectRepositoryWrites = [];
+
+    // The read-permission check is not under test; let the query through.
+    getJestSpyOn(
+      ModelPermission,
+      "checkReadQueryPermission",
+    ).mockImplementation(
+      async (
+        _modelType: unknown,
+        query: unknown,
+        select: unknown,
+      ): Promise<unknown> => {
+        return { query, select, relationSelect: null };
+      },
+    );
+
+    const writeTrap: (name: string) => () => never = (
+      name: string,
+    ): (() => never) => {
+      return (): never => {
+        projectRepositoryWrites.push(name);
+        throw new Error(`a read must not write (${name})`);
+      };
+    };
+
+    getJestSpyOn(ProjectService, "getRepository").mockReturnValue({
+      find: async (): Promise<Array<Project>> => {
+        const project: Project = new Project();
+        project._id = PROJECT_ID.toString();
+        project.name = storedProject.name;
+        project.requireSsoForLogin = storedProject.requireSsoForLogin;
+
+        if (storedProject.requireSsoWithSsoProviderId) {
+          project.requireSsoWithSsoProviderId =
+            storedProject.requireSsoWithSsoProviderId;
+        }
+
+        return [project];
+      },
+      update: writeTrap("update"),
+      save: writeTrap("save"),
+      insert: writeTrap("insert"),
+      delete: writeTrap("delete"),
+    });
+
+    getJestSpyOn(StatusPageService, "getRepository").mockReturnValue({
+      find: async (): Promise<Array<StatusPage>> => {
+        const statusPage: StatusPage = new StatusPage();
+        statusPage._id = STATUS_PAGE_ID.toString();
+        statusPage.name = storedStatusPage.name;
+        statusPage.requireSsoForLogin = storedStatusPage.requireSsoForLogin;
+        return [statusPage];
+      },
+      update: writeTrap("update"),
+      save: writeTrap("save"),
+    });
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+  });
+
+  describe("Project", () => {
+    for (const billing of [false, true]) {
+      test(`Community Edition (billing=${billing}): a user's read is masked`, async () => {
+        setTestBillingEnabled(billing);
+
+        expectProjectMasked(await readProject(userProps()));
+      });
+
+      test(`Community Edition (billing=${billing}): a master admin's read is masked`, async () => {
+        setTestBillingEnabled(billing);
+
+        expectProjectMasked(await readProject(masterAdminProps()));
+      });
+    }
+
+    for (const state of ENTERPRISE_STATES) {
+      test(`${state.label}: reads are ${state.isActive ? "not masked (SSO active)" : "masked (license lapsed, SSO stopped)"}`, async () => {
+        state.apply();
+
+        if (state.isActive) {
+          expectProjectRaw(await readProject(userProps()));
+          expectProjectRaw(await readProject(masterAdminProps()));
+        } else {
+          expectProjectMasked(await readProject(userProps()));
+          expectProjectMasked(await readProject(masterAdminProps()));
+          expectProjectRaw(await readProject({ isRoot: true }));
+        }
+      });
+    }
+
+    test("a lapse masks reads and a renewal unmasks them, with the stored row untouched", async () => {
+      getJestSpyOn(logger, "warn").mockImplementation((): void => {
+        return undefined;
+      });
+      getJestSpyOn(logger, "info").mockImplementation((): void => {
+        return undefined;
+      });
+
+      const fake: FakeEnterpriseModule = installFakeEnterpriseModule({
+        snapshot: createLicenseSnapshotWithStatus("valid"),
+      });
+
+      expectProjectRaw(await readProject(userProps()));
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("expired"));
+      expectProjectMasked(await readProject(userProps()));
+
+      fake.setSnapshot(createLicenseSnapshotWithStatus("valid"));
+      expectProjectRaw(await readProject(userProps()));
+
+      expect(projectRepositoryWrites).toEqual([]);
+      expect(storedProject.requireSsoForLogin).toBe(true);
+    });
+
+    test("internal root reads see the stored value on the Community Edition", async () => {
+      expectProjectRaw(await readProject({ isRoot: true }));
+    });
+
+    test("the write path's internal lookups (root + ignoreHooks) see the stored value", async () => {
+      expectProjectRaw(await readProject({ isRoot: true, ignoreHooks: true }));
+    });
+
+    test("a masked read leaves the stored row alone, and the Enterprise Edition sees it again", async () => {
+      expectProjectMasked(await readProject(userProps()));
+
+      expect(projectRepositoryWrites).toEqual([]);
+      expect(storedProject.requireSsoForLogin).toBe(true);
+      expect(storedProject.requireSsoWithSsoProviderId).toBe(PROVIDER_ID);
+
+      installFakeEnterpriseModule();
+
+      expectProjectRaw(await readProject(userProps()));
+    });
+
+    test("a project that does not require SSO reads the same on both editions", async () => {
+      storedProject.requireSsoForLogin = false;
+      storedProject.requireSsoWithSsoProviderId = null;
+
+      const onCommunity: Project = await readProject(userProps());
+
+      installFakeEnterpriseModule();
+
+      const onEnterprise: Project = await readProject(userProps());
+
+      expect(onCommunity.requireSsoForLogin).toBe(false);
+      expect(onEnterprise.requireSsoForLogin).toBe(false);
+    });
+  });
+
+  describe("StatusPage", () => {
+    for (const billing of [false, true]) {
+      test(`Community Edition (billing=${billing}): a caller's read is masked`, async () => {
+        setTestBillingEnabled(billing);
+
+        const statusPage: StatusPage = await readStatusPage(userProps());
+
+        expect(statusPage.requireSsoForLogin).toBe(false);
+        expect(statusPage.name).toBe("Customer Status");
+      });
+    }
+
+    for (const state of ENTERPRISE_STATES) {
+      test(`${state.label}: a caller's read is ${state.isActive ? "not masked" : "masked"}`, async () => {
+        state.apply();
+
+        expect((await readStatusPage(userProps())).requireSsoForLogin).toBe(
+          state.isActive,
+        );
+      });
+    }
+
+    test("internal root reads see the stored value on the Community Edition", async () => {
+      expect((await readStatusPage({ isRoot: true })).requireSsoForLogin).toBe(
+        true,
+      );
+    });
+
+    test("a masked read leaves the stored row alone", async () => {
+      await readStatusPage(userProps());
+
+      expect(storedStatusPage.requireSsoForLogin).toBe(true);
+
+      installFakeEnterpriseModule();
+
+      expect((await readStatusPage(userProps())).requireSsoForLogin).toBe(true);
+    });
+  });
+
+  describe("the hooks themselves", () => {
+    test("ProjectService.onFindSuccess only rewrites values that are present", async () => {
+      const selected: Project = new Project();
+      selected.requireSsoForLogin = true;
+      selected.requireSsoWithSsoProviderId = PROVIDER_ID;
+
+      const unselected: Project = new Project();
+      unselected.name = "Other";
+
+      const result: { carryForward: Array<Project> } = await (
+        ProjectService as any
+      ).onFindSuccess(
+        { findBy: { query: {}, props: userProps() }, carryForward: null },
+        [selected, unselected],
+      );
+
+      expect(result.carryForward).toEqual([selected, unselected]);
+      expect(selected.requireSsoForLogin).toBe(false);
+      expect(selected.requireSsoWithSsoProviderId).toBeNull();
+      expect(unselected.requireSsoForLogin).toBeUndefined();
+      expect(unselected.requireSsoWithSsoProviderId).toBeUndefined();
+    });
+
+    test("StatusPageService.onFindSuccess only rewrites values that are present", async () => {
+      const selected: StatusPage = new StatusPage();
+      selected.requireSsoForLogin = true;
+
+      const unselected: StatusPage = new StatusPage();
+
+      await (StatusPageService as any).onFindSuccess(
+        { findBy: { query: {}, props: userProps() }, carryForward: null },
+        [selected, unselected],
+      );
+
+      expect(selected.requireSsoForLogin).toBe(false);
+      expect(unselected.requireSsoForLogin).toBeUndefined();
+    });
+  });
+});