@oneuptime/common 13.0.7 → 14.0.0

package/Tests/Server/Types/Database/Permissions/TableLevelBlockPermission.test.ts

@@ -0,0 +1,459 @@
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import AccessControlPermission from "../../../../../Server/Types/Database/Permissions/AccessControlPermission";
+import CreatePermission from "../../../../../Server/Types/Database/Permissions/CreatePermission";
+import DeletePermission from "../../../../../Server/Types/Database/Permissions/DeletePermission";
+import ReadPermission from "../../../../../Server/Types/Database/Permissions/ReadPermission";
+import TablePermission from "../../../../../Server/Types/Database/Permissions/TablePermission";
+import UpdatePermission from "../../../../../Server/Types/Database/Permissions/UpdatePermission";
+import QueryUtil from "../../../../../Server/Types/Database/QueryUtil";
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import Label from "../../../../../Models/DatabaseModels/Label";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserPermission,
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+
+/*
+ * AccessTokenService.refreshUserTenantAccessPermission emits one row per
+ * TeamPermission across every team the user belongs to, without merging or
+ * ordering them. The same permission can therefore be blocked twice: once by
+ * a team that scopes the block to some labels and once by a team that blocks
+ * it outright. The table-wide block must win no matter which row comes first.
+ */
+describe("TablePermission.checkTableLevelBlockPermissions", () => {
+  const projectId: ObjectID = ObjectID.generate();
+  const userId: ObjectID = ObjectID.generate();
+  const labelA: ObjectID = ObjectID.generate();
+  const labelB: ObjectID = ObjectID.generate();
+
+  function makeProps(
+    permissions: Array<UserPermission>,
+  ): DatabaseCommonInteractionProps {
+    const tenantPermission: UserTenantAccessPermission = {
+      projectId,
+      _type: "UserTenantAccessPermission",
+      permissions,
+    };
+
+    return {
+      userId,
+      tenantId: projectId,
+      userTenantAccessPermission: {
+        [projectId.toString()]: tenantPermission,
+      },
+    };
+  }
+
+  function blockPermission(
+    permission: Permission,
+    labelIds: Array<ObjectID> | undefined,
+  ): UserPermission {
+    return {
+      _type: "UserPermission",
+      permission,
+      labelIds: labelIds as Array<ObjectID>,
+      isBlockPermission: true,
+    };
+  }
+
+  function allowPermission(
+    permission: Permission,
+    labelIds: Array<ObjectID>,
+  ): UserPermission {
+    return {
+      _type: "UserPermission",
+      permission,
+      labelIds,
+      isBlockPermission: false,
+    };
+  }
+
+  function incidentWithLabels(labelIds: Array<ObjectID>): Incident {
+    const incident: Incident = new Incident();
+    incident.labels = labelIds.map((id: ObjectID) => {
+      const label: Label = new Label();
+      label.id = id;
+      return label;
+    });
+    return incident;
+  }
+
+  const requestTypes: Array<DatabaseRequestType> = [
+    DatabaseRequestType.Create,
+    DatabaseRequestType.Read,
+    DatabaseRequestType.Update,
+    DatabaseRequestType.Delete,
+  ];
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  describe("with a single block row", () => {
+    it.each(requestTypes)(
+      "refuses %s when the block row carries no labels",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([blockPermission(Permission.ProjectMember, [])]),
+            type,
+          );
+        }).toThrow(NotAuthorizedException);
+      },
+    );
+
+    it.each(requestTypes)(
+      "does not refuse %s outright when the block row carries labels",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([blockPermission(Permission.ProjectMember, [labelA])]),
+            type,
+          );
+        }).not.toThrow();
+      },
+    );
+
+    it("treats a block row whose labelIds is missing as table-wide", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([blockPermission(Permission.ProjectMember, undefined)]),
+          DatabaseRequestType.Read,
+        );
+      }).toThrow(NotAuthorizedException);
+    });
+  });
+
+  describe("with several block rows for the same permission", () => {
+    it.each(requestTypes)(
+      "refuses %s when a labelled block row comes before an unlabelled one",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([
+              blockPermission(Permission.ProjectMember, [labelA]),
+              blockPermission(Permission.ProjectMember, []),
+            ]),
+            type,
+          );
+        }).toThrow(NotAuthorizedException);
+      },
+    );
+
+    it.each(requestTypes)(
+      "refuses %s when the unlabelled block row comes first",
+      (type: DatabaseRequestType) => {
+        expect(() => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([
+              blockPermission(Permission.ProjectMember, []),
+              blockPermission(Permission.ProjectMember, [labelA]),
+            ]),
+            type,
+          );
+        }).toThrow(NotAuthorizedException);
+      },
+    );
+
+    it("refuses when the unlabelled row is buried behind several labelled ones", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.ProjectMember, [labelB]),
+            blockPermission(Permission.ProjectMember, [labelA, labelB]),
+            blockPermission(Permission.ProjectMember, undefined),
+          ]),
+          DatabaseRequestType.Update,
+        );
+      }).toThrow(NotAuthorizedException);
+    });
+
+    it("leaves the request to the label check when every block row carries labels", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.ProjectMember, [labelB]),
+          ]),
+          DatabaseRequestType.Read,
+        );
+      }).not.toThrow();
+    });
+
+    it("names the blocked permission in the refusal", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.ProjectMember, []),
+          ]),
+          DatabaseRequestType.Delete,
+        );
+      }).toThrow(
+        `${Permission.ProjectMember} is in your team's permission block list.`,
+      );
+    });
+  });
+
+  describe("with block rows for different permissions of the model", () => {
+    it("refuses when another permission of the model is blocked table-wide", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.IncidentMember, []),
+          ]),
+          DatabaseRequestType.Update,
+        );
+      }).toThrow(
+        `${Permission.IncidentMember} is in your team's permission block list.`,
+      );
+    });
+
+    /*
+     * IncidentViewer is only in Incident's read list, so a table-wide block on
+     * it takes reading away and leaves the other operations alone.
+     */
+    it.each([
+      { type: DatabaseRequestType.Read, refused: true },
+      { type: DatabaseRequestType.Create, refused: false },
+      { type: DatabaseRequestType.Update, refused: false },
+      { type: DatabaseRequestType.Delete, refused: false },
+    ])(
+      "matches block rows against the $type permission list only",
+      ({ type, refused }: { type: DatabaseRequestType; refused: boolean }) => {
+        const check: () => void = (): void => {
+          TablePermission.checkTableLevelBlockPermissions(
+            Incident,
+            makeProps([
+              blockPermission(Permission.ProjectMember, [labelA]),
+              blockPermission(Permission.IncidentViewer, []),
+            ]),
+            type,
+          );
+        };
+
+        if (refused) {
+          expect(check).toThrow(NotAuthorizedException);
+        } else {
+          expect(check).not.toThrow();
+        }
+      },
+    );
+  });
+
+  describe("rows that must not trigger a table-wide block", () => {
+    it("ignores an unlabelled block row for a permission the model does not use", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            blockPermission(Permission.MonitorViewer, []),
+          ]),
+          DatabaseRequestType.Read,
+        );
+      }).not.toThrow();
+    });
+
+    it("ignores an unlabelled allow row for the blocked permission", () => {
+      expect(() => {
+        TablePermission.checkTableLevelBlockPermissions(
+          Incident,
+          makeProps([
+            blockPermission(Permission.ProjectMember, [labelA]),
+            allowPermission(Permission.ProjectMember, []),
+          ]),
+          DatabaseRequestType.Read,
+        );
+      }).not.toThrow();
+    });
+  });
+
+  /*
+   * Every CRUD entry point relies on this helper for the table-wide case: the
+   * read query rewrite and the update/delete label check only look at block
+   * rows that carry labels, so a missed unlabelled row is never enforced
+   * anywhere else.
+   */
+  describe("through the CRUD entry points", () => {
+    /*
+     * The user is granted the permission table-wide, so any refusal below can
+     * only come from the block rows.
+     */
+    const grant: UserPermission = allowPermission(Permission.ProjectMember, []);
+    const mixedBlockRows: Array<UserPermission> = [
+      grant,
+      blockPermission(Permission.ProjectMember, [labelA]),
+      blockPermission(Permission.ProjectMember, []),
+    ];
+
+    it("allows update and delete when only the grant is present", async () => {
+      await expect(
+        UpdatePermission.checkUpdatePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([labelB]);
+          },
+          props: makeProps([grant]),
+        }),
+      ).resolves.toBeUndefined();
+
+      await expect(
+        DeletePermission.checkDeletePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([labelB]);
+          },
+          props: makeProps([grant]),
+        }),
+      ).resolves.toBeUndefined();
+    });
+
+    it("refuses create", () => {
+      expect(() => {
+        CreatePermission.checkCreateBlockPermissions(
+          Incident,
+          makeProps(mixedBlockRows),
+        );
+      }).toThrow(NotAuthorizedException);
+    });
+
+    it("refuses read instead of only filtering the labelled rows out", async () => {
+      jest.spyOn(QueryUtil, "getManyToManyRelationMetadata").mockReturnValue({
+        joinTableName: "IncidentLabel",
+        ownerColumnName: "incidentId",
+        relationColumnName: "labelId",
+      });
+
+      await expect(
+        ReadPermission.checkReadBlockPermission(
+          Incident,
+          { projectId } as any,
+          makeProps(mixedBlockRows),
+        ),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("refuses update of a record that carries none of the blocked labels", async () => {
+      const fetchModel: jest.Mock = jest.fn(async () => {
+        return incidentWithLabels([labelB]);
+      });
+
+      await expect(
+        UpdatePermission.checkUpdatePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: fetchModel,
+          props: makeProps(mixedBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("refuses delete of a record that carries none of the blocked labels", async () => {
+      const fetchModel: jest.Mock = jest.fn(async () => {
+        return incidentWithLabels([labelB]);
+      });
+
+      await expect(
+        DeletePermission.checkDeletePermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: fetchModel,
+          props: makeProps(mixedBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("refuses before loading the record for a label comparison", async () => {
+      const fetchModel: jest.Mock = jest.fn(async () => {
+        return incidentWithLabels([]);
+      });
+
+      await expect(
+        AccessControlPermission.checkAccessControlBlockPermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: fetchModel,
+          type: DatabaseRequestType.Update,
+          props: makeProps(mixedBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+      expect(fetchModel).not.toHaveBeenCalled();
+    });
+
+    it.each([{ isRoot: true }, { isMasterAdmin: true }])(
+      "still lets %o requests through",
+      async (bypass: DatabaseCommonInteractionProps) => {
+        const props: DatabaseCommonInteractionProps = {
+          ...makeProps(mixedBlockRows),
+          ...bypass,
+        };
+
+        expect(() => {
+          CreatePermission.checkCreateBlockPermissions(Incident, props);
+        }).not.toThrow();
+
+        await expect(
+          ReadPermission.checkReadBlockPermission(
+            Incident,
+            { projectId } as any,
+            props,
+          ),
+        ).resolves.toBeDefined();
+
+        await expect(
+          AccessControlPermission.checkAccessControlBlockPermissionByModel({
+            modelType: Incident,
+            fetchModelWithAccessControlIds: jest.fn(),
+            type: DatabaseRequestType.Delete,
+            props,
+          }),
+        ).resolves.toBeUndefined();
+      },
+    );
+  });
+
+  describe("label-scoped blocks keep working after the table-level check", () => {
+    const labelledBlockRows: Array<UserPermission> = [
+      blockPermission(Permission.ProjectMember, [labelA]),
+      blockPermission(Permission.IncidentMember, [labelB]),
+    ];
+
+    it("refuses update of a record that carries a blocked label", async () => {
+      await expect(
+        AccessControlPermission.checkAccessControlBlockPermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([labelB]);
+          },
+          type: DatabaseRequestType.Update,
+          props: makeProps(labelledBlockRows),
+        }),
+      ).rejects.toThrow(NotAuthorizedException);
+    });
+
+    it("allows update of a record that carries none of the blocked labels", async () => {
+      await expect(
+        AccessControlPermission.checkAccessControlBlockPermissionByModel({
+          modelType: Incident,
+          fetchModelWithAccessControlIds: async () => {
+            return incidentWithLabels([ObjectID.generate()]);
+          },
+          type: DatabaseRequestType.Update,
+          props: makeProps(labelledBlockRows),
+        }),
+      ).resolves.toBeUndefined();
+    });
+  });
+});

package/Tests/Server/Types/Markdown.test.ts

@@ -278,6 +278,187 @@ describe("Markdown.convertToHTML - email renderer", () => {
   });
 });
 
+/*
+ * Lists in the email renderer.
+ *
+ * A platform monitor's root cause lists its affected resources as a
+ * numbered list with a bullet list of details nested under each item (see
+ * AffectedResourceList). Unstyled, Gmail and Apple Mail indent each level
+ * by 40px — close to a tenth of the card, twice over when nested — and
+ * Outlook ignores padding on <ul>/<ol> altogether. So lists carry inline
+ * styles that indent with margin-left and zero the padding.
+ */
+describe("Markdown.convertToHTML - email renderer lists", () => {
+  const AFFECTED_RESOURCES: string = [
+    "**Affected Resources** (2 total)",
+    "",
+    "1. **Pod** `checkout-7d9f` — **3**",
+    "   - Namespace: `payments`",
+    "   - Node: `gke-prod-pool-1`",
+    "2. **Pod** `ledger-0` — **2**",
+    "   - Namespace: `payments`",
+  ].join("\n");
+
+  test("ordered and bullet lists carry inline styles, not class names", async () => {
+    const html: string = await Markdown.convertToHTML(
+      AFFECTED_RESOURCES,
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toContain(
+      '<ol style="margin:6px 0 12px 0;margin-left:32px;margin-inline-start:32px;margin-inline-end:0;padding:0;">',
+    );
+    expect(html).toContain(
+      '<ul style="margin:6px 0 12px 0;margin-left:24px;margin-inline-start:24px;margin-inline-end:0;padding:0;">',
+    );
+    expect(html).toContain('<li style="margin:0 0 4px;padding:0;">');
+    expect(html).not.toContain('class="');
+    expect(html).not.toMatch(/<(ol|ul|li)>/);
+  });
+
+  /*
+   * Outlook's Word engine ignores padding on lists but honours margin, so
+   * the indent must live in margin-left for the marker to have room.
+   */
+  test("the indent is a margin, with the padding zeroed for Outlook", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "- one\n- two",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toMatch(/<ul style="[^"]*margin-left:24px;[^"]*padding:0;/);
+    expect(html).not.toContain("padding-left");
+    expect(html).not.toContain("40px");
+  });
+
+  /*
+   * A numbered marker is wider than a bullet: "100." needs about 30px at
+   * the card's 15px body size, so an ordered list gets the wider indent.
+   */
+  test("an ordered list is indented enough for a three-digit marker", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "100. step\n101. step",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toContain('<ol start="100" style="');
+    expect(html).toContain("margin-left:32px;");
+  });
+
+  /*
+   * margin-left is physical: in right-to-left text the marker sits on the
+   * right, so the indent has to move there. The logical properties come
+   * AFTER margin-left so a client that understands them overrides it (the
+   * trailing margin-inline-end:0 cancels the left margin in RTL), and a
+   * client that does not simply keeps margin-left.
+   */
+  test("lists carry logical margins after the physical one, for right-to-left text", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "1. one\n   - nested",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toMatch(
+      /<ol style="[^"]*margin-left:32px;margin-inline-start:32px;margin-inline-end:0;/,
+    );
+    expect(html).toMatch(
+      /<ul style="[^"]*margin-left:24px;margin-inline-start:24px;margin-inline-end:0;/,
+    );
+  });
+
+  test("each item's details are a list nested inside that item", async () => {
+    const html: string = await Markdown.convertToHTML(
+      AFFECTED_RESOURCES,
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toMatch(
+      /<ol [^>]*><li [^>]*><strong>Pod<\/strong> <code[^>]*>checkout-7d9f<\/code> — <strong>3<\/strong><ul [^>]*><li [^>]*>Namespace: <code[^>]*>payments<\/code><\/li><li [^>]*>Node: <code[^>]*>gke-prod-pool-1<\/code><\/li><\/ul><\/li><li [^>]*><strong>Pod<\/strong> <code[^>]*>ledger-0<\/code>/,
+    );
+    expect((html.match(/<ol /g) || []).length).toBe(1);
+    expect((html.match(/<ul /g) || []).length).toBe(2);
+    expect((html.match(/<li /g) || []).length).toBe(5);
+  });
+
+  test("an ordered list that does not start at 1 keeps its start number", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "3. third\n4. fourth",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toContain('<ol start="3" style="');
+  });
+
+  test("a list starting at 1 has no start attribute", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "1. first\n2. second",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).not.toContain("start=");
+  });
+
+  test("a bullet list never gets a start attribute", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "- a\n- b",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).not.toContain("start=");
+  });
+
+  test("task-list checkboxes still render inside their item", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "- [x] done\n- [ ] todo",
+      MarkdownContentType.Email,
+    );
+
+    expect(html).toMatch(
+      /<li [^>]*><input checked="" disabled="" type="checkbox"> done<\/li>/,
+    );
+    expect(html).toMatch(
+      /<li [^>]*><input disabled="" type="checkbox"> todo<\/li>/,
+    );
+  });
+
+  test("raw HTML inside a list item is still escaped", async () => {
+    const html: string = await Markdown.convertToHTML(
+      '- <img src=x onerror="alert(1)">',
+      MarkdownContentType.Email,
+    );
+
+    expect(html).not.toContain('onerror="alert(1)"');
+    expect(html).toContain("&lt;img");
+  });
+
+  test("repeated list renders are identical", async () => {
+    const first: string = await Markdown.convertToHTML(
+      AFFECTED_RESOURCES,
+      MarkdownContentType.Email,
+    );
+    const second: string = await Markdown.convertToHTML(
+      AFFECTED_RESOURCES,
+      MarkdownContentType.Email,
+    );
+
+    expect(second).toBe(first);
+  });
+
+  /*
+   * The list styling belongs to the email renderer alone; the docs and
+   * blog renderers keep their own Tailwind classes.
+   */
+  test("the docs renderer does not pick up the email list styles", async () => {
+    const html: string = await Markdown.convertToHTML(
+      "- one\n- two",
+      MarkdownContentType.Docs,
+    );
+
+    expect(html).not.toContain("margin-inline-start");
+    expect(html).not.toContain("margin:6px 0 12px 0");
+  });
+});
+
 describe("Markdown.escapeHtml", () => {
   /*
    * Public so that code hand-building an email fragment by string