@oneuptime/common 13.0.7 → 14.0.0

package/Server/Middleware/UserAuthorization.ts

@@ -41,6 +41,7 @@ import Permission, {
 } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
 import UserPermissionUtil from "../Utils/UserPermission/UserPermission";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export default class UserMiddleware {
   /*
@@ -495,6 +496,49 @@ export default class UserMiddleware {
     req: ExpressRequest,
     res: ExpressResponse,
     next: NextFunction,
+  ): Promise<void> {
+    return await UserMiddleware.resolveRequestUser(req, res, next, {
+      treatInvalidAccessTokenAsAnonymous: false,
+    });
+  }
+
+  /*
+   * getUserMiddleware for the anonymous surfaces: the public dashboard and
+   * public status page routes. Their handlers decide access themselves
+   * (DashboardService / StatusPageService.hasReadAccess: public flag, IP
+   * allowlist, master-password cookie, the page's own session cookie) and
+   * never read the caller's user identity.
+   *
+   * The one difference: an access token that is present but cannot be decoded
+   * makes the request anonymous (UserType.Public) instead of answering 401.
+   * The host-wide dashboard access-token cookie reaches these routes whenever
+   * the page is served from the dashboard's host (the preview routes), and it
+   * can stay in the browser after it stops decoding - an encryption-secret
+   * rotation, say. The public clients cannot refresh a dashboard session, so
+   * that 401 only ever meant "sent back to the login route": a reload loop on
+   * the preview route, and a password prompt for a master password the viewer
+   * already entered.
+   *
+   * A token that does decode is still resolved exactly as getUserMiddleware
+   * resolves it, and an API key is still validated. Never mount this on a
+   * route that needs to know who the caller is.
+   */
+  @CaptureSpan()
+  public static async getPublicRouteUserMiddleware(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> {
+    return await UserMiddleware.resolveRequestUser(req, res, next, {
+      treatInvalidAccessTokenAsAnonymous: true,
+    });
+  }
+
+  private static async resolveRequestUser(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+    options: { treatInvalidAccessTokenAsAnonymous: boolean },
   ): Promise<void> {
     const tenantId: ObjectID | null = ProjectMiddleware.getProjectId(req);
     const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
@@ -529,6 +573,12 @@ export default class UserMiddleware {
     try {
       oneuptimeRequest.userAuthorization = JSONWebToken.decode(accessToken);
     } catch (err) {
+      if (options.treatInvalidAccessTokenAsAnonymous) {
+        // decode() has already logged why the token was refused.
+        oneuptimeRequest.userType = UserType.Public;
+        return next();
+      }
+
       // if the token is invalid or expired, return 401 so clients can refresh the token.
       logger.error(err, getLogAttributesFromRequest(oneuptimeRequest));
       return Response.sendErrorResponse(
@@ -712,15 +762,12 @@ export default class UserMiddleware {
   ): Promise<void> {
     const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
 
-    if (
-      !oneuptimeRequest.userType ||
-      oneuptimeRequest.userType === UserType.Public
-    ) {
+    if (UserMiddleware.isAnonymousRequest(oneuptimeRequest)) {
       return Response.sendErrorResponse(
         req,
         res,
         new NotAuthenticatedException(
-          "Authentication required. Please log in to access this resource.",
+          UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
         ),
       );
     }
@@ -728,6 +775,19 @@ export default class UserMiddleware {
     return next();
   }
 
+  // Same wording as CommonAPI.AUTHENTICATION_REQUIRED_MESSAGE.
+  public static readonly AUTHENTICATION_REQUIRED_MESSAGE: string =
+    "Authentication required. Please log in to access this resource.";
+
+  /*
+   * The request-level twin of CommonAPI.isAnonymous: getUserMiddleware found
+   * no access token and no API key. Usually an expired session, since the
+   * access-token cookie expires with the JWT inside it.
+   */
+  public static isAnonymousRequest(req: OneUptimeRequest): boolean {
+    return !req.userType || req.userType === UserType.Public;
+  }
+
   public static requirePermission(data: {
     permissions: Array<Permission>;
   }): (
@@ -742,6 +802,21 @@ export default class UserMiddleware {
     ): Promise<void> => {
       const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
 
+      /*
+       * An anonymous caller has no permissions to compare, and telling it so
+       * with a 422 would stop the browser client from refreshing an expired
+       * session. Ask who it is first.
+       */
+      if (UserMiddleware.isAnonymousRequest(oneuptimeRequest)) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthenticatedException(
+            UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+          ),
+        );
+      }
+
       // Master admins bypass permission checks
       if (oneuptimeRequest.userType === UserType.MasterAdmin) {
         return next();
@@ -807,10 +882,21 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
+    /*
+     * SSO requirements are enforced while SSO is active: the Enterprise
+     * Edition is loaded and its license covers SSO (or billing is on). The
+     * Community Edition, which has no SSO login routes, and an Enterprise
+     * install whose license lapsed, where those routes refuse, relax them.
+     * Errors and an unknown license state answer "enforce".
+     */
+    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
+
     /*
      * Resolve the SSO requirement and the tenant permission in parallel.
      * `getRequireSsoForLogin` is cached in-process for 60s, so this is
-     * usually free; the tenant permission lookup is the expensive call.
+     * usually free; the tenant permission lookup is the expensive call. It
+     * runs on the Community Edition too: it is also what turns an unknown
+     * project into TenantNotFoundException.
      */
     const [projectRequireSsoForLogin, tenantPermission]: [
       boolean,
@@ -835,8 +921,9 @@ export default class UserMiddleware {
      * can't lock them out — a project's own requireSsoForLogin still applies to
      * them. Only checked when the project doesn't already enforce SSO.
      */
-    let requireSsoForLogin: boolean = projectRequireSsoForLogin;
-    if (!requireSsoForLogin && !isMasterAdmin) {
+    let requireSsoForLogin: boolean =
+      isSsoEnforced && projectRequireSsoForLogin;
+    if (isSsoEnforced && !requireSsoForLogin && !isMasterAdmin) {
       requireSsoForLogin =
         await GlobalConfigService.getRequireSsoForLogin().catch(() => {
           return false;
@@ -883,15 +970,23 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
+    /*
+     * Same rule as the single-tenant path: SSO requirements are enforced
+     * while SSO is active and relaxed on the Community Edition and while the
+     * license does not cover SSO. Decided once for the whole fan-out.
+     */
+    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
+
     /*
      * Instance-wide "Require SSO for Login" forces SSO on every project. Master
      * admins are exempt. Resolved once (cached) rather than per project.
      */
-    const globalRequireSsoForLogin: boolean = isMasterAdmin
-      ? false
-      : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
-          return false;
-        });
+    const globalRequireSsoForLogin: boolean =
+      isMasterAdmin || !isSsoEnforced
+        ? false
+        : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+            return false;
+          });
 
     /*
      * Resolve permissions for every project in parallel. A project's own
@@ -903,14 +998,15 @@ export default class UserMiddleware {
       permission: UserTenantAccessPermission | null;
     }> = await Promise.all(
       projectIds.map(async (projectId: ObjectID) => {
-        const projectRequireSsoForLogin: boolean =
-          await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
-            /*
-             * Unknown/inaccessible project: do not enforce SSO here. Actual
-             * access is still gated by AccessTokenService below.
-             */
-            return false;
-          });
+        const projectRequireSsoForLogin: boolean = !isSsoEnforced
+          ? false
+          : await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
+              /*
+               * Unknown/inaccessible project: do not enforce SSO here. Actual
+               * access is still gated by AccessTokenService below.
+               */
+              return false;
+            });
 
         const requireSsoForLogin: boolean =
           projectRequireSsoForLogin || globalRequireSsoForLogin;

package/Server/Services/ApiKeyPermissionService.ts

@@ -2,6 +2,7 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
+import ModelPermission from "../Types/Database/Permissions/Index";
 import UpdateBy from "../Types/Database/UpdateBy";
 import ApiKeyService from "./ApiKeyService";
 import DatabaseService from "./DatabaseService";
@@ -10,7 +11,7 @@ import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Exception from "../../Types/Exception/Exception";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
@@ -493,8 +494,27 @@ export class Service extends DatabaseService<Model> {
      */
     this.clearCache();
 
-    const existingPermissions: Array<Model> = await this.findBy({
+    updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+      Model,
+      updateBy.query,
+      updateBy.data,
+      updateBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: updateBy.query,
+      select: { _id: true },
+      skip: updateBy.skip,
+      limit: updateBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    // Reload by ID so a label filter cannot hide part of a saved block's scope.
+    const existingPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         labels: true,
@@ -503,8 +523,6 @@ export class Service extends DatabaseService<Model> {
         apiKeyId: true,
         permission: true,
       },
-      limit: LIMIT_PER_PROJECT,
-      skip: 0,
       props: {
         isRoot: true,
       },
@@ -565,6 +583,15 @@ export class Service extends DatabaseService<Model> {
       }
 
       await this.assertApiKeyBelongsToProject(apiKeyId, projectId);
+      // Changing a block's permission or labels can restore its old scope.
+      if (existingPermission.isBlockPermission) {
+        this.assertCallerCanGrantPermission({
+          permission: existingPermission.permission!,
+          labels: existingPermission.labels,
+          projectId,
+          props: updateBy.props,
+        });
+      }
       this.assertCallerCanGrantPermission({
         permission,
         labels: isLabelsUpdateRequested
@@ -647,6 +674,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    updateBy.query = { ...updateBy.query, _id: QueryHelper.any(selectedIds) };
+    updateBy.skip = 0;
     return { updateBy, carryForward: null };
   }
 
@@ -655,6 +684,74 @@ export class Service extends DatabaseService<Model> {
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
     this.clearCache();
+
+    if (!deleteBy.props.isRoot && !deleteBy.props.isMasterAdmin) {
+      // Hooks run before DatabaseService applies the delete ACL and tenant.
+      deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+        Model,
+        deleteBy.query,
+        deleteBy.props,
+      );
+      const selectedPermissions: Array<Model> = await this.findAllBy({
+        query: deleteBy.query,
+        select: { _id: true },
+        skip: deleteBy.skip,
+        limit: deleteBy.limit,
+        props: { isRoot: true },
+      });
+      const selectedIds: Array<ObjectID> = selectedPermissions.map(
+        (row: Model) => {
+          return row.id!;
+        },
+      );
+      // A relation filter may select a row, but must not trim its saved labels.
+      const permissions: Array<Model> = await this.findAllBy({
+        query: { _id: QueryHelper.any(selectedIds) },
+        select: {
+          _id: true,
+          projectId: true,
+          permission: true,
+          labels: { _id: true },
+          isBlockPermission: true,
+        },
+        props: { isRoot: true },
+      });
+
+      for (const permission of permissions) {
+        /*
+         * Revoking an allow cannot expand access. Removing a deny can expose
+         * an existing allow, so it requires authority over the entire deny.
+         */
+        if (permission.isBlockPermission) {
+          if (!permission.projectId || !permission.permission) {
+            throw new BadDataException("Invalid API Key permission");
+          }
+          if (
+            !deleteBy.props.tenantId ||
+            deleteBy.props.tenantId.toString() !==
+              permission.projectId.toString()
+          ) {
+            throw new BadDataException("Invalid API Key ID for this project");
+          }
+          this.assertCallerCanGrantPermission({
+            permission: permission.permission,
+            labels: permission.labels,
+            projectId: permission.projectId,
+            props: deleteBy.props,
+          });
+        }
+      }
+
+      /*
+       * Delete exactly the checked page, even when the query matches more
+       * than one batch. The original offset has already been applied.
+       */
+      deleteBy.query = {
+        ...deleteBy.query,
+        _id: QueryHelper.any(selectedIds),
+      };
+      deleteBy.skip = 0;
+    }
     return { deleteBy, carryForward: null };
   }